popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

system32.exe

Gen1 Vidar Malicious Library UPX Malicious Packer PE File OS Processor Check PE32 DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 19, 2023, 7:47 a.m. Oct. 19, 2023, 7:53 a.m.
Size 316.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 d1e40dfbae57e5f3205117f5c9d64a76
SHA256 ec7770a2cfa4cbffac72f98538eb541a67b18dc04658a3d6218a7a060ffed38d
CRC32 2D2F3E8E
ssdeep 6144:QUNdslLON1aPsi5chCRXmI4/LusZbXm+QRALNVJCofhOqUZaBMYUB:QxGwP/OWOxXm+4AdCo+oKxB
Yara
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
t.me
A 149.154.167.99
149.154.167.99
steamcommunity.com
A 104.76.78.101
104.75.41.21
IP Address Status Action
104.76.78.101 Active Moloch
149.154.167.99 Active Moloch
164.124.101.2 Active Moloch
5.75.212.77 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49161 -> 149.154.167.99:443 2041933 ET INFO Observed Telegram Domain (t .me in TLS SNI) Misc activity
TCP 192.168.56.103:49161 -> 149.154.167.99:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49161 -> 149.154.167.99:443 2041933 ET INFO Observed Telegram Domain (t .me in TLS SNI) Misc activity
TCP 192.168.56.103:49163 -> 149.154.167.99:443 2041933 ET INFO Observed Telegram Domain (t .me in TLS SNI) Misc activity
TCP 149.154.167.99:443 -> 192.168.56.103:49164 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.103:49163 -> 149.154.167.99:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49163 -> 149.154.167.99:443 2041933 ET INFO Observed Telegram Domain (t .me in TLS SNI) Misc activity
TCP 192.168.56.103:49166 -> 104.76.78.101:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49167 -> 5.75.212.77:80 2027262 ET INFO Dotted Quad Host ZIP Request Potentially Bad Traffic
TCP 192.168.56.103:49161 -> 149.154.167.99:443 2041933 ET INFO Observed Telegram Domain (t .me in TLS SNI) Misc activity

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49166
104.76.78.101:443 		C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 Extended Validation Server CA unknown=US, unknown=Washington, unknown=Private Organization, serialNumber=602 290 773, C=US, ST=Washington, L=Bellevue, O=Valve Corp, CN=store.steampowered.com b1:30:5e:4c:ee:14:70:87:a7:d7:1c:77:07:b5:3c:2c:99:13:aa:c5

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
system32+0xe7f4 @ 0x119e7f4
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 22
registers.esi: 18678604
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
system32+0xe7fe @ 0x119e7fe
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 6
registers.esi: 18649852
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe808 @ 0x119e808
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 4
registers.esi: 18649848
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe812 @ 0x119e812
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 10
registers.esi: 18678592
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe81c @ 0x119e81c
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 10
registers.esi: 18678580
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe826 @ 0x119e826
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 6
registers.esi: 18678572
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe830 @ 0x119e830
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 8
registers.esi: 18678564
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe83a @ 0x119e83a
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 14
registers.esi: 18678548
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe844 @ 0x119e844
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 8
registers.esi: 18678540
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe84e @ 0x119e84e
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 10
registers.esi: 18678528
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe858 @ 0x119e858
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 6
registers.esi: 18678520
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe862 @ 0x119e862
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 20
registers.esi: 18678500
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe86c @ 0x119e86c
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 8
registers.esi: 18678492
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe872 @ 0x119e872
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 6
registers.esi: 18649756
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe87c @ 0x119e87c
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 8
registers.esi: 18649748
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe886 @ 0x119e886
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 16
registers.esi: 18678476
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe890 @ 0x119e890
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 14
registers.esi: 18678460
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe896 @ 0x119e896
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 6
registers.esi: 18649756
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe8a0 @ 0x119e8a0
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 18
registers.esi: 18678440
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe8aa @ 0x119e8aa
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 14
registers.esi: 18678424
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe8b4 @ 0x119e8b4
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 22
registers.esi: 18678604
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe8be @ 0x119e8be
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 14
registers.esi: 18678408
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe8c8 @ 0x119e8c8
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 6
registers.esi: 18649884
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe8d2 @ 0x119e8d2
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 8
registers.esi: 18649748
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe8dc @ 0x119e8dc
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 16
registers.esi: 18678392
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe8e2 @ 0x119e8e2
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 6
registers.esi: 18649756
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe8ec @ 0x119e8ec
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 18
registers.esi: 18678372
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe8f6 @ 0x119e8f6
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 6
registers.esi: 18649876
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe900 @ 0x119e900
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 16
registers.esi: 18678356
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe90a @ 0x119e90a
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 6
registers.esi: 18649884
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe914 @ 0x119e914
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 8
registers.esi: 18678348
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe91e @ 0x119e91e
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 16
registers.esi: 18678332
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe977 @ 0x119e977
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 22
registers.esi: 18678604
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
system32+0xe981 @ 0x119e981
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 6
registers.esi: 18649852
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe98b @ 0x119e98b
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 4
registers.esi: 18649848
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe995 @ 0x119e995
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 10
registers.esi: 18678592
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe99f @ 0x119e99f
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 10
registers.esi: 18678580
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe9a9 @ 0x119e9a9
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 6
registers.esi: 18678572
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe9b3 @ 0x119e9b3
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 8
registers.esi: 18678564
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe9bd @ 0x119e9bd
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 14
registers.esi: 18678548
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe9c7 @ 0x119e9c7
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 8
registers.esi: 18678540
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe9d1 @ 0x119e9d1
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 10
registers.esi: 18678528
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe9db @ 0x119e9db
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 6
registers.esi: 18678520
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe9e5 @ 0x119e9e5
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 20
registers.esi: 18678500
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe9ef @ 0x119e9ef
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 8
registers.esi: 18678492
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe9f5 @ 0x119e9f5
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 6
registers.esi: 18649756
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xe9ff @ 0x119e9ff
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 8
registers.esi: 18649748
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xea09 @ 0x119ea09
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 16
registers.esi: 18678476
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xea13 @ 0x119ea13
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 14
registers.esi: 18678460
registers.ecx: 1971388416
1 0 0

__exception__

 stacktrace: 
system32+0xea19 @ 0x119ea19
system32+0x276da @ 0x11b76da
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 66 8b 4f 02 47 47 66 85 c9 75 f5 8b cb c1 e9 02
exception.symbol: lstrcatW+0x30 CopyFileW-0x4f kernel32+0x382be
exception.instruction: mov cx, word ptr [edi + 2]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 230078
exception.address: 0x758182be
registers.esp: 3668952
registers.edi: 4294967294
registers.eax: 0
registers.ebp: 3668992
registers.edx: 4294967294
registers.ebx: 6
registers.esi: 18649756
registers.ecx: 1971388416
1 0 0
suspicious_features Connection to IP address suspicious_request GET http://5.75.212.77/f02b730f81476e82205d9d2eb21e0ef8
suspicious_features Connection to IP address suspicious_request GET http://5.75.212.77/upgrade.zip
suspicious_features POST method with no referer header, Connection to IP address suspicious_request POST http://5.75.212.77/
request GET http://5.75.212.77/f02b730f81476e82205d9d2eb21e0ef8
request GET http://5.75.212.77/upgrade.zip
request POST http://5.75.212.77/
request GET https://steamcommunity.com/profiles/76561199563297648
request POST http://5.75.212.77/
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 508
region_size: 995328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x61e00000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceW

 number_of_free_clusters: 2424337
sectors_per_cluster: 8
bytes_per_sector: 512
root_path: \\?\Volume{c2d901c4-0706-11e8-912e-806e6f6e6963}\
total_number_of_clusters: 8362495
1 1 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64\Local Extension Settings\cjmkndjhnagcfbpiemnkdpomccnjblmj\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\WidevineCdm\4.10.2391.0\_platform_specific\win_x64\widevinecdm.dll.sig\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\OriginTrials\Local Extension Settings\lpilbniiabackdjcionkobglmddfbcjo\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\TLSDeprecationConfig\4\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Module Info Cache\IndexedDB\chrome-extension_hpglfhgfnhbgpjdenjgmdgoeiappafln_0.indexeddb.leveldb\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.47.0_0\_locales\th\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\FontLookupTableCache\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.47.0_0\_locales\iw\messages.json\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Module Info Cache\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\pnacl\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\uk\messages.json\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\RecoveryImproved\Local Extension Settings\bgpipimickeadkjlklgciifhnalhdjhe\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Cookies-journal\Local Extension Settings\fiedbfgcleddlbcmgdigjgdfcggjcion\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\it\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Local Extension Settings\oeljdldpnmdbchonielidgobddffflal\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Subresource Filter\Local Extension Settings\fmhmiaejopepamlcjkncpgpdjichnecm\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pl\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\IndexedDB\chrome-extension_hpglfhgfnhbgpjdenjgmdgoeiappafln_0.indexeddb.leveldb\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\zh_CN\messages.json\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Last Version\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Channel IDs\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crowd Deny\Sync Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Local Extension Settings\gjagmgiddbbciopjhllkdnddhcglnemk\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\es_419\messages.json\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Cookies-journal\Local Extension Settings\oeljdldpnmdbchonielidgobddffflal\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\OriginTrials\Local Extension Settings\fmhmiaejopepamlcjkncpgpdjichnecm\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.47.0_0\_locales\lo\messages.json\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\03019df3fd85a69a8ebd1facc6da9ba73e469774fe77f579fc5a08b8328c1d6b.sth\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ZxcvbnData\1\english_wikipedia.txt\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\GPUCache\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\MEIPreload\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments\Local Extension Settings\aijcbedoijmgnlmjeegjaglmepbmpkpi\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments\Local Extension Settings\pdadjkfkgcafgbceimcpbkalnfnepbnk\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\GrShaderCache\Local Extension Settings\gjagmgiddbbciopjhllkdnddhcglnemk\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\PepperFlash\Sync Extension Settings\oeljdldpnmdbchonielidgobddffflal\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\52\manifest.json\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.47.0_0\_locales\ka\messages.json\Network\Cookies
file C:\ProgramData\vcruntime140.dll
file C:\ProgramData\msvcp140.dll
file C:\ProgramData\nss3.dll
file C:\ProgramData\freebl3.dll
file C:\ProgramData\mozglue.dll
file C:\ProgramData\softokn3.dll
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\agent.pyw.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\?????.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\click_image.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\Database1.accdb.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\click.txt.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\msi2.png.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\test_doc.eml.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\office_2007.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\exe1.zip.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\test.eml.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\??2010(??) (2).lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\robot.png.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\air+france+klm+annual+report+2013-RTMD-AMBb5mCGMAAAvhwCAEtSGQASABszRd8A.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\ok2.png.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\ok1.png.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\util.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\test (1).eml.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\???.txt.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\KMSAuto_Net_2015_v1.4. 2.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\docx2.png.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\??2010(??).lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\KMS Activation.txt.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\sn.txt.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\Office.2010.Toolkit.and.EZ-Activator.v2.1.5.Final.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\????.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\+t+d¦².txt.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\robot2.png.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\agent.py.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\ZeroAI_Click.pyw.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\1234.zip.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\??????.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\readme.txt.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\ZeroCERT.bmp.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\age.pyw.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\password.txt.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\jsGIrPlHsPM.txt.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\click.pyw.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\ZeroAI_History.txt.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\click.py.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\doc.png.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\dd81b5e9d99588633b73117e3b1f84f1a6952f9d573057d804047a85abfb8328_1609fbf0d6c26e---38596704027.pdf.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\ZeroAI_Click.py.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\Python27.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\msi1.png.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\robot3.png.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\phishing_file.pdf.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\msoffice2010_32bit.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\doc2.png.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\Settings.ini.lnk
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\test_zip_doc.eml.lnk
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x00000568
process_name: mobsync.exe
process_identifier: 1664
1 1 0

Process32NextW

 snapshot_handle: 0x00000568
process_name: system32.exe
process_identifier: 508
1 1 0

Process32NextW

 snapshot_handle: 0x00000568
process_name: pw.exe
process_identifier: 108
1 1 0

Process32NextW

 snapshot_handle: 0x00000568
process_name: svchost.exe
process_identifier: 2312
1 1 0

Process32NextW

 snapshot_handle: 0x00000568
process_name: Ő#"
process_identifier: 2293760
0 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Time & API Arguments Status Return Repeated

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000568
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}
base_handle: 0x80000002
key_handle: 0x00000570
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}
1 0 0
host 5.75.212.77
registry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString
file C:\Users\test22\AppData\Roaming\Electrum\wallets\
file C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent.py
file C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
registry HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration
wmi
wmi Select * From AntiVirusProductroot\SecurityCente
Time & API Arguments Status Return Repeated

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 7-Zip 20.02 alpha
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe AIR
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: EditPlus
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Chrome
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: ????? ?? 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Mozilla Thunderbird 78.4.0 (x86 ko)
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Professional Plus 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe AIR
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: HttpWatch Professional 9.3.39
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: ????? ?? 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Java 8 Update 131
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Java Auto Updater
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Google Update Helper
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Access MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Excel MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft PowerPoint MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Publisher MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Outlook MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Word MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing Tools 2013 - English
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Outils de vérification linguistique 2013 de Microsoft Office - Français
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing Tools 2013 - Español
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft InfoPath MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft DCF MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft OneNote MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Groove MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office OSM MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office OSM UX MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared Setup Metadata MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Access Setup Metadata MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Lync MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Professional Plus 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Flash Player 13 ActiveX
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Flash Player 13 NPAPI
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Acrobat Reader DC MUI
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000570
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName
1 0 0
file C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob
process system32.exe useragent Mozilla/5.0 (Windows NT 10.0; x64 rv:107.0) Gecko / 20100101 Firefox / 107.0
process system32.exe useragent Mozilla/5.0 (iPad; CPU OS 17_0_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/605.1.15
Time & API Arguments Status Return Repeated

WNetGetProviderNameW

 net_type: 0x00250000
1222 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Coins.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Zusy.446002
Skyhigh BehavesLike.Win32.CoinMiner.fh
ALYac Gen:Variant.Zusy.446002
Cylance unsafe
VIPRE Gen:Variant.Zusy.446002
Sangfor Trojan.Win32.Save.a
Alibaba TrojanPSW:Win32/Coins.ee0f5ada
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Zusy.D6CE32
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Vidar.A
Cynet Malicious (score: 100)
APEX Malicious
Kaspersky HEUR:Trojan-PSW.Win32.Coins.gen
BitDefender Gen:Variant.Zusy.446002
Avast Win32:PWSX-gen [Trj]
Tencent Win32.Trojan-QQPass.QQRob.Dwnw
Emsisoft Gen:Variant.Zusy.446002 (B)
TrendMicro TrojanSpy.Win32.VIDAR.YXDJRZ
Trapmine malicious.moderate.ml.score
FireEye Generic.mg.d1e40dfbae57e5f3
Sophos Mal/Generic-S
Ikarus Win32.Outbreak
Webroot W32.VIDAR.YXDJRZ
Varist W32/Vidar.C.gen!Eldorado
Kingsoft malware.kb.a.980
Gridinsoft Spy.Win32.Vidar.bot
Microsoft Trojan:Win32/Sabsik.TE.B!ml
ZoneAlarm HEUR:Trojan-PSW.Win32.Coins.gen
GData Gen:Variant.Zusy.446002
Google Detected
AhnLab-V3 Trojan/Win.ST.R611531
McAfee Artemis!D1E40DFBAE57
MAX malware (ai score=88)
VBA32 BScope.TrojanPSW.Vidar
Malwarebytes Spyware.Vidar
Panda Trj/Genetic.gen
TrendMicro-HouseCall TrojanSpy.Win32.VIDAR.YXDJRZ
Rising Trojan.Generic@AI.100 (RDML:kWIqWZuH82n1kHaz4J+w5w)
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Raccoon.E910!tr
BitDefenderTheta Gen:NN.ZexaF.36738.tqW@a4Ladrc
AVG Win32:PWSX-gen [Trj]
Cybereason malicious.3fad51
DeepInstinct MALICIOUS