popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

lnstаllееer.exe

RedLine stealer Malicious Library UPX ScreenShot PWS AntiDebug PE File OS Processor Check PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 9, 2023, 10:17 a.m. Nov. 9, 2023, 10:19 a.m.
Size 437.8KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 e85a65b6ab5c25aec1cd5694586627c1
SHA256 ed18280c7037a3505148717767688dd86a5e4b67a0c40cd076af289b6ea5b0b6
CRC32 F256C974
ssdeep 6144:rmWQZca1DD/BZbRRyOtJkm3+AODDtyFu7HzLSb2+B+nkjy6ugI5O3YU+/CrE:LQKa1pt1l+dxj7TLAkkjZ+/CQ
Yara
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
5.75.177.255 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49164 -> 5.75.177.255:23682 2043233 ET INFO Microsoft net.tcp Connection Initialization Activity Potentially Bad Traffic
TCP 192.168.56.103:49164 -> 5.75.177.255:23682 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49164 -> 5.75.177.255:23682 2046045 ET MALWARE [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization) A Network Trojan was detected
TCP 5.75.177.255:23682 -> 192.168.56.103:49164 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response A Network Trojan was detected
TCP 192.168.56.103:49164 -> 5.75.177.255:23682 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 5.75.177.255:23682 -> 192.168.56.103:49164 2046056 ET MALWARE Redline Stealer Activity (Response) A Network Trojan was detected
TCP 192.168.56.103:49164 -> 5.75.177.255:23682 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49164 -> 5.75.177.255:23682 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49164 -> 5.75.177.255:23682 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49164 -> 5.75.177.255:23682 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49164 -> 5.75.177.255:23682 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49164 -> 5.75.177.255:23682 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49164 -> 5.75.177.255:23682 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49164 -> 5.75.177.255:23682 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49164 -> 5.75.177.255:23682 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49164 -> 5.75.177.255:23682 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49164 -> 5.75.177.255:23682 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49164 -> 5.75.177.255:23682 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49164 -> 5.75.177.255:23682 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49164 -> 5.75.177.255:23682 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49164 -> 5.75.177.255:23682 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49164 -> 5.75.177.255:23682 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49164 -> 5.75.177.255:23682 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49164 -> 5.75.177.255:23682 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49164 -> 5.75.177.255:23682 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bbe38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bbe38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bbe38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bbe38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bbeb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bbeb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bbdb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bbdb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bbdb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bbdb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bbdb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bc4b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bc9b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bc9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bc838
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bc838
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004bc938
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
file C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file C:\Program Files\Mozilla Firefox\firefox.exe
registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .BSS
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680432
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1937075299
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 13237836
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680436
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1970365249
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 3684720849
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680440
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1399157353
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 1280335481
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680444
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1867274066
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 4121499506
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680448
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 2017815395
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 719449619
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680432
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1684370017
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 13237836
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680436
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1970365249
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 3684720849
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680440
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1399157353
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 1280335481
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680444
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1867274066
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 4121499506
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680448
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1750297443
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 3771723283
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 13237836
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1131701057
registers.ebx: 0
registers.esi: 13237836
registers.ecx: 13237836
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 13237840
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1769235265
registers.ebx: 0
registers.esi: 13237836
registers.ecx: 3428016337
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 13237844
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1702125942
registers.ebx: 0
registers.esi: 13237836
registers.ecx: 3874855382
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 13237836
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1097690996
registers.ebx: 0
registers.esi: 13237836
registers.ecx: 13237836
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 13237840
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1097098305
registers.ebx: 0
registers.esi: 13237836
registers.ecx: 1563226577
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 13237836
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1466789748
registers.ebx: 0
registers.esi: 13237836
registers.ecx: 13237836
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 13237840
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1097098305
registers.ebx: 0
registers.esi: 13237836
registers.ecx: 1563226577
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680432
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1098080617
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 13237836
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680436
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1130652737
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 2133651921
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680440
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1869835887
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 3447952351
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680444
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1816225132
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 126205484
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680432
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1467179369
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 13237836
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680436
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1130652737
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 2133651921
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680440
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1869835887
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 3447952351
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680444
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1816225132
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 126205484
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6682664
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1869901929
registers.ebx: 0
registers.esi: 6682664
registers.ecx: 13237836
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6682668
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1231316033
registers.ebx: 0
registers.esi: 6682664
registers.ecx: 3844927953
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6682672
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1734702190
registers.ebx: 0
registers.esi: 6682664
registers.ecx: 255660110
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6682676
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 2037672306
registers.ebx: 0
registers.esi: 6682664
registers.ecx: 1526365074
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6682680
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1700946252
registers.ebx: 0
registers.esi: 6682664
registers.ecx: 1783842828
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6682684
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1114592364
registers.ebx: 0
registers.esi: 6682664
registers.ecx: 1158749484
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6682688
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1684960623
registers.ebx: 0
registers.esi: 6682664
registers.ecx: 3222375135
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6682692
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1148809825
registers.ebx: 0
registers.esi: 6682664
registers.ecx: 773132785
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6682696
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1919120229
registers.ebx: 0
registers.esi: 6682664
registers.ecx: 1792035125
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680432
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1835093618
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 13237836
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680436
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1281647681
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 2553082321
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680440
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1818321775
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 2840090847
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680444
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1702128705
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 3918100945
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680448
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1952542322
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 1237799058
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680452
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1836008293
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 751900981
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680456
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1702131056
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 642348144
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680432
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1835093618
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 13237836
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680436
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1281647681
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 2553082321
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680440
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1818321775
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 2840090847
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680444
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1702128705
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 3918100945
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680448
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1952542322
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 1237799058
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680452
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1836008293
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 751900981
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 6680456
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1702131056
registers.ebx: 0
registers.esi: 6680432
registers.ecx: 642348144
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 13237836
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 2020885364
registers.ebx: 0
registers.esi: 13237836
registers.ecx: 13237836
1 0 0

__exception__

 stacktrace: 
IsValidAcl+0xe InitializeAcl-0x1f kernelbase+0x1c19d @ 0x755ac19d
_GetSpecialResolution@0-0x346 lnst0ll55er+0x1dc7 @ 0x1131dc7

exception.instruction_r: 8a 03 3c 02 0f 82 de f7 02 00 3c 04 0f 87 d6 f7
exception.symbol: RtlValidAcl+0x13 RtlCreateSecurityDescriptor-0x5e ntdll+0x42c36
exception.instruction: mov al, byte ptr [ebx]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 273462
exception.address: 0x778e2c36
registers.esp: 13237688
registers.edi: 13237840
registers.eax: 13237732
registers.ebp: 13237748
registers.edx: 1382310977
registers.ebx: 0
registers.esi: 13237836
registers.ecx: 4264358353
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2132
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74742000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00550000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00560000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2132
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74392000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2132
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d3b000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2132
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d51000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2132
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73d52000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 851968
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00640000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005cc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2132
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c6a000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00720000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00721000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00722000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005eb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2132
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x70df1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2132
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x70c51000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005ca000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2132
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x70871000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2132
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6e451000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2132
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6e42e000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2132
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6e2ab000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00723000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00724000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005bc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00725000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2132
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6c841000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005d6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005db000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005dc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff40000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff48000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff30000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff48000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005dd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005d8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2132
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x758f1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b1f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\lockfile
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Take ScreenShot rule ScreenShot
description PWS Memory rule Generic_PWS_Memory_Zero
description RedLine stealer rule RedLine_Stealer_m_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

RegOpenKeyExW

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000488
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: 7-Zip
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
1 0 0

RegOpenKeyExW

 regkey_r: AddressBook
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
1 0 0

RegOpenKeyExW

 regkey_r: Adobe AIR
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR
1 0 0

RegOpenKeyExW

 regkey_r: Connection Manager
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
1 0 0

RegOpenKeyExW

 regkey_r: DirectDrawEx
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
1 0 0

RegOpenKeyExW

 regkey_r: EditPlus
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus
1 0 0

RegOpenKeyExW

 regkey_r: Fontcore
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
1 0 0

RegOpenKeyExW

 regkey_r: Google Chrome
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
1 0 0

RegOpenKeyExW

 regkey_r: Haansoft HWord 80 Korean
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean
1 0 0

RegOpenKeyExW

 regkey_r: IE40
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40
1 0 0

RegOpenKeyExW

 regkey_r: IE4Data
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
1 0 0

RegOpenKeyExW

 regkey_r: IE5BAKEX
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
1 0 0

RegOpenKeyExW

 regkey_r: IEData
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData
1 0 0

RegOpenKeyExW

 regkey_r: MobileOptionPack
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
1 0 0

RegOpenKeyExW

 regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko)
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)
1 0 0

RegOpenKeyExW

 regkey_r: Office15.PROPLUSR
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR
1 0 0

RegOpenKeyExW

 regkey_r: SchedulingAgent
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
1 0 0

RegOpenKeyExW

 regkey_r: WIC
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC
1 0 0

RegOpenKeyExW

 regkey_r: {00203668-8170-44A0-BE44-B632FA4D780F}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}
1 0 0

RegOpenKeyExW

 regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
1 0 0

RegOpenKeyExW

 regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}
1 0 0

RegOpenKeyExW

 regkey_r: {26A24AE4-039D-4CA4-87B4-2F32180131F0}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}
1 0 0

RegOpenKeyExW

 regkey_r: {4A03706F-666A-4037-7777-5F2748764D10}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}
1 0 0

RegOpenKeyExW

 regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-0015-0409-0000-0000000FF1CE}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-0016-0409-0000-0000000FF1CE}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-0018-0409-0000-0000000FF1CE}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-0019-0409-0000-0000000FF1CE}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-001A-0409-0000-0000000FF1CE}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-001B-0409-0000-0000000FF1CE}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-001F-0409-0000-0000000FF1CE}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-001F-040C-0000-0000000FF1CE}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-001F-0C0A-0000-0000000FF1CE}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-002C-0409-0000-0000000FF1CE}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-0044-0409-0000-0000000FF1CE}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-006E-0409-0000-0000000FF1CE}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-0090-0409-0000-0000000FF1CE}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-00A1-0409-0000-0000000FF1CE}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-00BA-0409-0000-0000000FF1CE}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-00E1-0409-0000-0000000FF1CE}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-00E2-0409-0000-0000000FF1CE}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-0115-0409-0000-0000000FF1CE}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-0117-0409-0000-0000000FF1CE}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90150000-012B-0409-0000-0000000FF1CE}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {91150000-0011-0000-0000-0000000FF1CE}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}
1 0 0

RegOpenKeyExW

 regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}
1 0 0

RegOpenKeyExW

 regkey_r: {AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}
1 0 0

RegOpenKeyExW

 regkey_r: {BB8B979E-E336-47E7-96BC-1031C1B94561}
base_handle: 0x00000488
key_handle: 0x000003bc
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}
1 0 0
wmi SELECT * FROM Win32_Processor
host 5.75.177.255
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 253952
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000068
1 0 0
Time & API Arguments Status Return Repeated

NtQuerySystemInformation

 information_class: 8 (SystemProcessorPerformanceInformation)
1 0 0
file C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
wmi SELECT * FROM Win32_VideoController
wmi SELECT * FROM AntivirusProduct
wmi SELECT * FROM Win32_OperatingSystem
wmi SELECT * FROM Win32_Process Where SessionId='1'
wmi SELECT * FROM AntiSpyWareProduct
wmi SELECT * FROM FirewallProduct
wmi SELECT * FROM Win32_DiskDrive
wmi SELECT * FROM Win32_Processor
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL™?Ðà 0¬^á @ à@…áSN©À  H.textdÁ  `.rsrcN©ªÄ@@.reloc Àn@B
base_address: 0x00400000
process_identifier: 2132
process_handle: 0x00000068
1 1 0

WriteProcessMemory

 buffer: à `1
base_address: 0x0043c000
process_identifier: 2132
process_handle: 0x00000068
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0xfffde008
process_identifier: 2132
process_handle: 0x00000068
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL™?Ðà 0¬^á @ à@…áSN©À  H.textdÁ  `.rsrcN©ªÄ@@.reloc Àn@B
base_address: 0x00400000
process_identifier: 2132
process_handle: 0x00000068
1 1 0
Time & API Arguments Status Return Repeated

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 7-Zip 20.02 alpha
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe AIR
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: EditPlus
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Chrome
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 한컴오피스 한글 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Mozilla Thunderbird 78.4.0 (x86 ko)
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Professional Plus 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe AIR
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: HttpWatch Professional 9.3.39
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 한컴오피스 한글 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Java 8 Update 131
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Java Auto Updater
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Google Update Helper
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Access MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Excel MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft PowerPoint MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Publisher MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Outlook MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Word MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing Tools 2013 - English
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Outils de vérification linguistique 2013 de Microsoft Office - Français
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing Tools 2013 - Español
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft InfoPath MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft DCF MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft OneNote MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Groove MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office OSM MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office OSM UX MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared Setup Metadata MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Access Setup Metadata MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Lync MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Professional Plus 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Flash Player 13 ActiveX
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Flash Player 13 NPAPI
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Acrobat Reader DC MUI
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x000003bc
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName
1 0 0
Process injection Process 2056 called NtSetContextThread to modify thread in remote process 2132
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2005598660
registers.esp: 4063040
registers.edi: 0
registers.eax: 4383070
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000064
process_identifier: 2132
1 0 0
Process injection Process 2056 resumed a thread in remote process 2132
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000064
suspend_count: 1
process_identifier: 2132
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2136
thread_handle: 0x00000064
process_identifier: 2132
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
track: 1
command_line:
filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000068
1 1 0

NtGetContextThread

 thread_handle: 0x00000064
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2132
region_size: 253952
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000068
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL™?Ðà 0¬^á @ à@…áSN©À  H.textdÁ  `.rsrcN©ªÄ@@.reloc Àn@B
base_address: 0x00400000
process_identifier: 2132
process_handle: 0x00000068
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00402000
process_identifier: 2132
process_handle: 0x00000068
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00430000
process_identifier: 2132
process_handle: 0x00000068
1 1 0

WriteProcessMemory

 buffer: à `1
base_address: 0x0043c000
process_identifier: 2132
process_handle: 0x00000068
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0xfffde008
process_identifier: 2132
process_handle: 0x00000068
1 1 0

NtSetContextThread

 registers.eip: 2005598660
registers.esp: 4063040
registers.edi: 0
registers.eax: 4383070
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000064
process_identifier: 2132
1 0 0

NtResumeThread

 thread_handle: 0x00000064
suspend_count: 1
process_identifier: 2132
1 0 0

NtResumeThread

 thread_handle: 0x00000144
suspend_count: 1
process_identifier: 2132
1 0 0

NtResumeThread

 thread_handle: 0x000001bc
suspend_count: 1
process_identifier: 2132
1 0 0

NtResumeThread

 thread_handle: 0x000001f8
suspend_count: 1
process_identifier: 2132
1 0 0

NtResumeThread

 thread_handle: 0x00000240
suspend_count: 1
process_identifier: 2132
1 0 0

NtGetContextThread

 thread_handle: 0x00000148
1 0 0

NtGetContextThread

 thread_handle: 0x00000148
1 0 0

NtResumeThread

 thread_handle: 0x00000148
suspend_count: 1
process_identifier: 2132
1 0 0

NtResumeThread

 thread_handle: 0x000002a0
suspend_count: 1
process_identifier: 2132
1 0 0

NtResumeThread

 thread_handle: 0x000002b8
suspend_count: 1
process_identifier: 2132
1 0 0

NtResumeThread

 thread_handle: 0x000003d4
suspend_count: 1
process_identifier: 2132
1 0 0

NtResumeThread

 thread_handle: 0x000003fc
suspend_count: 1
process_identifier: 2132
1 0 0

NtResumeThread

 thread_handle: 0x00000240
suspend_count: 1
process_identifier: 2132
1 0 0

NtResumeThread

 thread_handle: 0x000004d4
suspend_count: 1
process_identifier: 2132
1 0 0

NtResumeThread

 thread_handle: 0x00000234
suspend_count: 1
process_identifier: 2132
1 0 0

NtResumeThread

 thread_handle: 0x000003f0
suspend_count: 1
process_identifier: 2132
1 0 0

NtResumeThread

 thread_handle: 0x00000358
suspend_count: 1
process_identifier: 2132
1 0 0

NtResumeThread

 thread_handle: 0x000002b0
suspend_count: 1
process_identifier: 2132
1 0 0

NtResumeThread

 thread_handle: 0x000004e4
suspend_count: 1
process_identifier: 2132
1 0 0

NtResumeThread

 thread_handle: 0x0000023c
suspend_count: 1
process_identifier: 2132
1 0 0

NtResumeThread

 thread_handle: 0x000004dc
suspend_count: 1
process_identifier: 2132
1 0 0

NtResumeThread

 thread_handle: 0x000004c0
suspend_count: 1
process_identifier: 2132
1 0 0

NtResumeThread

 thread_handle: 0x00000474
suspend_count: 1
process_identifier: 2132
1 0 0

NtResumeThread

 thread_handle: 0x000004a8
suspend_count: 1
process_identifier: 2132
1 0 0
Bkav W32.AIDetectMalware
ClamAV Win.Malware.Botx-10004968-0
ALYac Gen:Variant.Babar.215513
VIPRE Gen:Variant.Babar.215513
CrowdStrike win/malicious_confidence_70% (D)
BitDefender Gen:Variant.Babar.215513
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/GenKryptik.GPWB
APEX Malicious
Cynet Malicious (score: 100)
Kaspersky VHO:Backdoor.Win32.Agent.gen
MicroWorld-eScan Gen:Variant.Babar.215513
Rising Trojan.RedLine!8.120FD (TFE:1:op57AWiCqLF)
TrendMicro TrojanSpy.Win32.TRICKBOT.SMC
Trapmine suspicious.low.ml.score
FireEye Generic.mg.e85a65b6ab5c25ae
Emsisoft Gen:Variant.Babar.215513 (B)
SentinelOne Static AI - Suspicious PE
Microsoft Trojan:Win32/Wacatac.B!ml
Arcabit Trojan.Babar.D349D9
ZoneAlarm VHO:Backdoor.Win32.Agent.gen
GData Gen:Variant.Babar.215513
Google Detected
MAX malware (ai score=80)
TrendMicro-HouseCall TrojanSpy.Win32.TRICKBOT.SMC
Ikarus Trojan.Win32.Krypt
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/GenKryptik.GOEE!tr
BitDefenderTheta Gen:NN.ZexaF.36792.BuY@aWiiPi
AVG FileRepMalware [Pws]
Avast FileRepMalware [Pws]