Summary | ZeroBOX

random.exe

Lumma Stealer Gen1 RedLine stealer RedlineStealer Amadey Generic Malware .NET framework(MSIL) Malicious Library Downloader Admin Tool (Sysinternals etc ...) Antivirus UPX Malicious Packer ScreenShot Anti_VM AntiDebug PE File PE32 AntiVM
Category Machine Started Completed
FILE s1_win7_x6403_us June 16, 2024, 10 a.m. June 16, 2024, 10:11 a.m.
Size 1.9MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 0f2c5d3966f262c04af7eb8cbe26c78a
SHA256 78368e1e15c6a4e92b78922eb386f95255f751467f5cf379542c1a013d4e970a
CRC32 33377F15
ssdeep 49152:IKJZZwLxzOlVCayaK/9CZLbb+KrSWr0SAIJPHHh:RZZwdOl4ayaKoRrdN5
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49164 -> 77.91.77.81:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 77.91.77.81:80 -> 192.168.56.103:49164 2014819 ET INFO Packed Executable Download Misc activity
TCP 77.91.77.81:80 -> 192.168.56.103:49164 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 77.91.77.81:80 -> 192.168.56.103:49164 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 77.91.77.81:80 -> 192.168.56.103:49164 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49167 -> 77.91.77.81:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49167 -> 77.91.77.81:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 77.91.77.81:80 -> 192.168.56.103:49167 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 77.91.77.81:80 -> 192.168.56.103:49167 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 77.91.77.81:80 -> 192.168.56.103:49167 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49167 -> 77.91.77.81:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49167 -> 77.91.77.81:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49167 -> 77.91.77.81:80 2019714 ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile Potentially Bad Traffic
TCP 77.91.77.81:80 -> 192.168.56.103:49167 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 77.91.77.81:80 -> 192.168.56.103:49167 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 185.215.113.67:40960 -> 192.168.56.103:49169 2400032 ET DROP Spamhaus DROP Listed Traffic Inbound group 33 Misc Attack
TCP 192.168.56.103:49169 -> 185.215.113.67:40960 2043233 ET INFO Microsoft net.tcp Connection Initialization Activity Potentially Bad Traffic
TCP 192.168.56.103:49169 -> 185.215.113.67:40960 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49169 -> 185.215.113.67:40960 2046045 ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) A Network Trojan was detected
TCP 185.215.113.67:40960 -> 192.168.56.103:49169 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response A Network Trojan was detected
TCP 192.168.56.103:49173 -> 172.67.198.131:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49167 -> 77.91.77.81:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49167 -> 77.91.77.81:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49167 -> 77.91.77.81:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49167 -> 77.91.77.81:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49167 -> 77.91.77.81:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49167 -> 77.91.77.81:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49169 -> 185.215.113.67:40960 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49167 -> 77.91.77.81:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49167 -> 77.91.77.81:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 185.215.113.67:40960 -> 192.168.56.103:49169 2046056 ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) A Network Trojan was detected
TCP 192.168.56.103:49169 -> 185.215.113.67:40960 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49169 -> 185.215.113.67:40960 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49169 -> 185.215.113.67:40960 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49169 -> 185.215.113.67:40960 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49212 -> 185.172.128.116:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49169 -> 185.215.113.67:40960 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49169 -> 185.215.113.67:40960 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49169 -> 185.215.113.67:40960 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49169 -> 185.215.113.67:40960 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 185.172.128.116:80 -> 192.168.56.103:49212 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 185.172.128.116:80 -> 192.168.56.103:49212 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 185.172.128.116:80 -> 192.168.56.103:49212 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49169 -> 185.215.113.67:40960 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49167 -> 77.91.77.81:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49167 -> 77.91.77.81:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49167 -> 77.91.77.81:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 192.168.56.103:49217 -> 185.172.128.116:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 185.172.128.116:80 -> 192.168.56.103:49217 2014819 ET INFO Packed Executable Download Misc activity
TCP 185.172.128.116:80 -> 192.168.56.103:49217 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 185.172.128.116:80 -> 192.168.56.103:49217 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 185.172.128.116:80 -> 192.168.56.103:49217 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49217 -> 185.172.128.116:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49221 -> 185.172.128.19:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 185.172.128.19:80 -> 192.168.56.103:49221 2014819 ET INFO Packed Executable Download Misc activity
TCP 185.172.128.19:80 -> 192.168.56.103:49221 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 185.172.128.19:80 -> 192.168.56.103:49221 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 185.172.128.19:80 -> 192.168.56.103:49221 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.103:49169 -> 185.215.113.67:40960 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49169 -> 185.215.113.67:40960 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49169 -> 185.215.113.67:40960 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49169 -> 185.215.113.67:40960 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49169 -> 185.215.113.67:40960 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49228 -> 172.67.198.131:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49167 -> 77.91.77.81:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49217 -> 185.172.128.116:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49229 -> 31.31.198.35:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49169 -> 185.215.113.67:40960 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49169 -> 185.215.113.67:40960 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49169 -> 185.215.113.67:40960 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49169 -> 185.215.113.67:40960 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49169 -> 185.215.113.67:40960 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49169 -> 185.215.113.67:40960 2043231 ET MALWARE Redline Stealer TCP CnC Activity A Network Trojan was detected
TCP 192.168.56.103:49236 -> 172.67.198.131:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49239 -> 172.67.198.131:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.103:62576 -> 164.124.101.2:53 2033268 ET POLICY Observed DNS Query to Coin Mining Domain (nanopool .org) Potential Corporate Privacy Violation
TCP 192.168.56.103:49232 -> 172.67.198.131:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49234 -> 104.20.3.235:443 906200068 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (CoinMiner) undefined
TCP 192.168.56.103:49237 -> 172.67.198.131:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49218 -> 185.172.128.116:80 2044597 ET MALWARE Amadey Bot Activity (POST) M1 A Network Trojan was detected
TCP 192.168.56.103:49219 -> 172.67.198.131:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.103:49225 -> 172.67.198.131:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.103:64178 -> 164.124.101.2:53 2033268 ET POLICY Observed DNS Query to Coin Mining Domain (nanopool .org) Potential Corporate Privacy Violation
TCP 192.168.56.103:49238 -> 172.67.198.131:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49173
172.67.198.131:443
C=US, O=Let's Encrypt, CN=E5 CN=boredombusters.online ae:46:98:37:44:2d:ec:1c:ce:ae:4b:ef:67:3e:b5:93:42:fe:8c:94
TLSv1
192.168.56.103:49228
172.67.198.131:443
C=US, O=Let's Encrypt, CN=E5 CN=boredombusters.online ae:46:98:37:44:2d:ec:1c:ce:ae:4b:ef:67:3e:b5:93:42:fe:8c:94
TLS 1.2
192.168.56.103:49229
31.31.198.35:443
C=US, O=Let's Encrypt, CN=R11 CN=kmsandallapp.ru 26:c0:93:6a:03:1b:96:aa:25:61:71:21:f5:de:ad:77:51:bf:39:19
TLS 1.3
192.168.56.103:49235
51.15.193.130:14433
None None None
TLSv1
192.168.56.103:49236
172.67.198.131:443
C=US, O=Let's Encrypt, CN=E5 CN=boredombusters.online ae:46:98:37:44:2d:ec:1c:ce:ae:4b:ef:67:3e:b5:93:42:fe:8c:94
TLSv1
192.168.56.103:49239
172.67.198.131:443
C=US, O=Let's Encrypt, CN=E5 CN=boredombusters.online ae:46:98:37:44:2d:ec:1c:ce:ae:4b:ef:67:3e:b5:93:42:fe:8c:94
TLSv1
192.168.56.103:49232
172.67.198.131:443
C=US, O=Let's Encrypt, CN=E5 CN=boredombusters.online ae:46:98:37:44:2d:ec:1c:ce:ae:4b:ef:67:3e:b5:93:42:fe:8c:94
TLS 1.3
192.168.56.103:49233
51.68.137.186:10943
None None None
TLS 1.3
192.168.56.103:49234
104.20.3.235:443
None None None
TLSv1
192.168.56.103:49237
172.67.198.131:443
C=US, O=Let's Encrypt, CN=E5 CN=boredombusters.online ae:46:98:37:44:2d:ec:1c:ce:ae:4b:ef:67:3e:b5:93:42:fe:8c:94
TLSv1
192.168.56.103:49219
172.67.198.131:443
C=US, O=Let's Encrypt, CN=E5 CN=boredombusters.online ae:46:98:37:44:2d:ec:1c:ce:ae:4b:ef:67:3e:b5:93:42:fe:8c:94
TLSv1
192.168.56.103:49225
172.67.198.131:443
C=US, O=Let's Encrypt, CN=E5 CN=boredombusters.online ae:46:98:37:44:2d:ec:1c:ce:ae:4b:ef:67:3e:b5:93:42:fe:8c:94
TLSv1
192.168.56.103:49238
172.67.198.131:443
None None None

Time & API Arguments Status Return Repeated

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0
Time & API Arguments Status Return Repeated

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00543050
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00543050
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00543050
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00543050
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x005430d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x005430d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00542fd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00542fd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00542fd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00542fd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00542fd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00543050
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00543050
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00543250
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00543990
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00543990
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00543850
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
file C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file C:\Program Files\Mozilla Firefox\firefox.exe
registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

1 1 0
section \x00
section .idata
section
section fbxmxckk
section nhkzgudz
section .taggant
Time & API Arguments Status Return Repeated

__exception__

stacktrace:
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: fb e9 4e 01 00 00 60 8b 74 24 24 8b 7c 24 28 fc
exception.symbol: random+0x3240b9
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 3293369
exception.address: 0x12740b9
registers.esp: 2621180
registers.edi: 0
registers.eax: 1
registers.ebp: 2621196
registers.edx: 21094400
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 55 68 c3 ac bb 66 e9 9c 00 00 00 81 f1 16 4c
exception.symbol: random+0x6d332
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 447282
exception.address: 0xfbd332
registers.esp: 2621148
registers.edi: 0
registers.eax: 27030
registers.ebp: 4006522900
registers.edx: 82608470
registers.ebx: 16505036
registers.esi: 3
registers.ecx: 1971388416
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 57 54 5f 81 c7 04 00 00 00 83 ef 04 87 3c 24
exception.symbol: random+0x6e5e4
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 452068
exception.address: 0xfbe5e4
registers.esp: 2621148
registers.edi: 0
registers.eax: 26704
registers.ebp: 4006522900
registers.edx: 16532110
registers.ebx: 980140288
registers.esi: 3
registers.ecx: 1971388416
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 81 ec 04 00 00 00 89 34 24 55 68 ba c5 7d 7f
exception.symbol: random+0x6e148
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 450888
exception.address: 0xfbe148
registers.esp: 2621148
registers.edi: 4294943896
registers.eax: 26704
registers.ebp: 4006522900
registers.edx: 16532110
registers.ebx: 980140288
registers.esi: 233705
registers.ecx: 1971388416
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 6b 09 00 00 81 c2 29 07 4f 3f e9 78 ff ff
exception.symbol: random+0x1ee088
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2023560
exception.address: 0x113e088
registers.esp: 2621148
registers.edi: 16542306
registers.eax: 32107
registers.ebp: 4006522900
registers.edx: 16494721
registers.ebx: 425984
registers.esi: 18079005
registers.ecx: 18111609
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 52 89 e2 e9 57 00 00 00 81 f6 15 5a 79 7f 21
exception.symbol: random+0x1edfd5
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2023381
exception.address: 0x113dfd5
registers.esp: 2621148
registers.edi: 16542306
registers.eax: 0
registers.ebp: 4006522900
registers.edx: 16494721
registers.ebx: 425984
registers.esi: 604292949
registers.ecx: 18082565
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 53 bb f7 e7 eb 75 81 c6 15 40 e7 1d 29 de 57
exception.symbol: random+0x1f50de
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2052318
exception.address: 0x11450de
registers.esp: 2621144
registers.edi: 1814312927
registers.eax: 30775
registers.ebp: 4006522900
registers.edx: 1814312927
registers.ebx: 18101762
registers.esi: 18105967
registers.ecx: 96
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 56 89 e6 51 b9 a0 e2 bb 22 e9 1a 0b 00 00 5a
exception.symbol: random+0x1f47ef
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2050031
exception.address: 0x11447ef
registers.esp: 2621148
registers.edi: 4294939884
registers.eax: 30775
registers.ebp: 4006522900
registers.edx: 1814312927
registers.ebx: 134889
registers.esi: 18136742
registers.ecx: 96
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb b9 17 7d d2 3f 53 bb 55 c5 d7 78 81 f3 cb 97
exception.symbol: random+0x1f9ada
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2071258
exception.address: 0x1149ada
registers.esp: 2621148
registers.edi: 202985
registers.eax: 28663
registers.ebp: 4006522900
registers.edx: 4294941352
registers.ebx: 18153626
registers.esi: 18136742
registers.ecx: 14288
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: ed 64 8f 05 00 00 00 00 e9 40 17 00 00 ba ac e2
exception.symbol: random+0x1ff3a5
exception.instruction: in eax, dx
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2093989
exception.address: 0x114f3a5
registers.esp: 2621140
registers.edi: 4730608
registers.eax: 1447909480
registers.ebp: 4006522900
registers.edx: 22104
registers.ebx: 1971327157
registers.esi: 18141970
registers.ecx: 20
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: 0f 3f 07 0b 64 8f 05 00 00 00 00 83 c4 04 83 fb
exception.symbol: random+0x1ff85e
exception.address: 0x114f85e
exception.module: random.exe
exception.exception_code: 0xc000001d
exception.offset: 2095198
registers.esp: 2621140
registers.edi: 4730608
registers.eax: 1
registers.ebp: 4006522900
registers.edx: 22104
registers.ebx: 0
registers.esi: 18141970
registers.ecx: 20
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: ed 81 fb 68 58 4d 56 75 0a c7 85 cf 38 2d 12 01
exception.symbol: random+0x1ff7ff
exception.instruction: in eax, dx
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2095103
exception.address: 0x114f7ff
registers.esp: 2621140
registers.edi: 4730608
registers.eax: 1447909480
registers.ebp: 4006522900
registers.edx: 22104
registers.ebx: 2256917605
registers.esi: 18141970
registers.ecx: 10
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: cd 01 eb 00 e9 0e 00 00 00 e4 ca 74 c3 c1 e0 95
exception.symbol: random+0x205d58
exception.instruction: int 1
exception.module: random.exe
exception.exception_code: 0xc0000005
exception.offset: 2121048
exception.address: 0x1155d58
registers.esp: 2621108
registers.edi: 0
registers.eax: 2621108
registers.ebp: 4006522900
registers.edx: 57802
registers.ebx: 18177567
registers.esi: 24095
registers.ecx: 28769
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 2d 4e 6e e0 69 03 04 24 81 ec 04 00 00 00 89
exception.symbol: random+0x206d0f
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2125071
exception.address: 0x1156d0f
registers.esp: 2621144
registers.edi: 4730608
registers.eax: 18179001
registers.ebp: 4006522900
registers.edx: 1345282759
registers.ebx: 7314312
registers.esi: 10
registers.ecx: 738263040
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 1c 01 00 00 53 e9 39 00 00 00 81 c7 43 30
exception.symbol: random+0x20659c
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2123164
exception.address: 0x115659c
registers.esp: 2621148
registers.edi: 4730608
registers.eax: 18209801
registers.ebp: 4006522900
registers.edx: 1345282759
registers.ebx: 7314312
registers.esi: 10
registers.ecx: 738263040
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 68 c1 09 67 0b 89 0c 24 b9 f7 78 63 7f e9 c8
exception.symbol: random+0x20648d
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2122893
exception.address: 0x115648d
registers.esp: 2621148
registers.edi: 2283
registers.eax: 18209801
registers.ebp: 4006522900
registers.edx: 4294938932
registers.ebx: 7314312
registers.esi: 10
registers.ecx: 738263040
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 52 c7 04 24 84 ea a6 3c 89 34 24 e9 81 ff ff
exception.symbol: random+0x2159df
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2185695
exception.address: 0x11659df
registers.esp: 2621144
registers.edi: 16497350
registers.eax: 27871
registers.ebp: 4006522900
registers.edx: 18241401
registers.ebx: 7314534
registers.esi: 1971262480
registers.ecx: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 57 68 c2 e8 4e 73 5f e9 c4 00 00 00 57 e9 ee
exception.symbol: random+0x215a64
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2185828
exception.address: 0x1165a64
registers.esp: 2621148
registers.edi: 4294942080
registers.eax: 27871
registers.ebp: 4006522900
registers.edx: 18269272
registers.ebx: 7314534
registers.esi: 604277079
registers.ecx: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 55 68 f9 c1 67 77 e9 00 00 00 00 89 14 24 55
exception.symbol: random+0x2193bf
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2200511
exception.address: 0x11693bf
registers.esp: 2621148
registers.edi: 4294942080
registers.eax: 18285271
registers.ebp: 4006522900
registers.edx: 2013296964
registers.ebx: 607947089
registers.esi: 586053925
registers.ecx: 4294939472
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 35 ff ff ff 83 c5 04 87 2c 24 5c 83 c4 04
exception.symbol: random+0x21dfc2
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2219970
exception.address: 0x116dfc2
registers.esp: 2621140
registers.edi: 18277978
registers.eax: 0
registers.ebp: 4006522900
registers.edx: 2013296964
registers.ebx: 4294950892
registers.esi: 33047400
registers.ecx: 2031558576
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 53 e9 35 00 00 00 81 eb 01 00 00 00 c1 e3 01
exception.symbol: random+0x220571
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2229617
exception.address: 0x1170571
registers.esp: 2621140
registers.edi: 18277978
registers.eax: 31537
registers.ebp: 4006522900
registers.edx: 18317456
registers.ebx: 4294950892
registers.esi: 33047400
registers.ecx: 1176665969
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 68 ba b2 eb 47 89 34 24 be 25 9f dd 3f 46 4e
exception.symbol: random+0x220c73
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2231411
exception.address: 0x1170c73
registers.esp: 2621140
registers.edi: 0
registers.eax: 31537
registers.ebp: 4006522900
registers.edx: 18288904
registers.ebx: 4294950892
registers.esi: 33047400
registers.ecx: 3924265303
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 53 57 81 ec 04 00 00 00 89 34 24 be 30 c6 e1
exception.symbol: random+0x231f04
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2301700
exception.address: 0x1181f04
registers.esp: 2621136
registers.edi: 4006522900
registers.eax: 30272
registers.ebp: 4006522900
registers.edx: 18357445
registers.ebx: 2147575809
registers.esi: 2130566132
registers.ecx: 2148925025
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 29 f6 ff 34 16 ff 34 24 8b 04 24 e9 00 00 00
exception.symbol: random+0x2327c2
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2303938
exception.address: 0x11827c2
registers.esp: 2621140
registers.edi: 4006522900
registers.eax: 30272
registers.ebp: 4006522900
registers.edx: 18387717
registers.ebx: 2147575809
registers.esi: 2130566132
registers.ecx: 2148925025
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 56 be 5a 7e ef 6f c1 ee 05 81 ee 74 f7 fd 6d
exception.symbol: random+0x2326c6
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2303686
exception.address: 0x11826c6
registers.esp: 2621140
registers.edi: 4006522900
registers.eax: 3367964512
registers.ebp: 4006522900
registers.edx: 18387717
registers.ebx: 2147575809
registers.esi: 4294940008
registers.ecx: 2148925025
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 68 44 94 4b 29 89 34 24 c7 04 24 98 dc fe 6b
exception.symbol: random+0x2443d8
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2376664
exception.address: 0x11943d8
registers.esp: 2621108
registers.edi: 1392536160
registers.eax: 0
registers.ebp: 4006522900
registers.edx: 2130566132
registers.ebx: 0
registers.esi: 18433740
registers.ecx: 738263040
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 81 ec 04 00 00 00 89 1c 24 89 04 24 b8 f4 ef
exception.symbol: random+0x245a28
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2382376
exception.address: 0x1195a28
registers.esp: 2621108
registers.edi: 18436102
registers.eax: 3070391912
registers.ebp: 4006522900
registers.edx: 0
registers.ebx: 18439482
registers.esi: 0
registers.ecx: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 05 71 61 97 7d 57 51 b9 34 c2 fc 3f bf 8c 81
exception.symbol: random+0x2466dd
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2385629
exception.address: 0x11966dd
registers.esp: 2621104
registers.edi: 18436102
registers.eax: 18439835
registers.ebp: 4006522900
registers.edx: 508261142
registers.ebx: 863758862
registers.esi: 0
registers.ecx: 521041918
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 d8 f7 ff ff c1 e2 03 e9 b5 fd ff ff 52 ba
exception.symbol: random+0x246844
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2385988
exception.address: 0x1196844
registers.esp: 2621108
registers.edi: 4294939064
registers.eax: 18471119
registers.ebp: 4006522900
registers.edx: 508261142
registers.ebx: 863758862
registers.esi: 0
registers.ecx: 1882634834
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 57 e9 ed f8 ff ff 89 1c 24 e9 de ff ff ff 29
exception.symbol: random+0x24744f
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2389071
exception.address: 0x119744f
registers.esp: 2621104
registers.edi: 4294939064
registers.eax: 28726
registers.ebp: 4006522900
registers.edx: 18443300
registers.ebx: 863758862
registers.esi: 0
registers.ecx: 1882634834
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 d0 ff ff ff 31 0c 24 e9 c0 09 00 00 c1 e1
exception.symbol: random+0x246ea3
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2387619
exception.address: 0x1196ea3
registers.esp: 2621108
registers.edi: 4294939064
registers.eax: 28726
registers.ebp: 4006522900
registers.edx: 18472026
registers.ebx: 863758862
registers.esi: 0
registers.ecx: 1882634834
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 53 bb 55 44 7f 5f 53 52 e9 7b f9 ff ff 29 c1
exception.symbol: random+0x2473c5
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2388933
exception.address: 0x11973c5
registers.esp: 2621108
registers.edi: 940809613
registers.eax: 0
registers.ebp: 4006522900
registers.edx: 18446550
registers.ebx: 863758862
registers.esi: 0
registers.ecx: 1882634834
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 56 89 3c 24 c7 04 24 a6 10 d7 72 89 04 24 b8
exception.symbol: random+0x24da56
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2415190
exception.address: 0x119da56
registers.esp: 2621104
registers.edi: 18469810
registers.eax: 26001
registers.ebp: 4006522900
registers.edx: 18462050
registers.ebx: 65804
registers.esi: 0
registers.ecx: 1969225870
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 53 51 54 8b 0c 24 83 c4 04 81 c1 04 00 00 00
exception.symbol: random+0x24d7f3
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2414579
exception.address: 0x119d7f3
registers.esp: 2621108
registers.edi: 18495811
registers.eax: 26001
registers.ebp: 4006522900
registers.edx: 18462050
registers.ebx: 65804
registers.esi: 0
registers.ecx: 1969225870
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 68 45 18 e5 36 8b 1c 24 51 54 59 51 89 04 24
exception.symbol: random+0x24df32
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2416434
exception.address: 0x119df32
registers.esp: 2621108
registers.edi: 18495811
registers.eax: 26001
registers.ebp: 4006522900
registers.edx: 96233
registers.ebx: 4294944344
registers.esi: 0
registers.ecx: 1969225870
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 3b 00 00 00 83 c4 04 68 33 7e 93 23 89 1c
exception.symbol: random+0x24f5c0
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2422208
exception.address: 0x119f5c0
registers.esp: 2621104
registers.edi: 18448559
registers.eax: 29348
registers.ebp: 4006522900
registers.edx: 829194415
registers.ebx: 1687934050
registers.esi: 18476928
registers.ecx: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 56 c7 04 24 22 2c 58 76 89 1c 24 55 55 c7 04
exception.symbol: random+0x24f8e6
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2423014
exception.address: 0x119f8e6
registers.esp: 2621108
registers.edi: 18448559
registers.eax: 29348
registers.ebp: 4006522900
registers.edx: 829194415
registers.ebx: 1687934050
registers.esi: 18506276
registers.ecx: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 52 51 57 c7 04 24 16 09 bd 6e 81 2c 24 25 4b
exception.symbol: random+0x24f286
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2421382
exception.address: 0x119f286
registers.esp: 2621108
registers.edi: 18448559
registers.eax: 29348
registers.ebp: 4006522900
registers.edx: 0
registers.ebx: 322689
registers.esi: 18479620
registers.ecx: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 51 b9 44 90 be 7a 01 ca e9 10 01 00 00 89 c5
exception.symbol: random+0x251462
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2430050
exception.address: 0x11a1462
registers.esp: 2621104
registers.edi: 4023857339
registers.eax: 27495
registers.ebp: 4006522900
registers.edx: 18485666
registers.ebx: 109461664
registers.esi: 36928179
registers.ecx: 380073120
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 52 89 e2 81 c2 04 00 00 00 81 ea 04 00 00 00
exception.symbol: random+0x251d34
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2432308
exception.address: 0x11a1d34
registers.esp: 2621108
registers.edi: 4023857339
registers.eax: 27495
registers.ebp: 4006522900
registers.edx: 18513161
registers.ebx: 109461664
registers.esi: 36928179
registers.ecx: 380073120
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 55 89 e5 81 c5 04 00 00 00 50 e9 42 00 00 00
exception.symbol: random+0x251837
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2431031
exception.address: 0x11a1837
registers.esp: 2621108
registers.edi: 3909414019
registers.eax: 27495
registers.ebp: 4006522900
registers.edx: 18513161
registers.ebx: 4294942780
registers.esi: 36928179
registers.ecx: 380073120
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 68 52 97 b3 63 89 04 24 e9 ac fe ff ff ba cd
exception.symbol: random+0x26edd8
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2551256
exception.address: 0x11bedd8
registers.esp: 2621108
registers.edi: 18585336
registers.eax: 30212
registers.ebp: 4006522900
registers.edx: 18637257
registers.ebx: 1969225702
registers.esi: 18548725
registers.ecx: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 00 00 00 00 56 be 47 1b 7b 6f e9 9e fc ff
exception.symbol: random+0x26f18e
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2552206
exception.address: 0x11bf18e
registers.esp: 2621108
registers.edi: 0
registers.eax: 22210897
registers.ebp: 4006522900
registers.edx: 18609741
registers.ebx: 1969225702
registers.esi: 18548725
registers.ecx: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 50 c7 04 24 5f 2c 6f 66 87 0c 24 f7 d1 87 0c
exception.symbol: random+0x26fb5e
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2554718
exception.address: 0x11bfb5e
registers.esp: 2621108
registers.edi: 0
registers.eax: 4294938872
registers.ebp: 4006522900
registers.edx: 878872855
registers.ebx: 1969225702
registers.esi: 82608464
registers.ecx: 18641036
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 fb 03 00 00 81 e2 bb f3 ae 6e 81 ea 29 cc
exception.symbol: random+0x276e3a
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2584122
exception.address: 0x11c6e3a
registers.esp: 2621108
registers.edi: 605849942
registers.eax: 29850
registers.ebp: 4006522900
registers.edx: 4294940240
registers.ebx: 18669826
registers.esi: 82608464
registers.ecx: 738263040
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 50 51 b9 06 18 5d 39 89 c8 59 c1 e8 04 e9 9a
exception.symbol: random+0x27def2
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2612978
exception.address: 0x11cdef2
registers.esp: 2621104
registers.edi: 49132
registers.eax: 27661
registers.ebp: 4006522900
registers.edx: 38744
registers.ebx: 18666736
registers.esi: 4702188
registers.ecx: 1182898008
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 53 c7 04 24 d6 ad a3 5f 89 14 24 51 e9 cd f5
exception.symbol: random+0x27e0a9
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2613417
exception.address: 0x11ce0a9
registers.esp: 2621108
registers.edi: 604292949
registers.eax: 27661
registers.ebp: 4006522900
registers.edx: 38744
registers.ebx: 18694397
registers.esi: 4702188
registers.ecx: 4294943392
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 53 e9 df 02 00 00 b8 af 29 fc b6 31 44 24 04
exception.symbol: random+0x28d458
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2675800
exception.address: 0x11dd458
registers.esp: 2621108
registers.edi: 18759277
registers.eax: 4294941900
registers.ebp: 4006522900
registers.edx: 11
registers.ebx: 3923937618
registers.esi: 4702188
registers.ecx: 12
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 51 55 e9 92 04 00 00 5f 33 14 24 e9 e7 00 00
exception.symbol: random+0x296969
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2713961
exception.address: 0x11e6969
registers.esp: 2621104
registers.edi: 18759277
registers.eax: 31645
registers.ebp: 4006522900
registers.edx: 18769646
registers.ebx: 55099636
registers.esi: 2005598220
registers.ecx: 738263040
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 57 c7 04 24 00 bb cc 32 89 34 24 57 52 89 0c
exception.symbol: random+0x296a26
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2714150
exception.address: 0x11e6a26
registers.esp: 2621108
registers.edi: 18759277
registers.eax: 31645
registers.ebp: 4006522900
registers.edx: 18801291
registers.ebx: 55099636
registers.esi: 2005598220
registers.ecx: 738263040
1 0 0
suspicious_features POST method with no referer header, POST method with no useragent header, Connection to IP address suspicious_request POST http://77.91.77.81/Kiru9gu/index.php
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://77.91.77.81/lend/judit.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://77.91.77.81/lend/redline123123.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://77.91.77.81/lend/upd.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://77.91.77.81/lend/setup222.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://77.91.77.81/lend/gold.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://77.91.77.81/lend/lummac2.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://77.91.77.81/lend/drivermanager.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://185.172.128.116/NewLatest.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://77.91.77.81/lend/monster.exe
suspicious_features POST method with no referer header, POST method with no useragent header, Connection to IP address suspicious_request POST http://185.172.128.116/Mb3GvQs8/index.php
suspicious_features POST method with no referer header, POST method with no useragent header, Connection to IP address suspicious_request POST http://185.172.128.116/Mb3GvQs8/index.php?scr=1
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://185.172.128.116/b2c2c1.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://185.172.128.19/FirstZ.exe
suspicious_features GET method with no useragent header suspicious_request GET https://kmsandallapp.ru/Gibson.exe
request POST http://77.91.77.81/Kiru9gu/index.php
request GET http://77.91.77.81/lend/judit.exe
request GET http://77.91.77.81/lend/redline123123.exe
request GET http://77.91.77.81/lend/upd.exe
request GET http://77.91.77.81/lend/setup222.exe
request GET http://77.91.77.81/lend/gold.exe
request GET http://77.91.77.81/lend/lummac2.exe
request GET http://77.91.77.81/lend/drivermanager.exe
request GET http://apps.identrust.com/roots/dstrootcax3.p7c
request GET http://185.172.128.116/NewLatest.exe
request GET http://77.91.77.81/lend/monster.exe
request POST http://185.172.128.116/Mb3GvQs8/index.php
request POST http://185.172.128.116/Mb3GvQs8/index.php?scr=1
request GET http://185.172.128.116/b2c2c1.exe
request GET http://185.172.128.19/FirstZ.exe
request GET http://x1.i.lencr.org/
request GET https://kmsandallapp.ru/Gibson.exe
request POST http://77.91.77.81/Kiru9gu/index.php
request POST http://185.172.128.116/Mb3GvQs8/index.php
request POST http://185.172.128.116/Mb3GvQs8/index.php?scr=1
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

process_identifier: 1696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7793f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x778b0000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 188416
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00f51000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1696
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1696
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1696
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1696
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1696
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1696
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00bb0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1696
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00bc0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1696
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00bd0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1696
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1696
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1696
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1696
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1696
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00e60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1696
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00f30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1696
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00f40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1696
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02830000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1696
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02880000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1696
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02890000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1696
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1696
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1696
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1696
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1696
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1696
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1696
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1696
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1696
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1696
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02cd0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1236
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000067c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2260
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7793f000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2260
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x778b0000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2260
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 188416
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00071000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x023e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x023f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2260
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02400000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2260
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02450000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2260
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02460000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02600000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02710000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02720000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2260
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02730000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2260
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02740000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
description axplong.exe tried to sleep 1139 seconds, actually delayed analysis time by 1139 seconds
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\lockfile
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file C:\Users\test22\AppData\Local\Temp\1000047001\lummac2.exe
file C:\Users\test22\AppData\Local\Temp\SetupWizard.exe
file C:\Users\test22\AppData\Local\Temp\1000064001\NewLatest.exe
file C:\Users\test22\AppData\Local\Temp\1000035001\gold.exe
file C:\Users\test22\AppData\Local\Temp\onefile_2760_133629768733125000\libcrypto-1_1.dll
file C:\Users\test22\AppData\Local\Temp\1000001001\b2c2c1.exe
file C:\Users\test22\AppData\Local\Temp\1000002001\FirstZ.exe
file C:\Users\test22\AppData\Local\Temp\onefile_2760_133629768733125000\python310.dll
file C:\Users\test22\AppData\Local\Temp\1000025001\setup222.exe
file C:\Users\test22\AppData\Local\Temp\onefile_2760_133629768733125000\vcruntime140.dll
file C:\Users\test22\AppData\Local\Temp\onefile_2760_133629768733125000\libffi-7.dll
file C:\Users\test22\AppData\Local\Temp\onefile_2760_133629768733125000\python3.dll
file C:\Users\test22\AppData\Local\Temp\onefile_2828_133629768978437500\sqlite3.dll
file C:\Users\test22\AppData\Local\Temp\onefile_2760_133629768733125000\stub.exe
file C:\Users\test22\AppData\Local\Temp\1000008001\upd.exe
file C:\Users\test22\AppData\Local\Temp\onefile_2828_133629768978437500\python3.dll
file C:\Users\test22\AppData\Local\Temp\onefile_2828_133629768978437500\python310.dll
file C:\Users\test22\AppData\Local\Temp\1000005001\judit.exe
file C:\Users\test22\AppData\Local\Temp\onefile_2828_133629768978437500\stub.exe
file C:\Users\test22\AppData\Local\Temp\onefile_2828_133629768978437500\libcrypto-1_1.dll
file C:\Users\test22\AppData\Local\Temp\1000070001\monster.exe
file C:\Users\test22\AppData\Local\Temp\onefile_2828_133629768978437500\libffi-7.dll
file C:\Users\test22\AppData\Local\Temp\onefile_2760_133629768733125000\libssl-1_1.dll
file C:\Users\test22\AppData\Local\Temp\onefile_2828_133629768978437500\vcruntime140.dll
file C:\Users\test22\AppData\Local\Temp\1000063001\drivermanager.exe
file C:\Users\test22\AppData\Local\Temp\1000007001\redline123123.exe
file C:\Users\test22\AppData\Local\Temp\onefile_2828_133629768978437500\libssl-1_1.dll
file C:\Users\test22\AppData\Local\Temp\onefile_2760_133629768733125000\sqlite3.dll
file C:\Users\test22\AppData\Local\Temp\8254624243\axplong.exe
file C:\Users\test22\AppData\Local\Temp\1000005001\judit.exe
file C:\Users\test22\AppData\Local\Temp\1000007001\redline123123.exe
file C:\Users\test22\AppData\Local\Temp\1000008001\upd.exe
file C:\Users\test22\AppData\Local\Temp\1000025001\setup222.exe
file C:\Users\test22\AppData\Local\Temp\1000035001\gold.exe
file C:\Users\test22\AppData\Local\Temp\1000047001\lummac2.exe
file C:\Users\test22\AppData\Local\Temp\1000063001\drivermanager.exe
file C:\Users\test22\AppData\Local\Temp\1000064001\NewLatest.exe
file C:\Users\test22\AppData\Local\Temp\1000070001\monster.exe
file C:\Users\test22\AppData\Local\Temp\onefile_2760_133629768733125000\stub.exe
file C:\Users\test22\AppData\Local\Temp\1000001001\b2c2c1.exe
file C:\Users\test22\AppData\Local\Temp\1000002001\FirstZ.exe
file C:\Users\test22\AppData\Local\Temp\onefile_2828_133629768978437500\stub.exe
file C:\Users\test22\AppData\Local\Temp\1000008001\upd.exe
file C:\Users\test22\AppData\Local\Temp\1000064001\NewLatest.exe
file C:\Users\test22\AppData\Local\Temp\1000035001\gold.exe
file C:\Users\test22\AppData\Local\Temp\1000007001\redline123123.exe
file C:\Users\test22\AppData\Local\Temp\1000063001\drivermanager.exe
file C:\Users\test22\AppData\Local\Temp\1000001001\b2c2c1.exe
file C:\Users\test22\AppData\Local\Temp\8254624243\axplong.exe
file C:\Users\test22\AppData\Local\Temp\1000047001\lummac2.exe
Time & API Arguments Status Return Repeated

ShellExecuteExW

show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\8254624243\axplong.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\8254624243\axplong.exe
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000005001\judit.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000005001\judit.exe
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000007001\redline123123.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000007001\redline123123.exe
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000008001\upd.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000008001\upd.exe
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000025001\setup222.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000025001\setup222.exe
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000035001\gold.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000035001\gold.exe
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000047001\lummac2.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000047001\lummac2.exe
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000063001\drivermanager.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000063001\drivermanager.exe
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000064001\NewLatest.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000064001\NewLatest.exe
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000070001\monster.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000070001\monster.exe
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\263c5c4d73\Hkbsse.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\263c5c4d73\Hkbsse.exe
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000001001\b2c2c1.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000001001\b2c2c1.exe
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000002001\FirstZ.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000002001\FirstZ.exe
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

flags: 15
family: 0
111 0
Time & API Arguments Status Return Repeated

InternetReadFile

buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEd† ÉOXfð. )®À«ö@P­˜ý` Pì €(¸©(@­”@ã(`S.text8¬®``.dataÀ²@À.rdataP+Ð,´@@.eh_framà@À.pdata( â@@.xdataø  ì@@.bss0€À.idataì Pö@À.CRT``@À.tlsp@À.rsrc(¸©€º©@@.reloc”@­«@BUH‰åH‰MH‰UL‰E D‰M(]ÃUH‰åHƒì èT‰öH‹Ú‹…Àt ¹èϨë ¹èèè^ H‹7Û‹‰è^ H‹Û‹‰è>2H‹gÙ‹ƒøuH‹)ÛH‰ÁèK;¸HƒÄ ]ÃUH‰åHƒì0H‹Û‹‰wH‹ÈÚ‹HgH‰D$ A‰ÑL@H1H‰ÂH#H‰Áè7¨‰)HƒÄ0]ÃUH‰åHƒì0ÇEüÿH‹¤ÙÇè=‰Eü‹EüHƒÄ0]ÃUH‰åHƒì0ÇEüÿH‹uÙÇè‰Eü‹EüHƒÄ0]ÃUH‰åHƒìpHÇEðÇEä0‹EäeH‹H‰EØH‹EØH‹@H‰EèÇEüë!H‹EðH;Eèu ÇEüëE¹èH‹öBÿÐH‹MÙH‰EÐH‹EèH‰EÈHÇEÀH‹MÈH‹EÀH‹UÐðH± H‰EðHƒ}ðu¨H‹&Ù‹ƒøu ¹è-§ë?H‹ Ù‹…Àu(H‹ÿØÇH‹BÙH‰ÂH‹(ÙH‰Áè§ë ÇèH‹ÍØ‹ƒøu&H‹ïØH‰ÂH‹ÕØH‰ÁèݦH‹¦Øǃ}üuH‹ƒØH‰E¸HÇE°H‹U°H‹E¸H‡H‹•×H‹H…ÀtH‹†×H‹A¸º¹ÿÐè8H‹ÕØH‰ÁH‹»AÿÐH‹ØH‰HýÿÿH‰ÁèŸèË/‹ H‰Áèsè),H‹[×H‹H‹ñH‰H‹ çH‹Ø‹ÎI‰È‰Áè ,‰Ö‹Ô…Àu ‹Æ‰Áè+¦‹Á…ÀuèÄ¥‹ªHƒÄp]ÃUH‰åHƒì H‹9×ÇH‹<×ÇH‹?×ÇH‹¢ÖH‰EøH‹Eø·f=MZt ¸é­H‹Eø‹@<HcÐH‹EøHÐH‰EðH‹Eð‹=PEt ¸éH‹EðHƒÀH‰EèH‹Eè··À= t = t)ëVH‹Eè‹@\ƒøw¸ëHH‹E苀ЅÀ•À¶Àë4H‹EèH‰EàH‹Eà‹@lƒøw¸ëH‹Eà‹€à…À•À¶Àë¸HƒÄ ]ÃUSHƒìHHl$@‰M H‰U(‹E ƒÀH˜HÁàH‰Áè¥H‰EðH‹E(H‹H‰EèÇEü鏋EüH˜HÅH‹EèHÐH‹H‰Áè,¥HƒÀHÀH‰Eà‹EüH˜HÅH‹EðHH‹EàH‰Áè°¤H‰‹EüH˜HÅH‹EèHÐH‹‹EüH˜H ÅH‹EðHÈH‹H‹MàI‰ÈH‰Á耤ƒEü‹Eü;E Œeÿÿÿ‹EüH˜HÅH‹EðHÐHÇH‹E(H‹UðH‰HƒÄH[]ÃUH‰åHƒì H‰MH‹EH‰Áè²£H…Àt¸ë¸ÿÿÿÿHƒÄ ]АÃff.„@1ÀÃff.„fUWVSHƒì(Hl$ H5 ºH‰ñÿ >H‰ÃH…ÀtkH‰ñÿB>H‹=û=H÷¹H‰ÙH‰ÿ×Hú¹H‰ÙH‰Æÿ×H‰©H…ötHH ¯éÿÖH 6HƒÄ([^_]éÿÿÿf„HYÿÿÿH5BÿÿÿH‰{©ë¼f„UH‰åHƒì H‹a©H…Àt H UéÿÐH‹ ŒH…ÉtHƒÄ ]Hÿ%ó<HƒÄ ]Аf.„fDUWVSHºÅgV/ëÔ'I‰ÊHI(E‹JHM‹BM‹IÉLÂIƒû†­I‹ZI‹RH¿OëÔ'=®²ÂI‹B H‰ÞH¯ßH‰ÕHÑÂHÁÆH¯ïHòL‰ÆHÁÆ L¯ÇHòH‰ÆHÁÅHÁÆH¯ÇHòIÁÀH¾‡Ê녱y7žH¯îL¯ÆH1êH‰ÝH»c®²ÂwÊë…H¯ÖHÁÅH¯îHÚH1êH¯ÖHÚI1ÐH‰ÂL¯ÆHÁÂH¯ÖIH1ÂH¯ÖHÚIr0LÚI9ñr`H»OëÔ'=®²ÂH‰ñI¸‡Ê녱y7žI»c®²ÂwÊë…fDH‹AøHƒÁH¯ÃHÁÀI¯ÀH1ÐHÁÀI¯ÀJI9ÉsØL‰ÈL)ÐHHÐHƒáøHñLAM9Ár5‹H¹‡Ê녱y7žH¯ÁL‰ÁH1ÐHºOëÔ'=®²ÂHÁÀH¯ÂHºùy7ž±gVHÂL9És2IºÅgV/ëÔ'I¸‡Ê녱y7ž¶HƒÁI¯ÂH1ÐHÁÀ I¯ÀH‰ÂI9ÉuâH‰ÐHÁè!H1ÐHºOëÔ'=®²ÂH¯ÂH‰ÂHÁêH1ÐHºùy7ž±gVH¯ÂH‰ÂHÁê H1Ð[^_]ÃHƒì8L‰D$PLD$PL‰L$XL‰D$(è3=HƒÄ8Ãff.„Hƒì8L‰L$XLL$XL‰L$(èx=HƒÄ8ÃAWAVAUATUWVSL‹\$hA‹;I‰ÊI‰ÔM…É„=C¶DÿIƒùv1HÇÂÿÿÿÿ„À„â½Ð¸)ÐIƒùˆ‡%KtøH‹ë@HɶA¶Jc ‹HÙÿá@A¶HHÁá0HÊA¶HHÁá(HÊA¶HHÁá HÊA¶HHÁáHÊA¶HHÁáHÊA¶HHÁáHʄÀ„Q½È¸ L‰ÆD)ÈÁà)ÈÁïK,"MK@¶ÿMhLuý‰û÷ۃã?éÁfI9ð„?‰ÂH‰ñÁêA‰ÓL)ÙL9Á‚ÁâH‰Î)ÐH‹M9òƒ¬‰ÁI‰ÓIƒÂIÓã‰ÙIÓëK YD¶YD¶9AÃH‰ÐEˆzüD‰ÙHÓà‰ÙHÓèIA¶¶@DØAˆJýI‰Ó‰ÁIÓã‰ÙIÓëK YD¶YD¶9AÃH‰ÐEˆzþD‰ÙHÓà‰ÙHÓèIA¶¶@DØAˆJÿƒø@w!L9î‚8ÿÿÿ‰ÂƒàÁêH)ÖH‹M9ò‚UÿÿÿI9ês/÷߃ç?‰ÁI‰ÓIƒÂIÓã‰ùIÓëOYA¶ E¶[AˆJÿDØL9ÕuÖI9ðt4HÇÂìÿÿÿH‰Ð[^_]A\A]A^A_ÃH‰òL)‰ÑÁâH)Î)ÐH‹ë›I9êr˜L‰âƒø@uÄëÉf„HǸÿÿÿH‰Ð[^_]A\A]A^A_ÃL‰Êë¤@AVAUATUWVSL‹\$`A‹3H‰ÕM…É„BC¶DÿIƒùv6HÇÂÿÿÿÿ„À„ä½Ð¸)ÐIƒùˆ‡(K\
request_handle: 0x00cc000c
1 1 0

InternetReadFile

buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL¼y’à 0ÐÐڟ @ @…ˆŸOÔÉà lŸ  H.textÀÏ Ð `.rsrcÔÉÌÔ@@.reloc à @B¼ŸHP*dtK´ž¸0 1s% ~Í%-&~Ìþ[s& %€Í(+o( 8Ðo) £%rprYp~* (+ ¢%rqpr¯p~* (+ ¢%rÇprp~* (+ ¢%r!prap~* (+ ¢(– o, 81(- sNsk~* }Ë~* s. (/ o0 }Ë{ËrqprÑp~* (+ o1   ,rãprp~* (+ +;rprap~* (+ o1 -{Ë(™+ {Ë(˜(2 þ  9:o3   (4 o5 o6 (7 {Ë(—  (2 þ  9ñs8 s8 s8 þOs9 ~Î%-&~Ìþ\s: %€Î(+þPs9 ~Ï%-&~Ìþ]s: %€Ï(+þQs9 ~Ð%-&~Ìþ^s: %€Ð(+o; þ9E{ˍ£%rip¢o< šr}p(7 (A(+o> s? (L(+oRo@ #>@(A (B ioC &ÞÞ(D þ9œþRs9 ~Ñ%-&~Ìþ_s: %€Ñ(+þSs9 ~Ò%-&~Ìþ`s: %€Ò(+þTs9 ~Ó%-&~Ìþas: %€Ó(+ÞÞo] o_þUsE ~Ô%-&~ÌþbsF %€Ô(+oaogþVsG ~Õ%-&~ÌþcsH %€Õ(+ocþWsI ~Ö%-&~ÌþdsJ %€Ö(+oeþXsK ~×%-&~ÌþesL %€×(+oi( +,dsk%o]% r£p(7 o_%sN oa%og%oi%sO oc%sP oeoQ ( +,dsk%o]% rµp(7 o_%sN oa%og%oi%sO oc%sP oeoQ ÞÞojþ, oQ (R :ÃúÿÿÞþoS ÜoT :%úÿÿÞ ,oS ÜÞ&Þ + *A”ñ,›:ÕåäɵDù4â $0sp rËp(U (V þ , Ýî( srÝpo&8žooW ooW (rùpo1   ,4sp  ¥%-oX šom oo +sp%om%oo Þ ÞXoþ  :NÿÿÿÞ ÞÞÞ+*ALPà1Ó 0’sN  ¥%Ю(Y sZ (U (V þ , ÝS( s¥%Ðz(Y sZ o&8òsooW o‹ooW oo(oÞÞÞooŠ(D - oŠ+rýpo‹oŒ(D - oŒ+rýpooŽ(D - oŽ+rýpoÜoŽrýp([   , o\ Xoþ  :úþÿÿÞ ÞÞ Þ+*AdzJÄzRÌoC8{}„0Ìs8 (U (V þ , Ý£( s¥%М(Y sZ o&8Csq%ooW ot%ooW o3 .þov%ooW ox%oo3 1þoz%ooW (] @Bj[!‘¶Yo|%ooW o~%r po(o€o{jþ,-(^    (_   (`
request_handle: 0x00cc000c
1 1 0

InternetReadFile

buffer: MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $³Ù#÷q·p÷q·p÷q·p$´qüq·p$²q^q·p$³qâq·p$¶qôq·p÷q¶pŒq·p5ð³qåq·p5ð´qâq·p5ð²q£q·pó¾qöq·póµqöq·pRich÷q·pPELò\fà '8ªYsP@@Xê(Ø(&ð, Î`Í@PT.textš/0 `.BSs³@4 `.rdata¢P¤<@@.dataèÚà@À.reloc,ðº@B¹pØ[èÕ=hJ?BèÿeYÃjjhÙ[¹@Ù[èChT?BèàeYÃVWjè©Y¿Ù[‹ð‹ÏèFCjV‹ÏǐÙ[8TBèìGh^?Bè¨eY_^ù9Ù[é‹C¹8Ù[è\=hh?Bè†eYÃh|?BèzeYÃhr?BèneYù Ü[è.=h?BèXeYÃh†?BèLeYÃÌÌÌÌÌÌ̸àç[ÃÌÌÌÌÌÌÌÌÌÌU‹ìƒäøQV‹ujèd¨ƒÄM QjVPèÎÿÿÿÿpÿ0è ӃÄ^‹å]ÃÌÌÌÌÌÌÌÌÌÌÌÌU‹ìƒäøEPjÿuÿu ÿuè–ÿÿÿÿpÿ0èvӃÉÿƒÄ…ÀHÁ‹å]ÃÌÌÌÌÌÌÌÌÌÌÌÌ̃ì‹D$ WÀV‹ñ‰D$VÆD$RD$ÇÄRBPfÖèmmƒÄ‹Æ^ƒÄÂÌÌÌÌÌÌV‹ñWÀFPÇÄRBf֋D$ ƒÀPè:mƒÄ‹Æ^ÂÌÌÌÌÌ̋I¸ôËB…ÉEÁÃÌÌV‹ñFÇÄRBPèlmƒÄöD$t j Vè¢aƒÄ‹Æ^ÂÌÌ̍AÇÄRBPè?mYÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌWÀ‹ÁfÖAÇAÌBÇÜRBÃÌÌÌÌÌÌÌÌƒì  $èÕÿÿÿhôéBD$Pè6mÌÌÌÌÌÌV‹ñWÀFPÇÄRBf֋D$ ƒÀPèjlƒÄÇÜRB‹Æ^ÂV‹ñWÀFPÇÄRBf֋D$ ƒÀPè:lƒÄÇÐRB‹Æ^Âh ÌBèC>ÌÌÌÌÌÌV‹ñWÀFPÇÄRBf֋D$ ƒÀPèúkƒÄÇèRB‹Æ^‹D$‹T$‰‰H‹T$øƒìVÿt$RÿP ‹t$‹H‹V‹I;Ju‹;u °^ƒÄÂ2À^ƒÄÂÌÌÌ̋AV‹t$‹V;Bu‹;D$ u°^Â2À^ÂÌÌÌÌÌÌÌÌÌÌÌ̋D$‹L$‰Ç@¨Ó[ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌU‹ìƒäðìˆ¡@C3ĉ„$„V‹uWÀW‹ù)D$ ÇD$0‹Æƒ~ÇD$4‰t$@v‹‰D$@‹vþÿÿÿ‡-ƒþw¹‰t$0‰L$4D$ ë[‹ÆƒÈ=ÿÿÿv¸ÿÿÿë ¹;ÁBÁ‰D$D$PD$$Pèª8‹È‰t$8‹D$‰D$<FPÿt$L‰L$0QèJo‹L$HƒÄ‹t$0‹E‹U ‰D$‰T$…ötK‹Á+ƃør#Fƒù‰D$0¹: D$ GD$ f‰ 0ÆD0ëjh0ÌBÆD$HL$(ÿt$Hjè6,‹T$ÿt$‹L$LQ‹ÊÿPƒ|$\T$H‹L$XGT$H‹D$4‹t$0+ƉL$QR;Èw*ƒ|$<‰D$8D$(GD$(ðVèn‹D$$ƒÄ Æ0ëÆD$ ÿt$ QL$0è¿+‹L$\ƒùv-‹T$HA‹Âùr‹PüƒÁ#+ƒÀüƒø‡¿QRè"^ƒÄ(L$ L$`ó~D$0fÖD$pWÀƒ|$tf~ÈÇÄRBfÖGGÈ)L$`G‰L$PD$ÆD$ Pè)i‹L$|ƒÄÇèRBƒùv)‹T$`A‹Âùr‹PüƒÁ#+ƒÀüƒøw>QRèœ]ƒÄ‹M‹Ç‹U ‰O ‹Œ$ŒÇôRB‰W_^3Ìè2]‹å] è”üÿÿèŽÛè‰ÛÌÌÌÌÌÌÌÌÌÌV‹ñFÇÄRBPèühƒÄöD$t jVè2]ƒÄ‹Æ^ÂÌÌÌV‹t$WÀW‹ùGPÇÄRBf֍FPèYhÇôRBƒÄ‹F ‹N‰G ‹Ç‰OÇSB_^ÂÌÌÌÌÌÌÌÌÌÌÌÌV‹t$WÀW‹ùGPÇÄRBf֍FPè hƒÄÇôRB‹F ‹N‰G ‹Ç‰O_^ÂÌ̸4ÌBÃÌÌÌÌÌÌÌÌÌ̋D$V‹t$ƒøu`D$ÇD$WÀPVÇFÇFè«5‹L$ƒÄ‰ÇF‰NÍB‹ ,ÍB‰HŠ 0ÍBˆHÆ@‹Æ^ÂWPèöP‹ÐWÀ‹ÊƒÄÇFÇFyŠA„Àuù+ÏQR‹ÎèK#_‹Æ^ÂÌÌÌÌöD$V‹ñt jVèÄ[ƒÄ‹Æ^ÂÌÌÌÌÌWÀ‹ÁfÖAÇA@ÌBÇ€SBÃÌÌÌÌÌÌÌÌƒì  $èÕÿÿÿh„éBD$PèvgÌÌÌÌÌÌV‹ñWÀFPÇÄRBf֋D$ ƒÀPèªfƒÄÇ€SB‹Æ^ÂöD$V‹ñÇŒSBt jVè.[ƒÄ‹Æ^ÂÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌVj‹ñèr53ÀÇFf‰F‰Ff‰F ‰F$ˆF(‰F,ˆF0‹D$ÆFÇF ÆFÇF…ÀtPVè’NƒÄ‹Æ^ÂhLÌBèk8ÌÌÌÌÌÌÌÌÌÌÌÌÌÌV‹ñVè³N‹F,ƒÄ…Àt PèF̃ÄÇF,‹F$…Àt Pè/̃ÄÇF$‹F…Àt Pè̃ÄÇF‹F…Àt Pè̃ÄÇF‹F …Àt Pèê˃ÄÇF ‹F…Àt PèÓ˃ÄÇF‹Î^éÆ4ÌÌQV‹ñƒ>u&jL$èX4ƒ>u ¡øÙ[@£øÙ[‰L$è•4‹^YÃÌÌÌÌÌÌÌÌÌÌÌÌðÿAÃÌÌÌÌÌÌÌÌÌÌ̃ÈÿðÁA¸DÁÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌ̋I…Ét‹ÿP…Àt‹‹ÈjÿÃÌÌÌÌÌÌ̋A…Àt‹H…Ét‹ÁÃÀøiÌBÃÌÌÌÌ̋IV‹t$W<µ;q s ‹A‹…Àu!ë3À€ytèïK;p s ‹@‹_^Â3À_^ÂÌÌÌÌÌÌÌÌÌÌ̍AP¶D$PèlNƒÄÂÌÌÌÌÌÌÌÌÌÌÌV‹t$W‹|$;÷tSY¶SPè?NˆƒÄF;÷uì[_‹Æ^ÂÌ̍AP¶D$Pè"PƒÄÂÌÌÌÌÌÌÌÌÌÌÌV‹t$W‹|$;÷tSY¶SPèõOˆƒÄF;÷uì[_‹Æ^ÂÌ̊D$ÂÌÌÌÌÌÌÌÌ̋T$‹L$+ÊQRÿt$è[h‹D$ƒÄ  ̊D$ÂÌÌÌÌÌÌÌÌ̋T$‹L$+ÊQRÿt$è+h‹D$ƒÄ ÂÌV‹ñ‹FÇœSB…À~ ÿv è§Éë y ÿv è­WƒÄÿvèÉƒÄÇŒSBöD$t jVè¿WƒÄ‹Æ^ÂU‹ìƒäðƒì8¡@C3Ä
request_handle: 0x00cc000c
1 1 0

InternetReadFile

buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEd†ì1cftÜð& *|Ð@@?"` € 00 PX°A(Ȃè.textX``.data0"@À.rdata @ $@@.pdataXP0@@.xdatað`4@@.bss€p€À.idata € 6@À.CRT`B@À.tls D@À.reloc°F@B/4ÀH@B/19]®Ð°L@B/31r€ ü@B/45‹ @B/57 À :@B/70ÚÐD@B/81åàH@B/97Ð^@B/113 r@B.rsrc0 0t@@Ãff.„@Hƒì(H‹µ41ÉÇH‹¶4ÇH‹¹4ÇH‹4f8MZuHcP<HЁ8PEtfH‹_4‰ ¥_‹…ÀtC¹èÉèDH‹5‹‰è,H‹í4‹‰èdH‹3ƒ8tP1ÀHƒÄ(йè†ë»@·Pfú tEfú uˆƒ¸„†{ÿÿÿ‹ø1ɅÒ•Áéiÿÿÿ€H‹ Á4è| 1ÀHƒÄ(ÃDƒxt†@ÿÿÿD‹€è1ÉE…À•Áé,ÿÿÿfHƒì8H‹•4LÖ^H×^H Ø^‹‰¬^H‹14D‹H›^H‰D$ èýHƒÄ8ÀATUWVSHƒì H‹3H‹=pqeH‹%0H‹pëf„H9Æ„g¹èÿ×1ÀðH±3uçH‹5`31ÿ‹ƒø„Z‹…À„¹Ç^‹ƒø„P…ÿ„iH‹…2H‹H…Àt E1Àº1ÉÿÐè¬H‹ …3ÿÏpH‹Ø2H ÁýÿÿH‰è蔋Ö]{HcÿHÁçH‰ùèDL‹%µ]H‰Å…ÛŽJHƒï1Û@I‹ èHpH‰ñèI‰ðH‰DI‹H‰ÁHƒÃèËH9ßuÎHïHÇH‰-]]èH‹Ñ1L‹B]‹ L]H‹L‰H‹7]èb‹ ]‰]…É„Æ‹]…ÒttHƒÄ [^_]A\Ãf„H‹5 2¿‹ƒø…¦þÿÿ¹èO‹ƒø…°þÿÿH‹ý1H‹ æ1èÙÇ…ÿ…—þÿÿ1ÀH‡éþÿÿf„ès‹…\HƒÄ [^_]A\Ãf.„H‹É1H‹ ²1Çèé3þÿÿfH‰Çéíþÿÿ‰Á艐Hƒì(H‹å0ÇèšýÿÿHƒÄ(ÃHƒì(H‹Å0ÇèzýÿÿHƒÄ(ÃHƒì(è7HƒøÀHƒÄ(АH éÔÿÿÿ@АUAWAVAUATVWSHì8H¬$€D)… )½)µ€èZH5s+H=¼+(5Å+(=®+EWÀL‹-[nH‹nL5µ+L=,ëfff.„¹'AÿÕHÇD$ 1ÉH‰òI‰øE1Éè+…ÀuÛ)uP)}@D)EÐD)EàD)EðD)ED)ED)E HÇE0ÇEÐhD)E`HÇEpHE`H‰D$HHEÐH‰D$@DD$0ÇD$(ÇD$ 1ÉHU@E1ÀE1Éÿ_mA‰Ä¹ˆAÿÕE…ätHÇD$ 1ÉL‰òM‰øE1É肅ÀtR¹¸ AÿÕHÇD$ 1ÉL‰òM‰øE1Éè]…Àt-¹¸ AÿÕHÇD$ 1ÉL‰òM‰øE1Éè8…Àt¹¸ AÿÕA¼_¹_AÿÕëA¼˜:H‹M`ÿÓH‹MhÿÓD‰áé»þÿÿfÿ%~nf.„fHƒì(H‹ÅH‹H…Àt"DÿÐH‹¯HPH‹@H‰ H…ÀuãHƒÄ(ÃfDVSHƒì(H‹Ó-H‹‰Áƒøÿt9…Ét ‰ÈƒéHÂH)ÈHtÂø@ÿHƒëH9óuõH ~ÿÿÿHƒÄ([^éSýÿÿ1ÀfDD@‰ÁJƒ<ÂL‰Àuðë­fD‹JY…ÀtÃDÇ6Yéqÿÿÿ1ÀАHƒì(ƒút…Òt¸HƒÄ(Ãf„è‹ ¸HƒÄ(ÐVSHƒì(H‹ã,ƒ8tǃútƒútN¸HƒÄ([^ÃfHáxH5ÚxH9ótßDH‹H…ÀtÿÐHƒÃH9óuí¸HƒÄ([^Ãf„è ¸HƒÄ([^Ãff.„@1ÀАVSHƒìxt$@|$PDD$`ƒ9‡Í‹H\*Hc‚HÐÿà€H@)òDA òyòqH‹q¹èsòDD$0I‰ØHê)ò|$(H‰ÁI‰ñòt$ 軐t$@|$P1ÀDD$`HƒÄx[^ÐH¹(ë–€H )놀HÙ(ésÿÿÿ@H9)écÿÿÿ@H)éSÿÿÿHS)éGÿÿÿÛãАVSHƒì8H‰ËHD$X¹H‰T$XL‰D$`L‰L$hH‰D$(è”A¸ºH R)I‰Áè¢H‹t$(¹èkH‰ÚH‰ÁI‰ðè­ èø€WVSHƒìPHc5&WH‰Ë…öŽH‹WE1ÉHƒÀf„L‹L9ÃrH‹P‹RIÐL9ŠAƒÁHƒÀ(A9ñuØH‰Ùè H‰ÇH…À„æH‹ÅVH¶HÁãHØH‰x Çè3 ‹W A¸0H H‹—V
request_handle: 0x00cc000c
1 1 0

InternetReadFile

buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $̉£ˆèÍTˆèÍTˆèÍT[šÎU„èÍT[šÈU#èÍT[šÉUèÍTJiÉUšèÍT[šÌUèÍTˆèÌT èÍTJiÈUÔèÍTJiÎUèÍT{jÈU‰èÍT{j2T‰èÍT{jÏU‰èÍTRichˆèÍTPELþÔdfà 'Z¸éœp@P@d<à(& ("xðÀð¸ï@pt.text‹YZ `.rdata¶p¸^@@.data¼Ø0È@À.rsrcàÞ@@.reloc(" $à@B¹ øGèœDhëhBè^YÃj¸¿dBèK¸¼ÝGÇEð`ÝG‰EìƒeüǼÝGHrBÇEüh|CPhlÝGèÅNƒMüÿhõhB菃ÄèޏÃj¸þdBèô¸TÝGÇEðøÜG‰EìƒeüÇTÝGpwBÇEühèCPhÝGènNƒMüÿhøhB跎ƒÄ臏ÃhiB褎YÃhûhB蘎YÃhèúGè´NÇ$iB耎YÃj¹´úGèhiBèhŽYùäúGèCh1iBèRŽYÃh'iBèFŽYÃjjhpûG¹ ûGè”ah;iBè'ŽYÃVWjèÏàY¿pûG‹ð‹ÏèØajV‹ÏÇpûGЃBè~fhEiBèïY_^ùûGéb¹ûGè ChOiBè͍YùÙûGé,u¹ØûGèëBhYiB譍YÃjjh0üG¹àûGèóshciB莍YÃVWjè6àY¿0üG‹ð‹Ïè7t‹ÏÇ0üG¨„BÆxüGÆnüGèWf¡ˆüG‹ ŒüGƒ%hüGhmiB‰5|üG£püG‰ tüGè(Y_^ùÀüGèNBhiBèYÃhwiBèYÃVÿt$ ‹ñ3Àÿt$ @‰F‰FFPÇüuBèÀƒÄ ‹Æ^ÂVÿt$‹ñÇävBè/ YPNè„^Vÿt$ ‹ñ3Àÿt$ @N ‰F‰FÇèuBè©‹Æ^ÂVÿt$‹ñƒf$NÇ vBèy ‰v$‹Æ^ƒì$SU‹l$43ÀVW‹ñ‰D$ƒì ‹Ì‰U‰Fè(‹} j[…ÿtðÿG‹Çë‹ÃP‹Îè”#…ÿt‹Ïè\-€}t‹EL$(‰D$$E Pè“3ۍD$$Cë3À‰D$‰D$‰D$ ‹D$4‰D$D$‹Pè80öÃt‹L$ƒãý…Ét‹D$ +ÁƒàüPQèHYYöÃt L$(è;2D$8‹ÎPè _‹Æ^][ƒÄ$ÂVj‹ñèÜ ‹D$–€ÇvBƒb$ÇävB‹‰B‹Æ‰R$^ÂU‹ìQQVWÿu‹ñè½ÿÿÿƒì0ÇÈvB¾¨‹Ìƒ'ƒgèEøVPèð ƒÄ8;øtP‹Ïè2‹Mü…Étè#_ÆFv‹Æ^ÉÂj ¸bBè_Œ‹]3ÿ‹Ç‰Eèÿu è§ùY‹È‰Mä‹‹@‹t ‹D$;Ç|;÷v;Ç| ;ñv+ñÇëWÀfE܋Eà‹u܉EìSMÔè €}Øu j^‹Öé‰}ü‹ ‹A‹D%Àƒø@t<‹Eì;Ç|3;÷v-‹‹H¶D@P‹L8èõ<ƒøÿtsƒÆÿ‰u܋EìƒÐÿ‰Eì‰Eàëɋ ‹A‹L8‹Wÿuäÿu ÿP$;EäuE;×uA‹Eì;Ç|3;÷v-‹‹H¶D@P‹L8è<ƒøÿtƒÆÿ‰u܋EìƒÐÿ‰Eì‰EàëÉj^‹×ëj^‹Ö‰Uè‹‹@‰| ‰|$ƒMüÿë;‹M‹‹PыB j^ Æj3É9J8Eñ ðV‹Êè‘2¸Ö@ÃMüÿ3ÿj^‹]‹Uè‹‹HËW3À9y8Eð q òVèa2MÔè-‹Ãè;ŠÃÌÌÌÌÌj@¸bB赊3ۋÉEä‰Eàÿu èý÷Y‹Ð‰U܉]؋}‹‹I‹t9 ‹D9$;Ã|;óv‹Ë;Á| ;òv+òÁëWÀfEċEȋuĉuè‰EìWM¼èë8]Àu j^‹Ö髉]ü‹‹@‹D80‹H‰MЋÿPEÌPè Y‰EԍMÌè\‹‹I‹L9áÀƒù@tR‹Mì;Ë|K;óvE‹‹H·D9@P‹L98èT;·À¹ÿÿf;Èu j^‹Ö‰Uä‰UàëƒÆÿ‰uè‰uċMìƒÑÿ‰Mì‰MÈë±j^‹Ó‹E܋˅Ò…œ;Ë|_;ÃvY‹E ŠˆEЋMԋÿuÐÿP0·ÀP‹‹H‹L98èâ:·À‹Uä¹ÿÿf;ÈD։Uä‰Uà‹E܃Àÿ‰E܉E´‹M؃Ñÿ‰M؉M¸ÿE 땋Eè‹Mì;Ë|/;Ãv)‹‹H·D9@P‹L98èŠ:·À¹ÿÿf;Èu‹Uä ։Uà‹‹@‰\8 ‰\8$ƒMüÿëX‹EèƒÀÿ‰Eè‰EċMìƒÑÿ‰Mì‰MȋUä띋M‹‹PыB j^ Æj3É9J8Eñ ðV‹Êè70¸0@ÃMüÿ3Ûj^‹}‹Uà‹‹HÏS3À9Y8Eð q òVè0M¼èÓ‹Çèá‡ÃÌÌÌÌ̋ËD$=rPèYÅÀtPèd„YÃ3ÀËD$H#;Ȇˆ,QèJ„Y‹È…Ét A#ƒàà‰HüÃé ÍS‹ÙVW‹|$‹C‹3+ÆÁø;øvWè$‹3VWÿt$è÷ƒÄ ë<U‹k+îÁýV;ýv ‹t$UVèٍ®+ý‹sVWPèɃÄë Wÿt$èºƒÄ ]¾_^‰C[Âj,趃Y‰‰@‰@fÇ@ ÃS‹\$ U‹é¹ÿÿÿ;ÙwZjX;ØwSÿt$‰]U‰EèŠ/ƒÄ Æ+ë4VWQPSè‹ðNQèÞþÿÿSÿt$(‹ø‰]W‰}‰uèV/ƒÄÆ_^][Âèü-ÌS‹Ù¹ÿÿÿW‹|$;ùwQjX;øwjÿt$‰{S‰CèXƒÄ ë.VQPW裋ðNQèqþÿÿO‰Qÿt$$‰{P‰sèé.ƒÄ^_[Âè”-ÌV‹t$W‹ù‹N…Étèó"„Àt‹‰‹F‰G°ë2À_^Âƒì ‹Ìÿt$èí ‹D$‹L$ÿ0è*Ã|$V‹ñt#ÿt$èÑ‹D$Vÿ6ÿ0‹D$ÿ0臃ĉF^ ‹T$‹B…Àtðÿ@‹‰‹B‰AÂV‹t$W‹|$+|$ Wÿt$VèiƒÄ 7_^ËL$‹D$ÿt$ PQèÈÿÿÿƒÄ ÃU‹ì‹E =rE PEPèý‹E YYPÿuè‚YY]ÃV‹ñ‹ÿpÿt$ èj,ÿ6èãYY^ÂV‹t$ W‹ùëÿv‹Ïÿt$èèÿÿÿVÿt$‹6è YY€~ tÞ_^ÂV‹t$ NèŸ*j,V藁YY^ËD$ƒèt0ƒèu+Vh¨èJ‹ðY…ötÿt$ ‹ÎèøÿÿǬvBë3ö‹Æ^Ãh°è Y…Àt ÿt$‹Èè)øÿÿÃ3ÀÃVj0聋ðYÿt$NÇXvBè
request_handle: 0x00cc000c
1 1 0

InternetReadFile

buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL¯ cfà À°’@@…öx0ìQœ÷”.textÀÀ `.rdata7*Ð,Ä@@.data„+˜ð@À.relocìQ0Rˆ@BU‰åSWVƒì0‹] ¡hD‰E𐐐P‰àP‰áP‰æP‰ç‰‹U‰ÆÆÇCÇCÇCÇC ÇCÇCÇÿeð‰}ЉMȱÇEð1҄ɕ‹]‰EÜÿ$•lD1À€ý&”Àÿ$…ìD‹E ƒÀˆ(°@‰ß‹]ðÉ]ðˆ‰û1ÀþÉ•Àÿ$…lDŠ+C1À€ýf’Àÿ$…tD1À€ýð’Àÿ$…|D1À€ýò’Àÿ$…„D1À€ýó’Àÿ$…ŒD”À¶Àÿ$…”D‹E @ˆ(°‰ß‹]ðÉ]ðˆ‰û1ÀþÉ•Àÿ$…lD1À€ý6’Àÿ$…´D1À€ý>’Àÿ$…¼D1À€ýd’Àÿ$…ÄD1À€ý>”Àÿ$…ÌD1À€ýg’Àÿ$…¤D”À¶Àÿ$…¬D‹E ƒÀˆ(°‰ß‹]ðÉ]ðˆ‰û1ÀþÉ•Àÿ$…lD1À€ý.’Àÿ$…ÜD”À¶Àÿ$…äD1À€ýð”Àÿ$…œD‰]ìÿ%ôD‹E ˆhÿ%D‹E ˆhˆhÿ%D° ‹]ðÉ]ðˆ1ÀþÉ•À‹]ìÿ$…lD1À€ý6”Àÿ$…ÔD‹E ƒÀˆ(°‰ß‹]ðÉ]ðˆ‰û1ÀþÉ•Àÿ$…lD‹E @ˆ(°‰ß‹]ðÉ]ðˆ‰û1ÀþÉ•Àÿ$…lD‰űUð¶òÁæ‹E ‰p1À„Ò•Àÿ$…D€Ê‹Ë‹E ˆh1À€ý”Àÿ$… D1À€ý “ÀÇEèÐC1ÿÿ$…D1À€ý¤’À1ÿÿ$…,D‰ÐÀè$¶Àÿ$…4D€â÷ëb‹E ˆh1À€ý”Àÿ$… D‰UðŠ+C‹E ˆh¿JÐC¶Õ‰ÐÁè‰Eضƒâ‰UäÐÇEèJÐC¶‰Uì1À€úÿ”Àˆê‰Uàÿ$…LD€Ê‹Ë¡DD1ÿÿà‰}à‰Uð¶Õ‰ÐÁè‰E؋}趃â‰Uäж1À‰Uì€úÿ”Àÿ$…LDÎ0‹E ‰pˆé€áý1À€ù$”ÀÇEìÿ$…TD‹EìÀè¶Àÿ$…lD1À€}à•À‰Ç1ҋEìˆÔ‰Eì‰}ԋUðÿ$½„D°‰Eì°Àè¶Àÿ$…lD¶Eìƒà‹Uè·‰Eì1À€}à•À‰EԋUðÿ$…„D‹Eض€0ÑC‹}䊌0ÑC¡˜Dÿà1À„Ê•Àÿ$…œD‹Eì$¶Àÿ$…¤DÀê€â¶Âÿ$…D D¶Eì‰ÁÁéƒá‹uÜÿ¡L D‰ð÷Ð ÿÏÿÿƁÆ0‹E ‰p‹Eì$¶Àÿ$…¤D‰Uðˆmèÿ%¬D‰ð÷ЃÈþƃƐ‰ðƒÎ‹M ‰qÿ%¸D¶‹} ˆW‰ÑÀéˆMàˆO ‰Ñ€áˆM؈O Áêƒâ‰UäˆW 1ɋUì„ö•Á‹Uðÿ$¼D‰×‹Mì¶Õ‹MäÓâÀê¶Ê‰úÿ$ÄDÿ%ÐD 0‰ÆÎ0‹E ‰pÿ%ØD‹EԉUðÿ$…ìD1À€}èÙ“Àÿ$…ôD1À€}èà’Àÿ$…üD¶Eè'1ɀ}à”Áÿ$D‹Mäÿ%D¶À¶€ñÐCÒà¶À¶€ñÐCÒàÿ%D¶EìÎ‹M ‰q‰ÁÁéƒá‹uÜÿ¡L D¶À‹M䶄ÁøÐC¶MØÒà‹ (DÿáÀè¶Àÿ$…,D¶Ê‰Êƒò័ 1À…Ñ•ÀŠmèŠMàÿ$…4D1À€ù”Àÿ$…<DºËÑC¸¹ÑCˆmèˆé‹}Ôÿ$½DDŠmèÿ%PDŠmè€åþˆéöрÉþéþÁº¹ÑC¸¡ÑCˆÍÿ%TD9Љ׺•Â‰UĊmè‹UÄÿ$•\D1Ò8”Âÿ$•dDƒÀ1Ò9ø•Âÿ$•\D¶@ˆê‹MäˆÕÓàÀè¶Àÿ$…|D¡DŠMàÿàÎ‹E ‰pŠMà‹EÔÿ$…”D1À€ýŽ’À‹Uäÿ$… D”À¶Àÿ$… D1À€ú”Àÿ$…4 D1À€}ä“Àÿ$…< D1À€ý"’À‹Uäÿ$…œD1À€ý#’Àÿ$…¤D”À¶Àÿ$…¬D1À€ýŒ”Àÿ$… D1À€ú“Àÿ$… D1À€ý!’Àÿ$…´D1À€ú”À±ÿ$…ôD1À€}ä”Àÿ$…üD1À€ý ”Àÿ$…¼D1À€ù”Àÿ$…D Dÿ%Ä D‹EÔÿ$…Ì D1À€ýÖ’Àÿ$…Ô D–À¶Àÿ$…Ü D1À€ý÷’Àÿ$…ä D”À¶Àÿ$…ì Dÿ%X Dˆmè¿ÚÑC¸ËÑC‹MÔÿ$\ D‹ l D¿ÒC¸ÚÑCÿá1É9ø•Áÿ$t D1ɶUè8”Áÿ$| DƒÀ1É9ø•Áÿ$t D1À€ú“À±ÿ$…ÔD1À€}ä”Àÿ$…ÜD1ɋUð„P•Áÿ$„ D¶@‹MäÓàÀè¶Àÿ$…Œ D1ÿº¶Màÿ$•¤ DŠmèÿ$•´ Dÿ%8 DÎ‹E ‰pÿ%< DÎÎ‹E ‰pÿ%< D1À€}ä’ÀˆMàÿ$…D D1À€ýö”Àÿ$…L D¡p Dÿà1À€ý÷”Àÿ$…t D‹Eì ‰Eì1À„É”À‹Uðÿ$…| D‰ÐÀè$¶Àÿ$…” D1ɀ}Ø”Á°ÿ$¤ D‹Eì ‰Eì¡` Dÿà1À„É”À‹Uðÿ$…| D‰È1É<’Á°ÿ$„ D”À¶Àÿ$…Œ D‹EÐÿ%¬ DƐÆÿ%¸ D‰ÐÀè$¶È°ÿ$¼ D1ɀ}Ø”Á°ÿ$œ D‹MЈK1À€}à•Àÿ$…Ä D1À€}Ø”Àÿ$…Ì DÀê€â¶Âÿ$…Ô D¶Cÿ%Ü DƒÎ‹} ‰wAˆG ‰ÂÀêˆW ÿ%ä DƒÎ‹} ‰wAˆG ‰ÂÀêˆW ƒÎ‰wAˆG ˆW ÿ%ä D‰ÂÀê€âˆW$ˆG1Ò<”Âÿ$•ì D¶Eà$¶Àÿ$…ô Dÿ%ü D‹EÐÆÿ% D‹EÐÆÆÿ% DI‹Eж1À€û’Àÿ$… D1À€û’À‹Uìÿ$… D1À€û”Àÿ$… DÎ€‹E ‰×‰Â‰p‹‰Bˉø¶À‰ÁÁéƒá‹uÜÿ¡L D1À€û”À‹Uìÿ$…, DƒÎ ‹E ‰×‰Â‰p¶ˆBˉø¶À‰ÁÁéƒá‹uÜÿ¡L D
request_handle: 0x00cc000c
1 1 0

InternetReadFile

buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELcefà  29,ÎP9 `9@ À9@…€P9K`9è) 9 3P9  H.textÔ09 29 `.rsrcè)`9*49@@.reloc  9^9@B°P9HøO<À]4%ÿ:( 8*&~þ*~*>( 8*&~þ*~*0€8lþ EL8*s € :×ÿÿÿ&8Íÿÿÿs €8s € :­ÿÿÿ&8£ÿÿÿs €8¬ÿÿÿs €8¸ÿÿÿ0$8 88~o 8äÿÿÿ*0$8 88*~o! 8áÿÿÿ0~o" 888*0$8 88~o# 8äÿÿÿ*0~o$ 8*8øÿÿÿ8óÿÿÿ&~þ*~*0W8<þ E%8 {  (9Ûÿÿÿ&8Ñÿÿÿ*8øÿÿÿ8óÿÿÿ{ (+} 8Àÿÿÿ0 þ8þ E8*8øÿÿÿ8968!{ @èÿÿÿ (:¹ÿÿÿ&8¯ÿÿÿ (½Ds% z| o+8£ÿÿÿ0&Œ9þo& 9ý~ 9:~ Ð(' o( 9 J(½D() s* z8 s+ € ~ Ð(' o, (+ ݔ݀uQ%:&8% (. o/ þþþþ& †(½D o/ o0 ¢ () o/ s1 z(2 Ý~ Ð(' o3 Ü8 8*…¿?•…yþ0 þo4 þ*>(5 8*0! ((8*8øÿÿÿ8óÿÿÿ0 8*(88êÿÿÿ8åÿÿÿ0 Ð(888*0 8 88(6 8èÿÿÿ*&~ þ*~ *.þ (7 *:þ þ (8 **þ (9 *.þ (' *0& 8 88(7 (8 8âÿÿÿ*0 8 *8øÿÿÿ8óÿÿÿ('8èÿÿÿ0$ 8 *8øÿÿÿ8óÿÿÿÐ(' 8äÿÿÿ0 8 88*((8åÿÿÿ0' Œ:(+ 88 8*0 þ*>(5 8*&~ þ*~ **þ (9 **þ (6 *0' ~: Œ: (+€: ~: 8*>(5 8*&~; þ*~; *0€ þ8þ E˜‹ËçN6%ÒÎuï-mS¤© B}î8“ È(½D 8„ÿÿÿ"š÷ÕA 8sÿÿÿ( þ8^ÿÿÿ"ܬÂB 8Qÿÿÿ h(é 8;ÿÿÿ þ8&ÿÿÿ8 8ÿÿÿ î(½D (ê:ùþÿÿ& 8îþÿÿG 8àþÿÿ"‰©¦B8Pÿÿÿ ¾(é (ê:¸þÿÿ&8®þÿÿ ø(é 8œþÿÿ8Yÿÿÿ8*ÿÿÿ32 þ8vþÿÿ8²Y-8°"-f A 8Xþÿÿ"ä A08fa38cÿÿÿ Ø(½D%8v ¦(½D'8¼X+8¢ 0(é/8”þÿÿ ®(é8Dÿÿÿ 8#8G!8’ÿÿÿ ”(½D8Šÿÿÿ B(½D8 ÿÿÿ.*8Ãþÿÿ (ë9Ÿýÿÿ&8•ýÿÿ$8¡*8/ÿÿÿ ð(½D8^ÿÿÿ (½D)8Dþÿÿ 8<ÿÿÿ"Á½B, 8Lýÿÿ" 8>ýÿÿ"@ :B (ë9(ýÿÿ&8ýÿÿ"õÝHB 8ýÿÿ T(é& 8ûüÿÿ"'§@8cþÿÿP (ë:Üüÿÿ& 8Ñüÿÿ"#·:A 8Àüÿÿ*8zÿÿÿ 8ýÿÿ ª(½D8±þÿÿ1 8’üÿÿ0±8ìþ 3E<Ë cöH{•²+REþˆì³ä87F1 (ë9‹ÿÿÿ&8ÿÿÿ  (½D8… (é- 8^ÿÿÿ* 8Qÿÿÿ"8 2(é (ê:.ÿÿÿ&8$ÿÿÿ 8ÿÿÿ 8h8¹H(8G p(é#8d=2 (ê:Þþÿÿ&8Ôþÿÿ æ(é (ê:½þÿÿ&8³þÿÿ"Ʉ£B8R (ë:˜þÿÿ& 8þÿÿ!8æþÿÿ"¸oö@8vÿÿÿ"lª­B.8Â8ßþÿÿ3,8ïÿÿÿ58Ê>0 þ38<þÿÿ"gl@ (ë9*þÿÿ&8 þÿÿ"žX¶B8¿ 8šþÿÿL! (ê9ûýÿÿ& 8ðýÿÿ8q"¦ÎUB8"føâ@'8² Ä(½D%8[ÿÿÿB þ38©ýÿÿ 81"ôãÇB8Q"¢34A (ê:ƒýÿÿ& 8xýÿÿ  (é)8Å+/ 8Yýÿÿ B(½D8`ÿÿÿ"…l€A (ê:2ýÿÿ&8(ýÿÿE 8ýÿÿ$8 þÿÿ81 (ê9úüÿÿ& 8ïüÿÿ/ 8áüÿÿ
request_handle: 0x00cc000c
1 1 0

InternetReadFile

buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ÌPJˆr>ˆr>ˆr>Ó=†r>Ó;(r>]:šr>]=žr>];ýr>Ó:œr>Ó?›r>ˆr?^r>7‰r>Á‰r><‰r>Richˆr>PEL‚àmfà ÌDô @@l#È°àÀ MP±8,²ˆ±@ (.textZ `.rdata¼ @@.dataìe@4@À.rsrcà°R@@.reloc MÀNT@BhðßDè¤áYÃÌÌÌÌhßDè”áYÃÌÌÌÌj h ¢E¹$LFè/‹hPàDèsáYÃÌÌÌj hÄ¢E¹ÜQFè‹h°àDèSáYÃÌÌÌjhè¢E¹lRFèïŠháDè3áYÃÌÌÌj hð¢E¹MFèϊhpáDèáYÃÌÌÌjh£E¹”QF诊hÐáDèóàYÃÌÌÌjh,£E¹LKF菊h0âDèÓàYÃÌÌÌjh«¡E¹<RFèoŠhâDè³àYÃÌÌÌjh«¡E¹œRFèOŠhðâDè“àYÃÌÌÌjh«¡E¹,MFè/ŠhPãDèsàYÃÌÌÌjh«¡E¹ìJFèŠh°ãDèSàYÃÌÌÌjhL£E¹ÜKFèï‰häDè3àYÃÌÌÌjhX£E¹UFèωhpäDèàYÃÌÌÌjhd£E¹$RF诉hÐäDèóßYÃÌÌÌjhp£E¹DJF菉h0åDèÓßYÃÌÌÌjh|£E¹ÄQFèo‰håDè³ßYÃÌÌÌjh£E¹¼MFèO‰hðåDè“ßYÃÌÌÌjDh¨£E¹ÀTFè/‰hPæDèsßYÃÌÌÌj\hð£E¹ÌLFè‰h°æDèSßYÃÌÌÌj hP¤E¹ÔMFèïˆhçDè3ßYÃÌÌÌjh`¤E¹äIFèψhpçDèßYÃÌÌÌjhh¤E¹äOF诈hÐçDèóÞYÃÌÌÌj<h„¤E¹´IF菈h0èDèÓÞYÃÌÌÌj hĤE¹œIFèoˆhèDè³ÞYÃÌÌÌj hÔ¤E¹PUFèOˆhðèDè“ÞYÃÌÌÌjXhè¤E¹¬NFè/ˆhPéDèsÞYÃÌÌÌjhD¥E¹hUFèˆh°éDèSÞYÃÌÌÌjh\¥E¹,SFèï‡hêDè3ÞYÃÌÌÌjhh¥E¹¨TFèχhpêDèÞYÃÌÌÌjht¥E¹¼JF诇hÐêDèóÝYÃÌÌÌjh|¥E¹´OF菇h0ëDèÓÝYÃÌÌÌjh„¥E¹ŒPFèo‡hëDè³ÝYÃÌÌÌjhŒ¥E¹QFèO‡hðëDè“ÝYÃÌÌÌjh”¥E¹JFè/‡hPìDèsÝYÃÌÌÌjhœ¥E¹ÌRFè‡h°ìDèSÝYÃÌÌÌjh¤¥E¹ÜNFèï†híDè3ÝYÃÌÌÌjh¬¥E¹DPFèφhpíDèÝYÃÌÌÌjh´¥E¹lOF识hÐíDèóÜYÃÌÌÌjh¼¥E¹xTF菆h0îDèÓÜYÃÌÌÌjhÄ¥E¹ìPFèo†hîDè³ÜYÃÌÌÌjhÌ¥E¹8UFèO†hðîDè“ÜYÃÌÌÌjhÔ¥E¹TRFè/†hPïDèsÜYÃÌÌÌjhÜ¥E¹¤JFè†h°ïDèSÜYÃÌÌÌjhä¥E¹ÔJFèï…hðDè3ÜYÃÌÌÌjh¦E¹NFèυhpðDèÜYÃÌÌÌjh¦E¹˜UF诅hÐðDèóÛYÃÌÌÌjh¦E¹¼SF菅h0ñDèÓÛYÃÌÌÌjh¦E¹ÄKFèo…hñDè³ÛYÃÌÌÌj h$¦E¹ÈUFèO…hðñDè“ÛYÃÌÌÌj h4¦E¹KFè/…hPòDèsÛYÃÌÌÌjhD¦E¹dNFè…h°òDèSÛYÃÌÌÌjhL¦E¹¬KFèï„hóDè3ÛYÃÌÌÌjhT¦E¹´LFèτhpóDèÛYÃÌÌÌjh\¦E¹ÄNF评hÐóDèóÚYÃÌÌÌjhd¦E¹ LF菄h0ôDèÓÚYÃÌÌÌjhl¦E¹dQFèo„hôDè³ÚYÃÌÌÌj ht¦E¹|QFèO„hðôDè“ÚYÃÌÌÌjh„¦E¹LNFè/„hPõDèsÚYÃÌÌÌjhŒ¦E¹\JFè„h°õDèSÚYÃÌÌÌjh”¦E¹ÔSFèïƒhöDè3ÚYÃÌÌÌjhœ¦E¹SFèσhpöDèÚYÃÌÌÌjh¨¦E¹4NF诃hÐöDèóÙYÃÌÌÌjh°¦E¹ðTF菃h0÷DèÓÙYÃÌÌÌjhĦE¹NFèoƒh÷Dè³ÙYÃÌÌÌjhئE¹TFèOƒhð÷Dè“ÙYÃÌÌÌjhø¦E¹tMFè/ƒhPøDèsÙYÃÌÌÌjh §E¹<LFèƒh°øDèSÙYÃÌÌÌjh$§E¹¬QFèï‚hùDè3ÙYÃÌÌÌjh0§E¹TOFèςhpùDèÙYÃÌÌÌjhH§E¹àUF诂hÐùDèóØYÃÌÌÌjhT§E¹TF菂h0úDèÓØYÃÌÌÌjhl§E¹,JFèo‚húDè³ØYÃÌÌÌjh€§E¹üLFèO‚hðúDè“ØYÃÌÌÌjhˆ§E¹ôNFè/‚hPûDèsØYÃÌÌÌjh¤§E¹„LFè‚h°ûDèSØYÃÌÌÌjh¸§E¹|NFèïhüDè3ØYÃÌÌÌjhħE¹üOFèρhpüDèØYÃÌÌÌjhЧE¹¤SF证hÐüDèó×YÃÌÌÌjhܧE¹”NF菁h0ýDèÓ×YÃÌÌÌjhð§E¹ØTFèohýDè³×YÃÌÌÌjh¨E¹°UFèOhðýDè“×YÃÌÌÌjh ¨E¹„RFè/hPþDès×YÃÌÌÌj@h¨E¹\MFèh°þDèS×YÃÌÌÌjh\¨E¹ÌOFèï€hÿDè3×YÃÌÌÌjLhh¨E¹$OFèπhpÿDè×YÃÌÌÌj<h¸¨E¹dKF诀hÐÿDèóÖYÃÌÌÌj hø¨E¹4QF菀h0EèÓÖYÃÌÌÌjh©E¹œOFèo€hEè³ÖYÃÌÌÌjh©E¹ OFèO€hðEè“ÖYÃÌÌÌjh ©E¹LQFè/€hPEèsÖYÃÌÌÌj@h0©E¹üIFè€h°EèSÖYÃÌÌÌjPhx©E¹ UFèïhEè3ÖYÃÌÌÌjhÌ©E¹tJFèÏhpEèÖYÃÌÌÌj4hà©E¹ŒSFè¯hÐEèóÕYÃÌÌÌj hªE¹ìMFèh0EèÓÕYÃÌÌÌjPh(ªE¹TLFèohEè³ÕYÃÌÌÌ
request_handle: 0x00cc000c
1 1 0

InternetReadFile

buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEd† ç¹mfð. )®î«ö@€­œ` P€(å©(p­”@ã(hS.text¸¬®``.dataÀ²@À.rdataP+Ð,´@@.eh_framà@À.pdata( â@@.xdataø  ì@@.bss0€À.idataPö@À.CRT``@À.tlsp@À.rsrc(婀æ© @@.reloc”p­ð«@BUH‰åH‰MH‰UL‰E D‰M(]ÃUH‰åHƒì èT‰öH‹Ú‹…Àt ¹èO©ë ¹èC©èÞ H‹7Û‹‰èÞ H‹Û‹‰è¾2H‹gÙ‹ƒøuH‹)ÛH‰ÁèË;¸HƒÄ ]ÃUH‰åHƒì0H‹Û‹‰wH‹ÈÚ‹HgH‰D$ A‰ÑL@H1H‰ÂH#H‰Áè·¨‰)HƒÄ0]ÃUH‰åHƒì0ÇEüÿH‹¤ÙÇè=‰Eü‹EüHƒÄ0]ÃUH‰åHƒì0ÇEüÿH‹uÙÇè‰Eü‹EüHƒÄ0]ÃUH‰åHƒìpHÇEðÇEä0‹EäeH‹H‰EØH‹EØH‹@H‰EèÇEüë!H‹EðH;Eèu ÇEüëE¹èH‹CÿÐH‹MÙH‰EÐH‹EèH‰EÈHÇEÀH‹MÈH‹EÀH‹UÐðH± H‰EðHƒ}ðu¨H‹&Ù‹ƒøu ¹è­§ë?H‹ Ù‹…Àu(H‹ÿØÇH‹BÙH‰ÂH‹(ÙH‰Á萧ë ÇèH‹ÍØ‹ƒøu&H‹ïØH‰ÂH‹ÕØH‰Áè]§H‹¦Øǃ}üuH‹ƒØH‰E¸HÇE°H‹U°H‹E¸H‡H‹•×H‹H…ÀtH‹†×H‹A¸º¹ÿÐè„8H‹ÕØH‰ÁH‹ËAÿÐH‹ØH‰HýÿÿH‰Á耟èK0‹ H‰Áèsè©,H‹[×H‹H‹ñH‰H‹ çH‹Ø‹ÎI‰È‰Áè ,‰Ö‹Ô…Àu ‹Æ‰Á諦‹Á…ÀuèD¦‹ªHƒÄp]ÃUH‰åHƒì H‹9×ÇH‹<×ÇH‹?×ÇH‹¢ÖH‰EøH‹Eø·f=MZt ¸é­H‹Eø‹@<HcÐH‹EøHÐH‰EðH‹Eð‹=PEt ¸éH‹EðHƒÀH‰EèH‹Eè··À= t = t)ëVH‹Eè‹@\ƒøw¸ëHH‹E苀ЅÀ•À¶Àë4H‹EèH‰EàH‹Eà‹@lƒøw¸ëH‹Eà‹€à…À•À¶Àë¸HƒÄ ]ÃUSHƒìHHl$@‰M H‰U(‹E ƒÀH˜HÁàH‰Á薥H‰EðH‹E(H‹H‰EèÇEü鏋EüH˜HÅH‹EèHÐH‹H‰Á謥HƒÀHÀH‰Eà‹EüH˜HÅH‹EðHH‹EàH‰Áè0¥H‰‹EüH˜HÅH‹EèHÐH‹‹EüH˜H ÅH‹EðHÈH‹H‹MàI‰ÈH‰Á襃Eü‹Eü;E Œeÿÿÿ‹EüH˜HÅH‹EðHÐHÇH‹E(H‹UðH‰HƒÄH[]ÃUH‰åHƒì H‰MH‹EH‰Áè2¤H…Àt¸ë¸ÿÿÿÿHƒÄ ]АÃff.„@1ÀÃff.„fUWVSHƒì(Hl$ H5 ºH‰ñÿ>H‰ÃH…ÀtkH‰ñÿR>H‹=>H÷¹H‰ÙH‰ÿ×Hú¹H‰ÙH‰Æÿ×H‰©H…ötHH ¯éÿÖH 6HƒÄ([^_]éÿÿÿf„HYÿÿÿH5BÿÿÿH‰{©ë¼f„UH‰åHƒì H‹a©H…Àt H UéÿÐH‹ ŒH…ÉtHƒÄ ]Hÿ%û<HƒÄ ]Аf.„fDUWVSHºÅgV/ëÔ'I‰ÊHI(E‹JHM‹BM‹IÉLÂIƒû†­I‹ZI‹RH¿OëÔ'=®²ÂI‹B H‰ÞH¯ßH‰ÕHÑÂHÁÆH¯ïHòL‰ÆHÁÆ L¯ÇHòH‰ÆHÁÅHÁÆH¯ÇHòIÁÀH¾‡Ê녱y7žH¯îL¯ÆH1êH‰ÝH»c®²ÂwÊë…H¯ÖHÁÅH¯îHÚH1êH¯ÖHÚI1ÐH‰ÂL¯ÆHÁÂH¯ÖIH1ÂH¯ÖHÚIr0LÚI9ñr`H»OëÔ'=®²ÂH‰ñI¸‡Ê녱y7žI»c®²ÂwÊë…fDH‹AøHƒÁH¯ÃHÁÀI¯ÀH1ÐHÁÀI¯ÀJI9ÉsØL‰ÈL)ÐHHÐHƒáøHñLAM9Ár5‹H¹‡Ê녱y7žH¯ÁL‰ÁH1ÐHºOëÔ'=®²ÂHÁÀH¯ÂHºùy7ž±gVHÂL9És2IºÅgV/ëÔ'I¸‡Ê녱y7ž¶HƒÁI¯ÂH1ÐHÁÀ I¯ÀH‰ÂI9ÉuâH‰ÐHÁè!H1ÐHºOëÔ'=®²ÂH¯ÂH‰ÂHÁêH1ÐHºùy7ž±gVH¯ÂH‰ÂHÁê H1Ð[^_]ÃHƒì8L‰D$PLD$PL‰L$XL‰D$(è³=HƒÄ8Ãff.„Hƒì8L‰L$XLL$XL‰L$(èø=HƒÄ8ÃAWAVAUATUWVSL‹\$hA‹;I‰ÊI‰ÔM…É„=C¶DÿIƒùv1HÇÂÿÿÿÿ„À„â½Ð¸)ÐIƒùˆ‡%KtøH‹ë@HɶA¶Jc ‹HÙÿá@A¶HHÁá0HÊA¶HHÁá(HÊA¶HHÁá HÊA¶HHÁáHÊA¶HHÁáHÊA¶HHÁáHʄÀ„Q½È¸ L‰ÆD)ÈÁà)ÈÁïK,"MK@¶ÿMhLuý‰û÷ۃã?éÁfI9ð„?‰ÂH‰ñÁêA‰ÓL)ÙL9Á‚ÁâH‰Î)ÐH‹M9òƒ¬‰ÁI‰ÓIƒÂIÓã‰ÙIÓëK YD¶YD¶9AÃH‰ÐEˆzüD‰ÙHÓà‰ÙHÓèIA¶¶@DØAˆJýI‰Ó‰ÁIÓã‰ÙIÓëK YD¶YD¶9AÃH‰ÐEˆzþD‰ÙHÓà‰ÙHÓèIA¶¶@DØAˆJÿƒø@w!L9î‚8ÿÿÿ‰ÂƒàÁêH)ÖH‹M9ò‚UÿÿÿI9ês/÷߃ç?‰ÁI‰ÓIƒÂIÓã‰ùIÓëOYA¶ E¶[AˆJÿDØL9ÕuÖI9ðt4HÇÂìÿÿÿH‰Ð[^_]A\A]A^A_ÃH‰òL)‰ÑÁâH)Î)ÐH‹ë›I9êr˜L‰âƒø@uÄëÉf„HǸÿÿÿH‰Ð[^_]A\A]A^A_ÃL‰Êë¤@AVAUATUWVSL‹\$`A‹3H‰ÕM…É„BC¶DÿIƒùv6HÇÂÿÿÿÿ„À„ä½Ð¸)ÐIƒùˆ‡(K\
request_handle: 0x00cc000c
1 1 0

InternetReadFile

buffer: MZÿÿ¸@躴 Í!¸LÍ!This program cannot be run in DOS mode. $dgRF < < <Op—9<Op¢8<Op–w<)~¯#< =w<Op“!<Op¦!<Op¡!<Rich <PELhiºdà  >È0P@’Y¬v(€€‰Ôvps(s@P0.textÀ<> `.rdata¨-P.B@@.data€ö€$p@À.rsrc€‰€Š”@@V‹ñÇsDèøöD$tVè]Y‹Æ^á4ïÆÃUl$ˆì˜‹ƒep‰Eh¡ÐD‰…ìýÿÿ¡ÔDV‹s‰…èýÿÿWEpDžàýÿÿ¹y7žè¸ÿÿÿ¡ØDEp?‹=܏D‰…äýÿÿDžðýÿÿ ÇEôƒEô‹Eh‹ÈÁáäýÿÿ‰Mt‹ Eù©u ÇE@.ëíùëuƒ%Œ E‹MpȋEhÁè‰El‹ElÇ3Á3EtÇüEî=êô+ð‰El‹ÆÁà‰Et‹…ìýÿÿEt‹Mp‹ÆÁèΉEl‹…èýÿÿEl1Mt=E uhðqDjjÿ4PD‹El1Et‹Et)EhDž`ÿÿÿŒ²°UDž@ÿÿÿ—s·eDžPÿÿÿˆÃh<Džÿÿÿƒ6Džhÿÿÿ÷ BÇEÐæGÇE0ÆÄõ?DžLÿÿÿÐæŠLDžþÿÿü†2ÇE””uM6ÇEØqvbÇEdˆÒ£DžÔþÿÿüºwÇEԜ(×ÇE4²oRÇELàSkÇE´¦ß6XDžlÿÿÿåFoDžàþÿÿ«{\DžÜþÿÿ!ofÇE (ˀrDžÀþÿÿvtÅDž ÿÿÿÜ{gVDžÿÿÿiÚ¾?Džpÿÿÿl÷³ Dž ÿÿÿ@HDžðþÿÿhw€'ÇEfƒ·OÇE¼IQÝDž|ÿÿÿðdCZÇE8™ šdÇE¬ÿ7§DžXÿÿÿŒï°-ÇEܟ­"Dž(ÿÿÿ¶ò=yDžxÿÿÿ&†¬KDžÈþÿÿ}²ÇE@9Ë#:ÇEG«ÇEH.:àÇE †tDžôýÿÿccDžÌþÿÿŽaU"ÇET9[*DžTÿÿÿç/K ÇE€Å ôDžüþÿÿìwð=ÇEü`3ÇE<ÑâšÇEˆ«DDž þÿÿƒç‰IDž,ÿÿÿõ’íMÇEàý]+ÇEŽ -2ÇE6é¾hÇEè]sHDžÿÿÿ¢ÃÂIDž|þÿÿR‚ÇEP7Ð0DžÄþÿÿµZdrDž4ÿÿÿCoö Dž¼þÿÿ”>6cDžHÿÿÿ²5ÇE„nÙS?ÇEäÜÍ jDž\ÿÿÿ²å› ÇE˜±x[ÇE ¢S\sDžøþÿÿQí‰Džìþÿÿ2<8DžÐþÿÿi|QÇEX¬Gž#ÇE` ^(Džÿÿÿz;VDž¨þÿÿq>÷ÇEðxÜADž¤þÿÿF“PÇEœr÷JiÇEø¨5qDžüýÿÿސ€6Džxþÿÿ¤GoÇE¤ÕHÇE¨xy~ÇEٔºhÇEŒbÎR!Dž¸þÿÿtF@cÇEÄ$¾,hDžØþÿÿIjF_Dž<ÿÿÿ!#“WDž¬þÿÿó%zDždÿÿÿ Eð#ÇE$¿&>Dž„þÿÿ‹óZDžèþÿÿ´ÇE¤e|îDDž0ÿÿÿÀÃÁQÇE°£æ£"ÇE\.8\Džþÿÿ» nQDž´þÿÿdAñ1ÇE¸l‘î Dždþÿÿ6óìDžÿÿÿøié/Dž`þÿÿ¬ƒ[ÇE(u…pEDž$ÿÿÿÈAmÇEÀÎ/pxDžÿÿÿ:A|Dž þÿÿºN9ÇEÌ{{°}ÇEÈJÌØDžˆþÿÿQGKÇED`ú¼@Dž(þÿÿ²Nø#Džþÿÿª“fDžþÿÿäÈ)Dž$þÿÿ…~%Džøýÿÿ¾s6ÇE,Ãàl?DžDþÿÿ?Dž þÿÿ—·lcDžDÿÿÿ§3€+DžXþÿÿ·¼û4Dž4þÿÿRµ‰nDžLþÿÿ±1Dž”þÿÿ©à+DžtÿÿÿíYÇE–˜ÇEì.Džhþÿÿ¥¿GvDžTþÿÿX6ÓDžlþÿÿº• kDžäþÿÿz†P7DžpþÿÿR1œPDžÿÿÿs¢ *Dž8ÿÿÿ¹žÞfDžôþÿÿ:2Œ@DžHþÿÿÆ³>Džþÿÿ517ODžþÿÿ:OÎZDžþÿÿò{ ,Dž˜þÿÿ§ŸÂxDžœþÿÿÀmo Dž<þÿÿõ{‡IDžtþÿÿ«æ-,DžŒþÿÿŠ*R ÇEª‡YDž0þÿÿØWjDžPþÿÿ]GDž\þÿÿ륗.DžþÿÿÐÂDž€þÿÿ££(,Dž°þÿÿ–Ë/~Dž8þÿÿó r#Dž,þÿÿ¾žfDž@þÿÿQG²­`ÿÿÿ®}b¸ ™Î:÷¥`ÿÿÿ‹…`ÿÿÿ…`ÿÿÿ;Õºs…@ÿÿÿ)51…@ÿÿÿ!ÏD­@ÿÿÿÒjO­`ÿÿÿØÐj…`ÿÿÿ»˜}­`ÿÿÿ%¤=-¸i›Íy÷¥`ÿÿÿ‹…`ÿÿÿ…@ÿÿÿ9¥¾ ¸!¨a@÷¥@ÿÿÿ‹…@ÿÿÿ¸‡†žZ÷¥`ÿÿÿ‹…`ÿÿÿ¸'wËE÷¥`ÿÿÿ‹…`ÿÿÿ¸Õ_B*÷¥`ÿÿÿ‹…`ÿÿÿ­`ÿÿÿ£J¸ÑB¤G÷¥hÿÿÿ‹…hÿÿÿm0C1JZ­@ÿÿÿŸA…`ÿÿÿ£']¸"æ~÷¥Lÿÿÿ‹…Lÿÿÿ¸ë^÷¥`ÿÿÿ‹…`ÿÿÿ…ÿÿÿUXú+­hÿÿÿ„\ê|EÐcK*¸Zíë&÷¥Pÿÿÿ‹…Pÿÿÿ¸6=÷¥Pÿÿÿ‹…Pÿÿÿ¸ "·÷e؋E؁…ÿÿÿ½vÂ1­ÿÿÿSr±­`ÿÿÿû)Ï3…PÿÿÿCMâ¸!`og÷e0‹E0mÔß ê+…hÿÿÿßs£_¸P©N÷¥Ôþÿÿ‹…ÔþÿÿEd&/œx¸\;q(÷¥@ÿÿÿ‹…@ÿÿÿ¸þrˆ'÷¥Pÿÿÿ‹…Pÿÿÿ¸¥ô4/÷eL‹EL­Pÿÿÿ>¥˜m¸S'«;÷eԋEÔ¸Ÿ>Ä}÷e4‹E4¸%d%÷¥hÿÿÿ‹…hÿÿÿ…ÀþÿÿªóWl¸0&ef÷eԋEԁ…Pÿÿÿ’Y l…`ÿÿÿžj(¸Ä1u÷¥ÿÿÿ‹…ÿÿÿ…@ÿÿÿvhdc¸àZ!p÷e ‹E …ÔþÿÿÈ®w&…Pÿÿÿº_”¸}'Y÷¥hÿÿÿ‹…hÿÿÿE‰I”E %_ì+E ­¶äs¸©Ÿ)÷¥ ÿÿÿ‹… ÿÿÿ¸íüíl÷e8‹E8m8Ý LmLHŽ­ðþÿÿ=R—D¸ÔÆ©&÷e܋E܁…lÿÿÿ ŒStE ë"c…ÿÿÿè^þ1­xÿÿÿD6+¸S ¡T÷¥@ÿÿÿ‹…@ÿÿÿ…ÔþÿÿoþW­àþÿÿÖ Wu¸¿d}÷¥@ÿÿÿ‹…@ÿÿÿ¸“¹Js÷e¬‹E¬­xÿÿÿ’L„qE·Ï/1E´}3+mEçE´•ªX$¸‘­×#÷eԋEԁ­Üþÿÿ‚Õ3mÔÚfôFm¼gfd…(ÿÿÿdT4m´L0ß<­pÿÿÿýdõWEØóÒ/…ÔþÿÿµGc…ÀþÿÿL¶–J¸“‰ÅL÷e܋E܁mL”öz­àþÿÿŸ¼þ~m 4©&Eܬ½Ñ(¸ëm‚÷e¼‹E¼…`ÿÿÿg–MmHM„¸Í$P?÷¥hÿÿÿ‹…hÿÿÿ…xÿÿÿÏË[­xÿÿÿCõsP¸QÆAF÷¥Àþÿÿ‹…Àþÿÿmˆo'Eܹ?ÏG¸èªP÷¥Pÿÿÿ‹…Pÿÿÿ¸èUñ÷¥ÿÿÿ‹…ÿÿÿE€Ýa\…@ÿÿÿýK}E8®°%…lÿÿÿûá]…pÿÿÿ«;„6…Ìþÿÿ‚6Ç0mØPgK¸Ô›y÷e”‹E”¸ó-½!÷e¬‹E¬m0çƒç<m4?$ím4º¡b¸¦ïY,÷¥(ÿÿÿ‹…(ÿÿÿ…@ÿÿÿë724­`ÿÿÿ] S­ÿÿÿ D™Eèºy‚$¸4IIP÷¥ ÿÿÿ‹… ÿÿÿm¬iÃø_Eîdz4­hÿÿÿ¿…¡¸”Y£÷e@‹E@E42‘ÏX
request_handle: 0x00cc000c
1 1 0

InternetReadFile

buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEd†œÒ®eð" ’(@@0)`¨Ë<)ˆÐ(Œ )x °(´8@ÍX.textV’ `.rdataü"°$–@@.dataé'àÖ'º@À.pdataŒÐ((@@.00cfgà(’(@@.tlsð(”(@À.rsrcˆ)–(@@.relocx )¬(@BVHƒì H‹ ÇH‹ ÇH‹ ÇH‹ ՟·1ÀúMZuKHcQ<<PEu>HÑ·Qú tú u'ƒytr!HÁè냹„rHÁø1Àƒ9•ÀH‹ ŽŸƒ9‰¡£(¹ƒÙèŽH‹ٟ‹0è ‰0H‹¹Ÿ‹0èê‰0èƒH‹,Ÿƒ8u H è 1ÀHƒÄ ^ÃHƒì(H‹•Ÿ‹‰=£(H6£(H‹ oŸD‹ H‰D$ H $£(H!£(L"£(è}HƒÄ(ÀHƒì(H‹՞Çè HƒÄ(ÃfAWAVVWSHƒì eH‹%0H‹xH‹5ɞ1ÀðH±>”Ãt.H9Çt)L‹5Ù¼f„¹èAÿÖ1ÀðH±>”ÃtH9ÇuçH‹=ž‹ƒøu ¹èÿŒë'ƒ?t Æy¢(ëÇH‹ zžH‹{žèöŒ‹ƒøuH‹ PžH‹Qžè܌Ç„Ût1ÀH‡H‹æH‹H…Àt1ɺE1ÀÿÆÍ(è9H  ÿ¼H‹ åH‰H +è& èHc=Ρ(H ý蝌H‰ÆH…ÿ~G‰ûL‹5´¡(E1ÿf„K‹ þ藌HxH‰ùèkŒJ‰þK‹þH‰ÁI‰øèhŒIÿÇL9ûuÐë1ÛHÇÞH‰5e¡(èØH‹a¡(H‹ "H‹ H‰‹ B¡(H‹?¡(L‹@¡(è )‰A¡(ƒ=¡(t €=-¡(u 讋‹$¡(HƒÄ [_^A^A_ÉÁèŋÌ@Hƒì(H‹ŜÇèúýÿÿHƒÄ(ÃfHƒì(臋1ÉHƒøɉÈHƒÄ(ÄÃÌÌÌXH‰L$H‰T$L‰D$L‰L$ Hƒì(‹ MÌ舆‰NÌH1Éè*‰H‰CÌH1À‹6ÌHƒÄ(H‹L$H‹T$L‹D$L‹L$ I‰Ê ÌÿÌÿ5ÌÃÇòË’ èÿÿÿÇãËQ²?èrÿÿÿÇÔË= C}ècÿÿÿÇÅËÈ\%,èTÿÿÿǶËÅ$VèEÿÿÿǧ˲Śè6ÿÿÿǘË{ºÛ8è'ÿÿÿÇ‰Ë TñèÿÿÿÇzËhypüè ÿÿÿÇkËÁÜRÔèúþÿÿÇ\ËÑú_ÓèëþÿÿÇMË`4*ÞèÜþÿÿÇ>˃€èÍþÿÿÇ/˅’‡è¾þÿÿÇ ËǛ*éè¯þÿÿÇË]laàè þÿÿÇËËKÓàè‘þÿÿÇóÊُâè‚þÿÿÇäÊ>ÄèsþÿÿÇÕÊ£®~èdþÿÿÇÆÊ6™ÿ8èUþÿÿÇ·ÊëË?ìèFþÿÿǨÊn©™è7þÿÿÇ™Ê)?âè(þÿÿÇŠÊ5¥@dèþÿÿÇ{Êq¼²è þÿÿÇlʝµ¨èûýÿÿÇ]ÊìlÃèìýÿÿÇNÊ_ôèÝýÿÿÇ?ʄœÍ=èÎýÿÿÇ0Ê<]]Êè¿ýÿÿÇ!Ênö…†è°ýÿÿÇÊEÀ†”è¡ýÿÿÌÌÌÌÌÌÌÌÌÌÌÌÌHƒì(H‹ ÊH‹H…Àt.ffff.„ÿâÉ(H‹ëÉHHH‰ àÉH‹@H…ÀußHƒÄ(Ãf.„VWSHƒì H‹5:š‹ƒøÿu¸ÿÿÿÿfDHÿÀHƒ<Îuô…Àt%‰ÇHÿÏH‰û„H‹DþÿmÉ(Hÿ˅ÿH‰ßuëH TÿÿÿHƒÄ [_^é¸üÿÿ„VWSHƒì €=’(tHƒÄ [_^ÃƁ(H‹5²™‹ƒøÿu¸ÿÿÿÿfffff.„HÿÀHƒ<Îuô…Àt%‰ÇHÿÏH‰û„H‹DþÿÝÈ(Hÿ˅ÿH‰ßuëH ÄþÿÿHƒÄ [_^é(üÿÿÌÌÌÌÌÌÌÌ1ÀÃÌÌÌÌÌÌÌÌÌÌÌÌÌVWHƒì(H‹c™ƒ8tǃút<ƒúuAH5¿³H=¸³H9÷uë,f„HƒÇH9þtH‹H…ÀtïÿQÈ(ëçºè ¸HƒÄ(_^Ð1ÀÃffff.„Hƒì(ƒút…Òuèî¸HƒÄ(ÃÌÌÌÌVWHƒì8H‰Î‹ÿȃøwH˜H љHc<HÏëH=†™¹è[ L‹NFòN òL$0D$ Hk™H‰ÁI‰øè1‡1ÀHƒÄ8_^ÃÌÌÌÌÌÌÌÌÛãÃÌÌÌÌÌÌÌÌÌÌÌÌÌUAWAVAUATVWSHƒìHl$€=ü›(…mÆï›(Hƒì èn HƒÄ H˜H€HÅHƒàðè“ H)ÄH‰àH‰ƛ(Çě(H‹=ŚH‰øH+ÚHƒøŽH‹²šH‰øH)ØHƒø |,H‹Ÿšƒ;u/H‹“šƒ{u"H‹†šHX ƒxHE؃;u ƒ{„ÓH;\šsHL‹5«–Huffffff.„‹‹KB1Lñ‰EHƒì A¸H‰òèHƒÄ HƒÃH9ûrҋ›(…À~g¿H‹ìš(1ÛHuøL‹5¿´ëffff.„HÿÃHcÈHƒÇ(H9Ë}0D‹D:ðE…ÀtçH‹L:øH‹:Hƒì I‰ñAÿÖHƒÄ H‹™š(‹›š(ëÁHe[_^A\A]A^A_]ËSƒú…[HƒÃ H;y™ƒaÿÿÿL‹5ĕL=½—A¼‹HuøI½ÿÿÿÿëffffff.„HƒÃ H9ûƒ!ÿÿÿ‹KA‰ÈAàøAƒÀøA¬ÈAƒø‡×‹‹CLðN‹ 2Oc‡MúAÿâD¶M“ÿÿÿE„ÛëD·M“ÿÿfE…Ûë D‹O+E…ÛMIÓëL‹LòI)ÒMÊL‰Uø¶Ñƒú?w&IÇÃÿÿÿÿ‰ÑIÓãI÷ÓM9ÚLJÿIÇÃÿÿÿÿIÓãM9Ú|:Aƒø‡DÿÿÿE£Äƒ:ÿÿÿIcÈH0˜L‹ÊHƒì H‰ÁH‰òèMHƒÄ éÿÿÿHƒì0L‰T$ H —I‰Àè̶ÑHƒì H ؖè¹Hƒì H ––è©Ì„AWAVATVWSHƒìXL‰ÇH‰ÓH‰ÎD‹=ë˜(E…ÿ~GH‹ט(J ýH ‰1Òë€HƒÂ(H9Ñt#L‹DI9ðwíL‹L E‹IMÈI
request_handle: 0x00cc000c
1 1 0
section {u'size_of_data': u'0x0002dc00', u'virtual_address': u'0x00001000', u'entropy': 7.982905320316767, u'name': u' \\x00 ', u'virtual_size': u'0x00068000'} entropy 7.98290532032 description A section with a high entropy has been found
section {u'size_of_data': u'0x001a8e00', u'virtual_address': u'0x00324000', u'entropy': 7.953702179004272, u'name': u'fbxmxckk', u'virtual_size': u'0x001a9000'} entropy 7.953702179 description A section with a high entropy has been found
entropy 0.994190652231 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0
process system
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

RegOpenKeyExW

regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x000003e8
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

regkey_r: 7-Zip
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
1 0 0

RegOpenKeyExW

regkey_r: AddressBook
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
1 0 0

RegOpenKeyExW

regkey_r: Adobe AIR
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR
1 0 0

RegOpenKeyExW

regkey_r: Connection Manager
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
1 0 0

RegOpenKeyExW

regkey_r: DirectDrawEx
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
1 0 0

RegOpenKeyExW

regkey_r: EditPlus
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus
1 0 0

RegOpenKeyExW

regkey_r: Fontcore
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
1 0 0

RegOpenKeyExW

regkey_r: Google Chrome
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
1 0 0

RegOpenKeyExW

regkey_r: Haansoft HWord 80 Korean
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean
1 0 0

RegOpenKeyExW

regkey_r: IE40
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40
1 0 0

RegOpenKeyExW

regkey_r: IE4Data
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
1 0 0

RegOpenKeyExW

regkey_r: IE5BAKEX
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
1 0 0

RegOpenKeyExW

regkey_r: IEData
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData
1 0 0

RegOpenKeyExW

regkey_r: MobileOptionPack
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
1 0 0

RegOpenKeyExW

regkey_r: Mozilla Thunderbird 78.4.0 (x86 ko)
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)
1 0 0

RegOpenKeyExW

regkey_r: Office15.PROPLUSR
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR
1 0 0

RegOpenKeyExW

regkey_r: SchedulingAgent
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
1 0 0

RegOpenKeyExW

regkey_r: WIC
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC
1 0 0

RegOpenKeyExW

regkey_r: {00203668-8170-44A0-BE44-B632FA4D780F}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}
1 0 0

RegOpenKeyExW

regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
1 0 0

RegOpenKeyExW

regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}
1 0 0

RegOpenKeyExW

regkey_r: {26A24AE4-039D-4CA4-87B4-2F32180131F0}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}
1 0 0

RegOpenKeyExW

regkey_r: {4A03706F-666A-4037-7777-5F2748764D10}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}
1 0 0

RegOpenKeyExW

regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}
1 0 0

RegOpenKeyExW

regkey_r: {90150000-0015-0409-0000-0000000FF1CE}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90150000-0016-0409-0000-0000000FF1CE}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90150000-0018-0409-0000-0000000FF1CE}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90150000-0019-0409-0000-0000000FF1CE}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90150000-001A-0409-0000-0000000FF1CE}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90150000-001B-0409-0000-0000000FF1CE}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90150000-001F-0409-0000-0000000FF1CE}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90150000-001F-040C-0000-0000000FF1CE}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90150000-001F-0C0A-0000-0000000FF1CE}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90150000-002C-0409-0000-0000000FF1CE}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90150000-0044-0409-0000-0000000FF1CE}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90150000-006E-0409-0000-0000000FF1CE}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90150000-0090-0409-0000-0000000FF1CE}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90150000-00A1-0409-0000-0000000FF1CE}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90150000-00BA-0409-0000-0000000FF1CE}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90150000-00E1-0409-0000-0000000FF1CE}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90150000-00E2-0409-0000-0000000FF1CE}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90150000-0115-0409-0000-0000000FF1CE}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90150000-0117-0409-0000-0000000FF1CE}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90150000-012B-0409-0000-0000000FF1CE}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {91150000-0011-0000-0000-0000000FF1CE}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}
1 0 0

RegOpenKeyExW

regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}
1 0 0

RegOpenKeyExW

regkey_r: {AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}
1 0 0

RegOpenKeyExW

regkey_r: {BB8B979E-E336-47E7-96BC-1031C1B94561}
base_handle: 0x000003e8
key_handle: 0x000003f4
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}
1 0 0
host 185.172.128.116
host 185.172.128.19
host 185.215.113.67
host 77.91.77.81
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

process_identifier: 368
region_size: 364544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000248
1 0 0
file C:\ProgramData\AVAST Software
file C:\ProgramData\Avira
file C:\ProgramData\Kaspersky Lab
file C:\ProgramData\Panda Security
file C:\ProgramData\Bitdefender
file C:\ProgramData\AVG
file C:\ProgramData\Doctor Web
file \??\SICE
file \??\SIWVID
file \??\NTICE
Time & API Arguments Status Return Repeated

FindWindowA

class_name: OLLYDBG
window_name:
0 0

FindWindowA

class_name: GBDYLLO
window_name:
0 0

FindWindowA

class_name: pediy06
window_name:
0 0

FindWindowA

class_name: FilemonClass
window_name:
0 0

FindWindowA

class_name: FilemonClass
window_name:
0 0

FindWindowA

class_name: #0
window_name: File Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: PROCMON_WINDOW_CLASS
window_name:
0 0

FindWindowA

class_name: #0
window_name: Process Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: RegmonClass
window_name:
0 0

FindWindowA

class_name: RegmonClass
window_name:
0 0

FindWindowA

class_name: #0
window_name: Registry Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: 18467-41
window_name:
0 0

FindWindowA

class_name: FilemonClass
window_name:
0 0

FindWindowA

class_name: FilemonClass
window_name:
0 0

FindWindowA

class_name: #0
window_name: File Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: PROCMON_WINDOW_CLASS
window_name:
0 0

FindWindowA

class_name: #0
window_name: Process Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: OLLYDBG
window_name:
0 0

FindWindowA

class_name: GBDYLLO
window_name:
0 0

FindWindowA

class_name: pediy06
window_name:
0 0

FindWindowA

class_name: FilemonClass
window_name:
0 0

FindWindowA

class_name: FilemonClass
window_name:
0 0

FindWindowA

class_name: #0
window_name: File Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: PROCMON_WINDOW_CLASS
window_name:
0 0

FindWindowA

class_name: #0
window_name: Process Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: RegmonClass
window_name:
0 0

FindWindowA

class_name: RegmonClass
window_name:
0 0

FindWindowA

class_name: #0
window_name: Registry Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: 18467-41
window_name:
0 0

FindWindowA

class_name: FilemonClass
window_name:
0 0

FindWindowA

class_name: FilemonClass
window_name:
0 0

FindWindowA

class_name: #0
window_name: File Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: PROCMON_WINDOW_CLASS
window_name:
0 0

FindWindowA

class_name: #0
window_name: Process Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: OLLYDBG
window_name:
0 0

FindWindowA

class_name: GBDYLLO
window_name:
0 0

FindWindowA

class_name: pediy06
window_name:
0 0

FindWindowA

class_name: OLLYDBG
window_name:
0 0

FindWindowA

class_name: GBDYLLO
window_name:
0 0

FindWindowA

class_name: pediy06
window_name:
0 0

FindWindowA

class_name: Regmonclass
window_name:
0 0

FindWindowA

class_name: Regmonclass
window_name:
0 0

FindWindowA

class_name: OLLYDBG
window_name:
0 0

FindWindowA

class_name: GBDYLLO
window_name:
0 0

FindWindowA

class_name: pediy06
window_name:
0 0

FindWindowA

class_name: 18467-41
window_name:
0 0

FindWindowA

class_name: Filemonclass
window_name:
0 0

FindWindowA

class_name: Filemonclass
window_name:
0 0

FindWindowA

class_name: PROCMON_WINDOW_CLASS
window_name:
0 0

FindWindowA

class_name: OLLYDBG
window_name:
0 0
registry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion
file C:\Windows\Tasks\axplong.job
file C:\Windows\Tasks\Hkbsse.job
file C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
Time & API Arguments Status Return Repeated

WriteProcessMemory

buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELã_fà ¶À“@@…öx0„Sœ÷”.textrµ¶ `.rdata7*Ð,º@@.data0.šæ@À.reloc„S0T€@B
base_address: 0x00400000
process_identifier: 368
process_handle: 0x00000248
1 1 0

WriteProcessMemory

buffer: @
base_address: 0xfffde008
process_identifier: 368
process_handle: 0x00000248
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELã_fà ¶À“@@…öx0„Sœ÷”.textrµ¶ `.rdata7*Ð,º@@.data0.šæ@À.reloc„S0T€@B
base_address: 0x00400000
process_identifier: 368
process_handle: 0x00000248
1 1 0
Time & API Arguments Status Return Repeated

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 7-Zip 20.02 alpha
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe AIR
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: EditPlus
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Chrome
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 한컴오피스 한글 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Mozilla Thunderbird 78.4.0 (x86 ko)
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Professional Plus 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe AIR
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: HttpWatch Professional 9.3.39
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 한컴오피스 한글 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Java 8 Update 131
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Java Auto Updater
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Google Update Helper
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Access MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Excel MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft PowerPoint MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Publisher MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Outlook MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Word MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing Tools 2013 - English
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Outils de vérification linguistique 2013 de Microsoft Office - Français
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing Tools 2013 - Español
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft InfoPath MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft DCF MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft OneNote MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Groove MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office OSM MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office OSM UX MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared Setup Metadata MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Access Setup Metadata MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Lync MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Professional Plus 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Flash Player 13 ActiveX
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Flash Player 13 NPAPI
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Acrobat Reader DC MUI
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x000003f4
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName
1 0 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob
Process injection Process 2412 called NtSetContextThread to modify thread in remote process 368
Time & API Arguments Status Return Repeated

NtSetContextThread

registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4232128
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000244
process_identifier: 368
1 0 0
Process injection Process 2412 resumed a thread in remote process 368
Time & API Arguments Status Return Repeated

NtResumeThread

thread_handle: 0x00000244
suspend_count: 1
process_identifier: 368
1 0 0
Time & API Arguments Status Return Repeated

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: ed 64 8f 05 00 00 00 00 e9 40 17 00 00 ba ac e2
exception.symbol: random+0x1ff3a5
exception.instruction: in eax, dx
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 2093989
exception.address: 0x114f3a5
registers.esp: 2621140
registers.edi: 4730608
registers.eax: 1447909480
registers.ebp: 4006522900
registers.edx: 22104
registers.ebx: 1971327157
registers.esi: 18141970
registers.ecx: 20
1 0 0
Time & API Arguments Status Return Repeated

NtResumeThread

thread_handle: 0x000001e8
suspend_count: 1
process_identifier: 1696
1 0 0

CreateProcessInternalW

thread_identifier: 2264
thread_handle: 0x000003e0
process_identifier: 2260
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\Temp\8254624243\axplong.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\8254624243\axplong.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\8254624243\axplong.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000003dc
1 1 0

NtResumeThread

thread_handle: 0x000001a4
suspend_count: 1
process_identifier: 2260
1 0 0

CreateProcessInternalW

thread_identifier: 2764
thread_handle: 0x00000470
process_identifier: 2760
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\Temp\1000005001\judit.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\1000005001\judit.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\1000005001\judit.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000474
1 1 0

CreateProcessInternalW

thread_identifier: 2816
thread_handle: 0x00000448
process_identifier: 2812
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\Temp\1000007001\redline123123.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\1000007001\redline123123.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\1000007001\redline123123.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000488
1 1 0

CreateProcessInternalW

thread_identifier: 2924
thread_handle: 0x000003a0
process_identifier: 2920
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\Temp\1000008001\upd.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\1000008001\upd.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\1000008001\upd.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000484
1 1 0

CreateProcessInternalW

thread_identifier: 2976
thread_handle: 0x00000454
process_identifier: 2972
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\Temp\1000025001\setup222.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\1000025001\setup222.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\1000025001\setup222.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000494
1 1 0

CreateProcessInternalW

thread_identifier: 3064
thread_handle: 0x00000480
process_identifier: 3060
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\Temp\1000035001\gold.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\1000035001\gold.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\1000035001\gold.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x0000048c
1 1 0

CreateProcessInternalW

thread_identifier: 2196
thread_handle: 0x00000448
process_identifier: 792
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\Temp\1000047001\lummac2.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\1000047001\lummac2.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\1000047001\lummac2.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x0000049c
1 1 0

CreateProcessInternalW

thread_identifier: 948
thread_handle: 0x00000484
process_identifier: 2412
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\Temp\1000063001\drivermanager.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\1000063001\drivermanager.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\1000063001\drivermanager.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000004a0
1 1 0

CreateProcessInternalW

thread_identifier: 2868
thread_handle: 0x00000458
process_identifier: 2872
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\Temp\1000064001\NewLatest.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\1000064001\NewLatest.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\1000064001\NewLatest.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000004a8
1 1 0

CreateProcessInternalW

thread_identifier: 1200
thread_handle: 0x00000454
process_identifier: 2828
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\Temp\1000070001\monster.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\1000070001\monster.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\1000070001\monster.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000004ac
1 1 0

CreateProcessInternalW

thread_identifier: 2872
thread_handle: 0x0000000000000084
process_identifier: 2868
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\onefile_2760_133629768733125000\stub.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\1000005001\judit.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\onefile_2760_133629768733125000\stub.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
inherit_handles: 0
process_handle: 0x0000000000000088
1 1 0

NtResumeThread

thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2812
1 0 0

NtResumeThread

thread_handle: 0x00000150
suspend_count: 1
process_identifier: 2812
1 0 0

NtResumeThread

thread_handle: 0x00000194
suspend_count: 1
process_identifier: 2812
1 0 0

NtResumeThread

thread_handle: 0x000002cc
suspend_count: 1
process_identifier: 2812
1 0 0

NtResumeThread

thread_handle: 0x0000032c
suspend_count: 1
process_identifier: 2812
1 0 0

NtResumeThread

thread_handle: 0x000003ac
suspend_count: 1
process_identifier: 2812
1 0 0

NtResumeThread

thread_handle: 0x000003c8
suspend_count: 1
process_identifier: 2812
1 0 0

NtResumeThread

thread_handle: 0x000003e0
suspend_count: 1
process_identifier: 2812
1 0 0

NtResumeThread

thread_handle: 0x000003f8
suspend_count: 1
process_identifier: 2812
1 0 0

NtResumeThread

thread_handle: 0x00000414
suspend_count: 1
process_identifier: 2812
1 0 0

NtResumeThread

thread_handle: 0x00000430
suspend_count: 1
process_identifier: 2812
1 0 0

NtResumeThread

thread_handle: 0x00000468
suspend_count: 1
process_identifier: 2812
1 0 0

NtResumeThread

thread_handle: 0x0000056c
suspend_count: 1
process_identifier: 2812
1 0 0

NtResumeThread

thread_handle: 0x00000420
suspend_count: 1
process_identifier: 2812
1 0 0

NtResumeThread

thread_handle: 0x00000410
suspend_count: 1
process_identifier: 2812
1 0 0

NtResumeThread

thread_handle: 0x000003dc
suspend_count: 1
process_identifier: 2812
1 0 0

NtGetContextThread

thread_handle: 0x000000e0
1 0 0

NtGetContextThread

thread_handle: 0x000000e0
1 0 0

NtResumeThread

thread_handle: 0x000000e0
suspend_count: 1
process_identifier: 2812
1 0 0

NtResumeThread

thread_handle: 0x000003b8
suspend_count: 1
process_identifier: 2812
1 0 0

NtResumeThread

thread_handle: 0x00000294
suspend_count: 1
process_identifier: 2812
1 0 0

NtResumeThread

thread_handle: 0x00000538
suspend_count: 1
process_identifier: 2812
1 0 0

NtResumeThread

thread_handle: 0x00000698
suspend_count: 1
process_identifier: 2812
1 0 0

NtResumeThread

thread_handle: 0x00000000000004cc
suspend_count: 1
process_identifier: 2972
1 0 0

NtResumeThread

thread_handle: 0x00000000000004ec
suspend_count: 1
process_identifier: 2972
1 0 0

NtResumeThread

thread_handle: 0x0000000000000508
suspend_count: 1
process_identifier: 2972
1 0 0

NtResumeThread

thread_handle: 0x0000000000000504
suspend_count: 1
process_identifier: 2972
1 0 0

NtResumeThread

thread_handle: 0x0000000000000508
suspend_count: 1
process_identifier: 2972
1 0 0

NtResumeThread

thread_handle: 0x000000000000054c
suspend_count: 1
process_identifier: 2972
1 0 0

NtResumeThread

thread_handle: 0x000000000000054c
suspend_count: 1
process_identifier: 2972
1 0 0

NtResumeThread

thread_handle: 0x0000000000000538
suspend_count: 1
process_identifier: 2972
1 0 0

NtResumeThread

thread_handle: 0x000000000000054c
suspend_count: 1
process_identifier: 2972
1 0 0

NtResumeThread

thread_handle: 0x0000000000000570
suspend_count: 1
process_identifier: 2972
1 0 0

NtResumeThread

thread_handle: 0x000000000000056c
suspend_count: 1
process_identifier: 2972
1 0 0

NtResumeThread

thread_handle: 0x0000000000000568
suspend_count: 1
process_identifier: 2972
1 0 0

NtResumeThread

thread_handle: 0x00000000000004f0
suspend_count: 1
process_identifier: 2972
1 0 0

NtResumeThread

thread_handle: 0x0000000000000274
suspend_count: 1
process_identifier: 2972
1 0 0
Bkav W32.AIDetectMalware
Lionic Virus.Generic.AI.1!c
tehtris Generic.Malware
Cynet Malicious (score: 99)
Skyhigh BehavesLike.Win32.Generic.tc
ALYac Trojan.GenericKDZ.107415
Cylance Unsafe
VIPRE Trojan.GenericKDZ.107415
BitDefender Trojan.GenericKDZ.107415
Arcabit Trojan.Generic.D1A397
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Packed.Themida.HZB
APEX Malicious
Avast Win32:TrojanX-gen [Trj]
Kaspersky HEUR:Trojan.Win32.Generic
MicroWorld-eScan Trojan.GenericKDZ.107415
Rising Stealer.RisePro!8.176E1 (TFE:2:IW4ctOC6JVQ)
Emsisoft Trojan.GenericKDZ.107415 (B)
F-Secure Trojan.TR/Crypt.TPM.Gen
McAfeeD Real Protect-LS!0F2C5D3966F2
Trapmine malicious.high.ml.score
FireEye Generic.mg.0f2c5d3966f262c0
Sophos Generic ML PUA (PUA)
Avira TR/Crypt.TPM.Gen
MAX malware (ai score=80)
Gridinsoft Trojan.Heur!.038120A1
Microsoft Trojan:Win32/Sabsik.RD.A!ml
ZoneAlarm HEUR:Trojan.Win32.Generic
GData Trojan.GenericKDZ.107415
AhnLab-V3 Trojan/Win.Generic.R645974
BitDefenderTheta Gen:NN.ZexaF.36806.2DWaaWlJZHei
DeepInstinct MALICIOUS
VBA32 TScope.Malware-Cryptor.SB
Malwarebytes Trojan.Amadey
Zoner Probably Heur.ExeHeaderL
Tencent Trojan-DL.Win32.Deyma.kh
SentinelOne Static AI - Malicious PE
MaxSecure Win.MxResIcn.Heur.Gen
Fortinet W32/Themida.HZB!tr
AVG Win32:TrojanX-gen [Trj]