popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

chart.exe

Gen1 Generic Malware Malicious Library UPX Malicious Packer AntiDebug PE File OS Processor Check PE32 AntiVM DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us July 17, 2024, 9:02 a.m. July 17, 2024, 9:04 a.m.
Size 1.1MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 73aa6448467db3d1ac25f7e9d8cf1cd4
SHA256 931076586d551cccba6532aeb6393cc64ab293035c582125ef32e7eb82e3b0e5
CRC32 CEFD9173
ssdeep 24576:tUFuDtv4dsn0Ff5qI/z8L642KlCWZr9zs7wKztmZ7RGP3Wg+8o:tvDtvnn0R5h3cLZ9smNR0W4o
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
77.91.77.81 Active Moloch
85.28.47.30 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 85.28.47.30:80 -> 192.168.56.103:49162 2400008 ET DROP Spamhaus DROP Listed Traffic Inbound group 9 Misc Attack
TCP 192.168.56.103:49162 -> 85.28.47.30:80 2044243 ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in Malware Command and Control Activity Detected
TCP 192.168.56.103:49162 -> 85.28.47.30:80 2044244 ET MALWARE Win32/Stealc Requesting browsers Config from C2 Malware Command and Control Activity Detected
TCP 85.28.47.30:80 -> 192.168.56.103:49162 2051828 ET MALWARE Win32/Stealc Active C2 Responding with browsers Config M1 Malware Command and Control Activity Detected
TCP 192.168.56.103:49162 -> 85.28.47.30:80 2044246 ET MALWARE Win32/Stealc Requesting plugins Config from C2 Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 85.28.47.30:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 85.28.47.30:80 2044303 ET HUNTING HTTP GET Request for freebl3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 85.28.47.30:80 -> 192.168.56.103:49162 2051831 ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 Malware Command and Control Activity Detected
TCP 192.168.56.103:49162 -> 85.28.47.30:80 2044248 ET MALWARE Win32/Stealc Submitting System Information to C2 Malware Command and Control Activity Detected
TCP 192.168.56.103:49162 -> 85.28.47.30:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49162 -> 85.28.47.30:80 2044301 ET HUNTING HTTP GET Request for sqlite3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 85.28.47.30:80 -> 192.168.56.103:49165 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 85.28.47.30:80 -> 192.168.56.103:49165 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 85.28.47.30:80 -> 192.168.56.103:49162 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 85.28.47.30:80 -> 192.168.56.103:49162 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 85.28.47.30:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 85.28.47.30:80 2044302 ET HUNTING HTTP GET Request for mozglue.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 85.28.47.30:80 -> 192.168.56.103:49165 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 85.28.47.30:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 85.28.47.30:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 85.28.47.30:80 2044305 ET HUNTING HTTP GET Request for nss3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 192.168.56.103:49165 -> 85.28.47.30:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 85.28.47.30:80 2044306 ET HUNTING HTTP GET Request for softokn3.dll - Possible Infostealer Activity A suspicious filename was detected
TCP 192.168.56.103:49165 -> 85.28.47.30:80 2027250 ET INFO Dotted Quad Host DLL Request Potentially Bad Traffic
TCP 192.168.56.103:49165 -> 85.28.47.30:80 2044307 ET HUNTING HTTP GET Request for vcruntime140.dll - Possible Infostealer Activity A suspicious filename was detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Access is denied.
console_handle: 0x0000000b
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section
section .data\x00Th
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
chart+0x3b0167 @ 0x1000167
chart+0x3bfdd5 @ 0x100fdd5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f7224
exception.instruction: ud2
exception.module: chart.exe
exception.exception_code: 0xc000001d
exception.offset: 3109412
exception.address: 0xf47224
registers.esp: 3866212
registers.edi: 17772784
registers.eax: 0
registers.ebp: 3866240
registers.edx: 2
registers.ebx: 652864531
registers.esi: 15253504
registers.ecx: 10565500
1 0 0

__exception__

 stacktrace: 
chart+0x3b0167 @ 0x1000167
chart+0x3bfdd5 @ 0x100fdd5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: f7 f0 e8 38 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f71f9
exception.instruction: div eax
exception.module: chart.exe
exception.exception_code: 0xc0000094
exception.offset: 3109369
exception.address: 0xf471f9
registers.esp: 3866212
registers.edi: 3866212
registers.eax: 0
registers.ebp: 3866240
registers.edx: 0
registers.ebx: 16020026
registers.esi: 0
registers.ecx: 3866248
1 0 0

__exception__

 stacktrace: 
chart+0x3b0167 @ 0x1000167
chart+0x3bfdd5 @ 0x100fdd5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: f7 f0 e8 38 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f71f9
exception.instruction: div eax
exception.module: chart.exe
exception.exception_code: 0xc0000094
exception.offset: 3109369
exception.address: 0xf471f9
registers.esp: 3866212
registers.edi: 3866212
registers.eax: 0
registers.ebp: 3866240
registers.edx: 0
registers.ebx: 16019983
registers.esi: 0
registers.ecx: 3866248
1 0 0

__exception__

 stacktrace: 
chart+0x3b0167 @ 0x1000167
chart+0x3bfdd5 @ 0x100fdd5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f7224
exception.instruction: ud2
exception.module: chart.exe
exception.exception_code: 0xc000001d
exception.offset: 3109412
exception.address: 0xf47224
registers.esp: 3866212
registers.edi: 3866212
registers.eax: 0
registers.ebp: 3866240
registers.edx: 2
registers.ebx: 16019983
registers.esi: 0
registers.ecx: 3866248
1 0 0

__exception__

 stacktrace: 
chart+0x3b0167 @ 0x1000167
chart+0x3bfdd5 @ 0x100fdd5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f7224
exception.instruction: ud2
exception.module: chart.exe
exception.exception_code: 0xc000001d
exception.offset: 3109412
exception.address: 0xf47224
registers.esp: 3866212
registers.edi: 3866212
registers.eax: 0
registers.ebp: 3866240
registers.edx: 2
registers.ebx: 16020026
registers.esi: 0
registers.ecx: 3866248
1 0 0

__exception__

 stacktrace: 
chart+0x3b0167 @ 0x1000167
chart+0x3bfdd5 @ 0x100fdd5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: f7 f0 e8 38 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f71f9
exception.instruction: div eax
exception.module: chart.exe
exception.exception_code: 0xc0000094
exception.offset: 3109369
exception.address: 0xf471f9
registers.esp: 3866212
registers.edi: 3866212
registers.eax: 0
registers.ebp: 3866240
registers.edx: 0
registers.ebx: 16020026
registers.esi: 0
registers.ecx: 3866248
1 0 0

__exception__

 stacktrace: 
chart+0x3b3446 @ 0x1003446
chart+0x3bfde5 @ 0x100fde5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f7224
exception.instruction: ud2
exception.module: chart.exe
exception.exception_code: 0xc000001d
exception.offset: 3109412
exception.address: 0xf47224
registers.esp: 3866140
registers.edi: 16568816
registers.eax: 0
registers.ebp: 3866168
registers.edx: 2
registers.ebx: 11059200
registers.esi: 15253504
registers.ecx: 15253504
1 0 0

__exception__

 stacktrace: 
chart+0x3b3446 @ 0x1003446
chart+0x3bfde5 @ 0x100fde5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: f7 f0 e8 38 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f71f9
exception.instruction: div eax
exception.module: chart.exe
exception.exception_code: 0xc0000094
exception.offset: 3109369
exception.address: 0xf471f9
registers.esp: 3866140
registers.edi: 3866140
registers.eax: 0
registers.ebp: 3866168
registers.edx: 0
registers.ebx: 16020026
registers.esi: 0
registers.ecx: 3866176
1 0 0

__exception__

 stacktrace: 
chart+0x3b3446 @ 0x1003446
chart+0x3bfde5 @ 0x100fde5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f7224
exception.instruction: ud2
exception.module: chart.exe
exception.exception_code: 0xc000001d
exception.offset: 3109412
exception.address: 0xf47224
registers.esp: 3866140
registers.edi: 3866140
registers.eax: 0
registers.ebp: 3866168
registers.edx: 2
registers.ebx: 16019983
registers.esi: 0
registers.ecx: 3866176
1 0 0

__exception__

 stacktrace: 
chart+0x3b3446 @ 0x1003446
chart+0x3bfde5 @ 0x100fde5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f7224
exception.instruction: ud2
exception.module: chart.exe
exception.exception_code: 0xc000001d
exception.offset: 3109412
exception.address: 0xf47224
registers.esp: 3866140
registers.edi: 3866140
registers.eax: 0
registers.ebp: 3866168
registers.edx: 2
registers.ebx: 16020026
registers.esi: 0
registers.ecx: 3866176
1 0 0

__exception__

 stacktrace: 
chart+0x3b3446 @ 0x1003446
chart+0x3bfde5 @ 0x100fde5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: f7 f0 e8 38 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f71f9
exception.instruction: div eax
exception.module: chart.exe
exception.exception_code: 0xc0000094
exception.offset: 3109369
exception.address: 0xf471f9
registers.esp: 3866140
registers.edi: 3866140
registers.eax: 0
registers.ebp: 3866168
registers.edx: 0
registers.ebx: 16020026
registers.esi: 0
registers.ecx: 3866176
1 0 0

__exception__

 stacktrace: 
chart+0x3b36f5 @ 0x10036f5
chart+0x3bfde5 @ 0x100fde5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f7224
exception.instruction: ud2
exception.module: chart.exe
exception.exception_code: 0xc000001d
exception.offset: 3109412
exception.address: 0xf47224
registers.esp: 3866140
registers.edi: 16568816
registers.eax: 0
registers.ebp: 3866168
registers.edx: 2
registers.ebx: 11059200
registers.esi: 15253504
registers.ecx: 167680307
1 0 0

__exception__

 stacktrace: 
chart+0x3b36f5 @ 0x10036f5
chart+0x3bfde5 @ 0x100fde5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f7224
exception.instruction: ud2
exception.module: chart.exe
exception.exception_code: 0xc000001d
exception.offset: 3109412
exception.address: 0xf47224
registers.esp: 3866140
registers.edi: 3866140
registers.eax: 0
registers.ebp: 3866168
registers.edx: 2
registers.ebx: 16020026
registers.esi: 0
registers.ecx: 3866176
1 0 0

__exception__

 stacktrace: 
chart+0x3b36f5 @ 0x10036f5
chart+0x3bfde5 @ 0x100fde5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: f7 f0 e8 38 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f71f9
exception.instruction: div eax
exception.module: chart.exe
exception.exception_code: 0xc0000094
exception.offset: 3109369
exception.address: 0xf471f9
registers.esp: 3866140
registers.edi: 3866140
registers.eax: 0
registers.ebp: 3866168
registers.edx: 0
registers.ebx: 16020026
registers.esi: 0
registers.ecx: 3866176
1 0 0

__exception__

 stacktrace: 
chart+0x3b387e @ 0x100387e
chart+0x3bfde5 @ 0x100fde5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: f7 f0 e8 38 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f71f9
exception.instruction: div eax
exception.module: chart.exe
exception.exception_code: 0xc0000094
exception.offset: 3109369
exception.address: 0xf471f9
registers.esp: 3866140
registers.edi: 16568816
registers.eax: 0
registers.ebp: 3866168
registers.edx: 0
registers.ebx: 11059200
registers.esi: 15253504
registers.ecx: 3866168
1 0 0

__exception__

 stacktrace: 
chart+0x3b387e @ 0x100387e
chart+0x3bfde5 @ 0x100fde5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: f7 f0 e8 38 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f71f9
exception.instruction: div eax
exception.module: chart.exe
exception.exception_code: 0xc0000094
exception.offset: 3109369
exception.address: 0xf471f9
registers.esp: 3866140
registers.edi: 3866140
registers.eax: 0
registers.ebp: 3866168
registers.edx: 0
registers.ebx: 16019983
registers.esi: 0
registers.ecx: 3866176
1 0 0

__exception__

 stacktrace: 
chart+0x3b387e @ 0x100387e
chart+0x3bfde5 @ 0x100fde5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: f7 f0 e8 38 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f71f9
exception.instruction: div eax
exception.module: chart.exe
exception.exception_code: 0xc0000094
exception.offset: 3109369
exception.address: 0xf471f9
registers.esp: 3866140
registers.edi: 3866140
registers.eax: 0
registers.ebp: 3866168
registers.edx: 0
registers.ebx: 16019983
registers.esi: 0
registers.ecx: 3866176
1 0 0

__exception__

 stacktrace: 
chart+0x3b387e @ 0x100387e
chart+0x3bfde5 @ 0x100fde5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: f7 f0 e8 38 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f71f9
exception.instruction: div eax
exception.module: chart.exe
exception.exception_code: 0xc0000094
exception.offset: 3109369
exception.address: 0xf471f9
registers.esp: 3866140
registers.edi: 3866140
registers.eax: 0
registers.ebp: 3866168
registers.edx: 0
registers.ebx: 16019983
registers.esi: 0
registers.ecx: 3866176
1 0 0

__exception__

 stacktrace: 
chart+0x3b387e @ 0x100387e
chart+0x3bfde5 @ 0x100fde5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f7224
exception.instruction: ud2
exception.module: chart.exe
exception.exception_code: 0xc000001d
exception.offset: 3109412
exception.address: 0xf47224
registers.esp: 3866140
registers.edi: 3866140
registers.eax: 0
registers.ebp: 3866168
registers.edx: 2
registers.ebx: 16019983
registers.esi: 0
registers.ecx: 3866176
1 0 0

__exception__

 stacktrace: 
chart+0x3b387e @ 0x100387e
chart+0x3bfde5 @ 0x100fde5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f7224
exception.instruction: ud2
exception.module: chart.exe
exception.exception_code: 0xc000001d
exception.offset: 3109412
exception.address: 0xf47224
registers.esp: 3866140
registers.edi: 3866140
registers.eax: 0
registers.ebp: 3866168
registers.edx: 2
registers.ebx: 16020026
registers.esi: 0
registers.ecx: 3866176
1 0 0

__exception__

 stacktrace: 
chart+0x3b3a67 @ 0x1003a67
chart+0x3bfde5 @ 0x100fde5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: f7 f0 e8 38 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f71f9
exception.instruction: div eax
exception.module: chart.exe
exception.exception_code: 0xc0000094
exception.offset: 3109369
exception.address: 0xf471f9
registers.esp: 3866140
registers.edi: 16568816
registers.eax: 0
registers.ebp: 3866168
registers.edx: 0
registers.ebx: 11059200
registers.esi: 15253504
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
chart+0x3b3a67 @ 0x1003a67
chart+0x3bfde5 @ 0x100fde5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: f7 f0 e8 38 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f71f9
exception.instruction: div eax
exception.module: chart.exe
exception.exception_code: 0xc0000094
exception.offset: 3109369
exception.address: 0xf471f9
registers.esp: 3866140
registers.edi: 3866140
registers.eax: 0
registers.ebp: 3866168
registers.edx: 0
registers.ebx: 16019983
registers.esi: 0
registers.ecx: 3866176
1 0 0

__exception__

 stacktrace: 
chart+0x3b3a67 @ 0x1003a67
chart+0x3bfde5 @ 0x100fde5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f7224
exception.instruction: ud2
exception.module: chart.exe
exception.exception_code: 0xc000001d
exception.offset: 3109412
exception.address: 0xf47224
registers.esp: 3866140
registers.edi: 3866140
registers.eax: 0
registers.ebp: 3866168
registers.edx: 2
registers.ebx: 16019983
registers.esi: 0
registers.ecx: 3866176
1 0 0

__exception__

 stacktrace: 
chart+0x3b3b85 @ 0x1003b85
chart+0x3bfde5 @ 0x100fde5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f7224
exception.instruction: ud2
exception.module: chart.exe
exception.exception_code: 0xc000001d
exception.offset: 3109412
exception.address: 0xf47224
registers.esp: 3866140
registers.edi: 16568816
registers.eax: 0
registers.ebp: 3866168
registers.edx: 2
registers.ebx: 11059200
registers.esi: 15253504
registers.ecx: 3607039093
1 0 0

__exception__

 stacktrace: 
chart+0x3b3b85 @ 0x1003b85
chart+0x3bfde5 @ 0x100fde5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f7224
exception.instruction: ud2
exception.module: chart.exe
exception.exception_code: 0xc000001d
exception.offset: 3109412
exception.address: 0xf47224
registers.esp: 3866140
registers.edi: 3866140
registers.eax: 0
registers.ebp: 3866168
registers.edx: 2
registers.ebx: 16020026
registers.esi: 0
registers.ecx: 3866176
1 0 0

__exception__

 stacktrace: 
chart+0x3b3b85 @ 0x1003b85
chart+0x3bfde5 @ 0x100fde5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f7224
exception.instruction: ud2
exception.module: chart.exe
exception.exception_code: 0xc000001d
exception.offset: 3109412
exception.address: 0xf47224
registers.esp: 3866140
registers.edi: 3866140
registers.eax: 0
registers.ebp: 3866168
registers.edx: 2
registers.ebx: 16020026
registers.esi: 0
registers.ecx: 3866176
1 0 0

__exception__

 stacktrace: 
chart+0x3b3b85 @ 0x1003b85
chart+0x3bfde5 @ 0x100fde5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f7224
exception.instruction: ud2
exception.module: chart.exe
exception.exception_code: 0xc000001d
exception.offset: 3109412
exception.address: 0xf47224
registers.esp: 3866140
registers.edi: 3866140
registers.eax: 0
registers.ebp: 3866168
registers.edx: 2
registers.ebx: 16020026
registers.esi: 0
registers.ecx: 3866176
1 0 0

__exception__

 stacktrace: 
chart+0x3b3b85 @ 0x1003b85
chart+0x3bfde5 @ 0x100fde5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f7224
exception.instruction: ud2
exception.module: chart.exe
exception.exception_code: 0xc000001d
exception.offset: 3109412
exception.address: 0xf47224
registers.esp: 3866140
registers.edi: 3866140
registers.eax: 0
registers.ebp: 3866168
registers.edx: 2
registers.ebx: 16020026
registers.esi: 0
registers.ecx: 3866176
1 0 0

__exception__

 stacktrace: 
chart+0x3b3b85 @ 0x1003b85
chart+0x3bfde5 @ 0x100fde5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f7224
exception.instruction: ud2
exception.module: chart.exe
exception.exception_code: 0xc000001d
exception.offset: 3109412
exception.address: 0xf47224
registers.esp: 3866140
registers.edi: 3866140
registers.eax: 0
registers.ebp: 3866168
registers.edx: 2
registers.ebx: 16020026
registers.esi: 0
registers.ecx: 3866176
1 0 0

__exception__

 stacktrace: 
chart+0x3b3b85 @ 0x1003b85
chart+0x3bfde5 @ 0x100fde5
chart+0x4a23a6 @ 0x10f23a6

exception.instruction_r: 0f 0b e8 0d 2d 01 00 33 c0 5a 59 59 64 89 10 eb
exception.symbol: chart+0x2f7224
exception.instruction: ud2
exception.module: chart.exe
exception.exception_code: 0xc000001d
exception.offset: 3109412
exception.address: 0xf47224
registers.esp: 3866140
registers.edi: 3866140
registers.eax: 0
registers.ebp: 3866168
registers.edx: 2
registers.ebx: 16020026
registers.esi: 0
registers.ecx: 3866176
1 0 0
suspicious_features POST method with no referer header, POST method with no useragent header, Connection to IP address suspicious_request POST http://85.28.47.30/920475a59bac849d.php
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://85.28.47.30/69934896f997d5bb/sqlite3.dll
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://85.28.47.30/69934896f997d5bb/freebl3.dll
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://85.28.47.30/69934896f997d5bb/mozglue.dll
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://85.28.47.30/69934896f997d5bb/msvcp140.dll
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://85.28.47.30/69934896f997d5bb/nss3.dll
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://85.28.47.30/69934896f997d5bb/softokn3.dll
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://85.28.47.30/69934896f997d5bb/vcruntime140.dll
request POST http://85.28.47.30/920475a59bac849d.php
request GET http://85.28.47.30/69934896f997d5bb/sqlite3.dll
request GET http://85.28.47.30/69934896f997d5bb/freebl3.dll
request GET http://85.28.47.30/69934896f997d5bb/mozglue.dll
request GET http://85.28.47.30/69934896f997d5bb/msvcp140.dll
request GET http://85.28.47.30/69934896f997d5bb/nss3.dll
request GET http://85.28.47.30/69934896f997d5bb/softokn3.dll
request GET http://85.28.47.30/69934896f997d5bb/vcruntime140.dll
request POST http://85.28.47.30/920475a59bac849d.php
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 932
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00530000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 932
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00420000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 932
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009e4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 932
region_size: 81920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009f4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 932
region_size: 147456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009f4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 932
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a14000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 932
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a24000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 932
region_size: 49152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a14000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 932
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a24000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 932
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a28000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 932
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a28000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 932
region_size: 49152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a28000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 932
region_size: 32768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a28000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 932
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a28000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 932
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a28000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 932
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a28000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 932
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00660000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 932
region_size: 995328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x61e00000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64\Local Extension Settings\cjmkndjhnagcfbpiemnkdpomccnjblmj\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\OriginTrials\Local Extension Settings\lpilbniiabackdjcionkobglmddfbcjo\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\TLSDeprecationConfig\4\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Subresource Filter\Local Extension Settings\bmikpgodpkclnkgmnpphehdgcimmided\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\WidevineCdm\Local Extension Settings\jhfjfclepacoldmjmkmdlmganfaalklb\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.47.0_0\_locales\th\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\FontLookupTableCache\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\RecoveryImproved\Local Extension Settings\naepdomgkenhinolocfifgehidddafch\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Module Info Cache\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\FontLookupTableCache\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\pnacl\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\_locales\uk\messages.json\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\TLSDeprecationConfig\Local Extension Settings\epapihdplajcdnnkdeiahlgigofloibg\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Local Extension Settings\djclckkglechooblngghdinmeemkbgci\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Local Extension Settings\oeljdldpnmdbchonielidgobddffflal\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\_locales\zh_CN\messages.json\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Last Version\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Channel IDs\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Local Extension Settings\gjagmgiddbbciopjhllkdnddhcglnemk\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\es_419\messages.json\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Cookies-journal\Local Extension Settings\oeljdldpnmdbchonielidgobddffflal\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel\Local Extension Settings\fooolghllnmhmmndgjiamiiodkpenpbb\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.47.0_0\_locales\lo\messages.json\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\1256\_platform_specific\all\sths\03019df3fd85a69a8ebd1facc6da9ba73e469774fe77f579fc5a08b8328c1d6b.sth\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\PepperFlash\Local Extension Settings\lpilbniiabackdjcionkobglmddfbcjo\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Module Info Cache\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\GPUCache\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments\Local Extension Settings\aijcbedoijmgnlmjeegjaglmepbmpkpi\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments\Local Extension Settings\pdadjkfkgcafgbceimcpbkalnfnepbnk\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\GrShaderCache\Local Extension Settings\gjagmgiddbbciopjhllkdnddhcglnemk\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\52\manifest.json\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.47.0_0\_locales\ka\messages.json\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Last Browser\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State\Local Extension Settings\djclckkglechooblngghdinmeemkbgci\CURRENT
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\hr\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8620.824.0.0_0\_locales\sk\Network\Cookies
file C:\ProgramData\freebl3.dll
file C:\ProgramData\msvcp140.dll
file C:\ProgramData\nss3.dll
file C:\ProgramData\vcruntime140.dll
file C:\ProgramData\mozglue.dll
file C:\ProgramData\softokn3.dll
cmdline C:\Windows\System32\cmd.exe /c start "" "C:\Users\test22\AppData\Local\Temp\IEHDAFHDHC.exe"
cmdline C:\Windows\System32\cmd.exe /c start "" "C:\Users\test22\AppData\Local\Temp\AAAEBAFBGI.exe"
cmdline "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\test22\AppData\Local\Temp\IEHDAFHDHC.exe"
cmdline "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\test22\AppData\Local\Temp\AAAEBAFBGI.exe"
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: C:\Windows\system32\cmd.exe
parameters: /c start "" "C:\Users\test22\AppData\Local\Temp\AAAEBAFBGI.exe"
filepath: C:\Windows\System32\cmd.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Windows\system32\cmd.exe
parameters: /c start "" "C:\Users\test22\AppData\Local\Temp\IEHDAFHDHC.exe"
filepath: C:\Windows\System32\cmd.exe
1 1 0
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x00000320
process_name: mobsync.exe
process_identifier: 2032
1 1 0

Process32NextW

 snapshot_handle: 0x00000320
process_name: pw.exe
process_identifier: 1684
1 1 0

Process32NextW

 snapshot_handle: 0x00000320
process_name: taskhost.exe
process_identifier: 792
1 1 0

Process32NextW

 snapshot_handle: 0x00000320
process_name: cmd.exe
process_identifier: 1648
1 1 0

Process32NextW

 snapshot_handle: 0x00000320
process_name: SearchProtocolHost.exe
process_identifier: 724
1 1 0

Process32NextW

 snapshot_handle: 0x00000320
process_name: SearchFilterHost.exe
process_identifier: 316
1 1 0

Process32NextW

 snapshot_handle: 0x00000320
process_name: conhost.exe
process_identifier: 1268
1 1 0

Process32NextW

 snapshot_handle: 0x00000320
process_name: chart.exe
process_identifier: 932
1 1 0

Process32NextW

 snapshot_handle: 0x00000320
process_name: pw.exe
process_identifier: 1608
1 1 0

Process32NextW

 snapshot_handle: 0x00000470
process_name: svchost.exe
process_identifier: 2252
1 1 0

Process32NextW

 snapshot_handle: 0x00000470
process_name: mscorsvw.exe
process_identifier: 2280
1 1 0

Process32NextW

 snapshot_handle: 0x00000470
process_name: mscorsvw.exe
process_identifier: 2324
1 1 0

Process32NextW

 snapshot_handle: 0x00000470
process_name: sppsvc.exe
process_identifier: 2372
1 1 0
Time & API Arguments Status Return Repeated

InternetReadFile

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL×Ýc’¿à! &  @ àa0: Ð ˆ* Ð 0 ¨@ <   Ð.text„% & `P`.data|'@ (, @`À.rdatapDp FT @`@.bss(À €`À.edataˆ*Ð ,š @0@.idataÐ Æ @0À.CRT, Ô @0À.tls Ö @0À.rsrc¨0 Ø @0À.reloc<@ >Þ @0B/48€  @@B/19RȐ Ê" @B/31]'`(ì @B/45š-.@B/57\ À B@0B/70#ÐN@B/81
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELó4cà"! 4pÐ Ëý @AH S› Ȑ xF P/  ð#”   ¤ @.text•  `.rdataÄ @@.data<F0  @À.00cfg€  @@.rsrcx  @@.relocð#  $" @B
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL¤4cà"! ¶^À¹€ jª @A`ãWä·, ° P/0 ØAS¼øhРì¼ÜäZ.textaµ¶ `.rdata” Ð º@@.dataDàÄ@À.00cfg È@@.tls Ê@À.rsrc° Ì@@.relocØA0 BÖ@B
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ٓ1Cò_ò_ò_)n°Ÿò_”ŠÌ‹ò_ò^"ò_Ϛ^žò_Ϛ\•ò_Ϛ[Óò_ϚZÑò_Ϛ_œò_Ϛ œò_Ϛ]œò_Richò_PEL‚ê0]à"! (‚`Ù@ ð,à@Ag‚Ïèr ðœèA°¬=`x8¸w@päÀc@.text’&( `.dataH)@,@À.idata¬pD@@.didat4X@À.rsrcð Z@@.reloc¬=°>^@B
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELÐ4cà"! Ø.`£pl- @Aä&úÞÄ@Px P/`\°ð |Ê\€&@.text‰×Ø `.rdatalïððÜ@@.dataDRà.Ì@À.00cfg@ú@@.rsrcxPü@@.reloc\` @B
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELó4cà"! ÌðPÏSg@ADvS—wð°€ÀP/ÀÈ58qà {Œ.text&ËÌ `.rdataÔ«à¬Ð@@.data˜ |@À.00cfg „@@.rsrc€°†@@.relocÈ5À6Š@B
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@躴 Í!¸LÍ!This program cannot be run in DOS mode. $ÀÅäՄ¤Š†„¤Š†„¤Š†08e††¤Š†Ü†¤Š†„¤‹†¬¤Š†Ö̉‡—¤Š†Ö̎‡¤Š†Ö̏‡Ÿ¤Š†Ö̊‡…¤Š†ÖÌu†…¤Š†Ö̈‡…¤Š†Rich„¤Š†PEL|ê0]à"! ސÙð 0Ôm@Aàã ¸ŒúðA  € 8¸ @´.textôÜÞ `.dataôðâ@À.idata„ä@@.rsrcê@@.reloc  î@B
request_handle: 0x00cc000c
1 1 0
section {u'size_of_data': u'0x0000a600', u'virtual_address': u'0x00001000', u'entropy': 7.986295184518006, u'name': u'', u'virtual_size': u'0x0001b000'} entropy 7.98629518452 description A section with a high entropy has been found
section {u'size_of_data': u'0x00004600', u'virtual_address': u'0x0001c000', u'entropy': 7.963799260938229, u'name': u'', u'virtual_size': u'0x00008000'} entropy 7.96379926094 description A section with a high entropy has been found
section {u'size_of_data': u'0x00002000', u'virtual_address': u'0x00237000', u'entropy': 7.953222933000368, u'name': u'', u'virtual_size': u'0x00005000'} entropy 7.953222933 description A section with a high entropy has been found
section {u'size_of_data': u'0x0002ba00', u'virtual_address': u'0x0023c000', u'entropy': 7.997940081835739, u'name': u'', u'virtual_size': u'0x0027e000'} entropy 7.99794008184 description A section with a high entropy has been found
section {u'size_of_data': u'0x000d7a00', u'virtual_address': u'0x004ba000', u'entropy': 7.984173366194839, u'name': u'.data\\x00Th', u'virtual_size': u'0x000d8000'} entropy 7.98417336619 description A section with a high entropy has been found
entropy 0.999095022624 description Overall entropy of this PE file is high
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000320
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}
1 0 0

RegOpenKeyExA

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}
base_handle: 0x80000002
key_handle: 0x00000324
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}
1 0 0
host 77.91.77.81
host 85.28.47.30
registry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString
file C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
Time & API Arguments Status Return Repeated

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 7-Zip 20.02 alpha
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe AIR
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: EditPlus
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Chrome
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: ????? ?? 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Mozilla Thunderbird 78.4.0 (x86 ko)
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Professional Plus 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe AIR
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: HttpWatch Professional 9.3.39
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: ????? ?? 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Java 8 Update 131
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Java Auto Updater
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Google Update Helper
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Access MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Excel MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft PowerPoint MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Publisher MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Outlook MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Word MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing Tools 2013 - English
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Outils de vérification linguistique 2013 de Microsoft Office - Français
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing Tools 2013 - Español
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft InfoPath MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft DCF MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft OneNote MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Groove MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office OSM MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office OSM UX MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared Setup Metadata MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Access Setup Metadata MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Lync MUI (English) 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Professional Plus 2013
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Flash Player 13 ActiveX
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Flash Player 13 NPAPI
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Acrobat Reader DC MUI
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\DisplayName
1 0 0

RegQueryValueExA

 key_handle: 0x00000324
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName
1 0 0
file C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini
registry HKEY_CURRENT_USER\oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\00000004
registry HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
registry HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Process injection Process 932 resumed a thread in remote process 2528
Process injection Process 932 resumed a thread in remote process 2612
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000508
suspend_count: 1
process_identifier: 2528
1 0 0

NtResumeThread

 thread_handle: 0x00000510
suspend_count: 1
process_identifier: 2612
1 0 0
dead_host 77.91.77.81:80
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Generic.4!c
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.Generic.tc
Cylance Unsafe
Sangfor Trojan.Win32.Agent.Vron
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Packed.EnigmaProtector.J suspicious
APEX Malicious
McAfee Artemis!73AA6448467D
Avast Win32:PWSX-gen [Trj]
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba Trojan:Win32/Stealc.4374cbec
F-Secure Heuristic.HEUR/AGEN.1314134
McAfeeD Real Protect-LS!73AA6448467D
Trapmine malicious.high.ml.score
FireEye Generic.mg.73aa6448467db3d1
Sophos Mal/Generic-S
Ikarus Trojan-Spy
Google Detected
Avira HEUR/AGEN.1314134
Antiy-AVL Trojan[PSW]/Win32.StealerC
Kingsoft Win32.HeurC.KVMH008.a
Gridinsoft Malware.Win32.Stealc.tr
Microsoft Trojan:Win32/Stealc.DA!MTB
ZoneAlarm UDS:DangerousObject.Multi.Generic
AhnLab-V3 Trojan/Win.PWSX-gen.C5644922
BitDefenderTheta Gen:NN.ZexaF.36808.fzW@aKqGF5n
DeepInstinct MALICIOUS
VBA32 BScope.Trojan.Downloader
Malwarebytes Malware.AI.861044805
Zoner Probably Heur.ExeHeaderL
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
AVG Win32:PWSX-gen [Trj]
Paloalto generic.ml
CrowdStrike win/malicious_confidence_100% (W)
alibabacloud VirTool:Win/Stealerc.GMH2XJC