Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 2, 2024, 10:58 a.m.	Sept. 2, 2024, 11:06 a.m.

Size	1.8MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`82f430cb027d4089280c1a2a42335131`
SHA256	`155d1ff2d0e4bd67cc173d67df82532971c542ffdca94fbe91b9a45fc62b0348`
CRC32	`CA66DDCB`
ssdeep	`49152:Jtd4P0tr3a1tThVBj5VEtyY6SHQF17lnXtY0Iso:Jtd4OarT9Y6SwF1pnXyd`
Yara	Admin_Tool_IN_Zero - Admin Tool Sysinternals PE_Header_Zero - PE File Signature IsPE32 - (no description)

random.exe "C:\Users\test22\AppData\Local\Temp\random.exe"
724
- axplong.exe "C:\Users\test22\AppData\Local\Temp\44111dbc49\axplong.exe"
  2260
  - crypted.exe "C:\Users\test22\AppData\Local\Temp\1000002001\crypted.exe"
    2500
    - RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2580
  - crypteda.exe "C:\Users\test22\AppData\Local\Temp\1000004001\crypteda.exe"
    2848
  - Nework.exe "C:\Users\test22\AppData\Local\Temp\1000005001\Nework.exe"
    3060
    - Hkbsse.exe "C:\Users\test22\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
      2236
      - setup2.exe "C:\Users\test22\AppData\Local\Temp\1000009001\setup2.exe"
        792
  - stealc_default2.exe "C:\Users\test22\AppData\Local\Temp\1000066001\stealc_default2.exe"
    2128
  - 1.exe "C:\Users\test22\AppData\Local\Temp\1000191001\1.exe"
    2928
  - GetSys.exe "C:\Users\test22\AppData\Local\Temp\1000228001\GetSys.exe"
    184
  - Amadeus.exe "C:\Users\test22\1000238002\Amadeus.exe"
    2636
  - runtime.exe "C:\Users\test22\AppData\Local\Temp\1000243001\runtime.exe"
    2228
  - seidr_build.exe "C:\Users\test22\AppData\Local\Temp\1000248001\seidr_build.exe"
    1012
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
x1.i.lencr.org	CNAME crl.root-x1.letsencrypt.org.edgekey.net CNAME e8652.dscx.akamaiedge.net A 23.207.177.83	23.52.33.11
sevxv17pt.top	A 195.133.13.230	195.133.13.230
ipinfo.io	A 34.117.59.81	34.117.59.81
fivexv5vs.top	A 195.133.48.136	195.133.48.136
stagingbyvdveen.com	A 147.45.60.44	147.45.60.44
ddl.safone.dev	A 54.247.69.169 CNAME cellular-coral-9r9jw7d9k5kj0dfl28uyy6l8.herokudns.com A 52.212.52.84 A 63.32.161.232	63.32.161.232

IP Address	Status	Action
154.216.17.170	Active	Moloch
147.45.60.44	Active	Moloch
164.124.101.2	Active	Moloch
185.215.113.16	Active	Moloch
185.215.113.17	Active	Moloch
185.215.113.19	Active	Moloch
185.215.113.26	Active	Moloch
195.133.13.230	Active	Moloch
195.133.48.136	Active	Moloch
52.212.52.84	Active	Moloch
95.179.250.45	Active	Moloch
23.207.177.83	Active	Moloch
34.117.59.81	Active	Moloch
95.216.143.20	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 185.215.113.16:80 -> 192.168.56.103:49164	2400032	ET DROP Spamhaus DROP Listed Traffic Inbound group 33	Misc Attack
TCP 52.212.52.84:80 -> 192.168.56.103:49165	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 52.212.52.84:80 -> 192.168.56.103:49165	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 52.212.52.84:80 -> 192.168.56.103:49165	2014520	ET INFO EXE - Served Attached HTTP	Misc activity
TCP 192.168.56.103:49168 -> 185.215.113.16:80	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	A Network Trojan was detected
TCP 192.168.56.103:49168 -> 185.215.113.16:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 185.215.113.16:80 -> 192.168.56.103:49168	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 185.215.113.16:80 -> 192.168.56.103:49168	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 185.215.113.16:80 -> 192.168.56.103:49168	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 185.215.113.26:80 -> 192.168.56.103:49178	2400032	ET DROP Spamhaus DROP Listed Traffic Inbound group 33	Misc Attack
TCP 52.212.52.84:80 -> 192.168.56.103:49183	2014819	ET INFO Packed Executable Download	Misc activity
TCP 52.212.52.84:80 -> 192.168.56.103:49183	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 52.212.52.84:80 -> 192.168.56.103:49183	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 52.212.52.84:80 -> 192.168.56.103:49183	2014520	ET INFO EXE - Served Attached HTTP	Misc activity
TCP 192.168.56.103:49178 -> 185.215.113.26:80	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	A Network Trojan was detected
TCP 192.168.56.103:49185 -> 154.216.17.170:80	2017598	ET MALWARE Possible Kelihos.F EXE Download Common Structure	A Network Trojan was detected
TCP 192.168.56.103:49185 -> 154.216.17.170:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 154.216.17.170:80 -> 192.168.56.103:49185	2014819	ET INFO Packed Executable Download	Misc activity
TCP 154.216.17.170:80 -> 192.168.56.103:49185	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 154.216.17.170:80 -> 192.168.56.103:49185	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 154.216.17.170:80 -> 192.168.56.103:49185	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.103:49168 -> 185.215.113.16:80	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	A Network Trojan was detected
TCP 192.168.56.103:49174 -> 185.215.113.26:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 185.215.113.26:80 -> 192.168.56.103:49174	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 185.215.113.26:80 -> 192.168.56.103:49174	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 185.215.113.26:80 -> 192.168.56.103:49174	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.103:49168 -> 185.215.113.16:80	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	A Network Trojan was detected
TCP 192.168.56.103:49168 -> 185.215.113.16:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 185.215.113.17:80 -> 192.168.56.103:49182	2400032	ET DROP Spamhaus DROP Listed Traffic Inbound group 33	Misc Attack
TCP 192.168.56.103:49168 -> 185.215.113.16:80	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	A Network Trojan was detected
TCP 147.45.60.44:80 -> 192.168.56.103:49180	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 147.45.60.44:80 -> 192.168.56.103:49180	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 192.168.56.103:49182 -> 185.215.113.17:80	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	Malware Command and Control Activity Detected
TCP 192.168.56.103:49182 -> 185.215.113.17:80	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	Malware Command and Control Activity Detected
TCP 185.215.113.17:80 -> 192.168.56.103:49182	2051828	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config M1	Malware Command and Control Activity Detected
TCP 192.168.56.103:49182 -> 185.215.113.17:80	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	Malware Command and Control Activity Detected
TCP 185.215.113.17:80 -> 192.168.56.103:49182	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	Malware Command and Control Activity Detected
TCP 192.168.56.103:49182 -> 185.215.113.17:80	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	Malware Command and Control Activity Detected
TCP 192.168.56.103:49182 -> 185.215.113.17:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 192.168.56.103:49182 -> 185.215.113.17:80	2044301	ET HUNTING HTTP GET Request for sqlite3.dll - Possible Infostealer Activity	A suspicious filename was detected
TCP 185.215.113.17:80 -> 192.168.56.103:49182	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 185.215.113.17:80 -> 192.168.56.103:49182	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 192.168.56.103:49178 -> 185.215.113.26:80	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	A Network Trojan was detected
TCP 192.168.56.103:49182 -> 185.215.113.17:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 192.168.56.103:49182 -> 185.215.113.17:80	2044303	ET HUNTING HTTP GET Request for freebl3.dll - Possible Infostealer Activity	A suspicious filename was detected
TCP 192.168.56.103:49168 -> 185.215.113.16:80	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	A Network Trojan was detected
TCP 192.168.56.103:49182 -> 185.215.113.17:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 192.168.56.103:49182 -> 185.215.113.17:80	2044302	ET HUNTING HTTP GET Request for mozglue.dll - Possible Infostealer Activity	A suspicious filename was detected
TCP 192.168.56.103:49182 -> 185.215.113.17:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 192.168.56.103:49182 -> 185.215.113.17:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 192.168.56.103:49182 -> 185.215.113.17:80	2044305	ET HUNTING HTTP GET Request for nss3.dll - Possible Infostealer Activity	A suspicious filename was detected
TCP 192.168.56.103:49168 -> 185.215.113.16:80	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	A Network Trojan was detected
TCP 192.168.56.103:49195 -> 195.133.13.230:80	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	A Network Trojan was detected
TCP 192.168.56.103:49195 -> 195.133.13.230:80	2023882	ET INFO HTTP Request to a *.top domain	Potentially Bad Traffic
UDP 192.168.56.103:53673 -> 164.124.101.2:53	2023883	ET DNS Query to a *.top domain - Likely Hostile	Potentially Bad Traffic
TCP 192.168.56.103:49182 -> 185.215.113.17:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 192.168.56.103:49182 -> 185.215.113.17:80	2044306	ET HUNTING HTTP GET Request for softokn3.dll - Possible Infostealer Activity	A suspicious filename was detected
TCP 192.168.56.103:49182 -> 185.215.113.17:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 192.168.56.103:49182 -> 185.215.113.17:80	2044307	ET HUNTING HTTP GET Request for vcruntime140.dll - Possible Infostealer Activity	A suspicious filename was detected
TCP 192.168.56.103:49202 -> 195.133.48.136:80	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	A Network Trojan was detected
TCP 192.168.56.103:49195 -> 195.133.13.230:80	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	A Network Trojan was detected
TCP 192.168.56.103:49202 -> 195.133.48.136:80	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	A Network Trojan was detected
TCP 192.168.56.103:49168 -> 185.215.113.16:80	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	A Network Trojan was detected
TCP 192.168.56.103:49195 -> 195.133.13.230:80	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	A Network Trojan was detected
TCP 192.168.56.103:49168 -> 185.215.113.16:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 192.168.56.103:49202 -> 195.133.48.136:80	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	A Network Trojan was detected
UDP 192.168.56.103:62576 -> 164.124.101.2:53	2054168	ET INFO External IP Lookup Domain in DNS Lookup (ipinfo .io)	Device Retrieving External IP Address Detected
TCP 192.168.56.103:49222 -> 34.117.59.81:443	2025331	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)	Device Retrieving External IP Address Detected
TCP 34.117.59.81:443 -> 192.168.56.103:49222	2025330	ET POLICY External IP Lookup SSL Cert Observed (ipinfo .io)	Device Retrieving External IP Address Detected
TCP 192.168.56.103:49168 -> 185.215.113.16:80	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	A Network Trojan was detected
TCP 192.168.56.103:49168 -> 185.215.113.16:80	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	A Network Trojan was detected
TCP 192.168.56.103:49168 -> 185.215.113.16:80	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 192.168.56.103:49168 -> 185.215.113.16:80	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	A Network Trojan was detected
TCP 192.168.56.103:49168 -> 185.215.113.16:80	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	A Network Trojan was detected
TCP 185.215.113.19:80 -> 192.168.56.103:49228	2400032	ET DROP Spamhaus DROP Listed Traffic Inbound group 33	Misc Attack
TCP 192.168.56.103:49228 -> 185.215.113.19:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 185.215.113.19:80 -> 192.168.56.103:49228	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 185.215.113.19:80 -> 192.168.56.103:49228	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.103:49222 34.117.59.81:443	C=US, O=Let's Encrypt, CN=R11	CN=ipinfo.io	10:03:a0:6b:0a:c8:49:d7:02:69:80:1b:ca:6a:94:20:83:0d:95:91

Queries for the computername (8 events)

Time & API	Arguments	Status	Return
GetComputerNameA Sept. 2, 2024, 10:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2024, 10:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 2, 2024, 10:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 2, 2024, 10:58 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 2, 2024, 10:59 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2024, 10:59 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 2, 2024, 10:59 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 2, 2024, 10:52 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (50 out of 98 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 2, 2024, 10:58 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:58 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:58 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:58 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:58 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:58 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:58 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:58 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:58 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 10:59 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 11 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 11 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 11 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 11 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 11 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 11 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 11 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 11 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 11 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 11 a.m.			0	0
IsDebuggerPresent Sept. 2, 2024, 11 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (14 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 2, 2024, 10:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051c800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2024, 10:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051c800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2024, 10:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051c800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2024, 10:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051c800 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2024, 10:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051c880 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2024, 10:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051c880 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2024, 10:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051c780 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2024, 10:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051c780 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2024, 10:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051c780 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2024, 10:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051c780 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2024, 10:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051c780 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2024, 10:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051cf00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2024, 10:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051cf00 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 2, 2024, 10:58 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0051d700 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 2, 2024, 10:58 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (6 events)

section	\x00
section	.idata
section
section	xzgvtied
section	eakryhpi
section	.taggant

One or more processes crashed (50 out of 238 events)

Time & API	Arguments	Status
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: fb e9 4e 01 00 00 60 8b 74 24 24 8b 7c 24 28 fc exception.symbol: random+0x3200b9 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3276985 exception.address: 0x3800b9 registers.esp: 8519240 registers.edi: 0 registers.eax: 1 registers.ebp: 8519256 registers.edx: 5402624 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb e9 aa fc ff ff 89 de 89 f2 5e 5b 42 81 e2 5f exception.symbol: random+0x6d2de exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 447198 exception.address: 0xcd2de registers.esp: 8519208 registers.edi: 1971192040 registers.eax: 31909 registers.ebp: 3990859796 registers.edx: 393216 registers.ebx: 870904 registers.esi: 3 registers.ecx: 1971388416	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 81 ec 04 00 00 00 89 14 24 55 c7 04 24 1a 87 exception.symbol: random+0x6d370 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 447344 exception.address: 0xcd370 registers.esp: 8519208 registers.edi: 1971192040 registers.eax: 31909 registers.ebp: 3990859796 registers.edx: 393216 registers.ebx: 870904 registers.esi: 846161 registers.ecx: 4294937620	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 31 c9 ff 34 19 ff 34 24 ff 34 24 e9 1b fe ff exception.symbol: random+0x6e167 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 450919 exception.address: 0xce167 registers.esp: 8519208 registers.edi: 1971192040 registers.eax: 29087 registers.ebp: 3990859796 registers.edx: 393216 registers.ebx: 870679 registers.esi: 846161 registers.ecx: 1180088322	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 56 e9 35 04 00 00 83 c4 04 56 51 68 0e e9 fc exception.symbol: random+0x6d870 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 448624 exception.address: 0xcd870 registers.esp: 8519208 registers.edi: 1971192040 registers.eax: 238825 registers.ebp: 3990859796 registers.edx: 393216 registers.ebx: 870679 registers.esi: 846161 registers.ecx: 4294940800	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb e9 ad f5 ff ff a4 21 9d b1 b7 05 cf 0d 3c 3a exception.symbol: random+0x1f3878 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2046072 exception.address: 0x253878 registers.esp: 8519208 registers.edi: 877630 registers.eax: 30395 registers.ebp: 3990859796 registers.edx: 833549 registers.ebx: 2466558 registers.esi: 2435665 registers.ecx: 788463616	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb e9 23 00 00 00 89 1c 24 bb 46 d9 a5 1f e9 9d exception.symbol: random+0x1f36e3 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2045667 exception.address: 0x2536e3 registers.esp: 8519208 registers.edi: 877630 registers.eax: 0 registers.ebp: 3990859796 registers.edx: 833549 registers.ebx: 2439290 registers.esi: 2435665 registers.ecx: 1695737192	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 57 89 e7 52 ba 04 00 00 00 81 c7 5b 49 f9 74 exception.symbol: random+0x1f8d7c exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2067836 exception.address: 0x258d7c registers.esp: 8519208 registers.edi: 2486235 registers.eax: 27829 registers.ebp: 3990859796 registers.edx: 2130566132 registers.ebx: 5111886 registers.esi: 2435665 registers.ecx: 78	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 56 e9 85 01 00 00 53 89 e3 81 ec 04 00 00 00 exception.symbol: random+0x1f86ea exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2066154 exception.address: 0x2586ea registers.esp: 8519208 registers.edi: 2461127 registers.eax: 0 registers.ebp: 3990859796 registers.edx: 1549541099 registers.ebx: 5111886 registers.esi: 2435665 registers.ecx: 78	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb e9 a2 00 00 00 5e 81 c6 04 00 00 00 52 ba 04 exception.symbol: random+0x1fca57 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2083415 exception.address: 0x25ca57 registers.esp: 8519204 registers.edi: 11939568 registers.eax: 32364 registers.ebp: 3990859796 registers.edx: 1067215031 registers.ebx: 2475718 registers.esi: 0 registers.ecx: 1971442156	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 29 f6 ff 34 33 68 21 ac 82 6e 89 1c 24 e9 31 exception.symbol: random+0x1fcb90 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2083728 exception.address: 0x25cb90 registers.esp: 8519208 registers.edi: 11939568 registers.eax: 32364 registers.ebp: 3990859796 registers.edx: 1067215031 registers.ebx: 2508082 registers.esi: 0 registers.ecx: 1971442156	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 68 91 d4 00 53 89 14 24 ba 82 1a 29 3d e9 e5 exception.symbol: random+0x1fd08e exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2085006 exception.address: 0x25d08e registers.esp: 8519208 registers.edi: 134889 registers.eax: 32364 registers.ebp: 3990859796 registers.edx: 1067215031 registers.ebx: 2508082 registers.esi: 4294937532 registers.ecx: 1971442156	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 52 83 ec 04 89 3c 24 89 exception.symbol: random+0x202215 exception.instruction: in eax, dx exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2105877 exception.address: 0x262215 registers.esp: 8519200 registers.edi: 134889 registers.eax: 1447909480 registers.ebp: 3990859796 registers.edx: 22104 registers.ebx: 1971327157 registers.esi: 2497561 registers.ecx: 20	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: 0f 3f 07 0b 64 8f 05 00 00 00 00 83 c4 04 83 fb exception.symbol: random+0x2030cf exception.address: 0x2630cf exception.module: random.exe exception.exception_code: 0xc000001d exception.offset: 2109647 registers.esp: 8519200 registers.edi: 134889 registers.eax: 1 registers.ebp: 3990859796 registers.edx: 22104 registers.ebx: 0 registers.esi: 2497561 registers.ecx: 20	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: ed 81 fb 68 58 4d 56 75 0a c7 85 dc 33 2d 12 01 exception.symbol: random+0x20749f exception.instruction: in eax, dx exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2127007 exception.address: 0x26749f registers.esp: 8519200 registers.edi: 134889 registers.eax: 1447909480 registers.ebp: 3990859796 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 2497561 registers.ecx: 10	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 56 e9 02 01 00 00 81 eb b6 ea f6 1b 52 ba c1 exception.symbol: random+0x20ac3d exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2141245 exception.address: 0x26ac3d registers.esp: 8519204 registers.edi: 134889 registers.eax: 31642 registers.ebp: 3990859796 registers.edx: 2130566132 registers.ebx: 55315015 registers.esi: 10 registers.ecx: 2532836	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 52 89 e2 51 52 ba 23 00 17 6e 89 d1 e9 0d 00 exception.symbol: random+0x20af6c exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2142060 exception.address: 0x26af6c registers.esp: 8519208 registers.edi: 134889 registers.eax: 31642 registers.ebp: 3990859796 registers.edx: 2130566132 registers.ebx: 55315015 registers.esi: 10 registers.ecx: 2564478	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb e9 e8 fd ff ff 5d 35 86 d7 f5 7b 35 96 b8 0f exception.symbol: random+0x20ae7c exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2141820 exception.address: 0x26ae7c registers.esp: 8519208 registers.edi: 134889 registers.eax: 31642 registers.ebp: 3990859796 registers.edx: 0 registers.ebx: 1656848480 registers.esi: 10 registers.ecx: 2535626	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: cd 01 eb 00 6a 00 53 e8 03 00 00 00 20 5b c3 5b exception.symbol: random+0x20b2b1 exception.instruction: int 1 exception.module: random.exe exception.exception_code: 0xc0000005 exception.offset: 2142897 exception.address: 0x26b2b1 registers.esp: 8519168 registers.edi: 0 registers.eax: 8519168 registers.ebp: 3990859796 registers.edx: 2536022 registers.ebx: 2536434 registers.esi: 16760 registers.ecx: 2536434	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 50 57 52 ba e1 d9 fd 7f e9 b2 04 00 00 81 f2 exception.symbol: random+0x219ee3 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2203363 exception.address: 0x279ee3 registers.esp: 8519204 registers.edi: 2596439 registers.eax: 25606 registers.ebp: 3990859796 registers.edx: 6 registers.ebx: 55315237 registers.esi: 1971262480 registers.ecx: 0	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 53 52 e9 0e 00 00 00 8b 34 24 e9 b7 00 00 00 exception.symbol: random+0x21a7b3 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2205619 exception.address: 0x27a7b3 registers.esp: 8519208 registers.edi: 2599253 registers.eax: 25606 registers.ebp: 3990859796 registers.edx: 0 registers.ebx: 607422802 registers.esi: 1971262480 registers.ecx: 0	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb e9 9d 08 00 00 03 14 24 81 ea 40 3e ff 5b e9 exception.symbol: random+0x21ac70 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2206832 exception.address: 0x27ac70 registers.esp: 8519204 registers.edi: 2599253 registers.eax: 30358 registers.ebp: 3990859796 registers.edx: 2599784 registers.ebx: 607422802 registers.esi: 1971262480 registers.ecx: 0	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 51 c7 04 24 65 f4 77 7d e9 38 01 00 00 89 04 exception.symbol: random+0x21af5e exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2207582 exception.address: 0x27af5e registers.esp: 8519208 registers.edi: 2599253 registers.eax: 30358 registers.ebp: 3990859796 registers.edx: 2630142 registers.ebx: 607422802 registers.esi: 1971262480 registers.ecx: 0	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 52 c7 04 24 75 ae 16 18 89 04 24 57 bf 7a cf exception.symbol: random+0x21abfc exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2206716 exception.address: 0x27abfc registers.esp: 8519208 registers.edi: 2599253 registers.eax: 30358 registers.ebp: 3990859796 registers.edx: 2602794 registers.ebx: 0 registers.esi: 262633 registers.ecx: 0	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb e9 11 00 00 00 ba a7 cd e7 7e bf 7c d4 85 b1 exception.symbol: random+0x22077d exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2230141 exception.address: 0x28077d registers.esp: 8519196 registers.edi: 2599253 registers.eax: 28844 registers.ebp: 3990859796 registers.edx: 1939626016 registers.ebx: 417502937 registers.esi: 2622646 registers.ecx: 1939626016	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 50 53 68 e4 2e 8c 73 89 2c 24 bd 80 ab db 7f exception.symbol: random+0x220b63 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2231139 exception.address: 0x280b63 registers.esp: 8519200 registers.edi: 2599253 registers.eax: 0 registers.ebp: 3990859796 registers.edx: 1939626016 registers.ebx: 1179202795 registers.esi: 2625970 registers.ecx: 1939626016	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 68 c1 32 7f 51 89 3c 24 e9 0f 00 00 00 5a 83 exception.symbol: random+0x2265cb exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2254283 exception.address: 0x2865cb registers.esp: 8519200 registers.edi: 2599253 registers.eax: 30172 registers.ebp: 3990859796 registers.edx: 2674874 registers.ebx: 940388154 registers.esi: 2625970 registers.ecx: 788463616	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 57 89 04 24 c7 04 24 b1 79 39 7d e9 f0 03 00 exception.symbol: random+0x225efc exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2252540 exception.address: 0x285efc registers.esp: 8519200 registers.edi: 30185 registers.eax: 30172 registers.ebp: 3990859796 registers.edx: 2674874 registers.ebx: 940388154 registers.esi: 2625970 registers.ecx: 4294940080	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb e9 36 00 00 00 bd ae 4e 7f 76 01 e8 5d 5f e9 exception.symbol: random+0x22f7c7 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2291655 exception.address: 0x28f7c7 registers.esp: 8519200 registers.edi: 2674489 registers.eax: 2712391 registers.ebp: 3990859796 registers.edx: 856144079 registers.ebx: 2674534 registers.esi: 570734268 registers.ecx: 788463616	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb e9 20 04 00 00 55 68 f7 b4 55 40 89 24 24 e9 exception.symbol: random+0x22f9a0 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2292128 exception.address: 0x28f9a0 registers.esp: 8519200 registers.edi: 1426090592 registers.eax: 2712391 registers.ebp: 3990859796 registers.edx: 4294942140 registers.ebx: 2674534 registers.esi: 570734268 registers.ecx: 788463616	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 51 b9 69 c2 df 77 41 81 f1 a0 ef bf 7f e9 5b exception.symbol: random+0x241e29 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2367017 exception.address: 0x2a1e29 registers.esp: 8519164 registers.edi: 2751994 registers.eax: 29138 registers.ebp: 3990859796 registers.edx: 2130566132 registers.ebx: 2752007 registers.esi: 2757590 registers.ecx: 788463616	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb e9 82 fd ff ff 83 c4 04 e9 aa fc ff ff 68 b0 exception.symbol: random+0x24198d exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2365837 exception.address: 0x2a198d registers.esp: 8519168 registers.edi: 2751994 registers.eax: 29138 registers.ebp: 3990859796 registers.edx: 2130566132 registers.ebx: 2752007 registers.esi: 2786728 registers.ecx: 788463616	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 68 99 c8 2e 79 e9 d5 01 00 00 50 b8 00 59 e9 exception.symbol: random+0x241598 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2364824 exception.address: 0x2a1598 registers.esp: 8519168 registers.edi: 604292950 registers.eax: 0 registers.ebp: 3990859796 registers.edx: 2130566132 registers.ebx: 2752007 registers.esi: 2760544 registers.ecx: 788463616	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb e9 3b 00 00 00 81 cd fa 86 d7 6b 81 f5 10 83 exception.symbol: random+0x2427d3 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2369491 exception.address: 0x2a27d3 registers.esp: 8519168 registers.edi: 4294939404 registers.eax: 2791567 registers.ebp: 3990859796 registers.edx: 1237932817 registers.ebx: 1375758944 registers.esi: 2760544 registers.ecx: 2033109145	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb e9 00 00 00 00 51 89 34 24 e9 00 00 00 00 89 exception.symbol: random+0x243da8 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2375080 exception.address: 0x2a3da8 registers.esp: 8519164 registers.edi: 4294939404 registers.eax: 2765665 registers.ebp: 3990859796 registers.edx: 1948915084 registers.ebx: 1375758944 registers.esi: 2760544 registers.ecx: 1866678959	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 55 54 5d 81 c5 04 00 00 00 81 ed 04 00 00 00 exception.symbol: random+0x2438aa exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2373802 exception.address: 0x2a38aa registers.esp: 8519168 registers.edi: 4294939404 registers.eax: 2795089 registers.ebp: 3990859796 registers.edx: 1948915084 registers.ebx: 1375758944 registers.esi: 2760544 registers.ecx: 1866678959	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 51 c7 04 24 ba 0f 3d 59 e9 45 00 00 00 57 50 exception.symbol: random+0x243768 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2373480 exception.address: 0x2a3768 registers.esp: 8519168 registers.edi: 4294939404 registers.eax: 2768365 registers.ebp: 3990859796 registers.edx: 1948915084 registers.ebx: 0 registers.esi: 109842272 registers.ecx: 1866678959	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 68 00 a8 5a 59 89 2c 24 bd 8b e6 f7 39 68 80 exception.symbol: random+0x2446bb exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2377403 exception.address: 0x2a46bb registers.esp: 8519168 registers.edi: 0 registers.eax: 29832 registers.ebp: 3990859796 registers.edx: 0 registers.ebx: 2772610 registers.esi: 0 registers.ecx: 834182541	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 81 c7 2a ec f7 7e 57 89 04 24 89 1c 24 55 e9 exception.symbol: random+0x24957a exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2397562 exception.address: 0x2a957a registers.esp: 8519164 registers.edi: 2787860 registers.eax: 28535 registers.ebp: 3990859796 registers.edx: 0 registers.ebx: 65804 registers.esi: 0 registers.ecx: 1969225870	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb e9 93 fc ff ff 81 f8 84 9c ff ff 0f 85 29 03 exception.symbol: random+0x249072 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2396274 exception.address: 0x2a9072 registers.esp: 8519168 registers.edi: 2816395 registers.eax: 28535 registers.ebp: 3990859796 registers.edx: 0 registers.ebx: 65804 registers.esi: 0 registers.ecx: 1969225870	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 51 e9 f5 00 00 00 81 ed ae 94 7a 9d 31 e9 5d exception.symbol: random+0x249084 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2396292 exception.address: 0x2a9084 registers.esp: 8519168 registers.edi: 2816395 registers.eax: 4294941828 registers.ebp: 3990859796 registers.edx: 0 registers.ebx: 24811 registers.esi: 0 registers.ecx: 1969225870	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 53 bb 40 05 a7 5f 01 de e9 21 00 00 00 52 ba exception.symbol: random+0x24c535 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2409781 exception.address: 0x2ac535 registers.esp: 8519164 registers.edi: 2798266 registers.eax: 28559 registers.ebp: 3990859796 registers.edx: 481735354 registers.ebx: 1312529944 registers.esi: 2801154 registers.ecx: 0	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 53 e9 ed fe ff ff 68 c0 cf f7 3f 5e 81 f6 e2 exception.symbol: random+0x24c888 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2410632 exception.address: 0x2ac888 registers.esp: 8519168 registers.edi: 2798266 registers.eax: 28559 registers.ebp: 3990859796 registers.edx: 481735354 registers.ebx: 4294941616 registers.esi: 2829713 registers.ecx: 157417	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 2d 56 81 7b 7e 68 d9 ef ae 32 e9 67 fd ff ff exception.symbol: random+0x24d488 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2413704 exception.address: 0x2ad488 registers.esp: 8519164 registers.edi: 2798266 registers.eax: 2805044 registers.ebp: 3990859796 registers.edx: 524582407 registers.ebx: 4294941616 registers.esi: 2829713 registers.ecx: 517475747	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 53 89 0c 24 68 6b 7c e3 7d e9 00 00 00 00 59 exception.symbol: random+0x24d4c2 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2413762 exception.address: 0x2ad4c2 registers.esp: 8519168 registers.edi: 607422807 registers.eax: 2833131 registers.ebp: 3990859796 registers.edx: 524582407 registers.ebx: 4294941616 registers.esi: 2829713 registers.ecx: 4294942176	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 2d 67 dc 57 7f e9 96 00 00 00 89 c1 58 81 ea exception.symbol: random+0x26a8c9 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2533577 exception.address: 0x2ca8c9 registers.esp: 8519164 registers.edi: 2902430 registers.eax: 2924071 registers.ebp: 3990859796 registers.edx: 2130566132 registers.ebx: 1969225702 registers.esi: 9879532 registers.ecx: 0	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 29 f6 e9 20 ff ff ff 83 c4 04 50 b8 ff ff ff exception.symbol: random+0x26a00c exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2531340 exception.address: 0x2ca00c registers.esp: 8519168 registers.edi: 2902430 registers.eax: 2954758 registers.ebp: 3990859796 registers.edx: 2130566132 registers.ebx: 1969225702 registers.esi: 9879532 registers.ecx: 0	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb e9 10 fd ff ff 53 c7 04 24 41 1b 7f 7d 8b 2c exception.symbol: random+0x26a625 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2532901 exception.address: 0x2ca625 registers.esp: 8519168 registers.edi: 2902430 registers.eax: 2954758 registers.ebp: 3990859796 registers.edx: 436827832 registers.ebx: 1969225702 registers.esi: 4294939520 registers.ecx: 0	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 81 ec 04 00 00 00 e9 ee 02 00 00 c1 e0 03 e9 exception.symbol: random+0x26acee exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2534638 exception.address: 0x2cacee registers.esp: 8519168 registers.edi: 2902430 registers.eax: 2956579 registers.ebp: 3990859796 registers.edx: 1396530597 registers.ebx: 823988410 registers.esi: 4294939520 registers.ecx: 0	1
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: fb 68 c2 56 b0 40 89 04 24 b8 e4 9b f7 7e 53 e9 exception.symbol: random+0x26ad55 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2534741 exception.address: 0x2cad55 registers.esp: 8519168 registers.edi: 2902430 registers.eax: 2930367 registers.ebp: 3990859796 registers.edx: 0 registers.ebx: 823988410 registers.esi: 9451 registers.ecx: 0	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Starts servers listening (3 events)

Time & API	Arguments	Status	Return
bind Sept. 2, 2024, 10:52 a.m.	ip_address: 127.0.0.1 socket: 244 port: 0	1	0
listen Sept. 2, 2024, 10:52 a.m.	socket: 244 backlog: 1	1	0
accept Sept. 2, 2024, 10:52 a.m.	ip_address: socket: 244 port: 0	1	252

HTTP traffic contains suspicious features which may be indicative of malware related traffic (26 events)

suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://185.215.113.16/Jo89Ku7d/index.php
suspicious_features	GET method with no useragent header	suspicious_request	GET http://ddl.safone.dev/3823166/crypted.exe?hash=AgADZl
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://185.215.113.16/inc/crypteda.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://185.215.113.26/Nework.exe
suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://185.215.113.26/Dem7kTu/index.php
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://185.215.113.16/inc/stealc_default2.exe
suspicious_features	GET method with no useragent header	suspicious_request	GET http://stagingbyvdveen.com/get/setup2.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://185.215.113.17/
suspicious_features	GET method with no useragent header	suspicious_request	GET http://ddl.safone.dev/3846636/Set-up.exe?hash=AgADDB
suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://185.215.113.17/2fb6c2cc8dce150a.php
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://185.215.113.17/f1ddeb6592c03206/sqlite3.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://154.216.17.170/joffer2.exe
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://185.215.113.17/f1ddeb6592c03206/freebl3.dll
suspicious_features	GET method with no useragent header	suspicious_request	GET http://ddl.safone.dev/3846244/1.exe?hash=AgADek
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://185.215.113.17/f1ddeb6592c03206/mozglue.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://185.215.113.17/f1ddeb6592c03206/msvcp140.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://185.215.113.17/f1ddeb6592c03206/nss3.dll
suspicious_features	GET method with no useragent header	suspicious_request	GET http://ddl.safone.dev/3846638/GetSys.exe?hash=AgADAh
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://185.215.113.17/f1ddeb6592c03206/softokn3.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://185.215.113.17/f1ddeb6592c03206/vcruntime140.dll
suspicious_features	POST method with no referer header	suspicious_request	POST http://sevxv17pt.top/v1/upload.php
suspicious_features	POST method with no referer header	suspicious_request	POST http://fivexv5vs.top/v1/upload.php
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://185.215.113.16/inc/Amadeus.exe
suspicious_features	GET method with no useragent header	suspicious_request	GET http://ddl.safone.dev/3840509/build.exe?hash=AgADNB
suspicious_features	GET method with no useragent header	suspicious_request	GET http://ddl.safone.dev/3850492/seidr_build.exe?hash=AgADjB
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://185.215.113.19/ProlongedPortable.dll

Performs some HTTP requests (27 events)

request	POST http://185.215.113.16/Jo89Ku7d/index.php
request	GET http://ddl.safone.dev/3823166/crypted.exe?hash=AgADZl
request	GET http://185.215.113.16/inc/crypteda.exe
request	GET http://185.215.113.26/Nework.exe
request	POST http://185.215.113.26/Dem7kTu/index.php
request	GET http://185.215.113.16/inc/stealc_default2.exe
request	GET http://stagingbyvdveen.com/get/setup2.exe
request	GET http://185.215.113.17/
request	GET http://ddl.safone.dev/3846636/Set-up.exe?hash=AgADDB
request	POST http://185.215.113.17/2fb6c2cc8dce150a.php
request	GET http://185.215.113.17/f1ddeb6592c03206/sqlite3.dll
request	GET http://154.216.17.170/joffer2.exe
request	GET http://185.215.113.17/f1ddeb6592c03206/freebl3.dll
request	GET http://ddl.safone.dev/3846244/1.exe?hash=AgADek
request	GET http://185.215.113.17/f1ddeb6592c03206/mozglue.dll
request	GET http://185.215.113.17/f1ddeb6592c03206/msvcp140.dll
request	GET http://185.215.113.17/f1ddeb6592c03206/nss3.dll
request	GET http://ddl.safone.dev/3846638/GetSys.exe?hash=AgADAh
request	GET http://185.215.113.17/f1ddeb6592c03206/softokn3.dll
request	GET http://185.215.113.17/f1ddeb6592c03206/vcruntime140.dll
request	POST http://sevxv17pt.top/v1/upload.php
request	POST http://fivexv5vs.top/v1/upload.php
request	GET http://185.215.113.16/inc/Amadeus.exe
request	GET http://ddl.safone.dev/3840509/build.exe?hash=AgADNB
request	GET http://ddl.safone.dev/3850492/seidr_build.exe?hash=AgADjB
request	GET http://x1.i.lencr.org/
request	GET http://185.215.113.19/ProlongedPortable.dll

Sends data using the HTTP POST Method (5 events)

request	POST http://185.215.113.16/Jo89Ku7d/index.php
request	POST http://185.215.113.26/Dem7kTu/index.php
request	POST http://185.215.113.17/2fb6c2cc8dce150a.php
request	POST http://sevxv17pt.top/v1/upload.php
request	POST http://fivexv5vs.top/v1/upload.php

Resolves a suspicious Top Level Domain (TLD) (1 event)

domain

fivexv5vs.top

description

Generic top level domain TLD

Allocates read-write-execute memory (usually to unpack itself) (50 out of 218 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7793f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x778b0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 188416 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00061000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00da0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00db0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00dc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02580000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02590000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02660000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02770000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02780000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02860000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02870000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02980000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02990000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02aa0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ab0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ac0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02e10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00dc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00dc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00dc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00dc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00dc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 724 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03090000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:51 a.m.	process_identifier: 1236 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000006920000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 2260 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7793f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 2260 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x778b0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 2260 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 188416 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c21000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 2260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00470000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 2260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00540000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 2260 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00590000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 2260 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00830000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 2260 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 2260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 2260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 2260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 2260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ba0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 2260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bf0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 2260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 2260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 2260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 2260 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02500000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Steals private information from local Internet browsers (50 out of 5881 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64\Local Extension Settings\cjmkndjhnagcfbpiemnkdpomccnjblmj\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\FontLookupTableCache\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\pnacl\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Local Extension Settings\djclckkglechooblngghdinmeemkbgci\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Last Version\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Last Version\Local Extension Settings\lpilbniiabackdjcionkobglmddfbcjo\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64\Local Extension Settings\apenkfbbpmhihehmihndmmcdanacolnh\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\PepperFlash\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Cookies-journal\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\Network\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Local Extension Settings\aodkkagnadcbobfpggfnjeongemjbjca\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\_locales\fil\messages.json\Network\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SwReporter\Local Extension Settings\aijcbedoijmgnlmjeegjaglmepbmpkpi\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\PnaclTranslationCache\Local Extension Settings\ciojocpkclfflombbcfigcijjcbkmhaf\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SafetyTips\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\RecoveryImproved\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log\Network\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opfgelmcmbiajamepnmloijbpoleiama\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\_locales\sv\Network\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\TLSDeprecationConfig\Local Extension Settings\fiikommddbeccaoicoejoniammnalkfa\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\OriginTrials\Local Extension Settings\oboonakemofpalcgghocfoadofidjkkk\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_2\Network\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Cookies-journal\Local Extension Settings\fooolghllnmhmmndgjiamiiodkpenpbb\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\PnaclTranslationCache\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\FontLookupTableCache\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\LOCK\Network\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8620.824.0.0_0\_locales\fa\messages.json\Network\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64\Local Extension Settings\bfogiafebfohielmmehodmfbbebbbpei\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ZxcvbnData\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\MANIFEST-000001\Network\Cookies
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SafetyTips\Local Extension Settings\naepdomgkenhinolocfifgehidddafch\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\TLSDeprecationConfig\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\omaabbefbmiijedngplfjmnooppbclkk\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\SafetyTips\Local Extension Settings\pdadjkfkgcafgbceimcpbkalnfnepbnk\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\TLSDeprecationConfig\Local Extension Settings\bmikpgodpkclnkgmnpphehdgcimmided\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\Local Extension Settings\fdjamakpfbbddfjaooikfcpapjohcfmg\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcobl\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\WidevineCdm\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba\CURRENT
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing Channel IDs\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch\CURRENT

Looks up the external IP address (1 event)

domain

ipinfo.io

Creates executable files on the filesystem (19 events)

file	C:\Users\test22\1000238002\Amadeus.exe
file	C:\Users\test22\AppData\Local\Temp\1000004001\crypteda.exe
file	C:\Users\test22\AppData\Local\Temp\1000005001\Nework.exe
file	C:\Users\test22\AppData\Local\Temp\1000228001\GetSys.exe
file	C:\ProgramData\freebl3.dll
file	C:\Users\test22\AppData\Local\Temp\1000248001\seidr_build.exe
file	C:\ProgramData\msvcp140.dll
file	C:\Users\test22\AppData\Local\Temp\1000011001\joffer2.exe
file	C:\Users\test22\AppData\Local\Temp\1000002001\crypted.exe
file	C:\Users\test22\AppData\Local\Temp\1000066001\stealc_default2.exe
file	C:\ProgramData\nss3.dll
file	C:\Users\test22\AppData\Local\Temp\1000009001\setup2.exe
file	C:\Users\test22\AppData\Local\Temp\1000129001\Set-up.exe
file	C:\Users\test22\AppData\Local\Temp\1000191001\1.exe
file	C:\Users\test22\AppData\Local\Temp\1000243001\runtime.exe
file	C:\Users\test22\AppData\Local\Temp\1000241001\build.exe
file	C:\ProgramData\vcruntime140.dll
file	C:\ProgramData\mozglue.dll
file	C:\ProgramData\softokn3.dll

Creates hidden or system file (4 events)

Time & API	Arguments	Return
NtCreateFile Sept. 2, 2024, 10:58 a.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Roaming\Microsoft desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	3221225525
NtCreateFile Sept. 2, 2024, 10:58 a.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Roaming\Microsoft\Crypto desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Crypto create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	3221225525
NtCreateFile Sept. 2, 2024, 10:58 a.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	3221225525
NtCreateFile Sept. 2, 2024, 10:58 a.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3832866432-4053218753-3017428901-1001 desired_access: 0x00100001 (FILE_READ_DATA\|FILE_LIST_DIRECTORY\|SYNCHRONIZE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3832866432-4053218753-3017428901-1001 create_options: 16417 (FILE_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_OPEN_FOR_BACKUP_INTENT) status_info: 4294967295 () share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	3221225525

Drops a binary and executes it (12 events)

file	C:\Users\test22\AppData\Local\Temp\44111dbc49\axplong.exe
file	C:\Users\test22\AppData\Local\Temp\1000002001\crypted.exe
file	C:\Users\test22\AppData\Local\Temp\1000004001\crypteda.exe
file	C:\Users\test22\AppData\Local\Temp\1000129001\Set-up.exe
file	C:\Users\test22\AppData\Local\Temp\1000228001\GetSys.exe
file	C:\Users\test22\1000238002\Amadeus.exe
file	C:\Users\test22\AppData\Local\Temp\1000241001\build.exe
file	C:\Users\test22\AppData\Local\Temp\1000243001\runtime.exe
file	C:\Users\test22\AppData\Local\Temp\1000248001\seidr_build.exe
file	C:\Users\test22\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
file	C:\Users\test22\AppData\Local\Temp\1000009001\setup2.exe
file	C:\Users\test22\AppData\Local\Temp\1000011001\joffer2.exe

Drops an executable to the user AppData folder (13 events)

file	C:\Users\test22\AppData\Local\Temp\JhCTEUiuPFSAmdKyCcGU.dll
file	C:\Users\test22\AppData\Local\Temp\1000009001\setup2.exe
file	C:\Users\test22\AppData\Local\Temp\1000002001\crypted.exe
file	C:\Users\test22\AppData\Local\Temp\44111dbc49\axplong.exe
file	C:\Users\test22\AppData\Local\Temp\BawuYOCdGNZiqevXAMeS.dll
file	C:\Users\test22\AppData\Local\Temp\service123.exe
file	C:\Users\test22\AppData\Local\Temp\1000004001\crypteda.exe
file	C:\Users\test22\AppData\Local\Temp\1000129001\Set-up.exe
file	C:\Users\test22\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
file	C:\Users\test22\AppData\Local\Temp\1000228001\GetSys.exe
file	C:\Users\test22\AppData\Local\Temp\1000241001\build.exe
file	C:\Users\test22\AppData\Local\Temp\1000243001\runtime.exe
file	C:\Users\test22\AppData\Local\Temp\1000011001\joffer2.exe

A process created a hidden window (15 events)

Time & API	Arguments	Status	Return
ShellExecuteExW Sept. 2, 2024, 10:58 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\44111dbc49\axplong.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\44111dbc49\axplong.exe	1	1
ShellExecuteExW Sept. 2, 2024, 10:58 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000002001\crypted.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000002001\crypted.exe	1	1
ShellExecuteExW Sept. 2, 2024, 10:58 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000004001\crypteda.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000004001\crypteda.exe	1	1
ShellExecuteExW Sept. 2, 2024, 10:58 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000005001\Nework.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000005001\Nework.exe	1	1
ShellExecuteExW Sept. 2, 2024, 10:58 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000066001\stealc_default2.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000066001\stealc_default2.exe	1	1
ShellExecuteExW Sept. 2, 2024, 10:59 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000129001\Set-up.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000129001\Set-up.exe	1	1
ShellExecuteExW Sept. 2, 2024, 10:59 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000191001\1.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000191001\1.exe	1	1
ShellExecuteExW Sept. 2, 2024, 10:59 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000228001\GetSys.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000228001\GetSys.exe	1	1
ShellExecuteExW Sept. 2, 2024, 10:59 a.m.	show_type: 0 filepath_r: C:\Users\test22\1000238002\Amadeus.exe parameters: filepath: C:\Users\test22\1000238002\Amadeus.exe	1	1
ShellExecuteExW Sept. 2, 2024, 10:59 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000241001\build.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000241001\build.exe	1	1
ShellExecuteExW Sept. 2, 2024, 10:59 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000243001\runtime.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000243001\runtime.exe	1	1
ShellExecuteExW Sept. 2, 2024, 10:59 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000248001\seidr_build.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000248001\seidr_build.exe	1	1
ShellExecuteExW Sept. 2, 2024, 10:58 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\054fdc5f70\Hkbsse.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\054fdc5f70\Hkbsse.exe	1	1
ShellExecuteExW Sept. 2, 2024, 10:59 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000009001\setup2.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000009001\setup2.exe	1	1
ShellExecuteExW Sept. 2, 2024, 10:59 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\1000011001\joffer2.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\1000011001\joffer2.exe	1	1

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (24 events)

Time & API	Arguments	Status	Return
Process32NextW Sept. 2, 2024, 10:59 a.m.	snapshot_handle: 0x00000294 process_name: pw.exe process_identifier: 1944	1	1
Process32NextW Sept. 2, 2024, 10:59 a.m.	snapshot_handle: 0x00000294 process_name: taskhost.exe process_identifier: 1884	1	1
Process32NextW Sept. 2, 2024, 10:59 a.m.	snapshot_handle: 0x00000294 process_name: SearchProtocolHost.exe process_identifier: 1608	1	1
Process32NextW Sept. 2, 2024, 10:59 a.m.	snapshot_handle: 0x00000294 process_name: axplong.exe process_identifier: 2260	1	1
Process32NextW Sept. 2, 2024, 10:59 a.m.	snapshot_handle: 0x00000294 process_name: svchost.exe process_identifier: 2816	1	1
Process32NextW Sept. 2, 2024, 10:59 a.m.	snapshot_handle: 0x00000294 process_name: mscorsvw.exe process_identifier: 2948	1	1
Process32NextW Sept. 2, 2024, 10:59 a.m.	snapshot_handle: 0x00000294 process_name: sppsvc.exe process_identifier: 2996	1	1
Process32NextW Sept. 2, 2024, 10:59 a.m.	snapshot_handle: 0x00000294 process_name: Hkbsse.exe process_identifier: 2236	1	1
Process32NextW Sept. 2, 2024, 10:59 a.m.	snapshot_handle: 0x00000294 process_name: stealc_default2.exe process_identifier: 2128	1	1
Process32NextW Sept. 2, 2024, 10:59 a.m.	snapshot_handle: 0x0000043c process_name: joffer2.exe process_identifier: 2600	1	1
Process32NextW Sept. 2, 2024, 10:59 a.m.	snapshot_handle: 0x0000043c process_name: Set-up.exe process_identifier: 2572	1	1
Process32NextW Sept. 2, 2024, 10:59 a.m.	snapshot_handle: 0x0000043c process_name: cmd.exe process_identifier: 2728	1	1
Process32NextW Sept. 2, 2024, 10:59 a.m.	snapshot_handle: 0x0000043c process_name: conhost.exe process_identifier: 2732	1	1
Process32NextW Sept. 2, 2024, 10:59 a.m.	snapshot_handle: 0x0000043c process_name: pw.exe process_identifier: 2792	1	1
Process32NextW Sept. 2, 2024, 10:59 a.m.	snapshot_handle: 0x0000043c process_name: 1.exe process_identifier: 2928	1	1
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: WmiPrvSE.exe process_identifier: 2288	1	1
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: cmd.exe process_identifier: 1156	1	1
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: conhost.exe process_identifier: 2452	1	1
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: pw.exe process_identifier: 1968	1	1
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: build.exe process_identifier: 2072	1	1
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: conhost.exe process_identifier: 2248	1	1
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: runtime.exe process_identifier: 2228	1	1
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: seidr_build.exe process_identifier: 1012	1	1
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: conhost.exe process_identifier: 2692	1	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 2, 2024, 10:52 a.m.	flags: 15 family: 0		111	0

An executable file was downloaded by the processes axplong.exe, hkbsse.exe, stealc_default2.exe, runtime.exe (21 events)

Time & API	Arguments	Status	Return
InternetReadFile Sept. 2, 2024, 10:58 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL`ÐfàÞ ®ý @ @Õ_`XýS. ü H.text´Ý Þ `.rsrc.à@@.reloc è@BýHxë¨B©(¹ü\|=C5H²ô£ýíÉÊ<6í2Ç«ù&¡+3ê½åg^cÜÅF1u×£À¿p.(Cëã:(åS+Ìþ?®EVÚÔè\ÊK©µßý ¾Ùúëxá¹Mrï×=62`è~B5=ûrQâø-]@m±1wL6RHÔTZ+üõÊ\|ÖÂ¾6ÃøiP"Íg×ý,ñd×l¡çÚb¤Ãî×$?=sjLÄãÇlNA¥BÙÁ ø<<¤YÁ5åÈ§ ñºãï¯ÛsT Û<]ïÝ M&R\|ðáÝ¦çùP§E:j¤ þQN9r"í,«üNÈuTÍY§rY¦×´®üM9ýI®`5ëýÚî¢HØï.ûóûâ¸eëòc:[´d2{ç§Â{n9ÿ9u¾ ñ¡Ë²)bÝSà¯ÌÇ²bÃ1Ä9¥Vv©óaiÄªá8bU4sîK(x4\|s+û-cSÎ']ÖmU `ÿ´PÜØ?ý¼RÔ i0)&\®<y3ÜkËC3(°iòö½uEì%¿»\h-ªh¯]I-ÇÉÀ¸3^s ÿ®0ò["½&Í^µÜõ9æçÜ1ÿyºú?ÆÔÅÛb -mì¹+ßä]ôï\¦GÚ,0;N&ÞLªEa!Oä.jÍõ1Zó´[]¤ÐI¢¾âÖh¶]N¢ "Ø0ÂxkÖ_9¾#RèßPzÍàGÈåúe¿¦yÙJM½~¥ÃÃG4»!= aäªj#gTá\´«=ÂËrTÄÔ)]¥¯ý×þòÎÍqðjüëjÔ¯'ÇÀ$r~S·Åaó®_¡Äê°@çI/á¹èG}âÆ"¡NñuK ÈÇdTÈa(å §&%:Õ yh#ü,ú¶pV¹-üÇBk:=ÖË;ÉýrG¼£²k:'Xrï¼%4Vi3ý¶&Øì}UÙfÈ¾` âJ'rgíhpm°ïy:ZqIt ¹H©/AÑ C4WVâYá?Ôñþüeí i>z+qqÿ§¦ÑzWÚ5ØVpÞ3máHn´P®þïåæeP.¸4pÍoYÆÑ_.¹ÓÉ¶ÎÿªÚToô@ðåçÍJËüø<zcwIo]KiÏÔ!I5äXM²És¨&=DA9÷®¢ÀÇGîÍ6èNõ EãÏëÍPjg%åZËÇcµ¤» ïìSî§\©Þ§¯ü.eì2¹UAÚ6¾û¢¦kîx,ö1\qóðñ7ËkýcÈr¿A@Ó"Yñï/ËÕY6û§þdËÛfF0Z" ÑìâQWÔ@ÁÏd¥óÔ·©(0æõàäåÛ©ÆÄÍÖ±-¦[)ñÊá3n¯ë`yåº<RpeKÄ×Xw7&' TíÙ4±óõt»ü²(3Zßâõ{T![\|QHYiª·ñ[Ïô0Ûl+ûü;# üÕÞù iPöðNÈP[Ù Wf^#Ãg7Ö±É(ÝUÕcú¡Çíj7³$zçßç8}6íZ@N]CÂÇát:®'+Q q÷Ëç0¦ÃdìãûuFWLàÇÙëv#gì?¼+î ªnijríµËev3ë®Q©Ï½/m3Áî[¥¸©õ[ü´¿tQ$J¢¥M?/ib&È¼1½¡ì6º¿úwõ,Ë\|9Ùëwe}Qª+nûCu_rÞ]AK\Z³R(ÁÏWò{ªv\T$æÏ#<Ný´à@dnX ÄD©òÓsaºüÇ¡¿ðÔµG®-,À'1Å$sZ}@yõ¡Öôÿ±;_º½x}åÚ^]×ùtiTxà_E&§Q\N-Â¥aüÎWÁÛ£Êp+¦äç]~"®¿''ó{B¾ÀKæLØâßMÔ]@¯¶ÑÂ4ª5[ã¾öû[VJÓWÁâiÈÀQCôã:HQ³UëÁé³4nãf»cµXÂWïÒKA/µSôkNL5ÊJ7@w9µÍÞ¥Õ¶¹Ö¼pÿ\|k0¹ÁÆh'Aæùsþ8Xu®EÂ õÏQy{ÿ>çô&¹F§#&Õ}à.²Ë¿åÝ8dHsJ¶ët é¾ZÊVpÖU6l¡Fs Ä]z·U ¶¥a\|k¾ ¥Óc\æ¹P çY=vNr0ÄovÕAb;¼êø>[Y±)õ0d[ÞUY`>õÚwÇm¾+¸ý.ì9YqAdºb JE©/È 1"Vöñòcc¼Jæa> ú¬öÒïÓëÑh\aN¸»ÝpÞéÕ]¬R Þh;.güYèßnlW±FÀ +¬]×>ÕøPR+]aqÍeñÐã(w¥}²þ:ËØ¾^TxRÝ¼Ã5#®zÎ 27gîØÜiàæ=J\|´6×¡J¯QÌî¤;Mr%á-6©2D:K?úS±ä28D¸KOO:@m[%«I'^üb½UÑ]ª-× O½\|09HÈ½>Ø7I,ûì$j!r¼ý¹Ý¯ZñbhéLáû) °QÝºÿÄ>!þ´á»År¼Ô;»Ó+7Ü-~[}DáOQ>RÏiv{Cô6òS/VÂ3#É>°ùØdç½S]ÁQ> ½2ÜÏ?oEâ® k9ðIÛ\|~ù=¬þ½)7R{A¹Øþé¤üÆÀDåîì >Ê¨jE°<tË2©\êí5\|PHðL¾'TãÞ¬>iowÂT?äÈ^X¿¬?6k¢kHDð «ÿCþQ®t;çF$EÃ´ îÄqÇ4ÐÛ.Þô×Ckßº~Ê\ è+íi¡ú}Ï÷ºhÃê¦2ãÏ©n?=NhíkrmÓ¯ÕÆÒI/^ÇÒh)%¡ãË_=Ðs-ÓáEâUe0\ºfÏHHýv}¯X¥JØ"ódO_çgOö$\|¾gZyl0ù<WÅ6úwÏF-ËÉmT:µ¥©ò^CÒQÎ&æ¥÷ÂqÁs'¦JÝ]Ãefüö¢§ ÎÞ¼»EKÐÚ#Çmú®´i{=F(1#cDUæëÔÎ¢gÊÿW\Þ±J1=@^ó ïgÓ;^7ü×Eò¨öpï!¹êvhÑî²"&y¿·F¨ÚÎÃé\|e<e½P0NÜP9,CìÕÆùAÀ!·(¬ÔÎ¹ô¤#MF:uô¯é ëLÎÙýh³ö´Þ8®þ\×`®¡©íe;W)D¤èñ¥å´}6d3F]È¸¡à§`¬ÙUÁ²\|F ·ã)jÈ¢ps,M?w¼pHqÕ¿j1.ìy8aðmÕAèvª^<Ë:§¸7ú<Î;$ëÜÌã¢á·êt5ÁÅ$õ HÇê£.[?i#©<p3(7êpK}=ô÷3kÚ$%hZÌK}Ò/PÂåÉJEÕZ\ºÑ9+ý6Ojyl½3sot%&"<ù½¦ìßó;ÀW úÛ«ÌÓbKúVíå.ÈÝeW(ò88´ d¬¬\|'Yoøöq °Û§ÏR°;î1Hô´idJ>%&òRÚ6µZKíâõ+Ò¤@<Ü`Ý]M÷$ú ¡gÕá:ÐØU7ºyß@ªóhHbE¶*n»þW·è¯ºù$ûÊÍ6vBOAþÈbÈ-9li«ET±J%7>ª`Ã5qµtI#} ØoêÔ'Ùo['5¨rs7Ó^p±æÅª¦È@oNíôsqVð«#Nv\|×:âbäô+Ï¸¬u{´]k¨ãÓ WöíB+_à©ë#³\| J &ÃÞ+4å¬hë? >}¡}p~, ÙDïN75øa"èäâM¤0%a-ò6CGÍ¤Kh)Õ¡ÀÃX¬®úµbyãJ/<7WeñÆóuÛ9RÅ zßd¨üpÞÃÝ`v°Ðÿéÿèb request_handle: 0x00cc000c	1	1
InternetReadFile Sept. 2, 2024, 10:58 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL\Ãfà¬Ê à@ `ÌÉOà°¶(&È H.text$ª ¬ `.rsrc°à®@@.reloc´@BÊH¹ ¬LævúlTp#E²'&ÈÄ@cCÎØtEÑ«ÈÉ% ëèprQA¸Uêv6ÕVÆ=CxGHòEÏ³ÞiÇ¡(hhÆqÄBfÀ}Æ¹¥gL-S¨1),pàªÄ×ç®¶$8ðij3¹ûà7Ó³ü«!TsÉßÏìT§[Ç Xª°PUE¥cÐ¸j ÅµsÊ¾]Eüõ÷qûXwsSÇY»®g)úÙçóõ7IªþîOK¯ m(d(½TÊÞË³´0`ÀV`³o»´Ý¬EGÊ#I ðq íÂlh9ñ+Õûäº>6Qá=ØS Óô³ÃíÀµ±-õÜÿ#ÕÒ]ÃrAËR Îú1?´[ü}l°ÝÇõjqD$úÅNÂxE1pÐóx[h~ÿÿ¾êÅi¾duÞ!x¨oÃDÏyue¶©åSÌ/z>\|Æ!æ 0è½^÷Ê¸w¬XÀ"ÐøñP9Ï1±âË\|Ï@lÏîÏø®ÃÓLôC`l>ÜåCUõsH1UcÅjv)µX´+nåK6w: ZUÄa.Ll?èrXðÏïÂ]083GÇ$)¤ÎõõMsâ@ú' d§AMmÎ8ÓçFY²~g}x_B /ãQêåôÀK%b[²øFèqÆôáÞ åãÓÊÃHë7>&Ð½ø6QxZy Nª¶Ú]=W¡êyyÒmß:Aón¢dnèýíñÈÕÒ°R÷s½_5`=6Ü9W¿îµ=¨àÖÕwxÅk\L½iÀVA ò×pRóTQ\|u9ä=0=KIºFo\n/ûw}UO §ãsÞ\|§ûæV5T²»T02ó+µ ^,×vXO+?zÉr¼ZÖÍ§I§y;§FÉ÷T(úh¹`¾[ô4{f\2e)lqÖø!4ç[¥CïdL4äÓá4Ó¼o[3¹PÔ¤Ý-¼Zbþq;÷¹ ÅEÄeº'{Èº¹øçð#X6D£p\á§nROìS?0}<ê½\|¾u0aÂ\¥-n{Y¨Z Nòqë¸$ðªÝöÄ_qª¿,NûâÎ¶ÓUþ8s/JsÀQa.e=ïqéÖáFô ¥½ÛhrÙÐ°æ8½Iòõbrêü.IF4/6:êNW,ný¤g9§ÓB5½ÿZ«ÕßmIzñù(_º:ö`Bt\|n°èP$þøþvj(Wâ<DîìYµAÊ¡P Ñ£}¶wW¡f<®ªóSÁ¶&ºW[¹,·{îdE.dîÄ3ý Ï+ F¦DWTÈË$Ôu´[ø`!AÏÕF¨xçXÐ´Õ1~í»ì(§/úb%³UÞ7$û-ä×¹7Úû$PsãÍÙSC¡øfÇAA6â[:gî®AÀËî;RÈæ\{¯ÑÚòjÅi¹U,áJKÿìå\|èüø¢ÝhËN/âNg½¨÷]°µfÈJ,~W3öÁÇáPg×°§²2ªsÝ¡°)'ìÆ¦ÍUU+ÐZÉ\9¦Æ£O´®ÓËNÑjrK\|G»0 ÓþÐ=Aóy»xØ¨Â:Øz%\|²äëMÏ:ã3Bñø\áû&WøEtÐ:x!ÿêù²_Ã ª>x ª~5rÜ ©Ä9¾Qiù»Ã®1§Lw¥ðx¯ø±cDWFÉU(ßÁp4´tÁ6> T^N±¢WÊJ~¹ç@t<1àÚk2tJ-a{ûº³ í%RÌ82B³5ml¿o1.Nu.±T`5McDÚº©Ú½a¿idÊªýnO8½)j ÉðûûÁ)ÏùÌ¤¨Ý%¦ß¾ü®LCOC}"O}`ADaxkòUÞqÕ¤%;@ZTÆü¡JnúüßYÏ5bbK°¾õKÆ}Êî~r;a«QI0Úÿ~ïÄÿéÿéIÏpÏüWH#ÁKU1eê÷;=àEï!u^uÒw"J©jpÚ»ÖF¥«'lFû¥?³Ê~ÔR@pÃ àZ£Åµcà6.Rt°[QúSxýåËöXE°ØÏ³hóÆue±CÿËßÎ^;î¿ð ÙJÇ#ËQ±[[f3æÃmÞÿzîÄå9ðàYë¼¼Í'@KÿQ¹Ngl©öâ@5Ù½}\|.Óë ß"súáÓö},c¢E!esÕ_RwJ»7ã¶R£yêÑàRø¸µû$]0ù-ò¹ýGK7ÏÈ¿yaÞLÑÈr/÷?«Bûg¥×ü_½ÐyIåÇV»ÝjLªÆÀëÌBÓ5éUl=@Âé»ûÒâÏùYéê-+àAHÆ÷.Ú÷"qýFØ?¶wQ2þWN:×rEâC¿b÷ÒçÚ±ö «=¢Ûy±ÃÝ;Æ¬¼¹{-¬_XË#â ¢Pk9o¹ZÕ¥Ò{N¯J¾ùdUõgg«Ä»F¹V¤ZìzÒQ¡ÜÔ¶çÒ5ü_²u¢¥xÅ2ë¼n^âÎç¬¡4KùÎô¯Ô&Ò1z®¥Ø6PåÆÚj¼w;#vo%'éÎprp V5qÙ´ ¹»ÐJCIÖæ£òÈ9ÕÆrLnKG(öa#aËÓüKû÷øgù©Í4/÷ò®Ëwwã=þmÒaY"#ÍÕíSNè4ÁGDúéíQ_~J6û ¼K5Û0¦Û8CñéÿRþñ¹'p/TÒR Ö²A·¿ynLoõgÆj'È²î5º2»Ó\|&TÑ«ôÌK:§Ï³³/õb c6]Uº£B~ªêóvª±âÕ^´âQ¶ÂXä°2Ä%IuLÐK}·LKÉ]çÍÜýâ£ÎF¢ÏýÃVcì$g\s5þXVçÈ-¬È Â.SmÚg2íÂäïÇe´FÌON²"'¾¹ ¯hÉÛð´~Õf"KÏåù÷ýÜ#AÇ+#ÞGØRÒOð8I¢ÀÁÍµ ¬ïZ÷ùMçÆÇ}ûmìÍªØ«ð@Ê¹vS%{wÊ¼ ½êgQJ R=E9TÀ¹_>[SEîKÒvsWªóÑI[¡Å°ºAëBC%EñÄ¸<¸ÈöÍ¯øR3]+ìëáª\|ÐæÒPß¬w°älíy-ßÁ±ìÛHv ùeJ>ähGûðD@EEãúnØ)¡zMq\|i¦åÅL&}µ2,ÀM¨õÆ\|"÷t2å´öÍßçü%Ìão"Ç ÒØaaîEá`thqKÖB6¯L¤ Aºyå{ó´ï=iÉXæ(÷ÄjÎ½LhCNïid6iÍÌ\|¡YºO5ß+#\r[aû6AYPåµm_Ny¼"Ý¿R«ÌSÊ=[W²5"] l=o)]},XÒQ±¤-+f+Ëtáû¾%Éï dIÈ´Z±ÕÈµ?¥Z.ÒZÉ%)¼ïÊf@VÔ]j^¸-³À;Qa,ÌZLqü¢²ÞÀ¬î PuÌ¾}þ-F(°shAèÑ$aYñMÏOñW@õ$ðÊîÒm¦GRüyzÇ8ÔÎ®áÃ°\¸cëiÌÍ}¬xéÃØkøuµ]·N^m`M:Pv:%y&¹ÛzUcúBO¶Ô'ÜÏñÐ_¡ßÜ£5DæÀMXíÒç·Mé©SªãçÏikU#¾F3D8ÄM<@¤Ñ xçB Èô°kØåP½:3¢?ÞÌ¬/OÎÆ~³&ÛÕp/wÖã´É¨ô¾kÓã½û7³[Ò.% m~Ë'ê² "ãÀ Ù:øEæ=ù=nxÆo½ÍR¸TEÆ©86§îB)ôÀJ¨>'±Þ¼ÎÜ³búbò¢Lõk»$&!Í©ðÌQÙE§ôbsxö»:kpÐ.!§PÕ»Á\|I)KTûX¼3/×É¹J èÓNhZ=.BLîäVÀÈà%¥=K'¿Á>/w*:ÞHâbä»ÐÒZ\å§;I¡óÖÔNPeÿùfG¥JHqàªnÉÍT¶©Js3Ï<µï{oÌ\«£{ ]ÈDq5?5vúlHÂÒ~¦ºÙæï request_handle: 0x00cc000c	1	1
InternetReadFile Sept. 2, 2024, 10:58 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ÌPJr>r>r>Ó=r>Ó;(r>]:r>]=r>];ýr>Ó:r>Ó?r>r?^r>7r>Ár><r>Richr>PEL ÊfàæÊE×@ð@Dà <Là8¼@È.text åæ `.rdata8ê@@.data\|f 4ü@À.rsrcà0@@.reloc<L N2@Bh`ÀDè¥ÄYÃÌÌÌÌhÀDèÄYÃÌÌÌÌj h`E¹<,FèïnhÀÀDètÄYÃÌÌÌj hE¹$2FèÏnh ÁDèTÄYÃÌÌÌjh¨E¹Ì2Fè¯nhÁDè4ÄYÃÌÌÌj h°E¹\-FènhàÁDèÄYÃÌÌÌjhÔE¹Ü1Fèonh@ÂDèôÃYÃÌÌÌjhìE¹d+FèOnh ÂDèÔÃYÃÌÌÌjhkE¹2Fè/nhÃDè´ÃYÃÌÌÌjhkE¹ü2Fènh`ÃDèÃYÃÌÌÌjhkE¹t-FèïmhÀÃDètÃYÃÌÌÌjhkE¹ìFèÏmh ÄDèTÃYÃÌÌÌjhE¹ô+Fè¯mhÄDè4ÃYÃÌÌÌjhE¹5FèmhàÄDèÃYÃÌÌÌjh E¹l2Fèomh@ÅDèôÂYÃÌÌÌjh,E¹DFèOmh ÅDèÔÂYÃÌÌÌjh8E¹2Fè/mhÆDè´ÂYÃÌÌÌjhLE¹.Fèmh`ÆDèÂYÃÌÌÌjDh`E¹85FèïlhÀÆDètÂYÃÌÌÌj\h¨E¹ü,FèÏlh ÇDèTÂYÃÌÌÌjhE¹.Fè¯lhÇDè4ÂYÃÌÌÌjhE¹ä)FèlhàÇDèÂYÃÌÌÌjh E¹,0Fèolh@ÈDèôÁYÃÌÌÌj<h<E¹´)FèOlh ÈDèÔÁYÃÌÌÌjh\|E¹)Fè/lhÉDè´ÁYÃÌÌÌjhE¹à5Fèlh`ÉDèÁYÃÌÌÌjXh E¹ô.FèïkhÀÉDètÁYÃÌÌÌjhüE¹ø5FèÏkh ÊDèTÁYÃÌÌÌjhE¹¤3Fè¯khÊDè4ÁYÃÌÌÌjh E¹ 5FèkhàÊDèÁYÃÌÌÌjh,E¹¼Fèokh@ËDèôÀYÃÌÌÌjh4E¹ü/FèOkh ËDèÔÀYÃÌÌÌjh<E¹Ô0Fè/khÌDè´ÀYÃÌÌÌjhDE¹d1Fèkh`ÌDèÀYÃÌÌÌjhLE¹FèïjhÀÌDètÀYÃÌÌÌjhTE¹,3FèÏjh ÍDèTÀYÃÌÌÌjh\E¹$/Fè¯jhÍDè4ÀYÃÌÌÌjhdE¹0FèjhàÍDèÀYÃÌÌÌjhlE¹´/Fèojh@ÎDèô¿YÃÌÌÌjhtE¹ð4FèOjh ÎDèÔ¿YÃÌÌÌjh\|E¹41Fè/jhÏDè´¿YÃÌÌÌjhE¹È5Fèjh`ÏDè¿YÃÌÌÌjhE¹´2FèïihÀÏDèt¿YÃÌÌÌjhE¹¤FèÏih ÐDèT¿YÃÌÌÌjhE¹ÔFè¯ihÐDè4¿YÃÌÌÌjh¸E¹+FèihàÐDè¿YÃÌÌÌjhÈE¹,Fèoih@ÑDèô¾YÃÌÌÌjhØE¹d.FèOih ÑDèÔ¾YÃÌÌÌjhàE¹D3Fè/ihÒDè´¾YÃÌÌÌjhèE¹(6Fèih`ÒDè¾YÃÌÌÌjhðE¹44FèïhhÀÒDèt¾YÃÌÌÌjhøE¹Ü+FèÏhh ÓDèT¾YÃÌÌÌjhE¹X6Fè¯hhÓDè4¾YÃÌÌÌjhE¹4+FèhhàÓDè¾YÃÌÌÌjh$E¹¬.Fèohh@ÔDèô½YÃÌÌÌjh,E¹Ä+FèOhh ÔDèÔ½YÃÌÌÌjh4E¹ä,Fè/hhÕDè´½YÃÌÌÌjh<E¹/Fèhh`ÕDè½YÃÌÌÌjhDE¹-FèïghÀÕDèt½YÃÌÌÌjhLE¹5FèÏgh ÖDèT½YÃÌÌÌjhTE¹2Fè¯ghÖDè4½YÃÌÌÌjh`E¹$,FèghàÖDè½YÃÌÌÌjhhE¹¬1Fèogh@×Dèô¼YÃÌÌÌjhpE¹Ä1FèOgh ×DèÔ¼YÃÌÌÌjhE¹.Fè/ghØDè´¼YÃÌÌÌjhE¹\Fègh`ØDè¼YÃÌÌÌjhE¹L4FèïfhÀØDèt¼YÃÌÌÌjhE¹3FèÏfh ÙDèT¼YÃÌÌÌjh¤E¹\|.Fè¯fhÙDè4¼YÃÌÌÌjh¬E¹h5FèfhàÙDè¼YÃÌÌÌjhÀE¹L.Fèofh@ÚDèô»YÃÌÌÌjhÔE¹5FèOfh ÚDèÔ»YÃÌÌÌjhôE¹¼-Fè/fhÛDè´»YÃÌÌÌjhE¹T,Fèfh`ÛDè»YÃÌÌÌjh E¹ô1FèïehÀÛDèt»YÃÌÌÌjh,E¹/FèÏeh ÜDèT»YÃÌÌÌjhDE¹p6Fè¯ehÜDè4»YÃÌÌÌjhPE¹\|4FèehàÜDè»YÃÌÌÌjhhE¹,Fèoeh@ÝDèôºYÃÌÌÌjh\|E¹D-FèOeh ÝDèÔºYÃÌÌÌjhE¹</Fè/ehÞDè´ºYÃÌÌÌjh E¹´,Fèeh`ÞDèºYÃÌÌÌjh´E¹Ä.FèïdhÀÞDètºYÃÌÌÌjhÀE¹D0FèÏdh ßDèTºYÃÌÌÌjhÌE¹4Fè¯dhßDè4ºYÃÌÌÌjhØE¹Ü.FèdhàßDèºYÃÌÌÌjhìE¹P5Fèodh@àDèô¹YÃÌÌÌjhE¹@6FèOdh àDèÔ¹YÃÌÌÌjhE¹ä2Fè/dháDè´¹YÃÌÌÌj@hE¹¤-Fèdh`áDè¹YÃÌÌÌjhTE¹0FèïchÀáDèt¹YÃÌÌÌjLh`E¹l/FèÏch âDèT¹YÃÌÌÌj<h°E¹\|+Fè¯châDè4¹YÃÌÌÌjhðE¹\|1FèchàâDè¹YÃÌÌÌjhE¹ä/Fèoch@ãDèô¸YÃÌÌÌjhE¹T/FèOch ãDèÔ¸YÃÌÌÌjhE¹1Fè/chäDè´¸YÃÌÌÌ request_handle: 0x00cc000c	1	1
InternetReadFile Sept. 2, 2024, 10:58 a.m.	buffer: MZÿÿ¸@èº´ Í!¸LÍ!This program cannot be run in DOS mode. $¢båæõ¶æõ¶æõ¶u^¶þõ¶uk¶ëõ¶u_¶Üõ¶ï{v¶åõ¶fzô·äõ¶ï{f¶áõ¶æô¶õ¶uZ¶ôõ¶uh¶çõ¶Richæõ¶PELàÈfà ÈB"dà@0$@Ø©<à#$àô.textJÆÈ à.rdataîÎàÐÌ@@.data+!°@À.relocDà#F¨@By¹ApÈAÙÈAUìQEEü}tMüÆUüÂUüEèEëàEå]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUìEèExMÿUMMMëä]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌUìQSjh0hÀAÈjÿ$ÐbEüPøtÀüÉÀøX}üt,ÀhÀæEüPèNsSÉÉü[hhÀAÈMüQÿdÏb[å]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌUìQÇEüjj@h0hÐjÿØÐbPÿÐbEü}üujÿìÏbèRÿÿÿå]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌUìì(EÜPÿtÏbMðMØ}ØsjÿìÏbå]ÃÌÌÌÌÌÌÌÌUì¡@ÍbPèâaPè,sÄÀu! ÎbQè9aPèsÄÀujÿìÏb]ÃÌÌUììjjj¡ÐÈbPÿ,ÐbEôj MôQÿÐÏbEøUôRjÿpÐb}ø}jÿìÏbå]ÃÌÌÌÌÌUììHj@jE¸PèrÇE¸@M¸QÿÑbøujhUÄREÀPèÁjhRPèÁEøUüëÇEøÇEü}üwr }øWsjÿìÏbå]ÃÌÌUììÇEøÿhjÿÀÐbPÿXÐbEôEüPhjMQURÿ¬ÏbÀuEøPMôQjjUREüPÿÏbMüQÿ(ÐbEôå]ÃÌÌÌÌUìì\hèjüÿÿPÿäàAÄh<MBhìMBhè\ÿÿÿÄPüÿÿQÿlÐbüÿÿRÿÏbøÊhbBüÿÿPÿlÐbhÿ Büÿÿèh´NBàûÿÿQðÉbRìûÿÿPüÿÿèÎÈèÇPüÿÿè«àûÿÿèìûÿÿèõhBøûÿÿè%jÈûÿÿQèrÄP¼ûÿÿR¡¤ÌbPÔûÿÿQøûÿÿèdÈèÍPøûÿÿèA¼ûÿÿèÔûÿÿèÈûÿÿèjøûÿÿèCPüÿÿRÿ0ÏbüÿÿPüÿÿQìÌøûÿÿRèæèÄÀtMüÿÿPüÿÿQìÌüÿÿRè»ìÌEPèÊ¤ûÿÿQè7Ä ¤ûÿÿèíøûÿÿè²PÿÏbøûÿÿèüÿÿèjjüÿÿRÿäàAÄøûÿÿè¦üÿÿèMèå]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUìQMüMüÁ\|ènMüÁHècMüÁ<èXMüÁ0èMMüèåå]ÃÌUìQMüEPMüè MÁ0QMüÁ0è»UÂ<RMüÁ<è©EÀHPMüÁHèMüUBTATMüUBXAXMüUB\A\MüUB`A`MüUBdAdMüUBhAhMüUBlAlMüUBpApMüUBtAtMüUBxAxMÁ\|QMüÁ\|è Eüå]ÂÌÌÌÌUìQMüMüÁ$èNMüÁèCMüÁè8Müè0å]ÃÌÌÌÌÌÌÌÌÌÌÌÌUìQMüEPMüèMÁQMüÁèUÂRMüÁèEÀ$PMüÁ$èwEüå]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌÌUììthBMèèêhBMôèÝEüÿÿ½üÿÿt½üÿÿtW½üÿÿéÇjhþÿÿQèqÄP\þÿÿRMèèoPMèèæ\þÿÿè;hþÿÿè0éjPþÿÿPèÍpÄPDþÿÿQMèèPMèè¡DþÿÿèöPþÿÿèëë@j(8þÿÿRèpÄP,þÿÿPMèèèPMèè_,þÿÿè´8þÿÿè©}0hbBüýÿÿQURþÿÿPhlOBþÿÿQUèR þÿÿPMôèÈèÈè{ÈèPMôèëüýÿÿè@þÿÿè5þÿÿè þÿÿèéM$QÀýÿÿRh¼PBÌýÿÿPMQØýÿÿRhPBäýÿÿPMèQðýÿÿRMôèùÈèÈèëÈètÈèÝPMôèTÀýÿÿè©ÌýÿÿèØýÿÿèäýÿÿèðýÿÿè} þÿÿPMôè>PÿÑbEä}äÿu5MôèVMèèNMèFMè>M$è6M4è®ûÿÿéhdQBÌþÿÿQÿÐbÀthRBÌþÿÿRÿÐbÀué}hBþÿÿè(}0æE$PlýÿÿQhTBxýÿÿRÌþÿÿPýÿÿQh\SBýÿÿREPýÿÿQh´RB¨ýÿÿREèP´ýÿÿQþÿÿè Èè)ÈèÈèÈèÈè ÈèvPþÿÿèêlýÿÿè?xýÿÿè4ýÿÿè)ýÿÿèýÿÿè¨ýÿÿè´ýÿÿèýé¦ÌþÿÿR0ýÿÿPhTUB<ýÿÿQURHýÿÿPh¬TBTýÿÿQUèR`ýÿÿPþÿÿèÑÈèZÈèÃÈèLÈèEPþÿÿè)0ýÿÿè~<ýÿÿèsHýÿÿèhTýÿÿè]`ýÿÿèRìÌþÿÿRèáèlÄÀ«h Bþÿÿèah¤VBüüÿÿPMQýÿÿRhüUBýÿÿP ðÉbQ ýÿÿRþÿÿèÈèÈè÷Èè request_handle: 0x00cc000c	1	1
InternetReadFile Sept. 2, 2024, 10:59 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELLøÓf2_E&à#èGZäf°H@°Æ.~f `³Bp³ä ³,$´¬Hàq³.textæGèG`P`.dataHHîG@`À.rdataØ H H@`@/4¨®ÀH°¤H@0@.bssTâfpL`À.edataB`³TL@0@.idataä p³ VL@0À.CRT4³`L@0À.tls³bL@0À.reloc,$ ³&dL@0B/14ÐÁZ@B/29Ä§àÁ¨Z@B/41XLÃN:\@B/55BãàÃä\@B/67TÐÄl]@0B/80a ðÄ ]@B/91Å]@B/102ÀÆ _@BÃ´&´&ì1Àf=@MZÇ@GóÇ<GóÇ8GóÇ0Góu<@º@PE@t`£p¡LGóÀtBÇ$èÆ×GèÉ×G`GóèÄ×GHGóè§G=ätN1ÀÄÃ´&Ç$è×Gë¼f·Qfút=fúu¹vø1ÀÒÀésÿÿÿvÇ$PèG1ÀÄÃ¶ytNÿÿÿè1ÀÉÀé<ÿÿÿ´&t&ì,¡4GóÇD$p£p¡,GóÇD$pD$ÇD$ pÇ$$pèöÖGÄ,ÃfL$äð1ÀÿqüUåWVU¤S×Q¹ìx5LGóó«ö d¡5róx1Ûët&9ÇÇ$èÿÖìØð±=$GóÀuÞ¡(Gó1Ûø¡(GóÀyÇp¡(GóøöÛ¡°¬ÀtÇD$ÇD$Ç$ÿÐìè_GÇ$ÿróì£dGóÇ$@èÞÛGèiGÇp@èâÕG1ÉÀuëMÒtDát'¹À¶ú ~çËóú"DËëè´&vÒtt&¶PÀÒtú ~ð£pLGóÛt¸ öEÐâ£$p44$èxÔG pEÛÃFü×EÐEÃÇ$èàÓGp4$è=ÔGCüOüt$L$$èÔG9}uÊEEÇE£ pè¡ýF¡p<róD$¡ pD$¡$p$è-Y p£pÉòpÒ¡eðY[^_]aüÃt&·EÔéÿÿÿ´&¡(Gó»øÿýÿÿÇ$è9ÔG¡(Góø þÿÿÇD$óÇ$óè÷ÓGÇ(GóÛìýÿÿ$Góéáýÿÿ´&v$ÿüqóìéOýÿÿ´&èËÓG¡peðY[^_]aüÃfÇD$óÇ$óÇ(GóèÓGénýÿÿEéÁþÿÿ$èMÓG´&¶ÇLGóé±üÿÿÇLGóé¡üÿÿìD$ $è)ÓGÀÀÄ¶À÷ØÃUåWVSìÇ$ ÿðqóìÀtsÃÇ$ ÿró=øqóì£(pÇD$ $ÿ×ìÆÇD$) $ÿ×£ìötÇD$,pÇ$ÀÿÖÇ$ @è^ÿÿÿeô[^_]Ã¶Ç¾ëÀ´&´&Uåì¡Àt Ç$ÀÿÐ¡(pÀt$ÿèqóìÉÃUåì¨ÇhÿÿÿOMÇlÿÿÿÒÇEðEpÿÿÿEtÿÿÿExÿÿÿE\|ÿÿÿEEEEE EE$EE(EE,EE0EE4EE8E E<E¤E@E¨EDE¬EHE°ELE´EPE¸ETE¼EXEÀE\EÄE`EÈEdEÌEhEÐElEÔEpEØEtEÜExEàE\|EäEèEìEðøwEðhÿÿÿpÿÿÿ$ÿÐëáÉÃUåìÇE@ÇEc¥~ÇEðEEEE EE¤EE¨EE¬EE°E E´E$E¸E(E¼E,EÀE0EÄE4EÈE8EÌE<EÐE@EÔEDEØEHEÜELEàEPEäETEèEXEìEðøwEðDU$ÿÐëçÉÃUåì(ÇEìÇ@ÇEðÅ@ÇEôEôDìÿàëEÂE$ÿÒìëèÉÃUåEÇ@]ÃUåì(ÇEô}ôt}ôuëE$è?(ÇEôëëÛÉÃUåìøÇEìM@ÇEð@ÇEôEôDìé1ä$Üà$ØÜ$ÔØ$ÐÔ$ÌÐ$ÈÌ$ÄÈ$ÀÄ$¼À$¸¼$´¸$°´$¬°$¨¬$¤¨$ ¤$ $$$$$$$D$\|D$xE\|D$tExD$pEtD$lEpD$hElD$dEhD$`EdD$\E`D$XE\D$TEXD$PETD$LEPD$HELD$DEHD$@EDD request_handle: 0x00cc000c	1	1
InternetReadFile Sept. 2, 2024, 10:59 a.m.	buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^BàH2V`@Ð7þú7@¸ Pv1f7!àDdÐCODE`FH `DATAd`L@ÀBSSQfÀ.idata¸ "f@À.tlsÀÀ.rdataÐ@P.relocDdàf@P.rsrcv1Pv1ð@PÐ7f7@P@Boolean@FalseTrue@,@Charÿ@@IntegerÿÿÿÀX@Byteÿl@Wordÿÿ@Cardinalÿÿÿÿ@ String¤@ WideString´@Variant@Ä@ OleVariant@@L3@X3@\3@`3@T3@´0@Ð0@1@TObject(@TObject@SystemH@ IInterfaceÀFSystemÿÿÌD$øéAFD$øé_FD$øéiFÌÌu@@@ÀF@@@¡@@Ð@L3@W@ W@`3@T3@°W@Ð0@1@TInterfacedObjectÀÿ%ÄEÀÿ%ÀEÀÿ%¼EÀÿ%¸EÀÿ%´EÀÿ%ØEÀÿ%°EÀÿ%ÔEÀÿ%¬EÀÿ%¨EÀÿ%¤EÀÿ% EÀÿ%EÀÿ%EÀÿ%EÀÿ%EÀÿ%EÀÿ%EÀÿ%EÀÿ%ÐEÀÿ%EÀÿ%\|EÀÿ%xEÀÿ%èEÀÿ%äEÀÿ%àEÀÿ%tEÀÿ%pEÀÿ%øEÀÿ%ôEÀÿ%ðEÀÿ%lEÀÿ%hEÀÿ%dEÀÿ%`EÀSÄ¼» TèYÿÿÿöD$,t·\$0ÃÄD[ÃÀÿ%\EÀÿ%XEÀÿ%TEÀÿ%PEÀÿ%LEÀÿ%HEÀÿ%DEÀÿ%@EÀSV¾èE>u:hDjè¨ÿÿÿÈÉu3À^[Ã¡äE äE3ÒÂÀDÁBúduì^[Ã@ÃÀSVòØèÿÿÿÀu3À^[ÃPVPXB°^[ÃP QèE£èEÃSVWUQñ$è]$PV;SS;ÂuÃè·ÿÿÿCCFëF;Cu ÃèÿÿÿCFß;ëuÃÖÅèVÿÿÿÀu3ÀZ]_^[ÃSVWUÄøØû2C;ðrpÎJèk;Íwb;ðuBCB)C{uHÃè9ÿÿÿë?ÎzÏèk;Íu){ë J${{+ù\|$+ðsÔÃèÐþÿÿÀu3Àë°ë;ûu3ÀYZ]_^[ÃSVWÚðþ}¾ëÆÿÿæÿÿsjh Vjèøýÿÿø;ÿt#Ó¸ìEèlþÿÿÀuhjPèÙýÿÿ3À_^[ÃSVWUÙòèÇCjh hUè¥ýÿÿø;ÿuÆÿÿæÿÿsjh VUèýÿÿ;t#Ó¸ìEèõýÿÿÀuhjPèbýÿÿ3À]_^[ÃSVWUÄìL$$ÇD$ÿÿÿÿ3ÒT$è$ÅD$ìEëQ;s;îwFÆC;D$w;;t$st$ÆC;D$vD$hjVèïüÿÿÀu ÇÈEÃèýÿÿßûìEu§D$3Ò\|$tD$T$D$+D$T$BÄ]_^[ÃSVWUÄôL$$Ðêåðÿÿ$ÂÿâðÿÿT$D$(D$+ÅT$B5ìEë<^~û;ëvÝ;\|$v\|$;ûvjh+ûWSè&üÿÿÀu D$3Òë 6þìEu¼Ä]_^[ÃÀSVWUQØóÆÿæðÿÿ4$ëêåðÿÿ$Å+$A5ìEë8^~û;$s$;ïsý;ûvh@+ûWSèûÿÿÀu ÇÈE6þìEuÀZ]_^[Ã@SVWUÄøòø½üEÇÿ?çÀÿÿ]ë3;{,Î×Cèºþÿÿ>tPFCF)C{u>Ãèìûÿÿë5;ÝuÉÖÇè÷üÿÿ>t!ÌÖÅèãûÿÿ<$u¥ÌVè±ýÿÿ3ÀYZ]_^[ÃÀSVWUÄì$úð½üEÇÿ?çÀÿÿ]ë;Ýt;suõ;suW;{L$×+SCCèÛüÿÿ\|$t3L$T$Åè]ûÿÿ\|$u±L$T$D$è%ýÿÿ$3ÒéL$×Æèüÿÿ\|$t4L$T$Åèûÿÿ\|$fÿÿÿL$T$D$èÚüÿÿ$3ÒëHk;õu:;{5$×Åèqýÿÿ$8t($@C$@)C{uÃèúÿÿë$3ÒÄ]_^[ÃSVWÄìù$ÿ?ãÀÿÿ4$ðæÀÿÿ;Þs[ÏÖ+ÓÃèýÿÿL$×¸üEè]úÿÿ\$ÛtL$T$Ãè&üÿÿD$D$D$D$\|$tT$¸üEèúÿÿë3ÀÄ_^[ÃUì3ÒUhâ@dÿ2d"hÌEè9ùÿÿ=MEt hÌEè.ùÿÿ¸ìEèùÿÿ¸üEèùÿÿ¸(EèxùÿÿhøjèÜøÿÿ£$E=$Et/¸$E3ÉLô@=uì¸E@£EÆÄE3ÀZYYdhé@=MEt hÌEè¯øÿÿÃéqëå ÄE]ÃUìS=ÄEÌ3ÒUhÆ@dÿ2d"=MEt hÌEèføÿÿÆÄE¡$EPè4øÿÿ3À£$EìEëhjCPè%øÿÿûìEuæ¸ìEèøÿÿ¸üEèøÿÿ¸(Eèuøÿÿ¡äEÀtäEPèÖ÷ÿÿ¡äEÀué3ÀZYYdhÍ@=MEt hÌEèÕ÷ÿÿhÌEèÓ÷ÿÿÃéëÛ[]ÃS;Eu PEPHù8;ÂuÉyÁÁù¡$ request_handle: 0x00cc000c	1	1
InternetReadFile Sept. 2, 2024, 10:59 a.m.	buffer: MZÿÿ@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELæ¨àHF , @p¬}ª@°§LÀ«À§Hë@3´.textÈGFHF `.rdata4µX`F¶XLF@@.data ò@À.idataL°§ô¤@À.relocHëÀ§ìú¤@B.symtab°«æ¨B.rsrcÀ«®è¨@@$ÃÌÌÌÌÌÌÌÌÌÌÌÌ$ÃÌÌÌÌÌÌÌÌÌÌÌÌ$ÃÌÌÌÌÌÌÌÌÌÌÌÌ$ÃÌÌÌÌÌÌÌÌÌÌÌÌ,$ÃÌÌÌÌÌÌÌÌÌÌÌÌ4$ÃÌÌÌÌÌÌÌÌÌÌÌÌ<$ÃÌÌÌÌÌÌÌÌÌÌÌÌ Ð#çd ;av ìèØD$$D$D$èÄÃèûëÉÌÌÌÌÌÌÌÌÌ Ð#çd ;aìD\$Hl$LëÍóí1Àé¯¸ÿÿÿÿÀ}è1É1öë'9èOp9õ;)Å}ÿùß÷ÛßÁÿ!þÞø\|°;cpu.u¨1ÒéyºÿÿÿÿL$,t$<ÒA9ÂíúØjüïÝ÷ÛÝÁýåJ4+9È®\|$(t$4)Ðxÿ\|$ß÷ÛßÁÿ!ù<\|$0øuf?onuaøëøuWf?ofuPL9fuGøßÃßúuf>alu\+;lu å1ÀéøD$åT$$\$(1ÀéÂèftÆà$ÇD$è°\|D$0$D$D$è\|^Ê$ÇD$ è\|D$4$D$(D$èr\|a$ÇD$è\\|èWtL$,t$<éKþÿÿD$\$8èÝsè$ÇD$!è'\|D$8$D$D$è\|a$ÇD$èý{èøsL$,t$<éìýÿÿå åëÀIÉ¶PÒtì¶P XÒtu¶+ÀulL$,D$@L$<PT$(è;sY$ÇD$è{D$<$D$(D$èq{Ã>$ÇD$è[{èVsD$@L$,élÿÿÿéeÿÿÿÄDÃ@9èIýÿÿ4>,uïéAýÿÿB9Âýÿÿ,}=uîévýÿÿE¶\|$9Ð å9ÈóÅÁà å\|9ßuÌl$ D$$t$\|$è%¶D$ÀuT$$\$(l$ t$4ë åD$ 9Èål$ÆD+ å9Èsuå¶\|$D+ L$,t$<ébüÿÿèüq¹§$ÇD$èFzD$4$D$(D$è2za$ÇD$èzèrL$,t$<éüÿÿèõèðèë5åD. @9Ø}& å9Ès.ÅÁå5åÆD. å9ÈrËë L$,t$<é¸ûÿÿè¢èÂÈÑèò¸ÑèæÑÂèðéèÔÁêèèåöéPûÿÿ Ð#çd ;avì0 f$èªD$Ç@ õd ¡-çHÇ@ ødH -çHÇ@$ ziH ©-çH(Ç@4 ¿H0 ¬-çH8Ç@D ItH@ ®-çHHÇ@T ûdHP ¯-çHXÇåÇå ¸'çÉtè åOåè© $D$(ø ååÂå9ÑsZ$T$L$ÇD$à D$èÞ·D$L$T$å¸'çÀtè åG åD$(ËåJûÁáÇDfÇD¸'çÒtMè© TWTWTWT WT(WT0WT8WT@è THWOt-çTÇDfÇD~iT°-çTÇD$fÇD,ámT ²-çT(ÇD4fÇD<æmT0³-çT8ÇDDfÇDLëmT@±-çTHø ååÂå9ÑsZ$T$L$ÇD$à D$èQ¶D$L$T$å¸'çÀtèåG åD$(ËåJûÁáÇDfÇD¸'çÒtMèTWTWTWT WT(WT0WT8WT@èTHWþd¢-çTÇDfÇDiT£-çTÇD$fÇD,iT §-çT(ÇD4fÇD<iT0¨-çT8ÇDDfÇDLeT@ª-çTHøå åÁå9ÈsZ$L$D$ÇD$à D$èÄ´D$L$T$å¸'çÀtèsåG åÐÊÁ åAýÁàÇDfÇD ¸'çÉt-èoLOLOLOL OL(O { ¤-çLÇDfÇD ¢L ¥-çLÇD$fÇD, ªL ¦-çL(Ç$ÇD$è D$À'D$$Ç$ÇD$èéD$d#çÇ$ÇD$èËD$©Á °-ç©Á ¬-ç©Á ±-ç©Á ²-ç©Á ³-ç©Á -ç©Á -ç©Á©Â«-ç!Ñ ª-ç©u1É1ÒëCD$,èQ$©t ©Áë1ÉÉt© t©@t ©Àë1ÀÂD$,©À!È¢-çD$$øüT$"L$#Ç$ÇD$è¾ request_handle: 0x00cc000c	1	1
InternetReadFile Sept. 2, 2024, 10:59 a.m.	buffer: MZÿÿ@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELRà¤$l °J@ WU@ÀRLÀTéÛÐR¼Ýà¼J´.textx¢$¤$ `.rdatadä%À$æ%¨$@@.data` °JJ@À.idataLÀRP@À.reloc¼ÝÐRÞ$P@B.symtab°TRB.rsrcéÛÀTÜR@@$ÃÌÌÌÌÌÌÌÌÌÌÌÌ$ÃÌÌÌÌÌÌÌÌÌÌÌÌ$ÃÌÌÌÌÌÌÌÌÌÌÌÌ$ÃÌÌÌÌÌÌÌÌÌÌÌÌ,$ÃÌÌÌÌÌÌÌÌÌÌÌÌ4$ÃÌÌÌÌÌÌÌÌÌÌÌÌ<$ÃÌÌÌÌÌÌÌÌÌÌÌÌ lBd ;av ìèØD$$D$D$èÄÃèïëÉÌÌÌÌÌÌÌÌÌ lBd ;aìD\$Hl$LëÍóí1Àé¯¸ÿÿÿÿÀ}è1É1öë'9èOp9õ;)Å}ÿùß÷ÛßÁÿ!þÞø\|°;cpu.u¨1ÒéyºÿÿÿÿL$,t$<ÒA9ÂíúØjüïÝ÷ÛÝÁýåJ4+9È®\|$(t$4)Ðxÿ\|$ß÷ÛßÁÿ!ù<\|$0øuf?onuaøëøuWf?ofuPL9fuGøßÃßúuf>alu\+;lu tG1ÀéøD$tGT$$\$(1ÀéÂèfn3Ûk$ÇD$è°vD$0$D$D$èv¹`l$ÇD$ èvD$4$D$(D$èrv~zk$ÇD$è\vèWnL$,t$<éKþÿÿD$\$8èÝmNhl$ÇD$!è'vD$8$D$D$èv~zk$ÇD$èýuèømL$,t$<éìýÿÿpG tGëÀIÉ¶PÒtì¶P XÒtu¶+ÀulL$,D$@L$<PT$(è;mø,l$ÇD$èuD$<$D$(D$èquÆl$ÇD$è[uèVmD$@L$,élÿÿÿéeÿÿÿÄDÃ@9èIýÿÿ4>,uïéAýÿÿB9Âýÿÿ,}=uîévýÿÿE¶\|$9Ð tG9ÈóÅÁà pG\|9ßuÌl$ D$$t$\|$è%¶D$ÀuT$$\$(l$ t$4ë tGD$ 9ÈpGl$ÆD+ tG9ÈsupG¶\|$D+ L$,t$<ébüÿÿèükMTl$ÇD$èFtD$4$D$(D$è2t~zk$ÇD$ètèlL$,t$<éüÿÿèåÿèàÿèÛÿ5pGD. @9Ø}& tG9Ès.ÅÁå5pGÆD. tG9ÈrËë L$,t$<é¸ûÿÿèÿèÿÂÈÑèâÿ¸ÑèÖÿÑÂèÿðéèÄÿÁêè{ÿèÕêéPûÿÿ lBd ;avì0À4g$è+¨D$Ç@ ,~k áIHÇ@ /~kH àIHÇ@$ kH éIH(Ç@4 VkH0 ìIH8Ç@D ¨kH@ îIHHÇ@T 2~kHP ïIHXÇtGÇxG øDÉtèÿý pGOpGè© $D$(ø xGtGÂpG9ÑsZ$T$L$ÇD$ÀciD$è~¬D$L$T$xGøDÀtè}ýpGG pGD$(ËtGJûÁáÇDfÇDøDÒtMèýTWTWTWT WT(WT0WT8WT@èýüTHW®kíITÇDfÇDkTðITÇD$fÇD,ôkT òIT(ÇD4fÇD<ùkT0óIT8ÇDDfÇDLþkT@ñITHø xGtGÂpG9ÑsZ$T$L$ÇD$ÀciD$èñªD$L$T$xGøDÀtèðûpGG pGD$(ËtGJûÁáÇDfÇDøDÒtMèüTWTWTWT WT(WT0WT8WT@èpûTHW5~kâITÇDfÇD¡kTãITÇD$fÇD,¥kT çIT(ÇD4fÇD<©kT0èIT8ÇDDfÇDL8~kT@êITHøxG tGÁpG9ÈsZ$L$D$ÇD$ÀciD$èd©D$L$T$xGøDÀtècúpGG pGÐÊÁ tGAýÁàÇDfÇD øDÉt-è_úLOLOLOL OL(O Ok äILÇDfÇD JkL åILÇD$fÇD, RkL æIL(Ç$ÇD$è D$À'D$$Ç$ÇD$èéD$HBÇ$ÇD$èËD$©Á ðI©Á ìI©Á ñI©Á òI©Á óI©Á íI©Á àI©Á©ÂëI!Ñ êI©u1É1ÒëCD$,èQ$©t ©Áë1ÉÉt© t©@t ©Àë1ÀÂD$,©À!ÈâID$$øüT$"L$#Ç$ÇD$è¾ request_handle: 0x00cc000c	1	1
InternetReadFile Sept. 2, 2024, 10:59 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL]ÝDà0B2®a @ à@`aK¬.À H.text´A B `.rsrc¬.0D@@.relocÀt@BaHDZh¤Í¬þÀ.(ò(0 Îs ~%:&~þ&s %(+o 8[o %F~((¢%G~((¢%H~((¢%e~((¢~)(¡ o 8Ô( ssÔ~ }~ s ( o }{I~((o 9I~((8C~((o :{~(¥8{~+(©( þ 9Ño ( o o ( {~,(( þ 9s s s þs ~%:&~þ's! %(+þs ~%:&~þ(s! %(+þs ~%:&~þ)s! %(+~-(±~.(µþs" ~ %:&~þs# % (+~/(¹~0(½þs$ ~ %:&~þ+s% % (+~1(Áþ s& ~%:&~þ,s' %(+~2(Åþ!s( ~%:&~þ-s) %(+~3(É{~4(Í~5(Ñ(+9«sÔ%~-(±%rpf~(((+ ~.(µ%s, ~/(¹%~0(½%s- ~1(Á%s. ~2(Å%~3(É%~6(Õ~5(Ño/ (+9«sÔ%~-(±%rpg~(((+ ~.(µ%s, ~/(¹%~0(½%s- ~1(Á%s. ~2(Å%~3(É%~6(Õ~5(Ño/ Ý Ý~7(Ùþ9o/ (0 : ûÿÿÝþo1 Üo2 :úÿÿÝ9o1 ÜÝ&Ý8AdÍ\|I ê7p§´»02s, F~(((3 (4 þ 9 Ýû~8(Ýsh~((~9(á&8s~:(å~:(åo5 ~;(é~:(åo5 ~<(í~=(ñ~>(õÝ ÝÝÃ~?(ù(6 :~?(ù8;~((~;(é~@(ý(6 :~@(ý8;~((~<(í~A((6 :~A(8;~((~>(õÜ~A(;~(((7 9o8 X~B(þ:aþÿÿÝ ÝÝ Ý8Adruç rõÃ@Ï 0ð þ8þEc8^8V8Q;~(( ~ {Ç9½ÿÿÿ& 8²ÿÿÿ ~ {:ÿÿÿ& 8ÿÿÿi~((( 8þE">\|8Ý²ÿÿÿ þ8Çÿÿÿ8p8Ê~C( þ8¡ÿÿÿ%j~((¢o9 %"o: o; 8(þ89Q~(((< (+ ~ {ý:(ÿÿÿ& 8ÿÿÿ: ~ {ö:ÿÿÿ& 8÷þÿÿ ~ {´9Þþÿÿ& 8ÓþÿÿÝþÿÿ8Ýuþÿÿ8pþÿÿAVÝ0`s (3 (4 þ 9 Ý4~8(ÝsH~((o> ~9(á&8ºsô%~:(åo5 ~D( %~:(åo5 o .þ~E(%~:(åo5 ~F(%~:(åo 1þ~G(%~:(åo5 (? @Bj[!¶Y~H(%~:(åo5 ~I(!% ~((~J(%~=(ñ~K()~L(-jþ92(@ (A (B !µ÷õY~H(Ý Ý:8~M(1(6 þ9 oC X~B(þ:-þÿÿÝ ÝÝ Ý8ALhsÛ 5= request_handle: 0x00cc000c	1	1
InternetReadFile Sept. 2, 2024, 10:59 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL[§Ñà"0¦jÄ à@ @ÄOàøtÃ8 H.textp¤ ¦ `.rsrcøà¨@@.reloc®@BJÄH¤1°TJ yþ~ }~ }~ }( ({t}6s (0>{rpo o &{ ( ( }(0!{ ( ( }(0!{ ( ( }(0!{ ( ( }(0!{ ( ( }(0!{ ( ( }(0!{ ( ( }(0!{ ( ( }(0"{ ( ( }(0!{ ( ( }(þ{X}{2({}+}~ }þ{X}{2({}-}~ }þ{X}{2({}}~ }þ{X}{2({}/}~ }{rpo {{o 0[{}{( &{( &{1{ {+3$X}{\|( o 8Þ{-3$Y}{\|( o 8°{3_#3}#3}#.#. Z}{\|( o +G{/3=#.![}{\|( o +{r po N}{X}0A{rpo ~ }~ }~ }N}}z,{ ,{ o ( 0`rprprp( rprpo rpr¡po s! (" '(# ($ r¯po% }0Ð(& s' s( } s( }s( }s( } s( }s( }s( }s( }s( }s( }s( }s( }s( }s( }s( }s) }s( }((* { (+ o, { @Ys- o. { rÓpo/ { Ks0 o1 { "o2 { rçpo { o3 { þ s4 o5 {(+ o, { @vs- o. {rëpo/ {Ks0 o1 {!o2 {rÿpo {o3 {þs4 o5 {{Ys- o. {rpo/ {Ks0 o1 { o2 {rpo {o3 {þs4 o5 { °s- o. { rpo/ { Ks0 o1 { o2 { r'po { o3 { þs4 o5 {(+ o, { @ s- o. {r+po/ {Ks0 o1 {o2 {r;po {o3 {þs4 o5 {(+ o, { @ °s- o. {r?po/ {Ks0 o1 {o2 {rSpo {o3 {þs4 o5 {(6 o, {o «s- o. {rWpo/ {l!s0 o1 {o2 {ripo {o3 {þs4 o5 { ÞYs- o. {rmpo/ {Ks0 o1 {o2 {r}po {o3 {þs4 o5 {vs- o. {rpo/ {Ks0 o1 {o2 {rpo {o3 {þs4 o5 { Þvs- o. {rpo/ {Ks0 o1 {o2 {r¥po {o3 {þs4 o5 {{vs- o. {r©po/ {Ks0 o1 {o2 {r¹po {o3 {þs4 o5 { Þ s- o. {r½po/ {Ks0 o1 {o2 {rÍpo {o3 {þs4 o5 {{ s- o. {rÑpo/ {Ks0 o1 {o2 {rápo {o3 {þ s4 o5 { s- o. {råpo/ {Ks0 o1 {o2 {rõpo {o3 {þ s4 o5 {Ys- o. request_handle: 0x00cc000c	1	1
InternetReadFile Sept. 2, 2024, 10:59 a.m.	buffer: MZÿÿ¸@(º´ Í!¸LÍ!This program cannot be run in DOS mode. $JJO+÷+÷+÷ESô+÷ESòÒ+÷ESó+÷¯ +÷¯ô+÷¯ó+÷¯òg+÷ESñ+÷ESö+÷+öB÷Tô+÷Tò'+÷TóÁ+÷F®þ+÷F®+÷+`+÷F®õ+÷Rich+÷PEdëÔfð")¦#@0`,,Ü/Ø¸.èv@0ä1°Þ)pà)(pÝ)@À#ð.text¬¥#¦# `.rdata@âÀ#äª#@@.dataÔI°,,@À.pdataèv.x"-@@.rsrcØ¸/º.@@.relocä1@02T/@BHìxÕ(÷(3É=>¬, Ï(D$X·à(D$0fD$\òÂ(¶É(òD$PD$^L$@1fo~Ì)HT$4fo%ÑË)foÌ)fo-!Ì)fD$ DD$ )t$`fo5Ì)ffnÑAfpÒHRfþÔÁfoÊfoÂfjÂfbÊf8(Ãf8(ËÆÈÝfráfoÁfrÐfþÁf8@ÅfúÐfAnÀTÖfgÒfgÒfüÐfnBôWÐf~RôfnÐfpÒfþÔfoÊfoÂfjÂfbÊf8(Ãf8(ËÆÈÝfráfoÁfrÐfþÁf8@ÅfúÐfAnÀTÖfgÒfgÒfüÐfnBøWÐf~Røù(ÿÿÿ(t$`ù/}BHcÁLD$0LÀff¸OìÄNM@÷éÁúÂÁèÐ¾ÂkÐ4¶ÁÿÁÂ9A0@ÿù/\|ÓHD$0IÇÀÿÿÿÿIÿÀB<uöHT$0H Úa-èuH #HÄxéñÌÌÌÌÌHìxZ(¿Z(3É=.ª, Z(D$X·¨Z(D$0fD$\òZ(¶Z(òD$PD$^L$@1fonÊ)HT$4fo%ÁÉ)foyÊ)fo-Ê)fD$ DD$ )t$`fo5 Ê)ffnÑAfpÒHRfþÔÁfoÊfoÂfjÂfbÊf8(Ãf8(ËÆÈÝfráfoÁfrÐfþÁf8@ÅfúÐfAnÀTÖfgÒfgÒfüÐfnBôWÐf~RôfnÐfpÒfþÔfoÊfoÂfjÂfbÊf8(Ãf8(ËÆÈÝfráfoÁfrÐfþÁf8@ÅfúÐfAnÀTÖfgÒfgÒfüÐfnBøWÐf~Røù(ÿÿÿ(t$`ù/}BHcÁLD$0LÀff¸OìÄNM@÷éÁúÂÁèÐ¾ÂkÐ4¶ÁÿÁÂ9A0@ÿù/\|ÓHD$0IÇÀÿÿÿÿIÿÀB<uöHT$0H ¢`-èeH #HÄxéáÌÌÌÌÌHì8· í(IÇÀÿÿÿÿ¶á(òÏ(òD$ t$!:t$";t$#<t$$=t$%>t$&?t$'@fL$(ñAt$)B4CÆD$ 6D$HD$ L$(DIÿÀB<uöHT$ H â_-èÅH #HÄ8éAÌÌÌÌÌHì8·aY(3É=§,òDY(FY(fD$,¶@Y(D$.òD$ T$(Jfo-öÇ)¹fo)Ç)foAÇ)foÊfo%Ç)foÂfjÂfbÊf8(Åf8(ÍÆÈÝfráfoÁfrÐfþÁf8@@Ç)fúÐfn´X(TÔfgÒfgÒfüaÇ)WÐf~T$ foÀÆ)foÊfoÂfjÂfbÊf8(Åf8(ÍÆÈÝfráfoÁfrÐfþÁfoËf8@ÓÆ)fúÐfbËfnD$$TÔfgÒfgÒfüòÆ)WÐf8(ÍfoÃf~T$$fjÃf8(ÅÆÈÝfráfoÁfrÐfþÁf8@xÆ)fúØfnÂTÜfgÛfgÛfüÆ)WØf~\$(ÁLD$ LÀff¸OìÄNM@÷éÁúÂÁèÐ¾ÂkÐ4¶ÁÿÁÂ9A0@ÿù\|ÓHD$ IÇÀÿÿÿÿIÿÀB<uöHT$ H ²]-èµH #HÄ8é1þÌÌÌÌÌHì(H ]-èßH y#HÄ(éþHì(èç HØ,-HÄ(ÃÌÌÌÌÌÌÌÌÌÌÌHì(èÇ H°,-HÄ(ÃÌÌÌÌÌÌÌÌÌÌÌÇ$H c#fl¢,¶óÆ$a¢,é¦ýÌÌÌÌÌÌÌÌÌÌH ©#éýÌÌÌÌH #éýÌÌÌÌHì(=Õ?-u è-xÆÇ?-fo}ì$H.ì$E3ÀH¼?-H ½?-ó½?-APèt_3ÉH»?- ½?-HÇH§?-HHH ¬#HÄ(éÿüÌÌÌHì(=U?-u èwÆG?-foýë$H®ë$E3ÀHl?-H m?-óm?-APèô^3ÉHk?- m?-HÇHW?-HHH l#HÄ(éüÌÌÌHì(=Õ>-u è-wÆÇ>-fo}ë$H.ë$E3ÀH$?-H %?-ó%?-APèt^3ÉH#?- %?-HH?-HHH 0#HÄ(éüÌÌÌÌÌÌÌé»vÌÌÌÌÌÌÌÌÌÌÌHì(E3ÀH ú ,APèI^H=ù ,Hú ,vHÇH ê ,LÛ ,HÁIètIÁà3Òè¾#H ÷#HÄ(éûÌÌÌÌÌÌÌÌÌÌÌÌÌÌHì(E3ÀH j ,3ÒèÛ]H #Hm ,HÄ(éPûÌÌÌÌHì(H ,è0H ,è#Æ´ ,H #HÄ(éûÌÌÌÌÌÌÌÌÌÌÌÌHì(H ,è`ÚH À ,èSÚÆä ,H E#HÄ(éØúÌÌÌÌÌÌÌÌÌÌÌÌé»¡ÌÌÌHì(H -?-è4áH #HÄ(é¤úHì(A¹H×@-E3ÀH ]@-èh,H m#HÄ(étú@SHì ¹èÐåH ¡@-HØèI9H" %E3ÀHÓH@-H ~@-è9"H r#HÄ [é$úHC-Lê?-LC-HÒtHHcHLDPLóB-HôB-HÒtHHcHLDPÃÌÌHì(H ?-èLàH #HÄ(é¼ùH m#é°ùH #é¤ùHì(A¹HWA-E3ÀH Ý@-èh+H u#HÄ(étù@SHì ¹èÐäH !A-HØèI8H"%E3ÀHÓHA-H þ@-è9!H z#HÄ [é$ùHq@-Hj@-HB-HcHHB-HDPH request_handle: 0x00cc000c	1	1
InternetReadFile Sept. 2, 2024, 10:58 a.m.	buffer: MZÿÿ¸@àº´ Í!¸LÍ!This program cannot be run in DOS mode. $þä~ºô-ºô-ºô-Õó_- ô-Õój- ô-Õó^-çô-³ýg-½ô-ºõ-Æô-Õó[-»ô-Õón-»ô-Õói-»ô-Richºô-PELíê[dà ÒÀ»ið@ ]ÖPp"\ÖØN@Ì.text´ÐÒ `.datahsðxÖ@À.rsrc"p$N@@ÝôÜâÜÝØ¤ØÂØÐØâØòØÙÙ2ÙBÙPÙ`ÙtÙÙªÙÈÙØÙîÙÚÚ.ÚDÚ^ÚvÚÚÚ°ÚvØÞÚôÚÛÛ&Û8ÛFÛZÛpÛÛÛªÛ¾ÛÞÛòÛÜÜ,ÜBÜNÜ^Ü¦ààà\|à^ØJØ:ØÄÚ(Ø0ÝFÝVÝbÝnÝÝÝ Ý²ÝÈÝÚÝöÝÞ(Þ8ÞLÞXÞpÞÞÞÞ°Þ¼ÞÊÞØÞâÞøÞß"ß.ß>ßfß~ßß®ßÈßâßôßàà2àLàTàjà¼Ü®Ü ÜÜÜÈÜ*t@@®@«@1@O@¡`@k`@Unknown exceptionð?ð?33ÿCorExitProcessmscoree.dllHH:mm:ssdddd, MMMM dd, yyyyMM/dd/yyPMAMDecemberNovemberOctoberSeptemberAugustJulyJuneAprilMarchFebruaryJanuaryDecNovOctSepAugJulJunMayAprMarFebJanSaturdayFridayThursdayWednesdayTuesdayMondaySundaySatFriThuWedTueMonSunHH:mm:ssdddd, MMMM dd, yyyyMM/dd/yyPMAMDecemberNovemberOctoberSeptemberAugustJulyJuneAprilMarchFebruaryJanuaryDecNovOctSepAugJulJunMayAprMarFebJanSaturdayFridayThursdayWednesdayTuesdayMondaySundaySatFriThuWedTueMonSunKERNEL32.DLLFlsFreeFlsSetValueFlsGetValueFlsAllocàO@¯\|@ððÿà ÿÀÀÿÊòIqÊòIñ`B¢ `B¢YóøÂn¥YóøÂn¥tancossinmodffloorceilatanexp10ð?acosasinloglog10exppowruntime error TLOSS error SING error DOMAIN error R6033 - Attempt to use MSIL code from this assembly during native code initialization This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain. R6032 - not enough space for locale information R6031 - Attempt to initialize the CRT more than once. This indicates a bug in your application. R6030 - CRT not initialized R6028 - unable to initialize heap R6027 - not enough space for lowio initialization R6026 - not enough spac request_handle: 0x00cc000c	1	1
InternetReadFile Sept. 2, 2024, 10:59 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÝ±Òf_%à#âG`Zâf°H@ Æÿe P³B`³ä ³Ü"ô«Hàa³.textôáGâG`P`.datahHèG@`À.rdata H þG@`@/4¼ÀHH@0@.bssôáf`L`À.edataBP³2L@0@.idataä `³ 4L@0À.CRT4p³>L@0À.tls³@L@0À.relocÜ"³$BL@0B/14ÀÁfZ@B/29Ä§ÐÁ¨nZ@B/41XLÃN\@B/55BãÐÃäd\@B/67TÀÄH]@0B/80a àÄ f]@B/91ðÄp]@B/102ÀÆü^@BÃ´&´&ì1Àf=@MZÇà6óÇÜ6óÇØ6óÇÐ6óu<@º@PE@t`£`¡ì6óÀtBÇ$è6ÓGè9ÓG7óè4ÓGè6óèüF=tN1ÀÄÃ´&Ç$èôÒGë¼f·Qfút=fúu¹vø1ÀÒÀésÿÿÿvÇ$À èôG1ÀÄÃ¶ytNÿÿÿè1ÀÉÀé<ÿÿÿ´&t&ì,¡Ô6óÇD$`£`¡Ì6óÇD$`D$ÇD$ `Ç$$`èfÒGÄ,ÃfL$äð1ÀÿqüUåWVU¤S×Q¹ìx5ì6óó«ö d¡5bóx1Ûët&9ÇÇ$èÿÖìØð±=Ä6óÀuÞ¡È6ó1Ûø¡È6óÀyÇ`¡È6óøöÛ¡ð«ÀtÇD$ÇD$Ç$ÿÐìèÏýFÇ$ÿbóì£7óÇ$@èN×GèÙûFÇ`@èRÑG1ÉÀuëMÒtDát'¹À¶ú ~çËóú"DËëè´&vÒtt&¶PÀÒtú ~ð£`ì6óÛt¸ öEÐâ£$`44$èèÏG `EÛÃFü×EÐEÃÇ$èPÏGp4$èÏGCüOüt$L$$èÏG9}uÊEEÇE£ `èùF¡`<bóD$¡ `D$¡$`$è `£`Éò`Ò¡eðY[^_]aüÃt&·EÔéÿÿÿ´&¡È6ó»øÿýÿÿÇ$è©ÏG¡È6óø þÿÿÇD$póÇ$póègÏGÇÈ6óÛìýÿÿÄ6óéáýÿÿ´&v$ÿüaóìéOýÿÿ´&è;ÏG¡`eðY[^_]aüÃfÇD$póÇ$póÇÈ6óèòÎGénýÿÿEéÁþÿÿ$è½ÎG´&¶Çì6óé±üÿÿÇì6óé¡üÿÿìD$ $èÎGÀÀÄ¶À÷ØÃUåWVSìÇ$ ÿðaóìÀtsÃÇ$ ÿbó=øaóì£(`ÇD$ $ÿ×ìÆÇD$) $ÿ×£ìötÇD$,`Ç$ÀÿÖÇ$ @è^ÿÿÿeô[^_]Ã¶Ç¾ëÀ´&´&Uåì¡Àt Ç$ÀÿÐ¡(`Àt$ÿèaóìÉÃUåWVSìÇEÜû@ÇEà@ÇEäEäDÜÿàé´E\ÂE<MÔET]ÐE@0uÌE8}ÈEEÄE4ÝE0ÝEMÀE8]¼EÝE0u¸E8}´EDE°EM¬E]¨ELp$u¤EX8} E(ÝEDEE<ME$]Ed8EP0E,E0ÝE0ÝE ÝÙÎEEEEH$UÔ$UÐ$UÌ$UÈ$UÄ$Ý\$\|ÙÌÝ\$tÙÊUÀT$pU¼T$lÝ\$dU¸T$`U´T$\U°T$XU¬T$TU¨T$PU¤T$LU T$HÝ\$@UT$<UT$8UT$4\|$0t$,\$(Ý\$ ÇD$P Ý\$Ý\$L$ut$$èþAU`éGþÿÿÄ[^_]ÃUåìÈÇHÿÿÿeÇLÿÿÿ?âÇEðEPÿÿÿETÿÿÿEXÿÿÿE\ÿÿÿE`ÿÿÿEdÿÿÿE hÿÿÿE$lÿÿÿE(pÿÿÿE,tÿÿÿE0xÿÿÿE4\|ÿÿÿE8EE<EE@EEDEEHEELEEPEETEEXE E\E¤E`E¨EdE¬EhE°ElE´EpE¸EtE¼ExEÀE\|EÄEÈEÌEÐEÔEØEÜEàEä Eè¤EìEðøwEðHÿÿÿPÿÿÿ$ÿÐëáÉÃUåE@=þEÇ@ëEÇ@]ÃUåì(ÇEì@ÇEð@ÇEôEôDìëëÿàE$èrÇEôEôDìëãÉÃUåì8ÇEè @ÇEìÕ@ÇEðþ@ÇEôEôDèÿàED$ED$ED$ED$E$è<ë"E request_handle: 0x00cc000c	1	1
InternetReadFile Sept. 2, 2024, 10:59 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL×Ýc¿à!& @àa0: Ð* Ð0 ¨@ < Ð.text%&`P`.data\|'@(,@`À.rdatapDpFT@`@.bss(À`À.edata*Ð,@0@.idataÐ Æ@0À.CRT, Ô@0À.tls Ö@0À.rsrc¨0 Ø@0À.reloc<@ >Þ@0B/48 @@B/19RÈ Ê" @B/31]'`(ì @B/45-.@B/57\ÀB@0B/70#ÐN@B/81 request_handle: 0x00cc000c	1	1
InternetReadFile Sept. 2, 2024, 10:59 a.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELó4cà"!4pÐ Ëý @AH S È xF P/ ð# ¤ @.text `.rdataÄ @@.data<F0 @À.00cfg @@.rsrcx @@.relocð# $" @B request_handle: 0x00cc000c	1	1
InternetReadFile Sept. 2, 2024, 10:59 a.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL¤4cà"!¶^À¹ jª @A`ãWä·, ° P/0 ØAS¼øhÐ ì¼ÜäZ.textaµ¶ `.rdata Ð º@@.dataDàÄ@À.00cfg È@@.tls Ê@À.rsrc° Ì@@.relocØA0 BÖ@B request_handle: 0x00cc000c	1	1
InternetReadFile Sept. 2, 2024, 10:59 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $Ù1Cò_ò_ò_)n°ò_Ìò_ò^"ò_Ï^ò_Ï\ò_Ï[Óò_ÏZÑò_Ï_ò_Ï ò_Ï]ò_Richò_PELê0]à"!(`Ù@ ð,à@AgÏèr ðèA°¬=`x8¸w@päÀc@.text&( `.dataH)@,@À.idata¬pD@@.didat4X@À.rsrcð Z@@.reloc¬=°>^@B request_handle: 0x00cc000c	1	1
InternetReadFile Sept. 2, 2024, 10:59 a.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELÐ4cà"!Ø.`£pl- @Aä&úÞÄ@Px P/`\°ð \|Ê\&@.text×Ø `.rdatalïððÜ@@.dataDRà.Ì@À.00cfg@ú@@.rsrcxPü@@.reloc\` @B request_handle: 0x00cc000c	1	1
InternetReadFile Sept. 2, 2024, 10:59 a.m.	buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELó4cà"!ÌðPÏSg@ADvSwð°ÀP/ÀÈ58qà {.text&ËÌ `.rdataÔ«à¬Ð@@.data\|@À.00cfg @@.rsrc°@@.relocÈ5À6@B request_handle: 0x00cc000c	1	1
InternetReadFile Sept. 2, 2024, 10:59 a.m.	buffer: MZÿÿ¸@èº´ Í!¸LÍ!This program cannot be run in DOS mode. $ÀÅäÕ¤¤¤08e¤Ü¤¤¬¤ÖÌ¤ÖÌ¤ÖÌ¤ÖÌ¤ÖÌu¤ÖÌ¤Rich¤PEL\|ê0]à"!ÞÙð 0Ôm@Aàã ¸úðA 8¸ @´.textôÜÞ `.dataôðâ@À.idataä@@.rsrcê@@.reloc î@B request_handle: 0x00cc000c	1	1
recv Sept. 2, 2024, 10:53 a.m.	buffer: HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 02 Sep 2024 02:04:55 GMT Content-Type: application/octet-stream Content-Length: 514560 Last-Modified: Sun, 01 Sep 2024 13:24:10 GMT Connection: keep-alive ETag: "66d46afa-7da00" Accept-Ranges: bytes MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÝOÐà!0Ò>ñ @ @@ìðOÄ H.textDÑ Ò `.rsrcÄÔ@@.reloc Ø@B ñH©äG¸WÃ¨£^ããYQ×=È(¶®êåsûà2$ã(\|cFOH:<Ñiv$Þ:§S¡(ÀOt!Ç"ÚOlÿ¯·,¥^êl¶Ø¿½wgdùÓ½SUJJ)»·ºã¢¯¯wôIvVì¾yµÇ^WÃx'f©Ú³0Hg¶V{fÿUAXòo¦¡O§ Ûú¿R)¸Ö³¸°ATýé]LÚ%cJ½vú9í}#-V°Ö%~GµN'ðI è5v°;IIàÂ)HÅqZ§ü<+(\|M îØ¿{²3ø¾UÇ¿aîútU ½¨¨ÜÐ f[ÉÇÇÉ[f ÐÜ 7ðð7¤¤ üüFF..ööDD7744øø··ÄÄ11BBww << ÄÄ¦¦QQÀÀ¹¹ ÌÌììÁÁÏÏmmôôÔÔ®®ÞÞùùMM""OO;;ïïllaaAAss received: 2800 socket: 928	1	2800

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x0002de00', u'virtual_address': u'0x00001000', u'entropy': 7.989358439733405, u'name': u' \\x00 ', u'virtual_size': u'0x00068000'}

entropy

7.98935843973

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x001a5a00', u'virtual_address': u'0x00320000', u'entropy': 7.953732717298406, u'name': u'xzgvtied', u'virtual_size': u'0x001a6000'}

entropy

7.9537327173

description

A section with a high entropy has been found

entropy

0.994152046784

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (2 events)

process	system
process	cmd.exe

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (32 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW Sept. 2, 2024, 10:59 a.m.	snapshot_handle: 0x0000043c process_name: 1.exe process_identifier: 2928		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000b0 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000f8 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000f8 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000f8 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000f8 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000f8 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000f8 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000f8 process_name: conhost.exe process_identifier: 2692		0	0
Process32NextW Sept. 2, 2024, 10:52 a.m.	snapshot_handle: 0x00000000000000f8 process_name: conhost.exe process_identifier: 2692		0	0

Yara rule detected in process memory (11 events)

description	Take ScreenShot	rule	ScreenShot
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	RedLine stealer	rule	RedLine_Stealer_m_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Queries for potentially installed applications (50 out of 52 events)

Time & API	Arguments	Status
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x00000294 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40 base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko) base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}	1
RegOpenKeyExA Sept. 2, 2024, 10:59 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561} base_handle: 0x80000002 key_handle: 0x00000298 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}	1

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess Sept. 2, 2024, 10:52 a.m.	status_code: 0x00000000 process_identifier: 1156 process_handle: 0x00000000000000b4		0	0
NtTerminateProcess Sept. 2, 2024, 10:52 a.m.	status_code: 0x00000000 process_identifier: 1156 process_handle: 0x00000000000000b4	1	0	0

Communicates with host for which no DNS query was performed (7 events)

host	154.216.17.170
host	185.215.113.16
host	185.215.113.17
host	185.215.113.19
host	185.215.113.26
host	95.179.250.45
host	95.216.143.20

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 2580 region_size: 335872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000001e8	1	0	0

Attempts to identify installed AV products by installation directory (7 events)

file	C:\ProgramData\AVAST Software
file	C:\ProgramData\Avira
file	C:\ProgramData\Kaspersky Lab
file	C:\ProgramData\Panda Security
file	C:\ProgramData\Bitdefender
file	C:\ProgramData\AVG
file	C:\ProgramData\Doctor Web

Checks for the presence of known devices from debuggers and forensic tools (3 events)

file	\??\SICE
file	\??\SIWVID
file	\??\NTICE

Checks for the presence of known windows from debuggers and forensic tools (50 out of 514 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: pediy06 window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: #0 window_name: File Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: #0 window_name: Process Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: #0 window_name: Registry Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: #0 window_name: File Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: #0 window_name: Process Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: pediy06 window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: #0 window_name: File Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: #0 window_name: Process Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: #0 window_name: Registry Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: #0 window_name: File Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: #0 window_name: Process Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: pediy06 window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: pediy06 window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: pediy06 window_name:		0	0
FindWindowA Sept. 2, 2024, 10:58 a.m.	class_name: OLLYDBG window_name:		0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Sept. 2, 2024, 10:58 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (5 events)

description	1.exe tried to sleep 120 seconds, actually delayed analysis time by 120 seconds
description	axplong.exe tried to sleep 1703 seconds, actually delayed analysis time by 1703 seconds
description	RegAsm.exe tried to sleep 185 seconds, actually delayed analysis time by 185 seconds
description	explorer.exe tried to sleep 120 seconds, actually delayed analysis time by 120 seconds
description	Hkbsse.exe tried to sleep 151 seconds, actually delayed analysis time by 151 seconds

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Checks the CPU name from registry, possibly for anti-virtualization (1 event)

registry

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString

Installs itself for autorun at Windows startup (3 events)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Amadeus.exe	reg_value	C:\Users\test22\1000238002\Amadeus.exe
file	C:\Windows\Tasks\axplong.job
file	C:\Windows\Tasks\Hkbsse.job

Attempts to access Bitcoin/ALTCoin wallets (1 event)

file	C:\Users\test22\AppData\Roaming\electrum\wallets

Harvests credentials from local FTP client softwares (1 event)

file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Sept. 2, 2024, 10:58 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELóûÆáà0ìÐfº @ @ºO ÄÉø¹ H.textLê ì `.rsrcÄÉ Ìð@@.reloc¼@B base_address: 0x00400000 process_identifier: 2580 process_handle: 0x000001e8	1	1
WriteProcessMemory Sept. 2, 2024, 10:58 a.m.	buffer: °h: base_address: 0x00450000 process_identifier: 2580 process_handle: 0x000001e8	1	1
WriteProcessMemory Sept. 2, 2024, 10:58 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2580 process_handle: 0x000001e8	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 2, 2024, 10:58 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELóûÆáà0ìÐfº @ @ºO ÄÉø¹ H.textLê ì `.rsrcÄÉ Ìð@@.reloc¼@B base_address: 0x00400000 process_identifier: 2580 process_handle: 0x000001e8	1	1	0

Collects information about installed applications (38 events)

Time & API	Arguments	Status
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: 7-Zip 20.02 alpha regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: ????? ?? 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Mozilla Thunderbird 78.4.0 (x86 ko) regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Thunderbird 78.4.0 (x86 ko)\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.PROPLUSR\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe AIR regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: ????? ?? 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java 8 Update 131 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180131F0}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Java Auto Updater regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Access MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0015-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Excel MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0016-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft PowerPoint MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0018-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Publisher MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0019-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Outlook MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001A-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Word MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001B-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing Tools 2013 - English regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Outils de vérification linguistique 2013 de Microsoft Office - Français regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-040C-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing Tools 2013 - Español regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-001F-0C0A-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-002C-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft InfoPath MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0044-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft DCF MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0090-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft OneNote MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00A1-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Groove MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OSM MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E1-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OSM UX MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-00E2-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared Setup Metadata MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0115-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Access Setup Metadata MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-0117-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Lync MUI (English) 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90150000-012B-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Professional Plus 2013 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{91150000-0011-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Acrobat Reader DC MUI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\DisplayName	1
RegQueryValueExA Sept. 2, 2024, 10:59 a.m.	key_handle: 0x00000298 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

Harvests credentials from local email clients (4 events)

file	C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini
registry	HKEY_CURRENT_USER\oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\00000004
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2500 called NtSetContextThread to modify thread in remote process 2580
NtSetContextThread Sept. 2, 2024, 10:58 a.m.	registers.eip: 2005598660 registers.esp: 3342004 registers.edi: 0 registers.eax: 4373094 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000002c process_identifier: 2580	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2500 resumed a thread in remote process 2580
NtResumeThread Sept. 2, 2024, 10:58 a.m.	thread_handle: 0x0000002c suspend_count: 1 process_identifier: 2580	1	0	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 2, 2024, 10:58 a.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 52 83 ec 04 89 3c 24 89 exception.symbol: random+0x202215 exception.instruction: in eax, dx exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2105877 exception.address: 0x262215 registers.esp: 8519200 registers.edi: 134889 registers.eax: 1447909480 registers.ebp: 3990859796 registers.edx: 22104 registers.ebx: 1971327157 registers.esi: 2497561 registers.ecx: 20	1	0	0

Detects the presence of Wine emulator (1 event)

Time & API	Arguments	Status	Return	Repeated
LdrGetProcedureAddress Sept. 2, 2024, 10:52 a.m.	ordinal: 0 function_address: 0x000000000000000c function_name: wine_get_version module: ntdll module_address: 0x00000000776c0000		-1073741511	0

Executed a process and injected code into it, probably while unpacking (45 events)

Time & API	Arguments	Status	Return
NtResumeThread Sept. 2, 2024, 10:58 a.m.	thread_handle: 0x000001ec suspend_count: 1 process_identifier: 724	1	0
CreateProcessInternalW Sept. 2, 2024, 10:58 a.m.	thread_identifier: 2264 thread_handle: 0x000003e8 process_identifier: 2260 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\44111dbc49\axplong.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\44111dbc49\axplong.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\44111dbc49\axplong.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003f0	1	1
NtResumeThread Sept. 2, 2024, 10:58 a.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 2260	1	0
CreateProcessInternalW Sept. 2, 2024, 10:58 a.m.	thread_identifier: 2504 thread_handle: 0x00000480 process_identifier: 2500 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\1000002001\crypted.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\1000002001\crypted.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\1000002001\crypted.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000484	1	1
CreateProcessInternalW Sept. 2, 2024, 10:58 a.m.	thread_identifier: 2852 thread_handle: 0x0000046c process_identifier: 2848 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\1000004001\crypteda.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\1000004001\crypteda.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\1000004001\crypteda.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000488	1	1
CreateProcessInternalW Sept. 2, 2024, 10:58 a.m.	thread_identifier: 3064 thread_handle: 0x000003b8 process_identifier: 3060 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\1000005001\Nework.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\1000005001\Nework.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\1000005001\Nework.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000049c	1	1
CreateProcessInternalW Sept. 2, 2024, 10:58 a.m.	thread_identifier: 2132 thread_handle: 0x00000394 process_identifier: 2128 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\1000066001\stealc_default2.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\1000066001\stealc_default2.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\1000066001\stealc_default2.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000498	1	1
CreateProcessInternalW Sept. 2, 2024, 10:59 a.m.	thread_identifier: 2560 thread_handle: 0x00000470 process_identifier: 2572 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\1000129001\Set-up.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\1000129001\Set-up.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\1000129001\Set-up.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000004a8	1	1
CreateProcessInternalW Sept. 2, 2024, 10:59 a.m.	thread_identifier: 2932 thread_handle: 0x00000490 process_identifier: 2928 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\1000191001\1.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\1000191001\1.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\1000191001\1.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000004b0	1	1
CreateProcessInternalW Sept. 2, 2024, 10:59 a.m.	thread_identifier: 1440 thread_handle: 0x00000438 process_identifier: 184 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\1000228001\GetSys.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\1000228001\GetSys.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\1000228001\GetSys.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000004b4	1	1
CreateProcessInternalW Sept. 2, 2024, 10:59 a.m.	thread_identifier: 2692 thread_handle: 0x00000494 process_identifier: 2636 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\1000238002\Amadeus.exe track: 1 command_line: "C:\Users\test22\1000238002\Amadeus.exe" filepath_r: C:\Users\test22\1000238002\Amadeus.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000004b0	1	1
CreateProcessInternalW Sept. 2, 2024, 10:59 a.m.	thread_identifier: 2076 thread_handle: 0x000004a4 process_identifier: 2072 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\1000241001\build.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\1000241001\build.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\1000241001\build.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000004b8	1	1
CreateProcessInternalW Sept. 2, 2024, 10:59 a.m.	thread_identifier: 1284 thread_handle: 0x00000490 process_identifier: 2228 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\1000243001\runtime.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\1000243001\runtime.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\1000243001\runtime.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000004b0	1	1
CreateProcessInternalW Sept. 2, 2024, 10:59 a.m.	thread_identifier: 1172 thread_handle: 0x00000488 process_identifier: 1012 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\1000248001\seidr_build.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\1000248001\seidr_build.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\1000248001\seidr_build.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000004b0	1	1
NtResumeThread Sept. 2, 2024, 10:58 a.m.	thread_handle: 0x000000e8 suspend_count: 1 process_identifier: 2500	1	0
NtResumeThread Sept. 2, 2024, 10:58 a.m.	thread_handle: 0x0000015c suspend_count: 1 process_identifier: 2500	1	0
NtResumeThread Sept. 2, 2024, 10:58 a.m.	thread_handle: 0x000001a4 suspend_count: 1 process_identifier: 2500	1	0
CreateProcessInternalW Sept. 2, 2024, 10:58 a.m.	thread_identifier: 2584 thread_handle: 0x0000002c process_identifier: 2580 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000001e8	1	1
NtGetContextThread Sept. 2, 2024, 10:58 a.m.	thread_handle: 0x0000002c	1	0
NtAllocateVirtualMemory Sept. 2, 2024, 10:58 a.m.	process_identifier: 2580 region_size: 335872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000001e8	1	0
WriteProcessMemory Sept. 2, 2024, 10:58 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELóûÆáà0ìÐfº @ @ºO ÄÉø¹ H.textLê ì `.rsrcÄÉ Ìð@@.reloc¼@B base_address: 0x00400000 process_identifier: 2580 process_handle: 0x000001e8	1	1
WriteProcessMemory Sept. 2, 2024, 10:58 a.m.	buffer: base_address: 0x00402000 process_identifier: 2580 process_handle: 0x000001e8	1	1
WriteProcessMemory Sept. 2, 2024, 10:58 a.m.	buffer: base_address: 0x00432000 process_identifier: 2580 process_handle: 0x000001e8	1	1
WriteProcessMemory Sept. 2, 2024, 10:58 a.m.	buffer: °h: base_address: 0x00450000 process_identifier: 2580 process_handle: 0x000001e8	1	1
WriteProcessMemory Sept. 2, 2024, 10:58 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2580 process_handle: 0x000001e8	1	1
NtSetContextThread Sept. 2, 2024, 10:58 a.m.	registers.eip: 2005598660 registers.esp: 3342004 registers.edi: 0 registers.eax: 4373094 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000002c process_identifier: 2580	1	0
NtResumeThread Sept. 2, 2024, 10:58 a.m.	thread_handle: 0x0000002c suspend_count: 1 process_identifier: 2580	1	0
NtResumeThread Sept. 2, 2024, 10:58 a.m.	thread_handle: 0x0000017c suspend_count: 1 process_identifier: 2580	1	0
NtResumeThread Sept. 2, 2024, 10:58 a.m.	thread_handle: 0x000001ec suspend_count: 1 process_identifier: 2580	1	0
NtResumeThread Sept. 2, 2024, 10:58 a.m.	thread_handle: 0x00000234 suspend_count: 1 process_identifier: 2580	1	0
NtResumeThread Sept. 2, 2024, 10:58 a.m.	thread_handle: 0x0000036c suspend_count: 1 process_identifier: 2580	1	0
NtResumeThread Sept. 2, 2024, 10:58 a.m.	thread_handle: 0x00000390 suspend_count: 1 process_identifier: 2580	1	0
NtResumeThread Sept. 2, 2024, 10:58 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2848	1	0
NtResumeThread Sept. 2, 2024, 10:58 a.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 2848	1	0
NtResumeThread Sept. 2, 2024, 10:58 a.m.	thread_handle: 0x000001b4 suspend_count: 1 process_identifier: 2848	1	0
NtResumeThread Sept. 2, 2024, 10:58 a.m.	thread_handle: 0x00000134 suspend_count: 1 process_identifier: 3060	1	0
CreateProcessInternalW Sept. 2, 2024, 10:58 a.m.	thread_identifier: 660 thread_handle: 0x00000314 process_identifier: 2236 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\054fdc5f70\Hkbsse.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\054fdc5f70\Hkbsse.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\054fdc5f70\Hkbsse.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000324	1	1
NtResumeThread Sept. 2, 2024, 10:58 a.m.	thread_handle: 0x000000ec suspend_count: 1 process_identifier: 2236	1	0
CreateProcessInternalW Sept. 2, 2024, 10:59 a.m.	thread_identifier: 932 thread_handle: 0x000003cc process_identifier: 792 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\1000009001\setup2.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\1000009001\setup2.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\1000009001\setup2.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003d0	1	1
CreateProcessInternalW Sept. 2, 2024, 10:59 a.m.	thread_identifier: 2596 thread_handle: 0x0000039c process_identifier: 2600 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\1000011001\joffer2.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\1000011001\joffer2.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\1000011001\joffer2.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003dc	1	1
NtResumeThread Sept. 2, 2024, 10:52 a.m.	thread_handle: 0x00000000000000c4 suspend_count: 1 process_identifier: 2228	1	0
NtResumeThread Sept. 2, 2024, 10:52 a.m.	thread_handle: 0x0000000000000138 suspend_count: 1 process_identifier: 2228	1	0
NtResumeThread Sept. 2, 2024, 10:52 a.m.	thread_handle: 0x000000000000017c suspend_count: 1 process_identifier: 2228	1	0
NtResumeThread Sept. 2, 2024, 10:53 a.m.	thread_handle: 0x0000000000000360 suspend_count: 1 process_identifier: 2228	1	0
NtResumeThread Sept. 2, 2024, 10:52 a.m.	thread_handle: 0x0000000000000108 suspend_count: 1 process_identifier: 1012	1	0

File has been identified by 43 AntiVirus engines on VirusTotal as malicious (43 events)

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
Cynet	Malicious (score: 99)
Skyhigh	BehavesLike.Win32.Generic.tc
ALYac	Gen:Variant.Kryptik.260
Cylance	Unsafe
VIPRE	Gen:Variant.Kryptik.260
BitDefender	Gen:Variant.Kryptik.260
Cybereason	malicious.b027d4
Arcabit	Trojan.Kryptik.260
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Packed.Themida.HZB
APEX	Malicious
McAfee	Themida-FWSE!82F430CB027D
Avast	Win32:TrojanX-gen [Trj]
Kaspersky	HEUR:Trojan.Win32.Generic
MicroWorld-eScan	Gen:Variant.Kryptik.260
Emsisoft	Gen:Variant.Kryptik.260 (B)
F-Secure	Trojan.TR/Crypt.TPM.Gen
McAfeeD	Real Protect-LS!82F430CB027D
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.82f430cb027d4089
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI - Malicious PE
Google	Detected
Avira	TR/Crypt.TPM.Gen
MAX	malware (ai score=81)
Kingsoft	malware.kb.a.712
Gridinsoft	Trojan.Heur!.038120A1
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Gen:Variant.Kryptik.260
Varist	W32/Agent.JDU.gen!Eldorado
AhnLab-V3	Trojan/Win.Generic.R645974
BitDefenderTheta	Gen:NN.ZexaF.36812.1DWaa4OeCEei
DeepInstinct	MALICIOUS
VBA32	TScope.Malware-Cryptor.SB
Malwarebytes	Trojan.Amadey
Zoner	Probably Heur.ExeHeaderL
Tencent	Trojan-DL.Win32.Deyma.kh
Fortinet	W32/Themida.HZB!tr
AVG	Win32:TrojanX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (D)

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (26 events)

dead_host	192.168.56.103:49193
dead_host	192.168.56.103:49224
dead_host	192.168.56.103:49212
dead_host	192.168.56.103:49247
dead_host	192.168.56.103:49278
dead_host	192.168.56.103:49186
dead_host	192.168.56.103:49208
dead_host	192.168.56.103:49229
dead_host	192.168.56.103:49225
dead_host	192.168.56.103:49210
dead_host	192.168.56.103:49232
dead_host	192.168.56.103:49218
dead_host	192.168.56.103:49285
dead_host	192.168.56.103:49230
dead_host	192.168.56.103:49171
dead_host	192.168.56.103:49267
dead_host	192.168.56.103:49226
dead_host	95.179.250.45:26212
dead_host	192.168.56.103:49179
dead_host	192.168.56.103:49243
dead_host	192.168.56.103:49214
dead_host	192.168.56.103:49231
dead_host	192.168.56.103:49255
dead_host	192.168.56.103:49227
dead_host	192.168.56.103:49251
dead_host	192.168.56.103:49200

random.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All