popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

66e27cc59b93f_111.exe

RedLine Infostealer RedLine stealer Generic Malware UltraVNC Malicious Library Antivirus UPX ScreenShot PWS AntiDebug OS Processor Check PE32 PE File .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 12, 2024, 6:20 p.m. Sept. 12, 2024, 6:22 p.m.
Size 886.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 24fbb160ccad6b035b0ed7e1070f820f
SHA256 5ef26f795226e5f0d2919f1a62001139585d0da64530e20976db9879695c2186
CRC32 1D724F0A
ssdeep 24576:0NA3R5drX/W50Fubje9k0jHOB8nDFQXi7hQH2:V5Ou0YkAHOi0i7hQW
PDB Path D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
107.189.171.131 Active Moloch
185.203.241.68 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059d5a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059d5a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059d5e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059d5e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059d8e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059d920
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059d920
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059d920
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059d920
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059d9e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059d9e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059d8e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059d8e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059d8e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059d8e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059d8e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059d8e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059d8e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059d8e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059d8e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059da20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059da20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059da20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059da20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059e060
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059e060
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0059e220
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x05ff69c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x05ff69c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x05ff6888
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x008c69c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x008c69c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x008c69c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x008c69c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x008c6a40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x008c6a40
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x008c6940
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x008c6940
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x008c6940
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x008c6940
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x008c6940
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x008c7180
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x008c7180
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x008c7340
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0594aee0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0594aee0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0594ada0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
pdb_path D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
file C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file C:\Program Files\Mozilla Firefox\firefox.exe
registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .gfids
resource name PNG
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 07 66 0f 7f 47 10 66 0f 7f 47 20 66 0f
exception.symbol: 2+0xefe7
exception.address: 0x40efe7
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61415
registers.esp: 1636976
registers.edi: 4465840
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 1476
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4468656
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 1454
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4472752
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 1422
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4476848
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 1390
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4480944
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 1358
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4485040
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 1326
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4489136
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 1294
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4493232
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 1262
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4497328
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 1230
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4501424
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 1198
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4505520
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 1166
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4509616
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 1134
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4513712
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 1102
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4517808
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 1070
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4521904
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 1038
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4526000
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 1006
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4530096
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 974
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4534192
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 942
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4538288
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 910
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4542384
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 878
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4546480
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 846
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4550576
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 814
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4554672
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 782
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4558768
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 750
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4562864
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 718
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4566960
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 686
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4571056
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 654
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4575152
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 622
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4579248
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 590
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4583344
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 558
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4587440
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 526
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4591536
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 494
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4595632
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 462
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4599728
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 430
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4603824
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 398
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4607920
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 366
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4612016
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 334
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4616112
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 302
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4620208
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 270
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4624304
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 238
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4628400
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 206
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4632496
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 174
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4636592
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 142
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4640688
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 110
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4644784
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 78
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4648880
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 46
1 0 0

__exception__

 stacktrace: 
2+0xf054 @ 0x40f054
2+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d
exception.symbol: 2+0xefff
exception.address: 0x40efff
exception.module: 2.exe
exception.exception_code: 0xc0000005
exception.offset: 61439
registers.esp: 1636976
registers.edi: 4652976
registers.eax: 4465840
registers.ebp: 1636980
registers.edx: 91
registers.ebx: 0
registers.esi: 32374856
registers.ecx: 14
1 0 0

__exception__

 stacktrace: 
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x722f2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7230264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72371838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72371737
mscorlib+0x2d3711 @ 0x71603711
mscorlib+0x308f2d @ 0x71638f2d
mscorlib+0x3133fd @ 0x716433fd
mscorlib+0x9873b1 @ 0x71cb73b1
mscorlib+0x97b352 @ 0x71cab352
DllUnregisterServerInternal-0x7666 clr+0x2a8e @ 0x722f2a8e
DllGetClassObjectInternal+0x37c9b CorDllMainForThunk-0x54860 clr+0xfcd14 @ 0x723ecd14
0x73a062
2+0x2403 @ 0x402403

exception.instruction_r: 8b 01 8b 40 38 ff 50 14 8b 15 3c 21 3e 03 8b c8
exception.instruction: mov eax, dword ptr [ecx]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x23402a6
registers.esp: 1635236
registers.edi: 37642944
registers.eax: 0
registers.ebp: 1635272
registers.edx: 37636392
registers.ebx: 37636392
registers.esi: 13
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x55db2ee
0x55db076
0x55d9615
0x55d91ee
0x234f4e3
0x234ef6d
0x234eed0
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x722f2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7230264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72371838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72371737
mscorlib+0x2d3711 @ 0x71603711
mscorlib+0x308f2d @ 0x71638f2d
0x23403cb
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x722f2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7230264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72371838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72371737
mscorlib+0x2d3711 @ 0x71603711
mscorlib+0x308f2d @ 0x71638f2d
mscorlib+0x3133fd @ 0x716433fd
mscorlib+0x9873b1 @ 0x71cb73b1
mscorlib+0x97b352 @ 0x71cab352
DllUnregisterServerInternal-0x7666 clr+0x2a8e @ 0x722f2a8e
DllGetClassObjectInternal+0x37c9b CorDllMainForThunk-0x54860 clr+0xfcd14 @ 0x723ecd14
0x73a062
2+0x2403 @ 0x402403

exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 c8 8b 45 c8 89 45 c4
exception.instruction: mov eax, dword ptr [ecx]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x55db418
registers.esp: 1633116
registers.edi: 1633168
registers.eax: 0
registers.ebp: 1633180
registers.edx: 5799456
registers.ebx: 1634804
registers.esi: 39311232
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x63e9636
0x63e94ef
0x63e93ed
0x63e80db
0x63e665c
0x63e0a8f
0x55d96dd
0x55d91ee
0x234f4e3
0x234ef6d
0x234eed0
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x722f2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7230264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72371838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72371737
mscorlib+0x2d3711 @ 0x71603711
mscorlib+0x308f2d @ 0x71638f2d
0x23403cb
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x722f2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7230264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x72371838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x72371737
mscorlib+0x2d3711 @ 0x71603711
mscorlib+0x308f2d @ 0x71638f2d
mscorlib+0x3133fd @ 0x716433fd
mscorlib+0x9873b1 @ 0x71cb73b1
mscorlib+0x97b352 @ 0x71cab352
DllUnregisterServerInternal-0x7666 clr+0x2a8e @ 0x722f2a8e
DllGetClassObjectInternal+0x37c9b CorDllMainForThunk-0x54860 clr+0xfcd14 @ 0x723ecd14
0x73a062
2+0x2403 @ 0x402403

exception.instruction_r: 39 09 ff 15 b8 2c 39 02 89 85 44 ff ff ff 8b 85
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x63ea00e
registers.esp: 1631612
registers.edi: 1631852
registers.eax: 0
registers.ebp: 1631864
registers.edx: 37301320
registers.ebx: 1634804
registers.esi: 41954916
registers.ecx: 0
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2556
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72d62000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2752
region_size: 1572864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00900000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2752
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2752
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x722f1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2752
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x722f2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2752
region_size: 1638400
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021a0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2752
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x022f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2752
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00582000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2752
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005b5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2752
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005bb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2752
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005b7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2752
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0059c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2752
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00720000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2752
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02502000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 589824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00480000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 1966080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02200000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x023a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x722f1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x722f2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 1179648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02070000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02150000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00732000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x023a1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x023a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0073a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0073c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x023a3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0074c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x023a4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0076b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00767000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02340000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00765000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0074d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0074e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 49152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02341000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0234d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00756000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0075a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00757000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0234e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0074a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0234f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x055d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x055d1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 20480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x055d2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x055d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x055d8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2796
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0075b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\lockfile
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file C:\Windows\Temp\2.exe
file C:\Windows\Temp\1.exe
Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 2 (FILE_CREATE)
file_handle: 0x00000000
filepath: C:\Users\test22\AppData\Roaming\Microsoft
desired_access: 0x00100001 (FILE_READ_DATA|FILE_LIST_DIRECTORY|SYNCHRONIZE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft
create_options: 16417 (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT)
status_info: 4294967295 ()
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
3221225525 0

NtCreateFile

 create_disposition: 2 (FILE_CREATE)
file_handle: 0x00000000
filepath: C:\Users\test22\AppData\Roaming\Microsoft\Crypto
desired_access: 0x00100001 (FILE_READ_DATA|FILE_LIST_DIRECTORY|SYNCHRONIZE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Crypto
create_options: 16417 (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT)
status_info: 4294967295 ()
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
3221225525 0

NtCreateFile

 create_disposition: 2 (FILE_CREATE)
file_handle: 0x00000000
filepath: C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA
desired_access: 0x00100001 (FILE_READ_DATA|FILE_LIST_DIRECTORY|SYNCHRONIZE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA
create_options: 16417 (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT)
status_info: 4294967295 ()
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
3221225525 0

NtCreateFile

 create_disposition: 2 (FILE_CREATE)
file_handle: 0x00000000
filepath: C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3832866432-4053218753-3017428901-1001
desired_access: 0x00100001 (FILE_READ_DATA|FILE_LIST_DIRECTORY|SYNCHRONIZE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3832866432-4053218753-3017428901-1001
create_options: 16417 (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT)
status_info: 4294967295 ()
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
3221225525 0

NtCreateFile

 create_disposition: 2 (FILE_CREATE)
file_handle: 0x00000000
filepath: C:\Users\test22\AppData\Roaming\Microsoft
desired_access: 0x00100001 (FILE_READ_DATA|FILE_LIST_DIRECTORY|SYNCHRONIZE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft
create_options: 16417 (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT)
status_info: 4294967295 ()
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
3221225525 0

NtCreateFile

 create_disposition: 2 (FILE_CREATE)
file_handle: 0x00000000
filepath: C:\Users\test22\AppData\Roaming\Microsoft\Crypto
desired_access: 0x00100001 (FILE_READ_DATA|FILE_LIST_DIRECTORY|SYNCHRONIZE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Crypto
create_options: 16417 (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT)
status_info: 4294967295 ()
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
3221225525 0

NtCreateFile

 create_disposition: 2 (FILE_CREATE)
file_handle: 0x00000000
filepath: C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA
desired_access: 0x00100001 (FILE_READ_DATA|FILE_LIST_DIRECTORY|SYNCHRONIZE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA
create_options: 16417 (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT)
status_info: 4294967295 ()
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
3221225525 0

NtCreateFile

 create_disposition: 2 (FILE_CREATE)
file_handle: 0x00000000
filepath: C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3832866432-4053218753-3017428901-1001
desired_access: 0x00100001 (FILE_READ_DATA|FILE_LIST_DIRECTORY|SYNCHRONIZE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\test22\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3832866432-4053218753-3017428901-1001
create_options: 16417 (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT)
status_info: 4294967295 ()
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
3221225525 0
file C:\Windows\Temp\1.exe
file C:\Windows\Temp\2.exe
section {u'size_of_data': u'0x0000e200', u'virtual_address': u'0x0005d000', u'entropy': 6.802287495720708, u'name': u'.rsrc', u'virtual_size': u'0x0000e034'} entropy 6.80228749572 description A section with a high entropy has been found
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Take ScreenShot rule ScreenShot
description PWS Memory rule Generic_PWS_Memory_Zero
description RedLine stealer rule RedLine_Stealer_m_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

RegOpenKeyExW

 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x00000480
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

 regkey_r: AddressBook
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
1 0 0

RegOpenKeyExW

 regkey_r: Connection Manager
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
1 0 0

RegOpenKeyExW

 regkey_r: DirectDrawEx
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
1 0 0

RegOpenKeyExW

 regkey_r: EditPlus
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus
1 0 0

RegOpenKeyExW

 regkey_r: ENTERPRISE
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE
1 0 0

RegOpenKeyExW

 regkey_r: Fontcore
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
1 0 0

RegOpenKeyExW

 regkey_r: Google Chrome
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
1 0 0

RegOpenKeyExW

 regkey_r: Haansoft HWord 80 Korean
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean
1 0 0

RegOpenKeyExW

 regkey_r: IE40
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40
1 0 0

RegOpenKeyExW

 regkey_r: IE4Data
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
1 0 0

RegOpenKeyExW

 regkey_r: IE5BAKEX
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
1 0 0

RegOpenKeyExW

 regkey_r: IEData
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData
1 0 0

RegOpenKeyExW

 regkey_r: MobileOptionPack
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
1 0 0

RegOpenKeyExW

 regkey_r: SchedulingAgent
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
1 0 0

RegOpenKeyExW

 regkey_r: WIC
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC
1 0 0

RegOpenKeyExW

 regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
1 0 0

RegOpenKeyExW

 regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980}
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}
1 0 0

RegOpenKeyExW

 regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA}
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}
1 0 0

RegOpenKeyExW

 regkey_r: {90120000-0015-0412-0000-0000000FF1CE}
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90120000-0016-0412-0000-0000000FF1CE}
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90120000-0018-0412-0000-0000000FF1CE}
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90120000-0019-0412-0000-0000000FF1CE}
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90120000-001A-0412-0000-0000000FF1CE}
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90120000-001B-0412-0000-0000000FF1CE}
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90120000-001F-0409-0000-0000000FF1CE}
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90120000-001F-0412-0000-0000000FF1CE}
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90120000-0028-0412-0000-0000000FF1CE}
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90120000-002C-0412-0000-0000000FF1CE}
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90120000-0030-0000-0000-0000000FF1CE}
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90120000-0044-0412-0000-0000000FF1CE}
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90120000-006E-0409-0000-0000000FF1CE}
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90120000-006E-0412-0000-0000000FF1CE}
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90120000-00A1-0412-0000-0000000FF1CE}
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90120000-00BA-0409-0000-0000000FF1CE}
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {90120000-0114-0412-0000-0000000FF1CE}
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

 regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4}
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}
1 0 0

RegOpenKeyExW

 regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40}
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}
1 0 0

RegOpenKeyExW

 regkey_r: {d992c12e-cab2-426f-bde3-fb8c53950b0d}
base_handle: 0x00000480
key_handle: 0x00000504
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}
1 0 0
wmi SELECT * FROM Win32_Processor
host 107.189.171.131
host 185.203.241.68
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 335872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001fc
1 0 0
file C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
wmi SELECT * FROM AntivirusProduct
wmi SELECT * FROM Win32_VideoController
wmi SELECT * FROM Win32_OperatingSystem
wmi SELECT * FROM Win32_Process Where SessionId='1'
wmi SELECT * FROM Win32_Process
wmi SELECT * FROM AntiSpyWareProduct
wmi SELECT * FROM FirewallProduct
wmi SELECT * FROM Win32_DiskDrive
wmi SELECT * FROM Win32_Processor
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÈþŽà 0ìÐ*º @  @…عO ÔÉ ¼¹  H.textê ì `.rsrcÔÉ Ìð@@.reloc ¼@B
base_address: 0x00400000
process_identifier: 2908
process_handle: 0x000001fc
1 1 0

WriteProcessMemory

 buffer: ° ,:
base_address: 0x00450000
process_identifier: 2908
process_handle: 0x000001fc
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2908
process_handle: 0x000001fc
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÈþŽà 0ìÐ*º @  @…عO ÔÉ ¼¹  H.textê ì `.rsrcÔÉ Ìð@@.reloc ¼@B
base_address: 0x00400000
process_identifier: 2908
process_handle: 0x000001fc
1 1 0
Time & API Arguments Status Return Repeated

RegQueryValueExW

 key_handle: 0x00000504
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: EditPlus
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000504
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Enterprise 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000504
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Chrome
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000504
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 한컴오피스 한글 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000504
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: HttpWatch Professional 9.3.39
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000504
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 한컴오피스 한글 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000504
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Google Update Helper
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000504
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Access MUI (Korean) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000504
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Excel MUI (Korean) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000504
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office PowerPoint MUI (Korean) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000504
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Publisher MUI (Korean) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000504
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Outlook MUI (Korean) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000504
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Word MUI (Korean) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000504
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proof (English) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000504
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proof (Korean) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000504
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office IME (Korean) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000504
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing (Korean) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000504
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Enterprise 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000504
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office InfoPath MUI (Korean) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000504
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared MUI (English) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000504
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared MUI (Korean) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000504
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office OneNote MUI (Korean) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000504
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Groove MUI (English) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000504
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Groove Setup Metadata MUI (Korean) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000504
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Flash Player 13 ActiveX
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000504
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Flash Player 13 NPAPI
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName
1 0 0

RegQueryValueExW

 key_handle: 0x00000504
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName
1 0 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob
Process injection Process 2752 called NtSetContextThread to modify thread in remote process 2908
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 3276472
registers.edi: 0
registers.eax: 4373034
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000001f8
process_identifier: 2908
1 0 0
Process injection Process 2752 resumed a thread in remote process 2908
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000001f8
suspend_count: 1
process_identifier: 2908
1 0 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000017c
suspend_count: 1
process_identifier: 2556
1 0 0

CreateProcessInternalW

 thread_identifier: 2756
thread_handle: 0x00000284
process_identifier: 2752
current_directory: C:\Windows\Temp
filepath: C:\Windows\Temp\1.exe
track: 1
command_line: "C:\Windows\Temp\1.exe"
filepath_r: C:\Windows\Temp\1.exe
stack_pivoted: 0
creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_SUSPENDED|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000280
1 1 0

CreateProcessInternalW

 thread_identifier: 2800
thread_handle: 0x000001d4
process_identifier: 2796
current_directory: C:\Windows\Temp
filepath: C:\Windows\Temp\2.exe
track: 1
command_line: "C:\Windows\Temp\2.exe"
filepath_r: C:\Windows\Temp\2.exe
stack_pivoted: 0
creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_SUSPENDED|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000002a4
1 1 0

NtResumeThread

 thread_handle: 0x000000e4
suspend_count: 1
process_identifier: 2752
1 0 0

NtResumeThread

 thread_handle: 0x00000158
suspend_count: 1
process_identifier: 2752
1 0 0

NtResumeThread

 thread_handle: 0x00000194
suspend_count: 1
process_identifier: 2752
1 0 0

CreateProcessInternalW

 thread_identifier: 2912
thread_handle: 0x000001f8
process_identifier: 2908
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
track: 1
command_line:
filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x000001fc
1 1 0

NtGetContextThread

 thread_handle: 0x000001f8
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2908
region_size: 335872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001fc
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÈþŽà 0ìÐ*º @  @…عO ÔÉ ¼¹  H.textê ì `.rsrcÔÉ Ìð@@.reloc ¼@B
base_address: 0x00400000
process_identifier: 2908
process_handle: 0x000001fc
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00402000
process_identifier: 2908
process_handle: 0x000001fc
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00432000
process_identifier: 2908
process_handle: 0x000001fc
1 1 0

WriteProcessMemory

 buffer: ° ,:
base_address: 0x00450000
process_identifier: 2908
process_handle: 0x000001fc
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2908
process_handle: 0x000001fc
1 1 0

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 3276472
registers.edi: 0
registers.eax: 4373034
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000001f8
process_identifier: 2908
1 0 0

NtResumeThread

 thread_handle: 0x000001f8
suspend_count: 1
process_identifier: 2908
1 0 0

NtResumeThread

 thread_handle: 0x00000114
suspend_count: 1
process_identifier: 2796
1 0 0

NtResumeThread

 thread_handle: 0x00000184
suspend_count: 1
process_identifier: 2796
1 0 0

NtResumeThread

 thread_handle: 0x000001c8
suspend_count: 1
process_identifier: 2796
1 0 0

NtResumeThread

 thread_handle: 0x000003bc
suspend_count: 1
process_identifier: 2796
1 0 0

NtResumeThread

 thread_handle: 0x000003f4
suspend_count: 1
process_identifier: 2796
1 0 0

NtResumeThread

 thread_handle: 0x0000045c
suspend_count: 1
process_identifier: 2796
1 0 0

NtResumeThread

 thread_handle: 0x00000478
suspend_count: 1
process_identifier: 2796
1 0 0

NtResumeThread

 thread_handle: 0x00000490
suspend_count: 1
process_identifier: 2796
1 0 0

NtResumeThread

 thread_handle: 0x000004a8
suspend_count: 1
process_identifier: 2796
1 0 0

NtResumeThread

 thread_handle: 0x000004c0
suspend_count: 1
process_identifier: 2796
1 0 0

NtResumeThread

 thread_handle: 0x000004dc
suspend_count: 1
process_identifier: 2796
1 0 0

NtResumeThread

 thread_handle: 0x0000050c
suspend_count: 1
process_identifier: 2796
1 0 0

NtResumeThread

 thread_handle: 0x0000054c
suspend_count: 1
process_identifier: 2796
1 0 0

NtResumeThread

 thread_handle: 0x00000634
suspend_count: 1
process_identifier: 2796
1 0 0

NtGetContextThread

 thread_handle: 0x00000118
1 0 0

NtGetContextThread

 thread_handle: 0x00000118
1 0 0

NtResumeThread

 thread_handle: 0x00000118
suspend_count: 1
process_identifier: 2796
1 0 0

NtGetContextThread

 thread_handle: 0x00000118
1 0 0

NtGetContextThread

 thread_handle: 0x00000118
1 0 0

NtResumeThread

 thread_handle: 0x00000118
suspend_count: 1
process_identifier: 2796
1 0 0

NtGetContextThread

 thread_handle: 0x00000118
1 0 0

NtGetContextThread

 thread_handle: 0x00000118
1 0 0

NtResumeThread

 thread_handle: 0x00000118
suspend_count: 1
process_identifier: 2796
1 0 0

NtGetContextThread

 thread_handle: 0x00000118
1 0 0

NtGetContextThread

 thread_handle: 0x00000118
1 0 0

NtResumeThread

 thread_handle: 0x00000118
suspend_count: 1
process_identifier: 2796
1 0 0

NtGetContextThread

 thread_handle: 0x00000118
1 0 0

NtGetContextThread

 thread_handle: 0x00000118
1 0 0

NtResumeThread

 thread_handle: 0x00000118
suspend_count: 1
process_identifier: 2796
1 0 0

NtGetContextThread

 thread_handle: 0x00000118
1 0 0

NtGetContextThread

 thread_handle: 0x00000118
1 0 0

NtResumeThread

 thread_handle: 0x00000118
suspend_count: 1
process_identifier: 2796
1 0 0

NtResumeThread

 thread_handle: 0x00000648
suspend_count: 1
process_identifier: 2796
1 0 0

NtGetContextThread

 thread_handle: 0x00000118
1 0 0
Bkav W32.AIDetectMalware
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.MSILHeracles.179311
CAT-QuickHeal Trojan.Seraph
Skyhigh BehavesLike.Win32.Generic.cc
ALYac Dump:Generic.Dacic.6D6C5790.A.AAF4F7E2
Cylance Unsafe
VIPRE Dump:Generic.Dacic.6D6C5790.A.AAF4F7E2
K7AntiVirus Trojan ( 700000121 )
BitDefender Gen:Variant.MSILHeracles.179311
K7GW Trojan ( 700000121 )
Cybereason malicious.0ccad6
Arcabit Trojan.MSILHeracles.D2BC6F [many]
VirIT Trojan.Win32.Genus.WLI
ESET-NOD32 multiple detections
APEX Malicious
Avast Win32:PWSX-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky Trojan-Spy.Win32.Stealer.fjat
Rising Trojan.Kryptik!8.8 (CLOUD)
Emsisoft Gen:Variant.MSILHeracles.179311 (B)
F-Secure Heuristic.HEUR/AGEN.1351932
DrWeb Trojan.PWS.Siggen3.38349
TrendMicro TrojanSpy.Win32.METASTEALER.YXEILZ
CTX malware (ai score=89)
Sophos Generic ML PUA (PUA)
SentinelOne Static AI - Malicious SFX
FireEye Generic.mg.24fbb160ccad6b03
Google Detected
Avira HEUR/AGEN.1351932
Kingsoft malware.kb.a.968
Gridinsoft Malware.Win32.RedLine.tr
Microsoft Trojan:Win32/Wacatac.B!ml
ZoneAlarm HEUR:Trojan-PSW.MSIL.Reline.gen
GData Win32.Trojan.Kryptik.4ZXPL0
Varist W32/S-8ed38c1a!Eldorado
DeepInstinct MALICIOUS
Malwarebytes Trojan.MalPack.MSIL
Ikarus Trojan.MSIL.Crypt
TrendMicro-HouseCall TrojanSpy.Win32.METASTEALER.YXEILZ
huorong Trojan/MSIL.Agent.li
Fortinet MSIL/Kryptik.AMEW!tr
AVG Win32:PWSX-gen [Trj]
CrowdStrike win/malicious_confidence_70% (D)