popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

yupmuh.rar

  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 April 1, 2021, 9:18 a.m. April 1, 2021, 9:20 a.m.
Size 381.5KB
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 eb838efdd43af0b576785bffcb48cbd1
SHA256 bbecfbfbec13e6b2144f32e3fcb248640e9c7c9dcfd3af0f8c5d887a777fa19a
CRC32 6B0AE4B8
ssdeep 6144:26vYH/guLTgpb1oFtIaJmGDtDplcJqiD4IU2fQ/TxHJrtrHayYm:26vYouLTgp5oFt/hRDfkL1U2Y/Txprtn
PDB Path paragraph.pdbVillagesdinghgaragraph#@db
Yara
  • PE_Header_Zero - PE File Signature Zero
  • OS_Processor_Check_Zero - OS Processor Check Signature Zero
  • win_files_operation - Affect private profile
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • IsWindowsGUI - (no description)
  • HasDebugData - DebugData Check
  • HasRichSignature - Rich Signature Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path paragraph.pdbVillagesdinghgaragraph#@db
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176356
        

      
        registers.edi:
        4532952
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        2000552521
        

      
        registers.edx:
        129161
        

      
        registers.ebx:
        2704346981
        

      
        registers.esi:
        1970405376
        

      
        registers.ecx:
        66040
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176332
        

      
        registers.edi:
        16
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        10684368
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176332
        

      
        registers.edi:
        15
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        10684384
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176332
        

      
        registers.edi:
        14
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        10684400
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176332
        

      
        registers.edi:
        13
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        10684416
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176332
        

      
        registers.edi:
        12
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        10684432
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176332
        

      
        registers.edi:
        11
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        10684448
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176332
        

      
        registers.edi:
        10
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        10684464
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176332
        

      
        registers.edi:
        9
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        10684480
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176332
        

      
        registers.edi:
        8
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        10684496
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176332
        

      
        registers.edi:
        7
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        10684512
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176332
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        10684528
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176332
        

      
        registers.edi:
        5
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        10684544
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176332
        

      
        registers.edi:
        4
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        10684560
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176332
        

      
        registers.edi:
        3
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        10684576
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176332
        

      
        registers.edi:
        2
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        10684592
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176332
        

      
        registers.edi:
        1
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        10684608
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          
DllRegisterServer+0xcbc7 yupmuh+0x16937 @ 0x73d16937

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1175528
        

      
        registers.edi:
        12
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        1176600
        

      
        registers.edx:
        23
        

      
        registers.ebx:
        1176616
        

      
        registers.esi:
        23
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176584
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        96784
        

      
        registers.edx:
        827898
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        282
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176560
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        16
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        10687848
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176560
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        15
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        10687872
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176560
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        14
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        10687896
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176560
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        13
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        10687920
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176560
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        12
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        10687944
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176560
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        11
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        10687968
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176560
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        10
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        10687992
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176560
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        9
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        10688016
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176560
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        8
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        10688040
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176560
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        7
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        10688064
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176560
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        6
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        10688088
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176560
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        5
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        10688112
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176560
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        10688136
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176560
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        3
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        10688160
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176560
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        2
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        10688184
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        1176560
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        1
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        10688208
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        2356492
        

      
        registers.edi:
        4795112
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        2000552521
        

      
        registers.edx:
        129161
        

      
        registers.ebx:
        2704346981
        

      
        registers.esi:
        1970405376
        

      
        registers.ecx:
        66040
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        2356468
        

      
        registers.edi:
        16
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4196304
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        2356468
        

      
        registers.edi:
        15
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4196320
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        2356468
        

      
        registers.edi:
        14
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4196336
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        2356468
        

      
        registers.edi:
        13
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4196352
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        2356468
        

      
        registers.edi:
        12
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4196368
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        2356468
        

      
        registers.edi:
        11
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4196384
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        2356468
        

      
        registers.edi:
        10
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4196400
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        2356468
        

      
        registers.edi:
        9
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4196416
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        2356468
        

      
        registers.edi:
        8
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4196432
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        2356468
        

      
        registers.edi:
        7
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4196448
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        2356468
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4196464
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        2356468
        

      
        registers.edi:
        5
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4196480
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        2356468
        

      
        registers.edi:
        4
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4196496
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec yupmuh+0x1105c
        

      
        exception.address:
        0x73d1105c
        

      
    
  
    
      
        registers.esp:
        2356468
        

      
        registers.edi:
        3
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4196512
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2648
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x73d41000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2648
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          16384
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x73d60000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2648
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x003b0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2648
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x003c0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2648
        
      
      
      

    
  
    
      region_size:
      
        
          532480
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00840000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2076
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x73d41000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2076
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          16384
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x73d60000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2076
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x003d0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2076
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x003e0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2076
        
      
      
      

    
  
    
      region_size:
      
        
          532480
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x01c80000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2276
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x73d41000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2276
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          16384
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x73d60000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2276
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00320000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2276
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00330000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2276
        
      
      
      

    
  
    
      region_size:
      
        
          532480
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00340000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1812
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x73d41000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1812
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          16384
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x73d60000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1812
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00330000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1812
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00380000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1812
        
      
      
      

    
  
    
      region_size:
      
        
          532480
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00390000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    Bkav
                                    W32.AIDetect.malware2
                                    
                                


                            

                        

                            

                                

                                    FireEye
                                    Generic.mg.eb838efdd43af0b5
                                    
                                


                            

                        

                            

                                

                                    APEX
                                    Malicious
                                    
                                


                            

                        

                            

                                

                                    Cynet
                                    Malicious (score: 100)
                                    
                                


                            

                        

                            

                                

                                    Ikarus
                                    Trojan-Dropper.VBA.Agent
                                    
                                


                            

                        

                            

                                

                                    Microsoft
                                    Trojan:Win32/Wacatac.B!ml
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x0003f600', u'virtual_address': u'0x00001000', u'entropy': 6.832597746974577, u'name': u'.text', u'virtual_size': u'0x0003f474'}
                                        
                                    
                                        
                                            entropy
                                            6.83259774697
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            entropy
                                            0.666228646518
                                        
                                    
                                        
                                            description
                                            Overall entropy of this PE file is high