popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

kwhqfq.tar

  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 April 1, 2021, 9:18 a.m. April 1, 2021, 9:25 a.m.
Size 381.5KB
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 8bdb981f0211ddf9ddcc34bf32bea729
SHA256 8184f7c71a3fcfd37d1257e46a3e00d8e761510f536e97c4c851ffed500174a4
CRC32 3A7815D8
ssdeep 6144:n6vYH/guLTgFb1oFtIaJmGDtDplcJqiD4IU2fQ/TxHIstrHayYm:n6vYouLTgF5oFt/hRDfkL1U2Y/Txostn
PDB Path paragraph.pdbVillagesdinghgaragraph#@db
Yara
  • PE_Header_Zero - PE File Signature Zero
  • OS_Processor_Check_Zero - OS Processor Check Signature Zero
  • win_files_operation - Affect private profile
  • IsPE32 - (no description)
  • IsDLL - (no description)
  • IsWindowsGUI - (no description)
  • HasDebugData - DebugData Check
  • HasRichSignature - Rich Signature Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path paragraph.pdbVillagesdinghgaragraph#@db
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291152
        

      
        registers.edi:
        5319384
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        2000552521
        

      
        registers.edx:
        129161
        

      
        registers.ebx:
        2704346981
        

      
        registers.esi:
        1970405376
        

      
        registers.ecx:
        66040
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291128
        

      
        registers.edi:
        16
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4720592
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291128
        

      
        registers.edi:
        15
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4720608
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291128
        

      
        registers.edi:
        14
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4720624
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291128
        

      
        registers.edi:
        13
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4720640
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291128
        

      
        registers.edi:
        12
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4720656
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291128
        

      
        registers.edi:
        11
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4720672
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291128
        

      
        registers.edi:
        10
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4720688
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291128
        

      
        registers.edi:
        9
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4720704
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291128
        

      
        registers.edi:
        8
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4720720
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291128
        

      
        registers.edi:
        7
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4720736
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291128
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4720752
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291128
        

      
        registers.edi:
        5
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4720768
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291128
        

      
        registers.edi:
        4
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4720784
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291128
        

      
        registers.edi:
        3
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4720800
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291128
        

      
        registers.edi:
        2
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4720816
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291128
        

      
        registers.edi:
        1
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4720832
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          
DllRegisterServer+0xcbc7 kwhqfq+0x16937 @ 0x73cc6937

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2290328
        

      
        registers.edi:
        12
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        2291396
        

      
        registers.edx:
        23
        

      
        registers.ebx:
        2291412
        

      
        registers.esi:
        23
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291380
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        96784
        

      
        registers.edx:
        827898
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        282
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291356
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        16
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        4724072
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291356
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        15
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        4724096
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291356
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        14
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        4724120
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291356
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        13
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        4724144
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291356
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        12
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        4724168
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291356
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        11
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        4724192
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291356
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        10
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        4724216
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291356
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        9
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        4724240
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291356
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        8
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        4724264
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291356
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        7
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        4724288
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291356
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        6
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        4724312
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291356
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        5
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        4724336
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291356
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        4
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        4724360
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291356
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        3
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        4724384
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291356
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        2
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        4724408
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        2291356
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        1
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        64
        

      
        registers.esi:
        4724432
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        1044464
        

      
        registers.edi:
        5253864
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        2000552521
        

      
        registers.edx:
        129161
        

      
        registers.ebx:
        2704346981
        

      
        registers.esi:
        1970405376
        

      
        registers.ecx:
        66040
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        1044440
        

      
        registers.edi:
        16
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34473936
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        1044440
        

      
        registers.edi:
        15
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34473952
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        1044440
        

      
        registers.edi:
        14
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34473968
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        1044440
        

      
        registers.edi:
        13
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34473984
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        1044440
        

      
        registers.edi:
        12
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34474000
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        1044440
        

      
        registers.edi:
        11
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34474016
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        1044440
        

      
        registers.edi:
        10
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34474032
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        1044440
        

      
        registers.edi:
        9
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34474048
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        1044440
        

      
        registers.edi:
        8
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34474064
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        1044440
        

      
        registers.edi:
        7
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34474080
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        1044440
        

      
        registers.edi:
        6
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34474096
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        1044440
        

      
        registers.edi:
        5
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34474112
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        1044440
        

      
        registers.edi:
        4
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34474128
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cc c3 5d c3 33 c0 5d c3 68 e0 7d b6 c0 68 ea b3
        

      
        exception.instruction:
        int3
        

      
        exception.exception_code:
        0x80000003
        

      
        exception.symbol:
        DllRegisterServer+0x72ec kwhqfq+0x1105c
        

      
        exception.address:
        0x73cc105c
        

      
    
  
    
      
        registers.esp:
        1044440
        

      
        registers.edi:
        3
        

      
        registers.eax:
        2000478246
        

      
        registers.ebp:
        34474144
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        64
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2948
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x73cf1000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2948
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          16384
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x73d10000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2948
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x003c0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2948
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x003e0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2948
        
      
      
      

    
  
    
      region_size:
      
        
          532480
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x003f0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1772
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x73cf1000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1772
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          16384
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x73d10000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1772
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x003e0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1772
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x003f0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1772
        
      
      
      

    
  
    
      region_size:
      
        
          532480
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00400000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1536
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x73cf1000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1536
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          16384
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x73d10000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1536
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x003b0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1536
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x003c0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1536
        
      
      
      

    
  
    
      region_size:
      
        
          532480
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00880000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2856
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x73cf1000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2856
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          16384
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x73d10000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2856
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00320000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2856
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00330000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2856
        
      
      
      

    
  
    
      region_size:
      
        
          532480
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00880000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    Bkav
                                    W32.AIDetect.malware2
                                    
                                


                            

                        

                            

                                

                                    FireEye
                                    Generic.mg.8bdb981f0211ddf9
                                    
                                


                            

                        

                            

                                

                                    McAfee
                                    Artemis!8BDB981F0211
                                    
                                


                            

                        

                            

                                

                                    APEX
                                    Malicious
                                    
                                


                            

                        

                            

                                

                                    McAfee-GW-Edition
                                    Artemis!Trojan
                                    
                                


                            

                        

                            

                                

                                    Ikarus
                                    Trojan-Dropper.VBA.Agent
                                    
                                


                            

                        

                            

                                

                                    Cynet
                                    Malicious (score: 100)
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x0003f600', u'virtual_address': u'0x00001000', u'entropy': 6.832600151243625, u'name': u'.text', u'virtual_size': u'0x0003f474'}
                                        
                                    
                                        
                                            entropy
                                            6.83260015124
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            entropy
                                            0.666228646518
                                        
                                    
                                        
                                            description
                                            Overall entropy of this PE file is high