popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

mnr.exe

Malicious Packer UPX OS Processor Check PE64 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 6, 2023, 10:50 a.m. Nov. 6, 2023, 10:52 a.m.
Size 2.8MB
Type PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5 6584c57539dd7f05013ecd3806683fb4
SHA256 b587f52032999910f4f2ba4fad3b734667be1ca93de36af283386af3fe4866e2
CRC32 13AA957A
ssdeep 49152:18KfYEwq6BCW4QKdgsI50GDLWZeIHako1+b/Ev8MhmWYyvL1mgJFDUg:ECSotIJBmgJFDz
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .sdata
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 2555904
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000b10000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000d00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2532
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a71000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2532
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef410b000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 1114112
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000022a0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002330000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2532
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a72000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2532
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a72000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2532
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a72000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2532
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a72000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2532
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a72000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2532
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a72000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2532
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a72000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2532
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a72000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2532
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a72000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2532
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a72000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2532
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a72000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2532
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a74000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2532
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a74000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2532
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a74000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2532
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef3a74000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe942da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe942ec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe944c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 1880064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe944c1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe94700000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9438c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe943b6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe94390000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe942ed000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 40960
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe94701000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe942db000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9470b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe942ea000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe942fb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9432c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe942fd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9470c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe942d2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000021e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2532
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef2376000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe9470d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe94711000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2532
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe94712000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d1ba4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d1ba4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d1ba4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d1ba4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d1ba4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d1ba4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d1ba4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d1ba4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d1ba4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d1ba4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d1ba4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d1ba4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d1ba4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d1ba4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d1ba4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d1ba4 size 0x00000134
name RT_BITMAP language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d1d90 size 0x00000144
name RT_BITMAP language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d1d90 size 0x00000144
name RT_DIALOG language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d1fbc size 0x00000034
name RT_DIALOG language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d1fbc size 0x00000034
name RT_STRING language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d2df0 size 0x000002be
name RT_STRING language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d2df0 size 0x000002be
name RT_STRING language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d2df0 size 0x000002be
name RT_STRING language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d2df0 size 0x000002be
name RT_STRING language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d2df0 size 0x000002be
name RT_STRING language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d2df0 size 0x000002be
name RT_STRING language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d2df0 size 0x000002be
name RT_STRING language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d2df0 size 0x000002be
name RT_STRING language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d2df0 size 0x000002be
name RT_STRING language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d2df0 size 0x000002be
name RT_STRING language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d2df0 size 0x000002be
name RT_STRING language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d2df0 size 0x000002be
name RT_STRING language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d2df0 size 0x000002be
name RT_GROUP_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d31d8 size 0x00000014
name RT_GROUP_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d31d8 size 0x00000014
name RT_GROUP_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d31d8 size 0x00000014
name RT_GROUP_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d31d8 size 0x00000014
name RT_GROUP_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d31d8 size 0x00000014
name RT_GROUP_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d31d8 size 0x00000014
name RT_GROUP_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d31d8 size 0x00000014
name RT_GROUP_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d31d8 size 0x00000014
name RT_GROUP_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d31d8 size 0x00000014
name RT_GROUP_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d31d8 size 0x00000014
name RT_GROUP_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d31d8 size 0x00000014
name RT_GROUP_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d31d8 size 0x00000014
name RT_GROUP_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d31d8 size 0x00000014
name RT_GROUP_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d31d8 size 0x00000014
name RT_GROUP_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d31d8 size 0x00000014
name RT_VERSION language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002d31ec size 0x00000244
section {u'size_of_data': u'0x002caa00', u'virtual_address': u'0x00002000', u'entropy': 6.877846689489419, u'name': u'.text', u'virtual_size': u'0x002ca8c4'} entropy 6.87784668949 description A section with a high entropy has been found
section {u'size_of_data': u'0x00001000', u'virtual_address': u'0x002ce000', u'entropy': 7.157881810967232, u'name': u'.sdata', u'virtual_size': u'0x00000e48'} entropy 7.15788181097 description A section with a high entropy has been found
entropy 0.9951329741 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

EnumServicesStatusW

 service_handle: 0x000000004bceb470
service_type: 48
service_status: 3
0 0
Time & API Arguments Status Return Repeated

LdrGetProcedureAddress

 ordinal: 0
function_address: 0x000000000017efa8
function_name: wine_get_unix_file_name
module: KERNEL32
module_address: 0x0000000076c10000
-1073741511 0