popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

dcee5b78-00b4-4c16-8307-e930fb72a169

EnigmaProtector PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 9, 2023, 7:48 a.m. Nov. 9, 2023, 7:54 a.m.
Size 2.4MB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 6aab37c5887c49c665d17fd7823498d6
SHA256 40623aeb8331c5cf8742be4e6080ad2da0d116d982e862f66b5f5ea17ca59726
CRC32 920A1AF0
ssdeep 49152:oGdXUUdMmN1NxNPu3/j87DvWFSJrdK12Hi2PlzvTWDLcnHAPxDo5:pZMyNx9yb8XcSJrdK1/2dzrWmAJD
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • EnigmaProtector_IN - EnigmaProtector

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
68.168.118.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
section
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
0x7ebd1080
0x7ebd0f30

exception.instruction_r: f7 f0 e8 84 4c 01 00 33 c0 5a 59 59 64 89 10 eb
exception.instruction: div eax
exception.module: dcee5b78-00b4-4c16-8307-e930fb72a169.exe
exception.exception_code: 0xc0000094
exception.offset: 1084017
exception.address: 0x10b8a71
registers.esp: 5570004
registers.edi: 24215792
registers.eax: 0
registers.ebp: 5570032
registers.edx: 0
registers.ebx: 937269258
registers.esi: 16588800
registers.ecx: 15546084
1 0 0

__exception__

 stacktrace: 
0x7ebd1080
0x7ebd0f30

exception.instruction_r: 0f 0b e8 59 4c 01 00 33 c0 5a 59 59 64 89 10 eb
exception.instruction: ud2
exception.module: dcee5b78-00b4-4c16-8307-e930fb72a169.exe
exception.exception_code: 0xc000001d
exception.offset: 1084060
exception.address: 0x10b8a9c
registers.esp: 5570004
registers.edi: 5570004
registers.eax: 0
registers.ebp: 5570032
registers.edx: 2
registers.ebx: 17533575
registers.esi: 0
registers.ecx: 5570040
1 0 0

__exception__

 stacktrace: 
0x7ebd1bc0
0x7ebd1800

exception.instruction_r: f7 f0 e8 84 4c 01 00 33 c0 5a 59 59 64 89 10 eb
exception.instruction: div eax
exception.module: dcee5b78-00b4-4c16-8307-e930fb72a169.exe
exception.exception_code: 0xc0000094
exception.offset: 1084017
exception.address: 0x10b8a71
registers.esp: 5569900
registers.edi: 17791656
registers.eax: 0
registers.ebp: 5569928
registers.edx: 0
registers.ebx: 12394496
registers.esi: 16588800
registers.ecx: 16588800
1 0 0

__exception__

 stacktrace: 
0x7ebd1bc0
0x7ebd1800

exception.instruction_r: 0f 0b e8 59 4c 01 00 33 c0 5a 59 59 64 89 10 eb
exception.instruction: ud2
exception.module: dcee5b78-00b4-4c16-8307-e930fb72a169.exe
exception.exception_code: 0xc000001d
exception.offset: 1084060
exception.address: 0x10b8a9c
registers.esp: 5569900
registers.edi: 5569900
registers.eax: 0
registers.ebp: 5569928
registers.edx: 2
registers.ebx: 17533575
registers.esi: 0
registers.ecx: 5569936
1 0 0

__exception__

 stacktrace: 
0x7ebd1bc0
0x7ebd1800

exception.instruction_r: 0f 0b e8 59 4c 01 00 33 c0 5a 59 59 64 89 10 eb
exception.instruction: ud2
exception.module: dcee5b78-00b4-4c16-8307-e930fb72a169.exe
exception.exception_code: 0xc000001d
exception.offset: 1084060
exception.address: 0x10b8a9c
registers.esp: 5569900
registers.edi: 5569900
registers.eax: 0
registers.ebp: 5569928
registers.edx: 2
registers.ebx: 17533618
registers.esi: 0
registers.ecx: 5569936
1 0 0

__exception__

 stacktrace: 
0x7ebd1bc0
0x7ebd1800

exception.instruction_r: f7 f0 e8 84 4c 01 00 33 c0 5a 59 59 64 89 10 eb
exception.instruction: div eax
exception.module: dcee5b78-00b4-4c16-8307-e930fb72a169.exe
exception.exception_code: 0xc0000094
exception.offset: 1084017
exception.address: 0x10b8a71
registers.esp: 5569900
registers.edi: 5569900
registers.eax: 0
registers.ebp: 5569928
registers.edx: 0
registers.ebx: 17533618
registers.esi: 0
registers.ecx: 5569936
1 0 0

__exception__

 stacktrace: 
0x7ebd1bc0
0x7ebd1800

exception.instruction_r: f7 f0 e8 84 4c 01 00 33 c0 5a 59 59 64 89 10 eb
exception.instruction: div eax
exception.module: dcee5b78-00b4-4c16-8307-e930fb72a169.exe
exception.exception_code: 0xc0000094
exception.offset: 1084017
exception.address: 0x10b8a71
registers.esp: 5569900
registers.edi: 5569900
registers.eax: 0
registers.ebp: 5569928
registers.edx: 0
registers.ebx: 17533575
registers.esi: 0
registers.ecx: 5569936
1 0 0

__exception__

 stacktrace: 
0x7ebd2040
0x7ebd1800

exception.instruction_r: 0f 0b e8 59 4c 01 00 33 c0 5a 59 59 64 89 10 eb
exception.instruction: ud2
exception.module: dcee5b78-00b4-4c16-8307-e930fb72a169.exe
exception.exception_code: 0xc000001d
exception.offset: 1084060
exception.address: 0x10b8a9c
registers.esp: 5569900
registers.edi: 17791656
registers.eax: 0
registers.ebp: 5569928
registers.edx: 2
registers.ebx: 12394496
registers.esi: 16588800
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x7ebd2040
0x7ebd1800

exception.instruction_r: f7 f0 e8 84 4c 01 00 33 c0 5a 59 59 64 89 10 eb
exception.instruction: div eax
exception.module: dcee5b78-00b4-4c16-8307-e930fb72a169.exe
exception.exception_code: 0xc0000094
exception.offset: 1084017
exception.address: 0x10b8a71
registers.esp: 5569900
registers.edi: 5569900
registers.eax: 0
registers.ebp: 5569928
registers.edx: 0
registers.ebx: 17533618
registers.esi: 0
registers.ecx: 5569936
1 0 0

__exception__

 stacktrace: 
0x7ebd2040
0x7ebd1800

exception.instruction_r: 0f 0b e8 59 4c 01 00 33 c0 5a 59 59 64 89 10 eb
exception.instruction: ud2
exception.module: dcee5b78-00b4-4c16-8307-e930fb72a169.exe
exception.exception_code: 0xc000001d
exception.offset: 1084060
exception.address: 0x10b8a9c
registers.esp: 5569900
registers.edi: 5569900
registers.eax: 0
registers.ebp: 5569928
registers.edx: 2
registers.ebx: 17533575
registers.esi: 0
registers.ecx: 5569936
1 0 0

__exception__

 stacktrace: 
0x7ebd2040
0x7ebd1800

exception.instruction_r: f7 f0 e8 84 4c 01 00 33 c0 5a 59 59 64 89 10 eb
exception.instruction: div eax
exception.module: dcee5b78-00b4-4c16-8307-e930fb72a169.exe
exception.exception_code: 0xc0000094
exception.offset: 1084017
exception.address: 0x10b8a71
registers.esp: 5569900
registers.edi: 5569900
registers.eax: 0
registers.ebp: 5569928
registers.edx: 0
registers.ebx: 17533618
registers.esi: 0
registers.ecx: 5569936
1 0 0

__exception__

 stacktrace: 
0x7ebd2190
0x7ebd1800

exception.instruction_r: 0f 0b e8 59 4c 01 00 33 c0 5a 59 59 64 89 10 eb
exception.instruction: ud2
exception.module: dcee5b78-00b4-4c16-8307-e930fb72a169.exe
exception.exception_code: 0xc000001d
exception.offset: 1084060
exception.address: 0x10b8a9c
registers.esp: 5569900
registers.edi: 17791656
registers.eax: 0
registers.ebp: 5569928
registers.edx: 2
registers.ebx: 12394496
registers.esi: 16588800
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x7ebd2190
0x7ebd1800

exception.instruction_r: 0f 0b e8 59 4c 01 00 33 c0 5a 59 59 64 89 10 eb
exception.instruction: ud2
exception.module: dcee5b78-00b4-4c16-8307-e930fb72a169.exe
exception.exception_code: 0xc000001d
exception.offset: 1084060
exception.address: 0x10b8a9c
registers.esp: 5569900
registers.edi: 5569900
registers.eax: 0
registers.ebp: 5569928
registers.edx: 2
registers.ebx: 17533618
registers.esi: 0
registers.ecx: 5569936
1 0 0

__exception__

 stacktrace: 
0x7ebd2190
0x7ebd1800

exception.instruction_r: f7 f0 e8 84 4c 01 00 33 c0 5a 59 59 64 89 10 eb
exception.instruction: div eax
exception.module: dcee5b78-00b4-4c16-8307-e930fb72a169.exe
exception.exception_code: 0xc0000094
exception.offset: 1084017
exception.address: 0x10b8a71
registers.esp: 5569900
registers.edi: 5569900
registers.eax: 0
registers.ebp: 5569928
registers.edx: 0
registers.ebx: 17533618
registers.esi: 0
registers.ecx: 5569936
1 0 0

__exception__

 stacktrace: 
0x7ebd2190
0x7ebd1800

exception.instruction_r: f7 f0 e8 84 4c 01 00 33 c0 5a 59 59 64 89 10 eb
exception.instruction: div eax
exception.module: dcee5b78-00b4-4c16-8307-e930fb72a169.exe
exception.exception_code: 0xc0000094
exception.offset: 1084017
exception.address: 0x10b8a71
registers.esp: 5569900
registers.edi: 5569900
registers.eax: 0
registers.ebp: 5569928
registers.edx: 0
registers.ebx: 17533575
registers.esi: 0
registers.ecx: 5569936
1 0 0

__exception__

 stacktrace: 
0x7ebd2190
0x7ebd1800

exception.instruction_r: f7 f0 e8 84 4c 01 00 33 c0 5a 59 59 64 89 10 eb
exception.instruction: div eax
exception.module: dcee5b78-00b4-4c16-8307-e930fb72a169.exe
exception.exception_code: 0xc0000094
exception.offset: 1084017
exception.address: 0x10b8a71
registers.esp: 5569900
registers.edi: 5569900
registers.eax: 0
registers.ebp: 5569928
registers.edx: 0
registers.ebx: 17533575
registers.esi: 0
registers.ecx: 5569936
1 0 0

__exception__

 stacktrace: 
0x7ebd2190
0x7ebd1800

exception.instruction_r: 0f 0b e8 59 4c 01 00 33 c0 5a 59 59 64 89 10 eb
exception.instruction: ud2
exception.module: dcee5b78-00b4-4c16-8307-e930fb72a169.exe
exception.exception_code: 0xc000001d
exception.offset: 1084060
exception.address: 0x10b8a9c
registers.esp: 5569900
registers.edi: 5569900
registers.eax: 0
registers.ebp: 5569928
registers.edx: 2
registers.ebx: 17533575
registers.esi: 0
registers.ecx: 5569936
1 0 0

__exception__

 stacktrace: 
0x7ebd2610
0x7ebd1800

exception.instruction_r: 0f 0b e8 59 4c 01 00 33 c0 5a 59 59 64 89 10 eb
exception.instruction: ud2
exception.module: dcee5b78-00b4-4c16-8307-e930fb72a169.exe
exception.exception_code: 0xc000001d
exception.offset: 1084060
exception.address: 0x10b8a9c
registers.esp: 5569900
registers.edi: 17791656
registers.eax: 0
registers.ebp: 5569928
registers.edx: 2
registers.ebx: 0
registers.esi: 16588800
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
0x7ebd2610
0x7ebd1800

exception.instruction_r: f7 f0 e8 84 4c 01 00 33 c0 5a 59 59 64 89 10 eb
exception.instruction: div eax
exception.module: dcee5b78-00b4-4c16-8307-e930fb72a169.exe
exception.exception_code: 0xc0000094
exception.offset: 1084017
exception.address: 0x10b8a71
registers.esp: 5569900
registers.edi: 5569900
registers.eax: 0
registers.ebp: 5569928
registers.edx: 0
registers.ebx: 17533618
registers.esi: 0
registers.ecx: 5569936
1 0 0

__exception__

 stacktrace: 
0x7ebd2610
0x7ebd1800

exception.instruction_r: 0f 0b e8 59 4c 01 00 33 c0 5a 59 59 64 89 10 eb
exception.instruction: ud2
exception.module: dcee5b78-00b4-4c16-8307-e930fb72a169.exe
exception.exception_code: 0xc000001d
exception.offset: 1084060
exception.address: 0x10b8a9c
registers.esp: 5569900
registers.edi: 5569900
registers.eax: 0
registers.ebp: 5569928
registers.edx: 2
registers.ebx: 17533575
registers.esi: 0
registers.ecx: 5569936
1 0 0

__exception__

 stacktrace: 
0x7ebd2850
0x7ebd1800

exception.instruction_r: f7 f0 e8 84 4c 01 00 33 c0 5a 59 59 64 89 10 eb
exception.instruction: div eax
exception.module: dcee5b78-00b4-4c16-8307-e930fb72a169.exe
exception.exception_code: 0xc0000094
exception.offset: 1084017
exception.address: 0x10b8a71
registers.esp: 5569900
registers.edi: 17791656
registers.eax: 0
registers.ebp: 5569928
registers.edx: 0
registers.ebx: 0
registers.esi: 16588800
registers.ecx: 3130303232
1 0 0

__exception__

 stacktrace: 
0x7ebd2850
0x7ebd1800

exception.instruction_r: f7 f0 e8 84 4c 01 00 33 c0 5a 59 59 64 89 10 eb
exception.instruction: div eax
exception.module: dcee5b78-00b4-4c16-8307-e930fb72a169.exe
exception.exception_code: 0xc0000094
exception.offset: 1084017
exception.address: 0x10b8a71
registers.esp: 5569900
registers.edi: 5569900
registers.eax: 0
registers.ebp: 5569928
registers.edx: 0
registers.ebx: 17533575
registers.esi: 0
registers.ecx: 5569936
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 131072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b44000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 32768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b64000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b6c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 32768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b70000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 180224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b78000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00ba4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00ba8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00bac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00bb0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00bb4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00bb8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00bbc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00bc0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00bc4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00bc8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00bcc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00bd0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00bd4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00bd8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00bdc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00be0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00be4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00be8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00bec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00bf0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00bf4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00bf8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00bfc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c04000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c08000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c0c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c14000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c18000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c1c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c24000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c28000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c2c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c34000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c38000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c3c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c44000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c48000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c4c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00c50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00009800', u'virtual_address': u'0x00001000', u'entropy': 7.9835887630410225, u'name': u'', u'virtual_size': u'0x00012000'} entropy 7.98358876304 description A section with a high entropy has been found
section {u'size_of_data': u'0x00003000', u'virtual_address': u'0x00013000', u'entropy': 7.8985128081965374, u'name': u'', u'virtual_size': u'0x00008000'} entropy 7.8985128082 description A section with a high entropy has been found
section {u'size_of_data': u'0x00000200', u'virtual_address': u'0x0001b000', u'entropy': 6.829558620638401, u'name': u'', u'virtual_size': u'0x00003000'} entropy 6.82955862064 description A section with a high entropy has been found
section {u'size_of_data': u'0x00001800', u'virtual_address': u'0x0001f000', u'entropy': 7.935195494720129, u'name': u'', u'virtual_size': u'0x00002000'} entropy 7.93519549472 description A section with a high entropy has been found
section {u'size_of_data': u'0x00030800', u'virtual_address': u'0x00022000', u'entropy': 7.999135981098137, u'name': u'', u'virtual_size': u'0x0075e000'} entropy 7.9991359811 description A section with a high entropy has been found
section {u'size_of_data': u'0x0021b400', u'virtual_address': u'0x00780000', u'entropy': 7.984502041044076, u'name': u'.data', u'virtual_size': u'0x0021c000'} entropy 7.98450204104 description A section with a high entropy has been found
entropy 0.999792358804 description Overall entropy of this PE file is high
host 68.168.118.2
dead_host 192.168.56.101:49161
dead_host 68.168.118.2:4043