popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

leg221.exe

RedLine Infostealer UltraVNC Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Jan. 24, 2024, 8:07 a.m. Jan. 24, 2024, 8:21 a.m.
Size 292.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 d177caf6762f5eb7e63e33d19c854089
SHA256 4296e28124f0def71c811d4b21284c5d4e1a068484db03aeae56f536c89976c0
CRC32 4A47339F
ssdeep 6144:iDKW1Lgbdl0TBBvjc/vGDn5rm0YEPFbBCM/:kh1Lk70Tnvjc2DxmNENdp/
PDB Path
Yara
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • MALWARE_Win_VT_RedLine - Detects RedLine infostealer
  • UltraVNC_Zero - UltraVNC
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
80.79.4.61 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005fee20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005fee20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005fee60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005fee60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00656e68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00656e68
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00657028
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
pdb_path
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
leg221+0x1fa2 @ 0x401fa2

exception.instruction_r: f3 aa 8b 45 f0 8b 4d 08 8b 55 10 03 c8 2b d0 52
exception.symbol: leg221+0xf088
exception.instruction: stosb byte ptr es:[edi], al
exception.module: leg221.exe
exception.exception_code: 0xc0000005
exception.offset: 61576
exception.address: 0x40f088
registers.esp: 1636996
registers.edi: 4418012
registers.eax: 0
registers.ebp: 1637012
registers.edx: 0
registers.ebx: 0
registers.esi: 31653960
registers.ecx: 4
1 0 0

__exception__

 stacktrace: 
leg221+0xf054 @ 0x40f054
leg221+0xf0a0 @ 0x40f0a0
leg221+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: leg221+0xeff0
exception.address: 0x40eff0
exception.module: leg221.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4419552
registers.eax: 4418016
registers.ebp: 1636944
registers.edx: 60
registers.ebx: 0
registers.esi: 31653960
registers.ecx: 696
1 0 0

__exception__

 stacktrace: 
leg221+0xf054 @ 0x40f054
leg221+0xf0a0 @ 0x40f0a0
leg221+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: leg221+0xeff0
exception.address: 0x40eff0
exception.module: leg221.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4423648
registers.eax: 4418016
registers.ebp: 1636944
registers.edx: 60
registers.ebx: 0
registers.esi: 31653960
registers.ecx: 664
1 0 0

__exception__

 stacktrace: 
leg221+0xf054 @ 0x40f054
leg221+0xf0a0 @ 0x40f0a0
leg221+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: leg221+0xeff0
exception.address: 0x40eff0
exception.module: leg221.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4427744
registers.eax: 4418016
registers.ebp: 1636944
registers.edx: 60
registers.ebx: 0
registers.esi: 31653960
registers.ecx: 632
1 0 0

__exception__

 stacktrace: 
leg221+0xf054 @ 0x40f054
leg221+0xf0a0 @ 0x40f0a0
leg221+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: leg221+0xeff0
exception.address: 0x40eff0
exception.module: leg221.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4431840
registers.eax: 4418016
registers.ebp: 1636944
registers.edx: 60
registers.ebx: 0
registers.esi: 31653960
registers.ecx: 600
1 0 0

__exception__

 stacktrace: 
leg221+0xf054 @ 0x40f054
leg221+0xf0a0 @ 0x40f0a0
leg221+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: leg221+0xeff0
exception.address: 0x40eff0
exception.module: leg221.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4435936
registers.eax: 4418016
registers.ebp: 1636944
registers.edx: 60
registers.ebx: 0
registers.esi: 31653960
registers.ecx: 568
1 0 0

__exception__

 stacktrace: 
leg221+0xf054 @ 0x40f054
leg221+0xf0a0 @ 0x40f0a0
leg221+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: leg221+0xeff0
exception.address: 0x40eff0
exception.module: leg221.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4440032
registers.eax: 4418016
registers.ebp: 1636944
registers.edx: 60
registers.ebx: 0
registers.esi: 31653960
registers.ecx: 536
1 0 0

__exception__

 stacktrace: 
leg221+0xf054 @ 0x40f054
leg221+0xf0a0 @ 0x40f0a0
leg221+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: leg221+0xeff0
exception.address: 0x40eff0
exception.module: leg221.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4444128
registers.eax: 4418016
registers.ebp: 1636944
registers.edx: 60
registers.ebx: 0
registers.esi: 31653960
registers.ecx: 504
1 0 0

__exception__

 stacktrace: 
leg221+0xf054 @ 0x40f054
leg221+0xf0a0 @ 0x40f0a0
leg221+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: leg221+0xeff0
exception.address: 0x40eff0
exception.module: leg221.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4448224
registers.eax: 4418016
registers.ebp: 1636944
registers.edx: 60
registers.ebx: 0
registers.esi: 31653960
registers.ecx: 472
1 0 0

__exception__

 stacktrace: 
leg221+0xf054 @ 0x40f054
leg221+0xf0a0 @ 0x40f0a0
leg221+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: leg221+0xeff0
exception.address: 0x40eff0
exception.module: leg221.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4452320
registers.eax: 4418016
registers.ebp: 1636944
registers.edx: 60
registers.ebx: 0
registers.esi: 31653960
registers.ecx: 440
1 0 0

__exception__

 stacktrace: 
leg221+0xf054 @ 0x40f054
leg221+0xf0a0 @ 0x40f0a0
leg221+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: leg221+0xeff0
exception.address: 0x40eff0
exception.module: leg221.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4456416
registers.eax: 4418016
registers.ebp: 1636944
registers.edx: 60
registers.ebx: 0
registers.esi: 31653960
registers.ecx: 408
1 0 0

__exception__

 stacktrace: 
leg221+0xf054 @ 0x40f054
leg221+0xf0a0 @ 0x40f0a0
leg221+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: leg221+0xeff0
exception.address: 0x40eff0
exception.module: leg221.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4460512
registers.eax: 4418016
registers.ebp: 1636944
registers.edx: 60
registers.ebx: 0
registers.esi: 31653960
registers.ecx: 376
1 0 0

__exception__

 stacktrace: 
leg221+0xf054 @ 0x40f054
leg221+0xf0a0 @ 0x40f0a0
leg221+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: leg221+0xeff0
exception.address: 0x40eff0
exception.module: leg221.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4464608
registers.eax: 4418016
registers.ebp: 1636944
registers.edx: 60
registers.ebx: 0
registers.esi: 31653960
registers.ecx: 344
1 0 0

__exception__

 stacktrace: 
leg221+0xf054 @ 0x40f054
leg221+0xf0a0 @ 0x40f0a0
leg221+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: leg221+0xeff0
exception.address: 0x40eff0
exception.module: leg221.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4468704
registers.eax: 4418016
registers.ebp: 1636944
registers.edx: 60
registers.ebx: 0
registers.esi: 31653960
registers.ecx: 312
1 0 0

__exception__

 stacktrace: 
leg221+0xf054 @ 0x40f054
leg221+0xf0a0 @ 0x40f0a0
leg221+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: leg221+0xeff0
exception.address: 0x40eff0
exception.module: leg221.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4472800
registers.eax: 4418016
registers.ebp: 1636944
registers.edx: 60
registers.ebx: 0
registers.esi: 31653960
registers.ecx: 280
1 0 0

__exception__

 stacktrace: 
leg221+0xf054 @ 0x40f054
leg221+0xf0a0 @ 0x40f0a0
leg221+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: leg221+0xeff0
exception.address: 0x40eff0
exception.module: leg221.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4476896
registers.eax: 4418016
registers.ebp: 1636944
registers.edx: 60
registers.ebx: 0
registers.esi: 31653960
registers.ecx: 248
1 0 0

__exception__

 stacktrace: 
leg221+0xf054 @ 0x40f054
leg221+0xf0a0 @ 0x40f0a0
leg221+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: leg221+0xeff0
exception.address: 0x40eff0
exception.module: leg221.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4480992
registers.eax: 4418016
registers.ebp: 1636944
registers.edx: 60
registers.ebx: 0
registers.esi: 31653960
registers.ecx: 216
1 0 0

__exception__

 stacktrace: 
leg221+0xf054 @ 0x40f054
leg221+0xf0a0 @ 0x40f0a0
leg221+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: leg221+0xeff0
exception.address: 0x40eff0
exception.module: leg221.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4485088
registers.eax: 4418016
registers.ebp: 1636944
registers.edx: 60
registers.ebx: 0
registers.esi: 31653960
registers.ecx: 184
1 0 0

__exception__

 stacktrace: 
leg221+0xf054 @ 0x40f054
leg221+0xf0a0 @ 0x40f0a0
leg221+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: leg221+0xeff0
exception.address: 0x40eff0
exception.module: leg221.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4489184
registers.eax: 4418016
registers.ebp: 1636944
registers.edx: 60
registers.ebx: 0
registers.esi: 31653960
registers.ecx: 152
1 0 0

__exception__

 stacktrace: 
leg221+0xf054 @ 0x40f054
leg221+0xf0a0 @ 0x40f0a0
leg221+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: leg221+0xeff0
exception.address: 0x40eff0
exception.module: leg221.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4493280
registers.eax: 4418016
registers.ebp: 1636944
registers.edx: 60
registers.ebx: 0
registers.esi: 31653960
registers.ecx: 120
1 0 0

__exception__

 stacktrace: 
leg221+0xf054 @ 0x40f054
leg221+0xf0a0 @ 0x40f0a0
leg221+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: leg221+0xeff0
exception.address: 0x40eff0
exception.module: leg221.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4497376
registers.eax: 4418016
registers.ebp: 1636944
registers.edx: 60
registers.ebx: 0
registers.esi: 31653960
registers.ecx: 88
1 0 0

__exception__

 stacktrace: 
leg221+0xf054 @ 0x40f054
leg221+0xf0a0 @ 0x40f0a0
leg221+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: leg221+0xeff0
exception.address: 0x40eff0
exception.module: leg221.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4501472
registers.eax: 4418016
registers.ebp: 1636944
registers.edx: 60
registers.ebx: 0
registers.esi: 31653960
registers.ecx: 56
1 0 0

__exception__

 stacktrace: 
leg221+0xf054 @ 0x40f054
leg221+0xf0a0 @ 0x40f0a0
leg221+0x1fa2 @ 0x401fa2

exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66
exception.symbol: leg221+0xeff0
exception.address: 0x40eff0
exception.module: leg221.exe
exception.exception_code: 0xc0000005
exception.offset: 61424
registers.esp: 1636940
registers.edi: 4505568
registers.eax: 4418016
registers.ebp: 1636944
registers.edx: 60
registers.ebx: 0
registers.esi: 31653960
registers.ecx: 24
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 1114112
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02060000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02130000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 1179648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02170000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02250000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x727a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x727a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 1572864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02390000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00592000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02251000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02252000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0059a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0059c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02253000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005ac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02254000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0085b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00857000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02210000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00855000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00846000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02211000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0084a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00847000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02215000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0084b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005aa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0084c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff50000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff58000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff40000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0xfff40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00848000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0084d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0085c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
host 80.79.4.61
dead_host 80.79.4.61:18236