popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

random.exe

Amadey PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 16, 2024, 10 a.m. June 16, 2024, 10:30 a.m.
Size 1.8MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 11afad19e16fa87f34c05c8e61e78811
SHA256 7ae8e8605e091e9e28a0e8f26b9c7de8c4dd086eea711a612f19a87283b5e6c1
CRC32 D9721F4B
ssdeep 24576:29N52KTQAlvFX66EhtRpGK04ahqRGRz+4VzaAXWa7zXVK2uBZNxL6ntpGmsGOdwY:29L2KBdwjF2llRzJrL7REXSrGmQ5zyR
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
114.132.189.148 Active Moloch
77.91.77.81 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
section \x00
section .idata
section
section ocmizcmb
section jkasthsw
section .taggant
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: fb e9 4e 01 00 00 60 8b 74 24 24 8b 7c 24 28 fc
exception.symbol: random+0x31b0b9
exception.instruction: sti
exception.module: random.exe
exception.exception_code: 0xc0000096
exception.offset: 3256505
exception.address: 0xdbb0b9
registers.esp: 1374376
registers.edi: 0
registers.eax: 1
registers.ebp: 1374392
registers.edx: 16109568
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb e9 4e 03 00 00 81 e9 fb fd df d3 68 0c 22 48
        

      
        exception.symbol:
        random+0x6d350
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        447312
        

      
        exception.address:
        0xb0d350
        

      
    
  
    
      
        registers.esp:
        1374340
        

      
        registers.edi:
        1968898280
        

      
        registers.eax:
        11586995
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        11141120
        

      
        registers.ebx:
        622460928
        

      
        registers.esi:
        3
        

      
        registers.ecx:
        1969094656
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb e9 04 03 00 00 68 e3 f7 f5 5f e9 bd 02 00 00
        

      
        exception.symbol:
        random+0x6d5c4
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        447940
        

      
        exception.address:
        0xb0d5c4
        

      
    
  
    
      
        registers.esp:
        1374344
        

      
        registers.edi:
        1968898280
        

      
        registers.eax:
        11619999
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        11141120
        

      
        registers.ebx:
        622460928
        

      
        registers.esi:
        3
        

      
        registers.ecx:
        1969094656
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb e9 bf fe ff ff 56 be 3a 8f 7a 33 c1 ee 03 81
        

      
        exception.symbol:
        random+0x6d0e6
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        446694
        

      
        exception.address:
        0xb0d0e6
        

      
    
  
    
      
        registers.esp:
        1374344
        

      
        registers.edi:
        799965624
        

      
        registers.eax:
        11619999
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        11141120
        

      
        registers.ebx:
        622460928
        

      
        registers.esi:
        3
        

      
        registers.ecx:
        4294937644
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 05 40 a3 ff 7d 03 04 24 e9 1b fc ff ff b8 ab
        

      
        exception.symbol:
        random+0x6e20e
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        451086
        

      
        exception.address:
        0xb0e20e
        

      
    
  
    
      
        registers.esp:
        1374340
        

      
        registers.edi:
        799965624
        

      
        registers.eax:
        11590828
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        366121202
        

      
        registers.ebx:
        905132397
        

      
        registers.esi:
        3
        

      
        registers.ecx:
        4294937644
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 31 d2 68 ca 1e fe 5b 89 1c 24 50 89 14 24 8b
        

      
        exception.symbol:
        random+0x6e348
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        451400
        

      
        exception.address:
        0xb0e348
        

      
    
  
    
      
        registers.esp:
        1374344
        

      
        registers.edi:
        799965624
        

      
        registers.eax:
        11619235
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        366121202
        

      
        registers.ebx:
        905132397
        

      
        registers.esi:
        3
        

      
        registers.ecx:
        4294937644
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 52 56 68 73 5b b3 5b 8b 34 24 e9 5d 00 00 00
        

      
        exception.symbol:
        random+0x6e13a
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        450874
        

      
        exception.address:
        0xb0e13a
        

      
    
  
    
      
        registers.esp:
        1374344
        

      
        registers.edi:
        239849
        

      
        registers.eax:
        11619235
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        4294941528
        

      
        registers.ebx:
        905132397
        

      
        registers.esi:
        3
        

      
        registers.ecx:
        4294937644
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb e9 24 03 00 00 5b 5f 81 c6 04 00 00 00 87 34
        

      
        exception.symbol:
        random+0x1ebc7d
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2014333
        

      
        exception.address:
        0xc8bc7d
        

      
    
  
    
      
        registers.esp:
        1374344
        

      
        registers.edi:
        11626681
        

      
        registers.eax:
        25812
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        2130566132
        

      
        registers.ebx:
        46072511
        

      
        registers.esi:
        13181117
        

      
        registers.ecx:
        703
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 55 c7 04 24 61 5c 09 26 89 14 24 50 e9 fb 05
        

      
        exception.symbol:
        random+0x1ec0c5
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2015429
        

      
        exception.address:
        0xc8c0c5
        

      
    
  
    
      
        registers.esp:
        1374344
        

      
        registers.edi:
        0
        

      
        registers.eax:
        25812
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        596201
        

      
        registers.ebx:
        46072511
        

      
        registers.esi:
        13158269
        

      
        registers.ecx:
        703
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 53 e9 42 05 00 00 bb 7c 35 1e 16 55 55 89 1c
        

      
        exception.symbol:
        random+0x1ed6e9
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2021097
        

      
        exception.address:
        0xc8d6e9
        

      
    
  
    
      
        registers.esp:
        1374340
        

      
        registers.edi:
        0
        

      
        registers.eax:
        32696
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        216970322
        

      
        registers.ebx:
        46072511
        

      
        registers.esi:
        13158269
        

      
        registers.ecx:
        13161690
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 81 ec 04 00 00 00 89 0c 24 89 1c 24 e9 8a fa
        

      
        exception.symbol:
        random+0x1edc54
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2022484
        

      
        exception.address:
        0xc8dc54
        

      
    
  
    
      
        registers.esp:
        1374344
        

      
        registers.edi:
        1549541099
        

      
        registers.eax:
        32696
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        4294937400
        

      
        registers.ebx:
        46072511
        

      
        registers.esi:
        13158269
        

      
        registers.ecx:
        13194386
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 83 ec 04 89 04 24 e9 ed 00 00 00 56 89 e6 e9
        

      
        exception.symbol:
        random+0x1f3046
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2043974
        

      
        exception.address:
        0xc93046
        

      
    
  
    
      
        registers.esp:
        1374344
        

      
        registers.edi:
        0
        

      
        registers.eax:
        13213918
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        1259
        

      
        registers.esi:
        0
        

      
        registers.ecx:
        4294939936
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        ed 64 8f 05 00 00 00 00 51 e9 79 00 00 00 58 48
        

      
        exception.symbol:
        random+0x1f702d
        

      
        exception.instruction:
        in eax, dx
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2060333
        

      
        exception.address:
        0xc9702d
        

      
    
  
    
      
        registers.esp:
        1374336
        

      
        registers.edi:
        5844504
        

      
        registers.eax:
        1447909480
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        22104
        

      
        registers.ebx:
        1969033397
        

      
        registers.esi:
        13201042
        

      
        registers.ecx:
        20
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        0f 3f 07 0b 64 8f 05 00 00 00 00 83 c4 04 83 fb
        

      
        exception.symbol:
        random+0x1fa032
        

      
        exception.address:
        0xc9a032
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc000001d
        

      
        exception.offset:
        2072626
        

      
    
  
    
      
        registers.esp:
        1374336
        

      
        registers.edi:
        5844504
        

      
        registers.eax:
        1
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        22104
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        13201042
        

      
        registers.ecx:
        20
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        ed 81 fb 68 58 4d 56 75 0a c7 85 58 37 2d 12 01
        

      
        exception.symbol:
        random+0x1fa9e4
        

      
        exception.instruction:
        in eax, dx
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2075108
        

      
        exception.address:
        0xc9a9e4
        

      
    
  
    
      
        registers.esp:
        1374336
        

      
        registers.edi:
        5844504
        

      
        registers.eax:
        1447909480
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        22104
        

      
        registers.ebx:
        2256917605
        

      
        registers.esi:
        13201042
        

      
        registers.ecx:
        10
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cd 01 eb 00 6a 00 53 e8 03 00 00 00 20 5b c3 5b
        

      
        exception.symbol:
        random+0x1ff74f
        

      
        exception.instruction:
        int 1
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000005
        

      
        exception.offset:
        2094927
        

      
        exception.address:
        0xc9f74f
        

      
    
  
    
      
        registers.esp:
        1374304
        

      
        registers.edi:
        0
        

      
        registers.eax:
        1374304
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        208086258
        

      
        registers.ebx:
        13236321
        

      
        registers.esi:
        942941426
        

      
        registers.ecx:
        13236321
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb e9 5a fe ff ff 68 00 84 83 2d e9 27 ff ff ff
        

      
        exception.symbol:
        random+0x1ffe09
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2096649
        

      
        exception.address:
        0xc9fe09
        

      
    
  
    
      
        registers.esp:
        1374344
        

      
        registers.edi:
        5844504
        

      
        registers.eax:
        6379
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        13239857
        

      
        registers.ebx:
        67261515
        

      
        registers.esi:
        21579
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 56 be 29 59 be 6e 57 bf 01 0c ff 57 09 fe 8b
        

      
        exception.symbol:
        random+0x207f28
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2129704
        

      
        exception.address:
        0xca7f28
        

      
    
  
    
      
        registers.esp:
        1374340
        

      
        registers.edi:
        5844504
        

      
        registers.eax:
        27000
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        13268303
        

      
        registers.ebx:
        1556165815
        

      
        registers.esi:
        21579
        

      
        registers.ecx:
        13239918
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 50 89 3c 24 89 0c 24 55 89 0c 24 89 2c 24 c7
        

      
        exception.symbol:
        random+0x20764e
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2127438
        

      
        exception.address:
        0xca764e
        

      
    
  
    
      
        registers.esp:
        1374344
        

      
        registers.edi:
        5844504
        

      
        registers.eax:
        27000
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        13271415
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        322689
        

      
        registers.ecx:
        13239918
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 53 57 bf c6 47 eb 4f 81 f7 bf 5e 7a 7b c1 e7
        

      
        exception.symbol:
        random+0x211791
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2168721
        

      
        exception.address:
        0xcb1791
        

      
    
  
    
      
        registers.esp:
        1374340
        

      
        registers.edi:
        11583654
        

      
        registers.eax:
        33095
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        13308207
        

      
        registers.ebx:
        67261737
        

      
        registers.esi:
        1968968720
        

      
        registers.ecx:
        6
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb e9 16 01 00 00 81 ec 04 00 00 00 89 04 24 89
        

      
        exception.symbol:
        random+0x21124f
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2167375
        

      
        exception.address:
        0xcb124f
        

      
    
  
    
      
        registers.esp:
        1374344
        

      
        registers.edi:
        0
        

      
        registers.eax:
        3914421847
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        13311382
        

      
        registers.ebx:
        67261737
        

      
        registers.esi:
        1968968720
        

      
        registers.ecx:
        6
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 52 c7 04 24 9a 68 cf 6f f7 14 24 ff 04 24 81
        

      
        exception.symbol:
        random+0x212476
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2172022
        

      
        exception.address:
        0xcb2476
        

      
    
  
    
      
        registers.esp:
        1374340
        

      
        registers.edi:
        0
        

      
        registers.eax:
        28611
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        1419724738
        

      
        registers.ebx:
        13311791
        

      
        registers.esi:
        1968968720
        

      
        registers.ecx:
        2100253082
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb e9 ff 02 00 00 31 2c 24 e9 99 fc ff ff 81 eb
        

      
        exception.symbol:
        random+0x21242e
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2171950
        

      
        exception.address:
        0xcb242e
        

      
    
  
    
      
        registers.esp:
        1374344
        

      
        registers.edi:
        0
        

      
        registers.eax:
        28611
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        1419724738
        

      
        registers.ebx:
        13340402
        

      
        registers.esi:
        1968968720
        

      
        registers.ecx:
        2100253082
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 50 89 2c 24 53 bb d5 9b f7 7e f7 d3 e9 3d fb
        

      
        exception.symbol:
        random+0x21276b
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2172779
        

      
        exception.address:
        0xcb276b
        

      
    
  
    
      
        registers.esp:
        1374344
        

      
        registers.edi:
        0
        

      
        registers.eax:
        1179202795
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        1419724738
        

      
        registers.ebx:
        13314554
        

      
        registers.esi:
        0
        

      
        registers.ecx:
        2100253082
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 56 e9 4a 00 00 00 b8 e0 a7 fa 4b 35 5c 2e cf
        

      
        exception.symbol:
        random+0x21a8fa
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2205946
        

      
        exception.address:
        0xcba8fa
        

      
    
  
    
      
        registers.esp:
        1374332
        

      
        registers.edi:
        0
        

      
        registers.eax:
        29158
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        2130566132
        

      
        registers.ebx:
        13314554
        

      
        registers.esi:
        0
        

      
        registers.ecx:
        13345715
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb b9 89 3d ff 4e 81 c1 01 00 00 00 e9 a5 04 00
        

      
        exception.symbol:
        random+0x21a8a7
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2205863
        

      
        exception.address:
        0xcba8a7
        

      
    
  
    
      
        registers.esp:
        1374336
        

      
        registers.edi:
        0
        

      
        registers.eax:
        29158
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        2130566132
        

      
        registers.ebx:
        13314554
        

      
        registers.esi:
        84201
        

      
        registers.ecx:
        13348701
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 68 5b d8 1e 17 89 14 24 68 bb 63 1f 6c 89 2c
        

      
        exception.symbol:
        random+0x237327
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2323239
        

      
        exception.address:
        0xcd7327
        

      
    
  
    
      
        registers.esp:
        1374300
        

      
        registers.edi:
        2115174400
        

      
        registers.eax:
        28050
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        2130566132
        

      
        registers.ebx:
        1443425765
        

      
        registers.esi:
        13459458
        

      
        registers.ecx:
        13463511
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 52 89 1c 24 89 2c 24 bd ce 94 bf 6f e9 00 00
        

      
        exception.symbol:
        random+0x2376cb
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2324171
        

      
        exception.address:
        0xcd76cb
        

      
    
  
    
      
        registers.esp:
        1374304
        

      
        registers.edi:
        2115174400
        

      
        registers.eax:
        28050
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        2130566132
        

      
        registers.ebx:
        1443425765
        

      
        registers.esi:
        13459458
        

      
        registers.ecx:
        13491561
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb e9 e4 00 00 00 55 bd 8a 38 fb 3f 81 ef 17 10
        

      
        exception.symbol:
        random+0x2372e0
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2323168
        

      
        exception.address:
        0xcd72e0
        

      
    
  
    
      
        registers.esp:
        1374304
        

      
        registers.edi:
        2115174400
        

      
        registers.eax:
        28050
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        2130566132
        

      
        registers.ebx:
        4294941864
        

      
        registers.esi:
        3881287511
        

      
        registers.ecx:
        13491561
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 53 e9 e3 fa ff ff 8b 14 24 68 00 23 4b 17 89
        

      
        exception.symbol:
        random+0x2384ff
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2327807
        

      
        exception.address:
        0xcd84ff
        

      
    
  
    
      
        registers.esp:
        1374300
        

      
        registers.edi:
        2115174400
        

      
        registers.eax:
        30693
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        675349118
        

      
        registers.ebx:
        4294941864
        

      
        registers.esi:
        13466570
        

      
        registers.ecx:
        1832698941
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 55 89 04 24 e9 d7 07 00 00 59 01 eb e9 f3 08
        

      
        exception.symbol:
        random+0x237be8
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2325480
        

      
        exception.address:
        0xcd7be8
        

      
    
  
    
      
        registers.esp:
        1374304
        

      
        registers.edi:
        1459645024
        

      
        registers.eax:
        30693
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        4294939360
        

      
        registers.ebx:
        4294941864
        

      
        registers.esi:
        13497263
        

      
        registers.ecx:
        1832698941
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 68 db 70 60 26 89 14 24 c7 04 24 1f cf fb 7f
        

      
        exception.symbol:
        random+0x239191
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2331025
        

      
        exception.address:
        0xcd9191
        

      
    
  
    
      
        registers.esp:
        1374304
        

      
        registers.edi:
        13470090
        

      
        registers.eax:
        28469
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        4294939360
        

      
        registers.ebx:
        1231489138
        

      
        registers.esi:
        13499111
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 68 37 b3 23 30 89 04 24 e9 60 fc ff ff bd 96
        

      
        exception.symbol:
        random+0x239250
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2331216
        

      
        exception.address:
        0xcd9250
        

      
    
  
    
      
        registers.esp:
        1374304
        

      
        registers.edi:
        13470090
        

      
        registers.eax:
        0
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        2179303765
        

      
        registers.ebx:
        1231489138
        

      
        registers.esi:
        13473387
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 52 e9 67 06 00 00 5f 01 d0 05 41 4a d1 6f 8b
        

      
        exception.symbol:
        random+0x2398e8
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2332904
        

      
        exception.address:
        0xcd98e8
        

      
    
  
    
      
        registers.esp:
        1374300
        

      
        registers.edi:
        13470090
        

      
        registers.eax:
        29533
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        2179303765
        

      
        registers.ebx:
        3652663
        

      
        registers.esi:
        13473387
        

      
        registers.ecx:
        13473777
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 55 c7 04 24 02 e2 57 7d 81 34 24 8d 52 f3 54
        

      
        exception.symbol:
        random+0x239a57
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2333271
        

      
        exception.address:
        0xcd9a57
        

      
    
  
    
      
        registers.esp:
        1374304
        

      
        registers.edi:
        13470090
        

      
        registers.eax:
        29533
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        2179303765
        

      
        registers.ebx:
        3652663
        

      
        registers.esi:
        13473387
        

      
        registers.ecx:
        13503310
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 55 50 e9 95 fe ff ff c1 e9 05 81 f1 79 b7 58
        

      
        exception.symbol:
        random+0x239f1a
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2334490
        

      
        exception.address:
        0xcd9f1a
        

      
    
  
    
      
        registers.esp:
        1374304
        

      
        registers.edi:
        13470090
        

      
        registers.eax:
        29533
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        4294940812
        

      
        registers.ebx:
        2828340064
        

      
        registers.esi:
        13473387
        

      
        registers.ecx:
        13503310
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 57 89 0c 24 b9 e3 d8 ff 2b c1 e9 07 56 be 40
        

      
        exception.symbol:
        random+0x23ae7d
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2338429
        

      
        exception.address:
        0xcdae7d
        

      
    
  
    
      
        registers.esp:
        1374300
        

      
        registers.edi:
        13470090
        

      
        registers.eax:
        30939
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        13479076
        

      
        registers.ebx:
        11593792
        

      
        registers.esi:
        13473387
        

      
        registers.ecx:
        1071472198
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 81 ec 04 00 00 00 89 04 24 68 d1 d4 1d 48 89
        

      
        exception.symbol:
        random+0x23b72d
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2340653
        

      
        exception.address:
        0xcdb72d
        

      
    
  
    
      
        registers.esp:
        1374304
        

      
        registers.edi:
        13470090
        

      
        registers.eax:
        30939
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        13510015
        

      
        registers.ebx:
        44777
        

      
        registers.esi:
        13473387
        

      
        registers.ecx:
        4294939328
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 55 c7 04 24 ac 7f e7 6f e9 0b 00 00 00 81 c4
        

      
        exception.symbol:
        random+0x23fd16
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2358550
        

      
        exception.address:
        0xcdfd16
        

      
    
  
    
      
        registers.esp:
        1374304
        

      
        registers.edi:
        4294940164
        

      
        registers.eax:
        13527150
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        65786
        

      
        registers.esi:
        13473387
        

      
        registers.ecx:
        24811
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 50 b8 21 97 77 7b b9 b7 7b 3f d0 55 bd 6a e2
        

      
        exception.symbol:
        random+0x242c84
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2370692
        

      
        exception.address:
        0xce2c84
        

      
    
  
    
      
        registers.esp:
        1374304
        

      
        registers.edi:
        0
        

      
        registers.eax:
        28910
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        13513572
        

      
        registers.ebx:
        65786
        

      
        registers.esi:
        13473387
        

      
        registers.ecx:
        2298801283
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 81 ec 04 00 00 00 89 0c 24 89 14 24 e9 67 00
        

      
        exception.symbol:
        random+0x2438ec
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2373868
        

      
        exception.address:
        0xce38ec
        

      
    
  
    
      
        registers.esp:
        1374304
        

      
        registers.edi:
        0
        

      
        registers.eax:
        26031
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        13513572
        

      
        registers.ebx:
        13539982
        

      
        registers.esi:
        13473387
        

      
        registers.ecx:
        1434770004
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 50 b8 e1 7b 05 7f c1 e8 06 56 be 6e 61 c9 37
        

      
        exception.symbol:
        random+0x243c4e
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2374734
        

      
        exception.address:
        0xce3c4e
        

      
    
  
    
      
        registers.esp:
        1374304
        

      
        registers.edi:
        0
        

      
        registers.eax:
        26031
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        13513572
        

      
        registers.ebx:
        13539982
        

      
        registers.esi:
        3939837675
        

      
        registers.ecx:
        4294943892
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 68 8d 20 b9 22 e9 00 00 00 00 89 2c 24 81 ec
        

      
        exception.symbol:
        random+0x24d01d
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2412573
        

      
        exception.address:
        0xced01d
        

      
    
  
    
      
        registers.esp:
        1374304
        

      
        registers.edi:
        1846578745
        

      
        registers.eax:
        28389
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        13578919
        

      
        registers.ebx:
        1860091517
        

      
        registers.esi:
        1873580677
        

      
        registers.ecx:
        2144114745
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb bb a2 80 1f 3e c1 e3 01 e9 38 01 00 00 c1 e6
        

      
        exception.symbol:
        random+0x24c539
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2409785
        

      
        exception.address:
        0xcec539
        

      
    
  
    
      
        registers.esp:
        1374304
        

      
        registers.edi:
        1846578745
        

      
        registers.eax:
        3909414019
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        13553943
        

      
        registers.ebx:
        1860091517
        

      
        registers.esi:
        1873580677
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 81 ec 04 00 00 00 89 1c 24 c7 04 24 c8 b0 5d
        

      
        exception.symbol:
        random+0x256a2e
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2452014
        

      
        exception.address:
        0xcf6a2e
        

      
    
  
    
      
        registers.esp:
        1374304
        

      
        registers.edi:
        13623142
        

      
        registers.eax:
        32468
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        2023512
        

      
        registers.ebx:
        13555135
        

      
        registers.esi:
        13555131
        

      
        registers.ecx:
        2115174400
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb e9 4c 04 00 00 8b 1c 24 83 c4 04 56 be 04 00
        

      
        exception.symbol:
        random+0x25644e
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2450510
        

      
        exception.address:
        0xcf644e
        

      
    
  
    
      
        registers.esp:
        1374304
        

      
        registers.edi:
        13593226
        

      
        registers.eax:
        32468
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        2023512
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        13555131
        

      
        registers.ecx:
        15657299
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 81 ee 67 74 ff 7c e9 d4 02 00 00 58 e9 cd 01
        

      
        exception.symbol:
        random+0x26b09d
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2535581
        

      
        exception.address:
        0xd0b09d
        

      
    
  
    
      
        registers.esp:
        1374300
        

      
        registers.edi:
        13664618
        

      
        registers.eax:
        26706
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        2130566132
        

      
        registers.ebx:
        9206363
        

      
        registers.esi:
        13676297
        

      
        registers.ecx:
        2115174400
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 68 a6 be 29 6e e9 76 00 00 00 2d 80 d5 bf 2b
        

      
        exception.symbol:
        random+0x26af48
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2535240
        

      
        exception.address:
        0xd0af48
        

      
    
  
    
      
        registers.esp:
        1374304
        

      
        registers.edi:
        13664618
        

      
        registers.eax:
        26706
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        2130566132
        

      
        registers.ebx:
        9206363
        

      
        registers.esi:
        13703003
        

      
        registers.ecx:
        2115174400
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 52 c7 04 24 96 69 da 76 89 34 24 e9 02 07 00
        

      
        exception.symbol:
        random+0x26b2a5
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2536101
        

      
        exception.address:
        0xd0b2a5
        

      
    
  
    
      
        registers.esp:
        1374304
        

      
        registers.edi:
        604277074
        

      
        registers.eax:
        0
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        2130566132
        

      
        registers.ebx:
        9206363
        

      
        registers.esi:
        13679643
        

      
        registers.ecx:
        2115174400
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 51 68 f2 ce eb 60 89 04 24 c7 04 24 f6 31 ff
        

      
        exception.symbol:
        random+0x27cf68
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2609000
        

      
        exception.address:
        0xd1cf68
        

      
    
  
    
      
        registers.esp:
        1374304
        

      
        registers.edi:
        1987218744
        

      
        registers.eax:
        27272
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        3967899218
        

      
        registers.ebx:
        13752322
        

      
        registers.esi:
        0
        

      
        registers.ecx:
        13167688
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                            suspicious_features
                                            POST method with no referer header, POST method with no useragent header, Connection to IP address
                                        
                                    
                                        
                                    
                                        
                                            suspicious_request
                                            POST http://77.91.77.81/Kiru9gu/index.php
                                        
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    request
                                    POST http://77.91.77.81/Kiru9gu/index.php
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    request
                                    POST http://77.91.77.81/Kiru9gu/index.php
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          8192
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x76faf000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          8192
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x76f20000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          188416
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00aa1000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00580000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x009b0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          8192
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x009c0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          65536
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x009d0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          8192
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00a20000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00a70000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00a80000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00a90000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x02360000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x023f0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x02440000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x02450000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x02460000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x024b0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x024c0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x02550000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x02560000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x02570000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x02780000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x02790000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x028a0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x028b0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00a20000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x02940000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00a20000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00a20000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00a20000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00a20000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x73402000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2564
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x02f60000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1452
        
      
      
      

    
  
    
      region_size:
      
        
          65536
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x0000000004710000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffffffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2828
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          8192
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x76faf000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2828
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          8192
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x76f20000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2828
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          188416
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00901000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2828
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x02220000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2828
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x02230000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2828
        
      
      
      

    
  
    
      region_size:
      
        
          8192
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x02280000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2828
        
      
      
      

    
  
    
      region_size:
      
        
          65536
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x02290000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2828
        
      
      
      

    
  
    
      region_size:
      
        
          8192
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x02320000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2828
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x024b0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2828
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x024c0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2828
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x025d0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2828
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x025e0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2828
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x025f0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2828
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x02600000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2828
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x02650000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2828
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x027e0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            axplong.exe tried to sleep 1118 seconds, actually delayed analysis time by 1118 seconds
                                        
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    file
                                    C:\Users\test22\AppData\Local\Temp\8254624243\axplong.exe
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    file
                                    C:\Users\test22\AppData\Local\Temp\8254624243\axplong.exe
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
ShellExecuteExW

  
  
    
      
    
  


  
    
      show_type:
      
        
          0
        
      
      
      

    
  
    
      filepath_r:
      
        
          C:\Users\test22\AppData\Local\Temp\8254624243\axplong.exe
        
      
      
      

    
  
    
      parameters:
      
        
          
        
      
      
      

    
  
    
      filepath:
      
        
          C:\Users\test22\AppData\Local\Temp\8254624243\axplong.exe
        
      
      
      

    
  


    
        1
    

1

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x0002dc00', u'virtual_address': u'0x00001000', u'entropy': 7.975155222993218, u'name': u'   \\x00    ', u'virtual_size': u'0x00068000'}
                                        
                                    
                                        
                                            entropy
                                            7.97515522299
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x001a0a00', u'virtual_address': u'0x0031b000', u'entropy': 7.954155083761257, u'name': u'ocmizcmb', u'virtual_size': u'0x001a1000'}
                                        
                                    
                                        
                                            entropy
                                            7.95415508376
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            entropy
                                            0.994087610857
                                        
                                    
                                        
                                            description
                                            Overall entropy of this PE file is high
                                        
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    process
                                    system
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                            host
                                            114.132.189.148
                                        
                                    
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                            host
                                            77.91.77.81
                                        
                                    
                                        
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    file
                                    C:\ProgramData\AVAST Software
                                    
                                


                            

                        

                            

                                

                                    file
                                    C:\ProgramData\Avira
                                    
                                


                            

                        

                            

                                

                                    file
                                    C:\ProgramData\Kaspersky Lab
                                    
                                


                            

                        

                            

                                

                                    file
                                    C:\ProgramData\Panda Security
                                    
                                


                            

                        

                            

                                

                                    file
                                    C:\ProgramData\Bitdefender
                                    
                                


                            

                        

                            

                                

                                    file
                                    C:\ProgramData\AVG
                                    
                                


                            

                        

                            

                                

                                    file
                                    C:\ProgramData\Doctor Web
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    file
                                    \??\SICE
                                    
                                


                            

                        

                            

                                

                                    file
                                    \??\SIWVID
                                    
                                


                            

                        

                            

                                

                                    file
                                    \??\NTICE
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          OLLYDBG
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          GBDYLLO
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          pediy06
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          FilemonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          FilemonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          #0
        
      
      
      

    
  
    
      window_name:
      
        
          File Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          PROCMON_WINDOW_CLASS
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          #0
        
      
      
      

    
  
    
      window_name:
      
        
          Process Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          RegmonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          RegmonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          #0
        
      
      
      

    
  
    
      window_name:
      
        
          Registry Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          18467-41
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          FilemonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          FilemonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          #0
        
      
      
      

    
  
    
      window_name:
      
        
          File Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          PROCMON_WINDOW_CLASS
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          #0
        
      
      
      

    
  
    
      window_name:
      
        
          Process Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          OLLYDBG
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          GBDYLLO
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          pediy06
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          FilemonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          FilemonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          #0
        
      
      
      

    
  
    
      window_name:
      
        
          File Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          PROCMON_WINDOW_CLASS
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          #0
        
      
      
      

    
  
    
      window_name:
      
        
          Process Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          RegmonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          RegmonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          #0
        
      
      
      

    
  
    
      window_name:
      
        
          Registry Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          18467-41
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          FilemonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          FilemonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          #0
        
      
      
      

    
  
    
      window_name:
      
        
          File Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          PROCMON_WINDOW_CLASS
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          #0
        
      
      
      

    
  
    
      window_name:
      
        
          Process Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          OLLYDBG
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          GBDYLLO
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          pediy06
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          OLLYDBG
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          GBDYLLO
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          pediy06
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Regmonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Regmonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          18467-41
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Filemonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Filemonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          PROCMON_WINDOW_CLASS
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          OLLYDBG
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          GBDYLLO
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          pediy06
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          OLLYDBG
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    registry
                                    HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
                                    
                                


                            

                        

                            

                                

                                    registry
                                    HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    file
                                    C:\Windows\Tasks\axplong.job
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        ed 64 8f 05 00 00 00 00 51 e9 79 00 00 00 58 48
        

      
        exception.symbol:
        random+0x1f702d
        

      
        exception.instruction:
        in eax, dx
        

      
        exception.module:
        random.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2060333
        

      
        exception.address:
        0xc9702d
        

      
    
  
    
      
        registers.esp:
        1374336
        

      
        registers.edi:
        5844504
        

      
        registers.eax:
        1447909480
        

      
        registers.ebp:
        4001607700
        

      
        registers.edx:
        22104
        

      
        registers.ebx:
        1969033397
        

      
        registers.esi:
        13201042
        

      
        registers.ecx:
        20
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    Bkav
                                    W32.AIDetectMalware
                                    
                                


                            

                        

                            

                                

                                    Lionic
                                    Virus.Generic.AI.1!c
                                    
                                


                            

                        

                            

                                

                                    Elastic
                                    malicious (high confidence)
                                    
                                


                            

                        

                            

                                

                                    Cynet
                                    Malicious (score: 99)
                                    
                                


                            

                        

                            

                                

                                    Skyhigh
                                    BehavesLike.Win32.Generic.tc
                                    
                                


                            

                        

                            

                                

                                    ALYac
                                    Trojan.GenericKDZ.107415
                                    
                                


                            

                        

                            

                                

                                    Cylance
                                    Unsafe
                                    
                                


                            

                        

                            

                                

                                    VIPRE
                                    Trojan.GenericKDZ.107415
                                    
                                


                            

                        

                            

                                

                                    BitDefender
                                    Trojan.GenericKDZ.107415
                                    
                                


                            

                        

                            

                                

                                    Arcabit
                                    Trojan.Generic.D1A397
                                    
                                


                            

                        

                            

                                

                                    Symantec
                                    ML.Attribute.HighConfidence
                                    
                                


                            

                        

                            

                                

                                    tehtris
                                    Generic.Malware
                                    
                                


                            

                        

                            

                                

                                    ESET-NOD32
                                    a variant of Win32/Packed.Themida.HZB
                                    
                                


                            

                        

                            

                                

                                    APEX
                                    Malicious
                                    
                                


                            

                        

                            

                                

                                    Avast
                                    Win32:TrojanX-gen [Trj]
                                    
                                


                            

                        

                            

                                

                                    Kaspersky
                                    HEUR:Trojan.Win32.Generic
                                    
                                


                            

                        

                            

                                

                                    MicroWorld-eScan
                                    Trojan.GenericKDZ.107415
                                    
                                


                            

                        

                            

                                

                                    Rising
                                    Trojan.Generic@AI.100 (RDML:y+YDW0pTaDjeBwUnnvUdaw)
                                    
                                


                            

                        

                            

                                

                                    Emsisoft
                                    Trojan.GenericKDZ.107415 (B)
                                    
                                


                            

                        

                            

                                

                                    F-Secure
                                    Trojan.TR/Crypt.TPM.Gen
                                    
                                


                            

                        

                            

                                

                                    McAfeeD
                                    Real Protect-LS!11AFAD19E16F
                                    
                                


                            

                        

                            

                                

                                    Trapmine
                                    malicious.high.ml.score
                                    
                                


                            

                        

                            

                                

                                    FireEye
                                    Generic.mg.11afad19e16fa87f
                                    
                                


                            

                        

                            

                                

                                    Sophos
                                    Generic ML PUA (PUA)
                                    
                                


                            

                        

                            

                                

                                    Avira
                                    TR/Crypt.TPM.Gen
                                    
                                


                            

                        

                            

                                

                                    MAX
                                    malware (ai score=87)
                                    
                                


                            

                        

                            

                                

                                    Gridinsoft
                                    Trojan.Heur!.038120A1
                                    
                                


                            

                        

                            

                                

                                    Microsoft
                                    Trojan:Win32/Sabsik.RD.A!ml
                                    
                                


                            

                        

                            

                                

                                    ZoneAlarm
                                    HEUR:Trojan.Win32.Generic
                                    
                                


                            

                        

                            

                                

                                    GData
                                    Trojan.GenericKDZ.107415
                                    
                                


                            

                        

                            

                                

                                    AhnLab-V3
                                    Trojan/Win.Generic.R645974
                                    
                                


                            

                        

                            

                                

                                    BitDefenderTheta
                                    Gen:NN.ZexaF.36806.0DWaaew!bppi
                                    
                                


                            

                        

                            

                                

                                    DeepInstinct
                                    MALICIOUS
                                    
                                


                            

                        

                            

                                

                                    Malwarebytes
                                    Trojan.Amadey
                                    
                                


                            

                        

                            

                                

                                    Zoner
                                    Probably Heur.ExeHeaderL
                                    
                                


                            

                        

                            

                                

                                    Tencent
                                    Trojan-DL.Win32.Deyma.kh
                                    
                                


                            

                        

                            

                                

                                    SentinelOne
                                    Static AI - Malicious PE
                                    
                                


                            

                        

                            

                                

                                    MaxSecure
                                    Win.MxResIcn.Heur.Gen
                                    
                                


                            

                        

                            

                                

                                    Fortinet
                                    W32/Themida.HZB!tr
                                    
                                


                            

                        

                            

                                

                                    AVG
                                    Win32:TrojanX-gen [Trj]
                                    
                                


                            

                        

                            

                                

                                    CrowdStrike
                                    win/malicious_confidence_100% (W)