popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

herso.exe

Amadey Anti_VM PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Aug. 5, 2024, 3:37 p.m. Aug. 5, 2024, 3:41 p.m.
Size 1.8MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 fc195e7f832004c004c41441a5658b50
SHA256 bafcc2fc61b7ac36e9ce04624e668252426ab18ef648d01fbc4e5c71453bd8d5
CRC32 2E000A7E
ssdeep 49152:1ClyTNMoxbNtXq92pCiuLmUhrZDiSSjcHtOge9:+y7OituLxwJYP
Yara
  • PE_Header_Zero - PE File Signature
  • anti_vm_detect - Possibly employs anti-virtualization techniques
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
185.215.113.19 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 185.215.113.19:80 -> 192.168.56.103:49165 2400032 ET DROP Spamhaus DROP Listed Traffic Inbound group 33 Misc Attack

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
section \x00
section .idata
section
section ibotyqbx
section bzvbefzh
section .taggant
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: fb e9 4e 01 00 00 60 8b 74 24 24 8b 7c 24 28 fc
exception.symbol: herso+0x3120b9
exception.instruction: sti
exception.module: herso.exe
exception.exception_code: 0xc0000096
exception.offset: 3219641
exception.address: 0x10920b9
registers.esp: 3668052
registers.edi: 0
registers.eax: 1
registers.ebp: 3668068
registers.edx: 19075072
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 50 e9 28 00 00 00 83 eb ff 81 f3 50 f8 9f 79
        

      
        exception.symbol:
        herso+0x6d0d6
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        446678
        

      
        exception.address:
        0xded0d6
        

      
    
  
    
      
        registers.esp:
        3668016
        

      
        registers.edi:
        14601653
        

      
        registers.eax:
        25499
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        14155776
        

      
        registers.ebx:
        14601984
        

      
        registers.esi:
        3
        

      
        registers.ecx:
        1971388416
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb e9 f1 00 00 00 58 e9 9d 00 00 00 81 c1 58 c7
        

      
        exception.symbol:
        herso+0x6d7a7
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        448423
        

      
        exception.address:
        0xded7a7
        

      
    
  
    
      
        registers.esp:
        3668020
        

      
        registers.edi:
        14627152
        

      
        registers.eax:
        25499
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        14155776
        

      
        registers.ebx:
        14601984
        

      
        registers.esi:
        3
        

      
        registers.ecx:
        1971388416
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 57 51 54 59 e9 7b 00 00 00 09 cf 59 55 bd 88
        

      
        exception.symbol:
        herso+0x6d41e
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        447518
        

      
        exception.address:
        0xded41e
        

      
    
  
    
      
        registers.esp:
        3668020
        

      
        registers.edi:
        14627152
        

      
        registers.eax:
        25499
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        14155776
        

      
        registers.ebx:
        14601984
        

      
        registers.esi:
        4294944676
        

      
        registers.ecx:
        242921
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb e9 cd fc ff ff 8b 34 24 83 c4 04 29 e9 81 e9
        

      
        exception.symbol:
        herso+0x6e472
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        451698
        

      
        exception.address:
        0xdee472
        

      
    
  
    
      
        registers.esp:
        3668016
        

      
        registers.edi:
        14627152
        

      
        registers.eax:
        32189
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        923485847
        

      
        registers.ebx:
        756514658
        

      
        registers.esi:
        14605965
        

      
        registers.ecx:
        242921
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 50 89 e0 05 04 00 00 00 83 e8 04 e9 4a f9 ff
        

      
        exception.symbol:
        herso+0x6e62c
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        452140
        

      
        exception.address:
        0xdee62c
        

      
    
  
    
      
        registers.esp:
        3668020
        

      
        registers.edi:
        14627152
        

      
        registers.eax:
        32189
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        923485847
        

      
        registers.ebx:
        756514658
        

      
        registers.esi:
        14638154
        

      
        registers.ecx:
        242921
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 68 f4 80 de 15 89 14 24 89 04 24 50 89 e0 68
        

      
        exception.symbol:
        herso+0x6e98d
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        453005
        

      
        exception.address:
        0xdee98d
        

      
    
  
    
      
        registers.esp:
        3668020
        

      
        registers.edi:
        0
        

      
        registers.eax:
        32189
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        923485847
        

      
        registers.ebx:
        1259
        

      
        registers.esi:
        14609114
        

      
        registers.ecx:
        242921
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 83 ec 04 89 04 24 b8 dd b8 6d 3e 40 40 c1 e8
        

      
        exception.symbol:
        herso+0x1e4dcb
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        1985995
        

      
        exception.address:
        0xf64dcb
        

      
    
  
    
      
        registers.esp:
        3668020
        

      
        registers.edi:
        14641828
        

      
        registers.eax:
        30856
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        425984
        

      
        registers.ebx:
        16169855
        

      
        registers.esi:
        16138543
        

      
        registers.ecx:
        1359937536
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 81 ec 04 00 00 00 e9 7f 01 00 00 55 bd d6 d3
        

      
        exception.symbol:
        herso+0x1e46f5
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        1984245
        

      
        exception.address:
        0xf646f5
        

      
    
  
    
      
        registers.esp:
        3668020
        

      
        registers.edi:
        1365136470
        

      
        registers.eax:
        30856
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        425984
        

      
        registers.ebx:
        16142379
        

      
        registers.esi:
        0
        

      
        registers.ecx:
        1359937536
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 81 c3 91 be fa 3e 51 53 bb 92 4b ef 3d 81 c3
        

      
        exception.symbol:
        herso+0x1ea2c2
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2007746
        

      
        exception.address:
        0xf6a2c2
        

      
    
  
    
      
        registers.esp:
        3668016
        

      
        registers.edi:
        1365136470
        

      
        registers.eax:
        30010
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        2130566132
        

      
        registers.ebx:
        16161519
        

      
        registers.esi:
        0
        

      
        registers.ecx:
        859
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 51 e9 a2 00 00 00 87 04 24 5c e9 b7 00 00 00
        

      
        exception.symbol:
        herso+0x1e9c36
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2006070
        

      
        exception.address:
        0xf69c36
        

      
    
  
    
      
        registers.esp:
        3668020
        

      
        registers.edi:
        1365136470
        

      
        registers.eax:
        30010
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        1549541099
        

      
        registers.ebx:
        16191529
        

      
        registers.esi:
        4294939676
        

      
        registers.ecx:
        859
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 53 bb 10 75 f3 3e 29 df 5b 56 55 e9 2c ff ff
        

      
        exception.symbol:
        herso+0x1ec4a4
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2016420
        

      
        exception.address:
        0xf6c4a4
        

      
    
  
    
      
        registers.esp:
        3668016
        

      
        registers.edi:
        16170457
        

      
        registers.eax:
        28723
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        16169859
        

      
        registers.ebx:
        16163935
        

      
        registers.esi:
        16165711
        

      
        registers.ecx:
        1971442156
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 52 89 e2 81 c2 04 00 00 00 83 ea 04 e9 e3 f8
        

      
        exception.symbol:
        herso+0x1ec736
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2017078
        

      
        exception.address:
        0xf6c736
        

      
    
  
    
      
        registers.esp:
        3668020
        

      
        registers.edi:
        16199180
        

      
        registers.eax:
        28723
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        16169859
        

      
        registers.ebx:
        16163935
        

      
        registers.esi:
        16165711
        

      
        registers.ecx:
        1971442156
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 56 c7 04 24 53 6a d8 15 89 3c 24 e9 e8 05 00
        

      
        exception.symbol:
        herso+0x1ebf34
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2015028
        

      
        exception.address:
        0xf6bf34
        

      
    
  
    
      
        registers.esp:
        3668020
        

      
        registers.edi:
        16173148
        

      
        registers.eax:
        28723
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        16169859
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        16165711
        

      
        registers.ecx:
        1259
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        ed 64 8f 05 00 00 00 00 52 54 e9 da d0 ff ff 66
        

      
        exception.symbol:
        herso+0x1f8262
        

      
        exception.instruction:
        in eax, dx
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2064994
        

      
        exception.address:
        0xf78262
        

      
    
  
    
      
        registers.esp:
        3668012
        

      
        registers.edi:
        16173148
        

      
        registers.eax:
        1447909480
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        22104
        

      
        registers.ebx:
        1971327157
        

      
        registers.esi:
        16200209
        

      
        registers.ecx:
        20
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        0f 3f 07 0b 64 8f 05 00 00 00 00 83 c4 04 83 fb
        

      
        exception.symbol:
        herso+0x1f862a
        

      
        exception.address:
        0xf7862a
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc000001d
        

      
        exception.offset:
        2065962
        

      
    
  
    
      
        registers.esp:
        3668012
        

      
        registers.edi:
        16173148
        

      
        registers.eax:
        1
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        22104
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        16200209
        

      
        registers.ecx:
        20
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        ed 81 fb 68 58 4d 56 75 0a c7 85 dd 2b 2d 12 01
        

      
        exception.symbol:
        herso+0x1f4847
        

      
        exception.instruction:
        in eax, dx
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2050119
        

      
        exception.address:
        0xf74847
        

      
    
  
    
      
        registers.esp:
        3668012
        

      
        registers.edi:
        16173148
        

      
        registers.eax:
        1447909480
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        22104
        

      
        registers.ebx:
        2256917605
        

      
        registers.esi:
        16200209
        

      
        registers.ecx:
        10
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 51 e9 2c ff ff ff 5a f7 d2 81 f2 7d c0 ff 5f
        

      
        exception.symbol:
        herso+0x1fbf9f
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2080671
        

      
        exception.address:
        0xf7bf9f
        

      
    
  
    
      
        registers.esp:
        3668016
        

      
        registers.edi:
        16173148
        

      
        registers.eax:
        16235423
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        2130566132
        

      
        registers.ebx:
        48115031
        

      
        registers.esi:
        10
        

      
        registers.ecx:
        1359937536
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 83 ec 04 89 14 24 57 89 24 24 81 04 24 04 00
        

      
        exception.symbol:
        herso+0x1fc03d
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2080829
        

      
        exception.address:
        0xf7c03d
        

      
    
  
    
      
        registers.esp:
        3668020
        

      
        registers.edi:
        16173148
        

      
        registers.eax:
        16265843
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        2130566132
        

      
        registers.ebx:
        48115031
        

      
        registers.esi:
        10
        

      
        registers.ecx:
        1359937536
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 83 ec 04 89 3c 24 bf b7 38 7e 72 e9 c1 ff ff
        

      
        exception.symbol:
        herso+0x1fbcab
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2079915
        

      
        exception.address:
        0xf7bcab
        

      
    
  
    
      
        registers.esp:
        3668020
        

      
        registers.edi:
        16173148
        

      
        registers.eax:
        16238155
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        48115031
        

      
        registers.esi:
        518496
        

      
        registers.ecx:
        1359937536
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        cd 01 eb 00 be 5f a4 41 20 66 81 c1 8e 14 64 8f
        

      
        exception.symbol:
        herso+0x1fc83c
        

      
        exception.instruction:
        int 1
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000005
        

      
        exception.offset:
        2082876
        

      
        exception.address:
        0xf7c83c
        

      
    
  
    
      
        registers.esp:
        3667980
        

      
        registers.edi:
        0
        

      
        registers.eax:
        3667980
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        246906408
        

      
        registers.ebx:
        16239009
        

      
        registers.esi:
        470412
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 55 89 04 24 e9 3f 00 00 00 83 c4 04 81 ec 04
        

      
        exception.symbol:
        herso+0x20b624
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2143780
        

      
        exception.address:
        0xf8b624
        

      
    
  
    
      
        registers.esp:
        3668020
        

      
        registers.edi:
        16300550
        

      
        registers.eax:
        0
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        6
        

      
        registers.ebx:
        262633
        

      
        registers.esi:
        1971262480
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 81 ea 01 8a b3 7d e9 28 fa ff ff ba f1 4a 4f
        

      
        exception.symbol:
        herso+0x20fb5b
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2161499
        

      
        exception.address:
        0xf8fb5b
        

      
    
  
    
      
        registers.esp:
        3668008
        

      
        registers.edi:
        16300550
        

      
        registers.eax:
        31717
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        16315658
        

      
        registers.ebx:
        1641292288
        

      
        registers.esi:
        1971262480
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb e9 f7 f9 ff ff 83 c1 04 51 e9 20 01 00 00 51
        

      
        exception.symbol:
        herso+0x20fc43
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2161731
        

      
        exception.address:
        0xf8fc43
        

      
    
  
    
      
        registers.esp:
        3668012
        

      
        registers.edi:
        16300550
        

      
        registers.eax:
        31717
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        16347375
        

      
        registers.ebx:
        1641292288
        

      
        registers.esi:
        1971262480
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 56 56 e9 1f f7 ff ff 41 e9 00 00 00 00 81 e9
        

      
        exception.symbol:
        herso+0x20ffb3
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2162611
        

      
        exception.address:
        0xf8ffb3
        

      
    
  
    
      
        registers.esp:
        3668012
        

      
        registers.edi:
        629225
        

      
        registers.eax:
        31717
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        16318427
        

      
        registers.ebx:
        1641292288
        

      
        registers.esi:
        0
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 81 c2 00 62 65 77 e9 bb f9 ff ff 31 f5 5e 89
        

      
        exception.symbol:
        herso+0x211b46
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2169670
        

      
        exception.address:
        0xf91b46
        

      
    
  
    
      
        registers.esp:
        3668008
        

      
        registers.edi:
        629225
        

      
        registers.eax:
        30970
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        16323289
        

      
        registers.ebx:
        1147035608
        

      
        registers.esi:
        0
        

      
        registers.ecx:
        16318427
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb e9 8c 01 00 00 bf 33 67 e6 3c 81 ef 26 50 9f
        

      
        exception.symbol:
        herso+0x211663
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2168419
        

      
        exception.address:
        0xf91663
        

      
    
  
    
      
        registers.esp:
        3668012
        

      
        registers.edi:
        629225
        

      
        registers.eax:
        30970
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        16354259
        

      
        registers.ebx:
        1147035608
        

      
        registers.esi:
        0
        

      
        registers.ecx:
        16318427
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 68 1d 1b ed 56 89 14 24 50 68 ff 3a f7 01 89
        

      
        exception.symbol:
        herso+0x211c83
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2169987
        

      
        exception.address:
        0xf91c83
        

      
    
  
    
      
        registers.esp:
        3668012
        

      
        registers.edi:
        1179202795
        

      
        registers.eax:
        30970
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        16354259
        

      
        registers.ebx:
        1147035608
        

      
        registers.esi:
        4294938956
        

      
        registers.ecx:
        16318427
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 51 b9 6f 4f 49 7c 29 ce e9 ab 00 00 00 c1 24
        

      
        exception.symbol:
        herso+0x21387a
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2177146
        

      
        exception.address:
        0xf9387a
        

      
    
  
    
      
        registers.esp:
        3668008
        

      
        registers.edi:
        1179202795
        

      
        registers.eax:
        29045
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        1494131986
        

      
        registers.ebx:
        1327239730
        

      
        registers.esi:
        16330538
        

      
        registers.ecx:
        1161976576
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb e9 36 fd ff ff 54 8f 04 24 81 04 24 04 00 00
        

      
        exception.symbol:
        herso+0x213c1e
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2178078
        

      
        exception.address:
        0xf93c1e
        

      
    
  
    
      
        registers.esp:
        3668012
        

      
        registers.edi:
        1179202795
        

      
        registers.eax:
        29045
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        37480784
        

      
        registers.ebx:
        1327239730
        

      
        registers.esi:
        16333943
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb e9 b1 03 00 00 35 7a 84 b3 7f 0d 00 31 ff 67
        

      
        exception.symbol:
        herso+0x221689
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2233993
        

      
        exception.address:
        0xfa1689
        

      
    
  
    
      
        registers.esp:
        3668012
        

      
        registers.edi:
        16392639
        

      
        registers.eax:
        30621
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        2130566069
        

      
        registers.ebx:
        1293338754
        

      
        registers.esi:
        1392536160
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 51 55 bd a7 cc de 3b 55 81 34 24 3a bb 93 5c
        

      
        exception.symbol:
        herso+0x233c5d
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2309213
        

      
        exception.address:
        0xfb3c5d
        

      
    
  
    
      
        registers.esp:
        3667976
        

      
        registers.edi:
        3126611346
        

      
        registers.eax:
        16463003
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        2130566132
        

      
        registers.ebx:
        2904614921
        

      
        registers.esi:
        16457795
        

      
        registers.ecx:
        1359937536
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 31 f6 e9 00 00 00 00 ff 34 06 ff 34 24 5a 55
        

      
        exception.symbol:
        herso+0x233abe
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2308798
        

      
        exception.address:
        0xfb3abe
        

      
    
  
    
      
        registers.esp:
        3667980
        

      
        registers.edi:
        3126611346
        

      
        registers.eax:
        16494881
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        2130566132
        

      
        registers.ebx:
        2904614921
        

      
        registers.esi:
        16457795
        

      
        registers.ecx:
        1359937536
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb e9 84 01 00 00 81 c5 7f 2b fd 7c 5b 52 89 ea
        

      
        exception.symbol:
        herso+0x233949
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2308425
        

      
        exception.address:
        0xfb3949
        

      
    
  
    
      
        registers.esp:
        3667980
        

      
        registers.edi:
        3126611346
        

      
        registers.eax:
        16494881
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        2298801283
        

      
        registers.ebx:
        2904614921
        

      
        registers.esi:
        4294937900
        

      
        registers.ecx:
        1359937536
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 68 44 c4 07 59 89 34 24 89 2c 24 e9 d4 fa ff
        

      
        exception.symbol:
        herso+0x235d4e
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2317646
        

      
        exception.address:
        0xfb5d4e
        

      
    
  
    
      
        registers.esp:
        3667976
        

      
        registers.edi:
        16471486
        

      
        registers.eax:
        32467
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        2086741083
        

      
        registers.ebx:
        687895168
        

      
        registers.esi:
        3126581950
        

      
        registers.ecx:
        2103210628
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 81 ec 04 00 00 00 89 0c 24 e9 b8 00 00 00 29
        

      
        exception.symbol:
        herso+0x235662
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2315874
        

      
        exception.address:
        0xfb5662
        

      
    
  
    
      
        registers.esp:
        3667980
        

      
        registers.edi:
        16503953
        

      
        registers.eax:
        32467
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        2086741083
        

      
        registers.ebx:
        687895168
        

      
        registers.esi:
        3126581950
        

      
        registers.ecx:
        2103210628
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 50 53 c7 04 24 e6 bd 13 15 89 34 24 e9 b2 05
        

      
        exception.symbol:
        herso+0x2359d9
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2316761
        

      
        exception.address:
        0xfb59d9
        

      
    
  
    
      
        registers.esp:
        3667980
        

      
        registers.edi:
        16503953
        

      
        registers.eax:
        32467
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        1405321568
        

      
        registers.ebx:
        687895168
        

      
        registers.esi:
        3126581950
        

      
        registers.ecx:
        4294937712
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 52 c7 04 24 64 7c 52 77 89 04 24 e9 29 06 00
        

      
        exception.symbol:
        herso+0x238361
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2327393
        

      
        exception.address:
        0xfb8361
        

      
    
  
    
      
        registers.esp:
        3667980
        

      
        registers.edi:
        16503953
        

      
        registers.eax:
        32833
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        16515217
        

      
        registers.ebx:
        570433793
        

      
        registers.esi:
        3126626380
        

      
        registers.ecx:
        656273757
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 51 68 53 f2 7d 69 e9 1d 02 00 00 52 81 04 24
        

      
        exception.symbol:
        herso+0x238264
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2327140
        

      
        exception.address:
        0xfb8264
        

      
    
  
    
      
        registers.esp:
        3667980
        

      
        registers.edi:
        0
        

      
        registers.eax:
        32833
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        16485529
        

      
        registers.ebx:
        1358981728
        

      
        registers.esi:
        3126626380
        

      
        registers.ecx:
        656273757
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 51 81 ec 04 00 00 00 89 14 24 e9 8b 00 00 00
        

      
        exception.symbol:
        herso+0x23caab
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2345643
        

      
        exception.address:
        0xfbcaab
        

      
    
  
    
      
        registers.esp:
        3667976
        

      
        registers.edi:
        117161854
        

      
        registers.eax:
        27563
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        65804
        

      
        registers.esi:
        16501092
        

      
        registers.ecx:
        1969225870
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb e9 11 00 00 00 b9 01 00 00 00 01 4c 24 04 8b
        

      
        exception.symbol:
        herso+0x23d10e
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2347278
        

      
        exception.address:
        0xfbd10e
        

      
    
  
    
      
        registers.esp:
        3667980
        

      
        registers.edi:
        117161854
        

      
        registers.eax:
        27563
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        65804
        

      
        registers.esi:
        16528655
        

      
        registers.ecx:
        1969225870
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 68 5a a8 3a 56 89 14 24 e9 49 f9 ff ff 83 c4
        

      
        exception.symbol:
        herso+0x23d2d7
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2347735
        

      
        exception.address:
        0xfbd2d7
        

      
    
  
    
      
        registers.esp:
        3667980
        

      
        registers.edi:
        0
        

      
        registers.eax:
        44777
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        65804
        

      
        registers.esi:
        16504419
        

      
        registers.ecx:
        1969225870
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 50 68 3a 74 4a 47 8b 04 24 81 c4 04 00 00 00
        

      
        exception.symbol:
        herso+0x23f647
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2356807
        

      
        exception.address:
        0xfbf647
        

      
    
  
    
      
        registers.esp:
        3667980
        

      
        registers.edi:
        0
        

      
        registers.eax:
        26950
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        16538180
        

      
        registers.ebx:
        16509406
        

      
        registers.esi:
        33013825
        

      
        registers.ecx:
        2081089995
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 68 5e 30 f2 2f 89 2c 24 52 50 b8 ef 04 bd 6e
        

      
        exception.symbol:
        herso+0x23f995
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2357653
        

      
        exception.address:
        0xfbf995
        

      
    
  
    
      
        registers.esp:
        3667980
        

      
        registers.edi:
        0
        

      
        registers.eax:
        26950
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        16513944
        

      
        registers.ebx:
        24811
        

      
        registers.esi:
        33013825
        

      
        registers.ecx:
        2081089995
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 56 e9 a0 f8 ff ff 89 1c 24 53 e9 25 00 00 00
        

      
        exception.symbol:
        herso+0x242a63
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2370147
        

      
        exception.address:
        0xfc2a63
        

      
    
  
    
      
        registers.esp:
        3667980
        

      
        registers.edi:
        1763665
        

      
        registers.eax:
        16526058
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        746459095
        

      
        registers.esi:
        16521039
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 52 e9 00 00 00 00 c7 04 24 c4 3f bf 4c 89 04
        

      
        exception.symbol:
        herso+0x243163
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2371939
        

      
        exception.address:
        0xfc3163
        

      
    
  
    
      
        registers.esp:
        3667976
        

      
        registers.edi:
        1763665
        

      
        registers.eax:
        25653
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        746459095
        

      
        registers.esi:
        16526419
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 52 e9 a3 02 00 00 81 ec 04 00 00 00 89 04 24
        

      
        exception.symbol:
        herso+0x242f64
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2371428
        

      
        exception.address:
        0xfc2f64
        

      
    
  
    
      
        registers.esp:
        3667980
        

      
        registers.edi:
        1763665
        

      
        registers.eax:
        25653
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        0
        

      
        registers.ebx:
        746459095
        

      
        registers.esi:
        16552072
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 50 68 7e 18 b1 76 89 24 24 81 04 24 04 00 00
        

      
        exception.symbol:
        herso+0x242d45
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2370885
        

      
        exception.address:
        0xfc2d45
        

      
    
  
    
      
        registers.esp:
        3667980
        

      
        registers.edi:
        1763665
        

      
        registers.eax:
        25653
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        4294944400
        

      
        registers.ebx:
        746459095
        

      
        registers.esi:
        16552072
        

      
        registers.ecx:
        157417
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb e9 b6 00 00 00 55 bd f1 31 7d 1f 55 bd 00 bd
        

      
        exception.symbol:
        herso+0x252e51
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2436689
        

      
        exception.address:
        0xfd2e51
        

      
    
  
    
      
        registers.esp:
        3667976
        

      
        registers.edi:
        16570150
        

      
        registers.eax:
        30537
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        16591052
        

      
        registers.ebx:
        1969225702
        

      
        registers.esi:
        16537020
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fb 68 17 14 cd 20 89 0c 24 b9 0a ca ff 37 53 51
        

      
        exception.symbol:
        herso+0x252ece
        

      
        exception.instruction:
        sti
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2436814
        

      
        exception.address:
        0xfd2ece
        

      
    
  
    
      
        registers.esp:
        3667980
        

      
        registers.edi:
        938038359
        

      
        registers.eax:
        30537
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        16593849
        

      
        registers.ebx:
        1969225702
        

      
        registers.esi:
        0
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                            suspicious_features
                                            POST method with no referer header, POST method with no useragent header, Connection to IP address
                                        
                                    
                                        
                                    
                                        
                                            suspicious_request
                                            POST http://185.215.113.19/Vi9leo/index.php
                                        
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    request
                                    POST http://185.215.113.19/Vi9leo/index.php
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    request
                                    POST http://185.215.113.19/Vi9leo/index.php
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          8192
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x7793f000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          8192
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x778b0000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          188416
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00d81000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00580000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x005d0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      region_size:
      
        
          8192
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x005e0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      region_size:
      
        
          65536
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00630000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      region_size:
      
        
          8192
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00640000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00650000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00a80000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00a90000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00ae0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00af0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00b40000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00b50000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00b60000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00bb0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00bc0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00cd0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00d60000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00d70000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x026c0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x027d0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x028e0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00640000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00640000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00640000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00640000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00640000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          652
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x02c30000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1236
        
      
      
      

    
  
    
      region_size:
      
        
          65536
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00000000064e0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffffffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2304
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          8192
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x7793f000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2304
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          8192
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x778b0000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2304
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          188416
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x002b1000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2304
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x009c0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2304
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00a50000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2304
        
      
      
      

    
  
    
      region_size:
      
        
          8192
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00b20000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2304
        
      
      
      

    
  
    
      region_size:
      
        
          65536
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00b30000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2304
        
      
      
      

    
  
    
      region_size:
      
        
          8192
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00b40000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2304
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x025f0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2304
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x02700000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2304
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x02710000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2304
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x02720000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2304
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x02770000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2304
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x02880000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2304
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x02890000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2304
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x028a0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2304
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x028b0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2304
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x02940000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2304
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x02950000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                    
                                        
                                            description
                                            explorti.exe tried to sleep 1133 seconds, actually delayed analysis time by 1133 seconds
                                        
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    file
                                    C:\Users\test22\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    file
                                    C:\Users\test22\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
ShellExecuteExW

  
  
    
      
    
  


  
    
      show_type:
      
        
          0
        
      
      
      

    
  
    
      filepath_r:
      
        
          C:\Users\test22\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
        
      
      
      

    
  
    
      parameters:
      
        
          
        
      
      
      

    
  
    
      filepath:
      
        
          C:\Users\test22\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
        
      
      
      

    
  


    
        1
    

1

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x0002dc00', u'virtual_address': u'0x00001000', u'entropy': 7.984002536987203, u'name': u'   \\x00    ', u'virtual_size': u'0x00068000'}
                                        
                                    
                                        
                                            entropy
                                            7.98400253699
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x0019d200', u'virtual_address': u'0x00312000', u'entropy': 7.954067697802154, u'name': u'ibotyqbx', u'virtual_size': u'0x0019e000'}
                                        
                                    
                                        
                                            entropy
                                            7.9540676978
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            entropy
                                            0.99377368706
                                        
                                    
                                        
                                            description
                                            Overall entropy of this PE file is high
                                        
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    process
                                    system
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                            host
                                            185.215.113.19
                                        
                                    
                                        
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    file
                                    C:\ProgramData\AVAST Software
                                    
                                


                            

                        

                            

                                

                                    file
                                    C:\ProgramData\Avira
                                    
                                


                            

                        

                            

                                

                                    file
                                    C:\ProgramData\Kaspersky Lab
                                    
                                


                            

                        

                            

                                

                                    file
                                    C:\ProgramData\Panda Security
                                    
                                


                            

                        

                            

                                

                                    file
                                    C:\ProgramData\Bitdefender
                                    
                                


                            

                        

                            

                                

                                    file
                                    C:\ProgramData\AVG
                                    
                                


                            

                        

                            

                                

                                    file
                                    C:\ProgramData\Doctor Web
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    file
                                    \??\SICE
                                    
                                


                            

                        

                            

                                

                                    file
                                    \??\SIWVID
                                    
                                


                            

                        

                            

                                

                                    file
                                    \??\NTICE
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          OLLYDBG
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          GBDYLLO
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          pediy06
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          FilemonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          FilemonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          #0
        
      
      
      

    
  
    
      window_name:
      
        
          File Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          PROCMON_WINDOW_CLASS
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          #0
        
      
      
      

    
  
    
      window_name:
      
        
          Process Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          RegmonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          RegmonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          #0
        
      
      
      

    
  
    
      window_name:
      
        
          Registry Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          18467-41
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          FilemonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          FilemonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          #0
        
      
      
      

    
  
    
      window_name:
      
        
          File Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          PROCMON_WINDOW_CLASS
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          #0
        
      
      
      

    
  
    
      window_name:
      
        
          Process Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          OLLYDBG
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          GBDYLLO
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          pediy06
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          FilemonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          FilemonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          #0
        
      
      
      

    
  
    
      window_name:
      
        
          File Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          PROCMON_WINDOW_CLASS
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          #0
        
      
      
      

    
  
    
      window_name:
      
        
          Process Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          RegmonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          RegmonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          #0
        
      
      
      

    
  
    
      window_name:
      
        
          Registry Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          18467-41
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          FilemonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          FilemonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          #0
        
      
      
      

    
  
    
      window_name:
      
        
          File Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          PROCMON_WINDOW_CLASS
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          #0
        
      
      
      

    
  
    
      window_name:
      
        
          Process Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          OLLYDBG
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          GBDYLLO
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          pediy06
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          OLLYDBG
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          GBDYLLO
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          pediy06
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Regmonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Regmonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          18467-41
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Filemonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Filemonclass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          PROCMON_WINDOW_CLASS
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          OLLYDBG
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          GBDYLLO
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          pediy06
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          OLLYDBG
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    registry
                                    HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
                                    
                                


                            

                        

                            

                                

                                    registry
                                    HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    file
                                    C:\Windows\Tasks\explorti.job
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        ed 64 8f 05 00 00 00 00 52 54 e9 da d0 ff ff 66
        

      
        exception.symbol:
        herso+0x1f8262
        

      
        exception.instruction:
        in eax, dx
        

      
        exception.module:
        herso.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        2064994
        

      
        exception.address:
        0xf78262
        

      
    
  
    
      
        registers.esp:
        3668012
        

      
        registers.edi:
        16173148
        

      
        registers.eax:
        1447909480
        

      
        registers.ebp:
        4004622356
        

      
        registers.edx:
        22104
        

      
        registers.ebx:
        1971327157
        

      
        registers.esi:
        16200209
        

      
        registers.ecx:
        20
        

      
    
  


    
        1
    

0

    
        0