Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 15, 2021, 10:53 a.m.	June 15, 2021, 11:07 a.m.

Size	5.0MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`2b766f06adf2c73fb6da681572d72a6f`
SHA256	`e2e80df13f72ce8833c2b41643da4a1f99eb5af25422a40d1250a8a40cc92c2c`
CRC32	`5D24158C`
ssdeep	`98304:y9wAo0zbKuJjtc95IamQEcgfrEXtutTacMm2jDltezaYPwJxv1pyGpc79m/yUGLK:ydo03KUmEcgfrItucjpoz5UxqGWmypLK`
PDB Path
Yara	UltraVNC_Zero - UltraVNC PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description)

VOKLIGHTD.exe "C:\Users\test22\AppData\Local\Temp\VOKLIGHTD.exe"
2948

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 15, 2021, 10:53 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (5 events)

Time & API	Arguments	Status	Return
CryptExportKey June 15, 2021, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00a4b648 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 15, 2021, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00a4b648 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 15, 2021, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00a4b688 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 15, 2021, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00a4b688 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey June 15, 2021, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00a4b808 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 15, 2021, 10:53 a.m.		1	1	0

One or more processes crashed (50 out of 1166 events)

Time & API	Arguments	Status
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0x1f28 @ 0x401f28 exception.instruction_r: f3 aa 8b 45 f0 8b 4d 08 8b 55 10 03 c8 2b d0 52 exception.symbol: voklightd+0xf048 exception.instruction: stosb byte ptr es:[edi], al exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61512 exception.address: 0x40f048 registers.esp: 1637008 registers.edi: 4644500 registers.eax: 0 registers.ebp: 1637024 registers.edx: 0 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 12	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4644768 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 37249	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4648864 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 37217	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4652960 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 37185	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4657056 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 37153	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4661152 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 37121	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4665248 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 37089	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4669344 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 37057	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4673440 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 37025	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4677536 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36993	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4681632 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36961	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4685728 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36929	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4689824 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36897	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4693920 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36865	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4698016 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36833	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4702112 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36801	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4706208 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36769	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4710304 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36737	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4714400 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36705	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4718496 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36673	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4722592 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36641	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4726688 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36609	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4730784 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36577	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4734880 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36545	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4738976 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36513	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4743072 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36481	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4747168 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36449	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4751264 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36417	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4755360 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36385	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4759456 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36353	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4763552 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36321	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4767648 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36289	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4771744 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36257	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4775840 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36225	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4779936 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36193	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4784032 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36161	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4788128 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36129	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4792224 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36097	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4796320 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36065	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4800416 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36033	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4804512 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 36001	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4808608 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 35969	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4812704 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 35937	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4816800 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 35905	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4820896 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 35873	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4824992 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 35841	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4829088 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 35809	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4833184 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 35777	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4837280 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 35745	1
__exception__ June 15, 2021, 10:53 a.m.	stacktrace: voklightd+0xf014 @ 0x40f014 voklightd+0xf060 @ 0x40f060 voklightd+0x1f28 @ 0x401f28 exception.instruction_r: 66 0f 7f 47 60 66 0f 7f 47 70 8d bf 80 00 00 00 exception.symbol: voklightd+0xefc4 exception.address: 0x40efc4 exception.module: VOKLIGHTD.exe exception.exception_code: 0xc0000005 exception.offset: 61380 registers.esp: 1636952 registers.edi: 4841376 registers.eax: 4644512 registers.ebp: 1636956 registers.edx: 12 registers.ebx: 4644500 registers.esi: 4644500 registers.ecx: 35713	1

Allocates read-write-execute memory (usually to unpack itself) (40 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03010000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x030c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72831000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0096a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72832000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00962000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00972000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x030c1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x030c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00992000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0099c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x030c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00973000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0097c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x030c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x030c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02460000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00974000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0099a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00975000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00976000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00977000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00978000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00979000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 45056 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02461000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0097a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0096b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0246c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00986000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0098a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00987000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0246d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03270000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72735000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06460000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00993000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 15, 2021, 10:53 a.m.	process_identifier: 2948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x030c9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x004d4600', u'virtual_address': u'0x00026000', u'entropy': 7.965101538720504, u'name': u'.rsrc', u'virtual_size': u'0x004d4414'}

entropy

7.96510153872

description

A section with a high entropy has been found

entropy

0.973427812223

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW June 15, 2021, 10:53 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

File has been identified by 13 AntiVirus engines on VirusTotal as malicious (13 events)

Bkav	W32.AIDetect.malware1
FireEye	Generic.mg.2b766f06adf2c73f
Cylance	Unsafe
BitDefenderTheta	Gen:NN.ZexaF.34738.@t0@aGODgoj
APEX	Malicious
Kaspersky	VHO:Trojan-Downloader.MSIL.Convagent.gen
McAfee-GW-Edition	BehavesLike.Win32.Generic.rc
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI - Malicious PE
eGambit	Unsafe.AI_Score_99%
Cynet	Malicious (score: 100)
Rising	Malware.Heuristic!ET#92% (RDMK:cmRtazr+a2du9CbeA9BDsbuMqvkV)
Cybereason	malicious.c716ff

VOKLIGHTD.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All