Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 29, 2021, 8:17 a.m.	Sept. 29, 2021, 8:22 a.m.

Size	4.8MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`c04496520501bc6a3b3f0b7f5f875a32`
SHA256	`3b347a4641e8553c4ecbee8e6d86c32311cd9348d61eb55929aae076e82f96c3`
CRC32	`BAD58BF0`
ssdeep	`98304:DP8EeWykgfsLgF5NHpo1zoypHIrnpp6IApSCN2s8s343ot+S+uDqB60xZQB2ffw:DkEeWVgfR1HpAzokIrdMD41s39+S+uD7`
Yara	PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) themida_packer - themida packer IsPE32 - (no description)

s.exe "C:\Users\test22\AppData\Local\Temp\s.exe"
2472

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

The executable contains unknown PE section names indicative of a packer (could be a false positive) (4 events)

section
section	.imports
section	.themida
section	.boot

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ Sept. 29, 2021, 8:17 a.m.	stacktrace: s+0x6e66bf @ 0x16d66bf s+0x65b75c @ 0x164b75c exception.instruction_r: c9 c2 10 00 cc cc cc cc cc e9 0f bd c0 8b 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x7566b727 registers.esp: 2161468 registers.edi: 19185664 registers.eax: 2161468 registers.ebp: 2161548 registers.edx: 2130566132 registers.ebx: 0 registers.esi: 2008380459 registers.ecx: 3875012608	1
__exception__ Sept. 29, 2021, 8:17 a.m.	stacktrace: exception.instruction_r: ed e9 ba a9 00 00 c3 e9 ea 8f ff ff d6 c2 f0 de exception.symbol: s+0x71098c exception.instruction: in eax, dx exception.module: s.exe exception.exception_code: 0xc0000096 exception.offset: 7408012 exception.address: 0x170098c registers.esp: 2161588 registers.edi: 21604344 registers.eax: 1750617430 registers.ebp: 19185664 registers.edx: 22614 registers.ebx: 0 registers.esi: 5161508 registers.ecx: 20	1
__exception__ Sept. 29, 2021, 8:17 a.m.	stacktrace: exception.instruction_r: ed e9 81 48 02 00 d4 6b 06 af 26 81 dc bd 48 00 exception.symbol: s+0x71411d exception.instruction: in eax, dx exception.module: s.exe exception.exception_code: 0xc0000096 exception.offset: 7422237 exception.address: 0x170411d registers.esp: 2161588 registers.edi: 21604344 registers.eax: 1447909480 registers.ebp: 19185664 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 5161508 registers.ecx: 10	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 176 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x770d3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a5c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a43000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a5a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a45000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a43000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a45000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a6c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a6d000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75671000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a43000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7567b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a45000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7567b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76abf000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7557f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75588000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a44000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75678000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75678000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a6c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75678000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a45000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75678000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a47000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a45000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a5c000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7566b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 29, 2021, 8:17 a.m.	process_identifier: 2472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76a45000 process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (4 events)

section

{u'size_of_data': u'0x0006ccdc', u'virtual_address': u'0x00002000', u'entropy': 7.978514966464134, u'name': u' ', u'virtual_size': u'0x0012c000'}

entropy

7.97851496646

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00124e00', u'virtual_address': u'0x0012e000', u'entropy': 7.9941675284491716, u'name': u' ', u'virtual_size': u'0x00124d0a'}

entropy

7.99416752845

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00338a0d', u'virtual_address': u'0x00770000', u'entropy': 7.952496596082204, u'name': u'.boot', u'virtual_size': u'0x00338c00'}

entropy

7.95249659608

description

A section with a high entropy has been found

entropy

0.997353998855

description

Overall entropy of this PE file is high

Checks for the presence of known windows from debuggers and forensic tools (21 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA Sept. 29, 2021, 8:17 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 29, 2021, 8:17 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Sept. 29, 2021, 8:17 a.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 29, 2021, 8:17 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 29, 2021, 8:17 a.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 29, 2021, 8:17 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 29, 2021, 8:17 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Sept. 29, 2021, 8:17 a.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA Sept. 29, 2021, 8:17 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 29, 2021, 8:17 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 29, 2021, 8:17 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 29, 2021, 8:17 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 29, 2021, 8:17 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 29, 2021, 8:17 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 29, 2021, 8:17 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 29, 2021, 8:17 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 29, 2021, 8:17 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Sept. 29, 2021, 8:17 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Sept. 29, 2021, 8:17 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 29, 2021, 8:17 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Sept. 29, 2021, 8:17 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Sept. 29, 2021, 8:17 a.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 29, 2021, 8:17 a.m.	stacktrace: exception.instruction_r: ed e9 81 48 02 00 d4 6b 06 af 26 81 dc bd 48 00 exception.symbol: s+0x71411d exception.instruction: in eax, dx exception.module: s.exe exception.exception_code: 0xc0000096 exception.offset: 7422237 exception.address: 0x170411d registers.esp: 2161588 registers.edi: 21604344 registers.eax: 1447909480 registers.ebp: 19185664 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 5161508 registers.ecx: 10	1	0	0

File has been identified by 50 AntiVirus engines on VirusTotal as malicious (50 events)

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Coins.i!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.37630103
FireEye	Generic.mg.c04496520501bc6a
CAT-QuickHeal	Trojan.IGENERIC
ALYac	Trojan.GenericKD.37630103
Cylance	Unsafe
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	TrojanPSW:Win32/Coins.6dc87edd
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_80% (W)
BitDefenderTheta	Gen:NN.ZexaF.34170.@F0@ay2yoZni
Cyren	W32/Zusy.HF.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Generik.DJCCAWZ
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Packed.Agensla-9795240-0
Kaspersky	Trojan-PSW.Win32.Coins.abmv
BitDefender	Trojan.GenericKD.37630103
NANO-Antivirus	Virus.Win32.Gen-Crypt.ccnc
Avast	Win32:Malware-gen
Tencent	Win32.Trojan-qqpass.Qqrob.Suwy
Ad-Aware	Trojan.GenericKD.37630103
Sophos	Mal/Generic-S
TrendMicro	TROJ_GEN.R002C0WIG21
McAfee-GW-Edition	BehavesLike.Win32.Generic.rc
Emsisoft	Trojan.GenericKD.37630103 (B)
SentinelOne	Static AI - Malicious PE
Jiangmin	Trojan.PSW.Coins.jdh
Avira	HEUR/AGEN.1135447
MAX	malware (ai score=80)
Gridinsoft	Trojan.Heur!.032100A1
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
GData	Trojan.GenericKD.37630103
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.R436118
McAfee	Artemis!C04496520501
VBA32	BScope.Trojan.Injects
Malwarebytes	Spyware.Echelon
TrendMicro-HouseCall	TROJ_GEN.R002C0WIG21
Rising	Trojan.Generic@ML.100 (RDMK:v+H7VvuVtKyyrjvhj7a7TQ)
Yandex	Trojan.PWS.Coins!chS2VB+TsCE
Ikarus	Trojan.SuspectCRC
eGambit	Unsafe.AI_Score_100%
Fortinet	W32/Coins.ABMV!tr.pws
AVG	Win32:Malware-gen
Cybereason	malicious.20501b
Panda	Trj/CI.A

s.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All