Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	March 8, 2023, 7:43 a.m.	March 8, 2023, 7:46 a.m.

Size	1.1MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`212c5beb7e726a395316402bc999a534`
SHA256	`c5bbffaaa02f6289977ee6ba6f2684953114cebc79f3e3e6aca7ca301a87a117`
CRC32	`D3AD5CE4`
ssdeep	`24576:Ih+HEj5fhxXUJrlqQVAtJ9be9pIwpVRC0ueNvqI5c0:IhwQYsQStJ98hRxuwSIq0`
Yara	UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library Malicious_Packer_Zero - Malicious Packer anti_vm_detect - Possibly employs anti-virtualization techniques IsPE32 - (no description) PE_Header_Zero - PE File Signature

zmp2.exe "C:\Users\test22\AppData\Local\Temp\zmp2.exe"
1076

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
103.127.83.43	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 8, 2023, 7:43 a.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.sedata

One or more processes crashed (50 out of 368 events)

Time & API	Arguments	Status
__exception__ March 8, 2023, 7:43 a.m.	stacktrace: zmp2+0x111441 @ 0x511441 zmp2+0x148721 @ 0x548721 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: eb 09 aa 39 a9 c8 3b 8e 98 fb d2 c3 e9 6a ff ff exception.symbol: zmp2+0x6e4c6 exception.instruction: jmp 0x46e4d1 exception.module: zmp2.exe exception.exception_code: 0x80000003 exception.offset: 451782 exception.address: 0x46e4c6 registers.esp: 1638008 registers.edi: 0 registers.eax: 0 registers.ebp: 1638052 registers.edx: 582600 registers.ebx: 5 registers.esi: 10086512 registers.ecx: 10086512	1
__exception__ March 8, 2023, 7:43 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 1637020 registers.edi: 4825872 registers.eax: 4599830 registers.ebp: 1637256 registers.edx: 2437994714 registers.ebx: 268630617 registers.esi: 1637020 registers.ecx: 4599830	1
__exception__ March 8, 2023, 7:43 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 41155388 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 41155624 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 41155388 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:43 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 43514680 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 43514916 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 43514680 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:43 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 42203960 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 42204196 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 42203960 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:43 a.m.	stacktrace: 0x80 exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 46136108 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 46136344 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 46136108 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:43 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 44825404 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 44825640 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 44825404 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:43 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 47446852 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 47447088 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 47446852 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:43 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 47446872 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 47447108 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 47446872 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:43 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 48757580 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 48757816 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 48757580 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:43 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 50068312 registers.edi: 4825872 registers.eax: 4599808 registers.ebp: 50068548 registers.edx: 690254307 registers.ebx: 268630617 registers.esi: 50068312 registers.ecx: 4599808	1
__exception__ March 8, 2023, 7:43 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 41155388 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 41155624 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 41155388 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:43 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 42203960 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 42204196 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 42203960 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:43 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 43514680 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 43514916 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 43514680 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:43 a.m.	stacktrace: 0x80 exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 46136108 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 46136344 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 46136108 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:43 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 44825404 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 44825640 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 44825404 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:43 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 41155388 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 41155624 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 41155388 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:43 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 42203960 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 42204196 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 42203960 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:43 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 43514680 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 43514916 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 43514680 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:43 a.m.	stacktrace: 0x80 exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 46136108 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 46136344 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 46136108 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:43 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 48757580 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 48757816 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 48757580 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:43 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 44825404 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 44825640 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 44825404 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:44 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 42203960 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 42204196 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 42203960 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:44 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 41155388 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 41155624 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 41155388 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:44 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 43514680 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 43514916 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 43514680 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:44 a.m.	stacktrace: 0x80 exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 46136108 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 46136344 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 46136108 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:44 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 44825404 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 44825640 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 44825404 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:44 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 42203960 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 42204196 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 42203960 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:44 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 41155388 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 41155624 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 41155388 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:44 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 43514680 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 43514916 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 43514680 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:44 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 44825404 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 44825640 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 44825404 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:44 a.m.	stacktrace: 0x80 exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 46136108 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 46136344 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 46136108 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:44 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 48757580 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 48757816 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 48757580 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:44 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 42203960 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 42204196 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 42203960 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:44 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 41155388 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 41155624 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 41155388 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:44 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 43514680 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 43514916 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 43514680 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:44 a.m.	stacktrace: 0x80 exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 46136108 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 46136344 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 46136108 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:44 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 44825404 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 44825640 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 44825404 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:44 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 47446852 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 47447088 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 47446852 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:44 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 47446872 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 47447108 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 47446872 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:44 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 50068312 registers.edi: 4825872 registers.eax: 4599808 registers.ebp: 50068548 registers.edx: 690254307 registers.ebx: 268630617 registers.esi: 50068312 registers.ecx: 4599808	1
__exception__ March 8, 2023, 7:44 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 43514680 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 43514916 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 43514680 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:44 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 41155388 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 41155624 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 41155388 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:44 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 42203960 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 42204196 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 42203960 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:44 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 44825404 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 44825640 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 44825404 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:44 a.m.	stacktrace: 0x80 exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 46136108 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 46136344 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 46136108 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:44 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 48757580 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 48757816 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 48757580 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:44 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 43514680 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 43514916 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 43514680 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:44 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 42203960 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 42204196 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 42203960 registers.ecx: 4599937	1
__exception__ March 8, 2023, 7:44 a.m.	stacktrace: exception.instruction_r: c1 e8 02 7f 3d 7e 3b 3c ae 3c 5b b6 00 3f 06 b1 exception.symbol: zmp2+0x95da7 exception.instruction: shr eax, 2 exception.module: zmp2.exe exception.exception_code: 0x80000004 exception.offset: 613799 exception.address: 0x495da7 registers.esp: 41155388 registers.edi: 4825872 registers.eax: 4599937 registers.ebp: 41155624 registers.edx: 3947219416 registers.ebx: 268630617 registers.esi: 41155388 registers.ecx: 4599937	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 4861 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e80000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 region_size: 1576960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02080000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 65536 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x778b0000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 region_size: 294912 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 24576 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x755ca000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2023, 7:43 a.m.	process_identifier: 1076 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 process_handle: 0xffffffff	1

Foreign language identified in PE resource (3 events)

name

RT_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0014d0e8

size

0x00010828

name

RT_GROUP_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0015d910

size

0x00000014

name

RT_VERSION

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0015d924

size

0x00000418

The binary likely contains encrypted or compressed data indicative of a packer (4 events)

section

{u'size_of_data': u'0x00029000', u'virtual_address': u'0x00001000', u'entropy': 7.977218259709148, u'name': u'.text', u'virtual_size': u'0x00062000'}

entropy

7.97721825971

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x000e9000', u'virtual_address': u'0x00063000', u'entropy': 7.5781765112868005, u'name': u'.sedata', u'virtual_size': u'0x000e9000'}

entropy

7.57817651129

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00001000', u'virtual_address': u'0x0015e000', u'entropy': 7.9822445207214185, u'name': u'.sedata', u'virtual_size': u'0x00001000'}

entropy

7.98224452072

description

A section with a high entropy has been found

entropy

0.938566552901

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 event)

host

103.127.83.43

File has been identified by 29 AntiVirus engines on VirusTotal as malicious (29 events)

Bkav	W32.AIDetectNet.01
Lionic	Hacktool.Win32.Generic.lC41
tehtris	Generic.Malware
Malwarebytes	Malware.Heuristic.1003
K7AntiVirus	Trojan ( 005239691 )
K7GW	Adware ( 005693e61 )
CrowdStrike	win/malicious_confidence_100% (W)
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Packed.NoobyProtect.M suspicious
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Alibaba	Backdoor:Win32/Lotok.39f2ce56
Rising	Trojan.Generic@AI.98 (RDML:YjwgqFFQVg8gtBl8vEIXtw)
Trapmine	malicious.high.ml.score
Sophos	Generic ML PUA (PUA)
Ikarus	PUA.NoobyProtect
Webroot	W32.Adware.Gen
Avira	HEUR/AGEN.1237427
Antiy-AVL	GrayWare/Win32.Safeguard.a
Gridinsoft	Trojan.Heur!.03010021
Google	Detected
AhnLab-V3	Trojan/Win.Leonem.C5391929
MAX	malware (ai score=80)
Cylance	unsafe
TrendMicro-HouseCall	TROJ_FRS.VSNTC723
Tencent	Win32.Backdoor.Lotok.Zylw
SentinelOne	Static AI - Malicious PE

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

103.127.83.43:8225

zmp2.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All