Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 10, 2023, 10:47 a.m.	March 10, 2023, 10:52 a.m.

Size	1.3MB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`d9e7186fb49d75774327df10b2df2dfe`
SHA256	`231ef19528c94c50a19d4669f1446fd41117f7e94b6dcd2ac68643ab7b745847`
CRC32	`77382C35`
ssdeep	`24576:sQ6c51ZE/sGM/6e/+ctUB9c9axgFOHQd4eQcZsGMMTMZ/f6le2:D6c7PGM/6CUBOMxgIU4FcZTTU/Cl`
Yara	UPX_Zero - UPX packed file Network_Downloader - File Downloader IsPE32 - (no description) PE_Header_Zero - PE File Signature

microsoftedge.exe "C:\Users\test22\AppData\Local\Temp\microsoftedge.exe"
2560

Name	Response	Post-Analysis Lookup
iplogger.org	A 148.251.234.83	148.251.234.83

IP Address	Status	Action
148.251.234.83	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
UDP 192.168.56.101:59002 -> 164.124.101.2:53	2035948	ET POLICY IP Check Domain (iplogger .org in DNS Lookup)	Potential Corporate Privacy Violation
TCP 192.168.56.101:49164 -> 148.251.234.83:443	2035949	ET POLICY IP Check Domain (iplogger .org in TLS SNI)	Potential Corporate Privacy Violation
TCP 192.168.56.101:49164 -> 148.251.234.83:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49164 -> 148.251.234.83:443	2035949	ET POLICY IP Check Domain (iplogger .org in TLS SNI)	Potential Corporate Privacy Violation
UDP 192.168.56.101:59002 -> 8.8.8.8:53	2035948	ET POLICY IP Check Domain (iplogger .org in DNS Lookup)	Potential Corporate Privacy Violation
TCP 148.251.234.83:443 -> 192.168.56.101:49166	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.101:49165 -> 148.251.234.83:443	2035949	ET POLICY IP Check Domain (iplogger .org in TLS SNI)	Potential Corporate Privacy Violation
TCP 192.168.56.101:49165 -> 148.251.234.83:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49165 -> 148.251.234.83:443	2035949	ET POLICY IP Check Domain (iplogger .org in TLS SNI)	Potential Corporate Privacy Violation
TCP 192.168.56.101:49165 -> 148.251.234.83:443	2035949	ET POLICY IP Check Domain (iplogger .org in TLS SNI)	Potential Corporate Privacy Violation
TCP 192.168.56.101:49165 -> 148.251.234.83:443	2035949	ET POLICY IP Check Domain (iplogger .org in TLS SNI)	Potential Corporate Privacy Violation
TCP 192.168.56.101:49164 -> 148.251.234.83:443	2035949	ET POLICY IP Check Domain (iplogger .org in TLS SNI)	Potential Corporate Privacy Violation

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA March 10, 2023, 10:47 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 10, 2023, 10:47 a.m.			0	0
IsDebuggerPresent March 10, 2023, 10:47 a.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

The executable uses a known packer (1 event)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (30 events)

Time & API	Arguments	Status
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1ed0d2 @ 0xadd0d2 microsoftedge+0x1e4021 @ 0xad4021 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x126300 exception.instruction: ud2 exception.module: microsoftedge.exe exception.exception_code: 0xc000001d exception.offset: 1204992 exception.address: 0xa16300 registers.esp: 4258488 registers.edi: 12333296 registers.eax: 0 registers.ebp: 4258516 registers.edx: 2 registers.ebx: 2934211287 registers.esi: 9809920 registers.ecx: 38090752	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1ed0d2 @ 0xadd0d2 microsoftedge+0x1e4021 @ 0xad4021 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x1262d5 exception.instruction: div eax exception.module: microsoftedge.exe exception.exception_code: 0xc0000094 exception.offset: 1204949 exception.address: 0xa162d5 registers.esp: 4258488 registers.edi: 4258488 registers.eax: 0 registers.ebp: 4258516 registers.edx: 0 registers.ebx: 10576662 registers.esi: 0 registers.ecx: 4258524	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1ed0d2 @ 0xadd0d2 microsoftedge+0x1e4021 @ 0xad4021 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x126300 exception.instruction: ud2 exception.module: microsoftedge.exe exception.exception_code: 0xc000001d exception.offset: 1204992 exception.address: 0xa16300 registers.esp: 4258488 registers.edi: 4258488 registers.eax: 0 registers.ebp: 4258516 registers.edx: 2 registers.ebx: 10576619 registers.esi: 0 registers.ecx: 4258524	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1ed0d2 @ 0xadd0d2 microsoftedge+0x1e4021 @ 0xad4021 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x126300 exception.instruction: ud2 exception.module: microsoftedge.exe exception.exception_code: 0xc000001d exception.offset: 1204992 exception.address: 0xa16300 registers.esp: 4258488 registers.edi: 4258488 registers.eax: 0 registers.ebp: 4258516 registers.edx: 2 registers.ebx: 10576662 registers.esi: 0 registers.ecx: 4258524	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1ed0d2 @ 0xadd0d2 microsoftedge+0x1e4021 @ 0xad4021 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x126300 exception.instruction: ud2 exception.module: microsoftedge.exe exception.exception_code: 0xc000001d exception.offset: 1204992 exception.address: 0xa16300 registers.esp: 4258488 registers.edi: 4258488 registers.eax: 0 registers.ebp: 4258516 registers.edx: 2 registers.ebx: 10576662 registers.esi: 0 registers.ecx: 4258524	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1ed0d2 @ 0xadd0d2 microsoftedge+0x1e4021 @ 0xad4021 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x1262d5 exception.instruction: div eax exception.module: microsoftedge.exe exception.exception_code: 0xc0000094 exception.offset: 1204949 exception.address: 0xa162d5 registers.esp: 4258488 registers.edi: 4258488 registers.eax: 0 registers.ebp: 4258516 registers.edx: 0 registers.ebx: 10576662 registers.esi: 0 registers.ecx: 4258524	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1ed0d2 @ 0xadd0d2 microsoftedge+0x1e4021 @ 0xad4021 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x1262d5 exception.instruction: div eax exception.module: microsoftedge.exe exception.exception_code: 0xc0000094 exception.offset: 1204949 exception.address: 0xa162d5 registers.esp: 4258488 registers.edi: 4258488 registers.eax: 0 registers.ebp: 4258516 registers.edx: 0 registers.ebx: 10576619 registers.esi: 0 registers.ecx: 4258524	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1e34a5 @ 0xad34a5 microsoftedge+0x1e4031 @ 0xad4031 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x1262d5 exception.instruction: div eax exception.module: microsoftedge.exe exception.exception_code: 0xc0000094 exception.offset: 1204949 exception.address: 0xa162d5 registers.esp: 4258416 registers.edi: 11125232 registers.eax: 0 registers.ebp: 4258444 registers.edx: 0 registers.ebx: 5615616 registers.esi: 9809920 registers.ecx: 9809920	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1e34a5 @ 0xad34a5 microsoftedge+0x1e4031 @ 0xad4031 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x126300 exception.instruction: ud2 exception.module: microsoftedge.exe exception.exception_code: 0xc000001d exception.offset: 1204992 exception.address: 0xa16300 registers.esp: 4258416 registers.edi: 4258416 registers.eax: 0 registers.ebp: 4258444 registers.edx: 2 registers.ebx: 10576619 registers.esi: 0 registers.ecx: 4258452	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1e34a5 @ 0xad34a5 microsoftedge+0x1e4031 @ 0xad4031 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x1262d5 exception.instruction: div eax exception.module: microsoftedge.exe exception.exception_code: 0xc0000094 exception.offset: 1204949 exception.address: 0xa162d5 registers.esp: 4258416 registers.edi: 4258416 registers.eax: 0 registers.ebp: 4258444 registers.edx: 0 registers.ebx: 10576662 registers.esi: 0 registers.ecx: 4258452	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1e34a5 @ 0xad34a5 microsoftedge+0x1e4031 @ 0xad4031 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x126300 exception.instruction: ud2 exception.module: microsoftedge.exe exception.exception_code: 0xc000001d exception.offset: 1204992 exception.address: 0xa16300 registers.esp: 4258416 registers.edi: 4258416 registers.eax: 0 registers.ebp: 4258444 registers.edx: 2 registers.ebx: 10576619 registers.esi: 0 registers.ecx: 4258452	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1e34a5 @ 0xad34a5 microsoftedge+0x1e4031 @ 0xad4031 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x1262d5 exception.instruction: div eax exception.module: microsoftedge.exe exception.exception_code: 0xc0000094 exception.offset: 1204949 exception.address: 0xa162d5 registers.esp: 4258416 registers.edi: 4258416 registers.eax: 0 registers.ebp: 4258444 registers.edx: 0 registers.ebx: 10576662 registers.esi: 0 registers.ecx: 4258452	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1e34a5 @ 0xad34a5 microsoftedge+0x1e4031 @ 0xad4031 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x126300 exception.instruction: ud2 exception.module: microsoftedge.exe exception.exception_code: 0xc000001d exception.offset: 1204992 exception.address: 0xa16300 registers.esp: 4258416 registers.edi: 4258416 registers.eax: 0 registers.ebp: 4258444 registers.edx: 2 registers.ebx: 10576619 registers.esi: 0 registers.ecx: 4258452	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1e34a5 @ 0xad34a5 microsoftedge+0x1e4031 @ 0xad4031 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x1262d5 exception.instruction: div eax exception.module: microsoftedge.exe exception.exception_code: 0xc0000094 exception.offset: 1204949 exception.address: 0xa162d5 registers.esp: 4258416 registers.edi: 4258416 registers.eax: 0 registers.ebp: 4258444 registers.edx: 0 registers.ebx: 10576662 registers.esi: 0 registers.ecx: 4258452	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1e34a5 @ 0xad34a5 microsoftedge+0x1e4031 @ 0xad4031 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x1262d5 exception.instruction: div eax exception.module: microsoftedge.exe exception.exception_code: 0xc0000094 exception.offset: 1204949 exception.address: 0xa162d5 registers.esp: 4258416 registers.edi: 4258416 registers.eax: 0 registers.ebp: 4258444 registers.edx: 0 registers.ebx: 10576619 registers.esi: 0 registers.ecx: 4258452	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1e34a5 @ 0xad34a5 microsoftedge+0x1e4031 @ 0xad4031 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x1262d5 exception.instruction: div eax exception.module: microsoftedge.exe exception.exception_code: 0xc0000094 exception.offset: 1204949 exception.address: 0xa162d5 registers.esp: 4258416 registers.edi: 4258416 registers.eax: 0 registers.ebp: 4258444 registers.edx: 0 registers.ebx: 10576619 registers.esi: 0 registers.ecx: 4258452	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1e3785 @ 0xad3785 microsoftedge+0x1e4031 @ 0xad4031 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x126300 exception.instruction: ud2 exception.module: microsoftedge.exe exception.exception_code: 0xc000001d exception.offset: 1204992 exception.address: 0xa16300 registers.esp: 4258416 registers.edi: 11125232 registers.eax: 0 registers.ebp: 4258444 registers.edx: 2 registers.ebx: 5615616 registers.esi: 9809920 registers.ecx: 3686321903	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1e3785 @ 0xad3785 microsoftedge+0x1e4031 @ 0xad4031 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x1262d5 exception.instruction: div eax exception.module: microsoftedge.exe exception.exception_code: 0xc0000094 exception.offset: 1204949 exception.address: 0xa162d5 registers.esp: 4258416 registers.edi: 4258416 registers.eax: 0 registers.ebp: 4258444 registers.edx: 0 registers.ebx: 10576662 registers.esi: 0 registers.ecx: 4258452	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1e38f2 @ 0xad38f2 microsoftedge+0x1e4031 @ 0xad4031 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x126300 exception.instruction: ud2 exception.module: microsoftedge.exe exception.exception_code: 0xc000001d exception.offset: 1204992 exception.address: 0xa16300 registers.esp: 4258416 registers.edi: 11125232 registers.eax: 0 registers.ebp: 4258444 registers.edx: 2 registers.ebx: 5615616 registers.esi: 9809920 registers.ecx: 4258444	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1e38f2 @ 0xad38f2 microsoftedge+0x1e4031 @ 0xad4031 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x1262d5 exception.instruction: div eax exception.module: microsoftedge.exe exception.exception_code: 0xc0000094 exception.offset: 1204949 exception.address: 0xa162d5 registers.esp: 4258416 registers.edi: 4258416 registers.eax: 0 registers.ebp: 4258444 registers.edx: 0 registers.ebx: 10576662 registers.esi: 0 registers.ecx: 4258452	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1e38f2 @ 0xad38f2 microsoftedge+0x1e4031 @ 0xad4031 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x1262d5 exception.instruction: div eax exception.module: microsoftedge.exe exception.exception_code: 0xc0000094 exception.offset: 1204949 exception.address: 0xa162d5 registers.esp: 4258416 registers.edi: 4258416 registers.eax: 0 registers.ebp: 4258444 registers.edx: 0 registers.ebx: 10576619 registers.esi: 0 registers.ecx: 4258452	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1e38f2 @ 0xad38f2 microsoftedge+0x1e4031 @ 0xad4031 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x1262d5 exception.instruction: div eax exception.module: microsoftedge.exe exception.exception_code: 0xc0000094 exception.offset: 1204949 exception.address: 0xa162d5 registers.esp: 4258416 registers.edi: 4258416 registers.eax: 0 registers.ebp: 4258444 registers.edx: 0 registers.ebx: 10576619 registers.esi: 0 registers.ecx: 4258452	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1e38f2 @ 0xad38f2 microsoftedge+0x1e4031 @ 0xad4031 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x126300 exception.instruction: ud2 exception.module: microsoftedge.exe exception.exception_code: 0xc000001d exception.offset: 1204992 exception.address: 0xa16300 registers.esp: 4258416 registers.edi: 4258416 registers.eax: 0 registers.ebp: 4258444 registers.edx: 2 registers.ebx: 10576619 registers.esi: 0 registers.ecx: 4258452	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1e38f2 @ 0xad38f2 microsoftedge+0x1e4031 @ 0xad4031 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x1262d5 exception.instruction: div eax exception.module: microsoftedge.exe exception.exception_code: 0xc0000094 exception.offset: 1204949 exception.address: 0xa162d5 registers.esp: 4258416 registers.edi: 4258416 registers.eax: 0 registers.ebp: 4258444 registers.edx: 0 registers.ebx: 10576662 registers.esi: 0 registers.ecx: 4258452	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1e38f2 @ 0xad38f2 microsoftedge+0x1e4031 @ 0xad4031 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x126300 exception.instruction: ud2 exception.module: microsoftedge.exe exception.exception_code: 0xc000001d exception.offset: 1204992 exception.address: 0xa16300 registers.esp: 4258416 registers.edi: 4258416 registers.eax: 0 registers.ebp: 4258444 registers.edx: 2 registers.ebx: 10576619 registers.esi: 0 registers.ecx: 4258452	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1e3ad1 @ 0xad3ad1 microsoftedge+0x1e4031 @ 0xad4031 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x1262d5 exception.instruction: div eax exception.module: microsoftedge.exe exception.exception_code: 0xc0000094 exception.offset: 1204949 exception.address: 0xa162d5 registers.esp: 4258416 registers.edi: 11125232 registers.eax: 0 registers.ebp: 4258444 registers.edx: 0 registers.ebx: 5615616 registers.esi: 9809920 registers.ecx: 2742534263	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1e3bca @ 0xad3bca microsoftedge+0x1e4031 @ 0xad4031 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x126300 exception.instruction: ud2 exception.module: microsoftedge.exe exception.exception_code: 0xc000001d exception.offset: 1204992 exception.address: 0xa16300 registers.esp: 4258416 registers.edi: 11125232 registers.eax: 0 registers.ebp: 4258444 registers.edx: 2 registers.ebx: 5615616 registers.esi: 9809920 registers.ecx: 2334387162	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1e3bca @ 0xad3bca microsoftedge+0x1e4031 @ 0xad4031 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x126300 exception.instruction: ud2 exception.module: microsoftedge.exe exception.exception_code: 0xc000001d exception.offset: 1204992 exception.address: 0xa16300 registers.esp: 4258416 registers.edi: 4258416 registers.eax: 0 registers.ebp: 4258444 registers.edx: 2 registers.ebx: 10576662 registers.esi: 0 registers.ecx: 4258452	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1e3bca @ 0xad3bca microsoftedge+0x1e4031 @ 0xad4031 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x126300 exception.instruction: ud2 exception.module: microsoftedge.exe exception.exception_code: 0xc000001d exception.offset: 1204992 exception.address: 0xa16300 registers.esp: 4258416 registers.edi: 4258416 registers.eax: 0 registers.ebp: 4258444 registers.edx: 2 registers.ebx: 10576662 registers.esi: 0 registers.ecx: 4258452	1
__exception__ March 10, 2023, 10:47 a.m.	stacktrace: microsoftedge+0x1e3bca @ 0xad3bca microsoftedge+0x1e4031 @ 0xad4031 microsoftedge+0x2d2295 @ 0xbc2295 exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: microsoftedge+0x1262d5 exception.instruction: div eax exception.module: microsoftedge.exe exception.exception_code: 0xc0000094 exception.offset: 1204949 exception.address: 0xa162d5 registers.esp: 4258416 registers.edi: 4258416 registers.eax: 0 registers.ebp: 4258444 registers.edx: 0 registers.ebx: 10576662 registers.esi: 0 registers.ecx: 4258452	1

Performs some HTTP requests (1 event)

request

GET http://iplogger.org/1wDnb7

Allocates read-write-execute memory (usually to unpack itself) (21 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 10, 2023, 10:47 a.m.	process_identifier: 2560 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02290000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2023, 10:47 a.m.	process_identifier: 2560 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02420000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2023, 10:47 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2023, 10:47 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02600000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2023, 10:47 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02610000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2023, 10:47 a.m.	process_identifier: 2560 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02424000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2023, 10:47 a.m.	process_identifier: 2560 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02434000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2023, 10:47 a.m.	process_identifier: 2560 region_size: 147456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02434000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2023, 10:47 a.m.	process_identifier: 2560 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02454000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2023, 10:47 a.m.	process_identifier: 2560 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02464000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2023, 10:47 a.m.	process_identifier: 2560 region_size: 114688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02464000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2023, 10:47 a.m.	process_identifier: 2560 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02464000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2023, 10:47 a.m.	process_identifier: 2560 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02468000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2023, 10:47 a.m.	process_identifier: 2560 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02480000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2023, 10:47 a.m.	process_identifier: 2560 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02480000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2023, 10:47 a.m.	process_identifier: 2560 region_size: 163840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02480000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2023, 10:47 a.m.	process_identifier: 2560 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02480000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2023, 10:47 a.m.	process_identifier: 2560 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02480000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2023, 10:47 a.m.	process_identifier: 2560 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02480000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2023, 10:47 a.m.	process_identifier: 2560 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02480000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2023, 10:47 a.m.	process_identifier: 2560 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02484000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (7 events)

section

{u'size_of_data': u'0x00027400', u'virtual_address': u'0x00001000', u'entropy': 7.997883606315596, u'name': u'', u'virtual_size': u'0x0004e000'}

entropy

7.99788360632

description