Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	March 29, 2023, 10:35 a.m.	March 29, 2023, 10:37 a.m.

Size	1.6MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`147ca2fb0887fd3d38afae9c02b5ca11`
SHA256	`2270054b492c4e73a3f1e68c0cae972c82d18a96d9962b050798ba53d231b41b`
CRC32	`7BFE2957`
ssdeep	`49152:C7tJ7tyPgz94RBcwBd9DW653ADCONzwZVBYw7i+:C7tJ8PgMyw5S653D+MXSwG+`
Yara	UPX_Zero - UPX packed file IsPE32 - (no description) PE_Header_Zero - PE File Signature

2023.03.28-000125689.exe "C:\Users\test22\AppData\Local\Temp\2023.03.28-000125689.exe"
3020

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 29, 2023, 10:35 a.m.			0	0
IsDebuggerPresent March 29, 2023, 10:35 a.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (5 events)

section	\x00
section	.idata
section
section	upbczvhn
section	niplqgdr

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

TEXTINCLUDE

One or more processes crashed (50 out of 125 events)

Time & API	Arguments	Status
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x774a9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x774a9ea5 exception.instruction_r: fb e9 4e 01 00 00 60 8b 74 24 24 8b 7c 24 28 fc exception.symbol: 2023+0x2eb0b9 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 3059897 exception.address: 0x6eb0b9 registers.esp: 1638276 registers.edi: 0 registers.eax: 1 registers.ebp: 1638292 registers.edx: 8589312 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 51 b9 63 19 ae 16 e9 bc 01 00 00 81 c7 04 00 exception.symbol: 2023+0xc7ecc exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 818892 exception.address: 0x4c7ecc registers.esp: 1638240 registers.edi: 1961296104 registers.eax: 25751 registers.ebp: 3887226900 registers.edx: 4194304 registers.ebx: 3 registers.esi: 5013025 registers.ecx: 1961492480	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 68 bb 16 00 00 ff 34 24 ff 34 24 ff 34 24 5f exception.symbol: 2023+0xc86f4 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 820980 exception.address: 0x4c86f4 registers.esp: 1638244 registers.edi: 1961296104 registers.eax: 25751 registers.ebp: 3887226900 registers.edx: 4194304 registers.ebx: 3 registers.esi: 5038776 registers.ecx: 1961492480	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb ba 9e 2f ae 10 50 89 14 24 e9 62 ff ff ff 81 exception.symbol: 2023+0xc803f exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 819263 exception.address: 0x4c803f registers.esp: 1638244 registers.edi: 0 registers.eax: 25751 registers.ebp: 3887226900 registers.edx: 4194304 registers.ebx: 230633 registers.esi: 5015500 registers.ecx: 1961492480	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 52 e9 db 04 00 00 5c 5a 55 68 42 03 90 33 5d exception.symbol: 2023+0xc8c48 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 822344 exception.address: 0x4c8c48 registers.esp: 1638240 registers.edi: 0 registers.eax: 31328 registers.ebp: 3887226900 registers.edx: 279850910 registers.ebx: 432452356 registers.esi: 5015500 registers.ecx: 5016640	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 52 ba 00 67 5a 24 52 83 ec 04 89 0c 24 b9 dd exception.symbol: 2023+0xc92c0 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 824000 exception.address: 0x4c92c0 registers.esp: 1638244 registers.edi: 4294938872 registers.eax: 31328 registers.ebp: 3887226900 registers.edx: 279850910 registers.ebx: 1259 registers.esi: 5015500 registers.ecx: 5047968	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb e9 cd 01 00 00 89 3c 24 56 53 bb dc 41 75 69 exception.symbol: 2023+0x21d0a2 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2216098 exception.address: 0x61d0a2 registers.esp: 1638240 registers.edi: 5048088 registers.eax: 30791 registers.ebp: 3887226900 registers.edx: 2345 registers.ebx: 774144 registers.esi: 6410244 registers.ecx: 490653764	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 29 db 68 25 44 00 00 89 14 24 89 da 56 e9 f1 exception.symbol: 2023+0x21d130 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2216240 exception.address: 0x61d130 registers.esp: 1638244 registers.edi: 5048088 registers.eax: 30791 registers.ebp: 3887226900 registers.edx: 2345 registers.ebx: 774144 registers.esi: 6441035 registers.ecx: 490653764	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 57 89 0c 24 89 3c 24 bf 87 15 f2 54 53 e9 8f exception.symbol: 2023+0x21da92 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2218642 exception.address: 0x61da92 registers.esp: 1638244 registers.edi: 5048088 registers.eax: 30791 registers.ebp: 3887226900 registers.edx: 2345 registers.ebx: 4294939688 registers.esi: 6441035 registers.ecx: 19177	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb e9 ec 03 00 00 f7 d2 e9 e8 f6 ff ff 29 f0 2d exception.symbol: 2023+0x222823 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2238499 exception.address: 0x622823 registers.esp: 1638240 registers.edi: 0 registers.eax: 30326 registers.ebp: 3887226900 registers.edx: 6430416 registers.ebx: 6427924 registers.esi: 0 registers.ecx: 0	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 68 3f 1a 00 00 ff 34 24 ff 34 24 5f 50 54 58 exception.symbol: 2023+0x2221f5 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2236917 exception.address: 0x6221f5 registers.esp: 1638244 registers.edi: 0 registers.eax: 30326 registers.ebp: 3887226900 registers.edx: 6460742 registers.ebx: 6427924 registers.esi: 0 registers.ecx: 0	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 68 49 15 00 00 89 3c 24 68 78 6c 00 00 89 34 exception.symbol: 2023+0x221f26 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2236198 exception.address: 0x621f26 registers.esp: 1638244 registers.edi: 0 registers.eax: 30326 registers.ebp: 3887226900 registers.edx: 6433866 registers.ebx: 6427924 registers.esi: 7323752 registers.ecx: 0	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb e9 17 01 00 00 81 f2 a5 d0 b6 a7 89 d7 5a 21 exception.symbol: 2023+0x22344f exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2241615 exception.address: 0x62344f registers.esp: 1638240 registers.edi: 0 registers.eax: 6434311 registers.ebp: 3887226900 registers.edx: 6433866 registers.ebx: 6427924 registers.esi: 7323752 registers.ecx: 875316418	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 83 ec 04 89 14 24 52 89 0c 24 e9 e2 01 00 00 exception.symbol: 2023+0x223130 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2240816 exception.address: 0x623130 registers.esp: 1638244 registers.edi: 0 registers.eax: 6462919 registers.ebp: 3887226900 registers.edx: 6433866 registers.ebx: 6427924 registers.esi: 7323752 registers.ecx: 875316418	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb ba bd 65 bf 74 e9 57 02 00 00 33 2c 24 e9 25 exception.symbol: 2023+0x2233ad exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2241453 exception.address: 0x6233ad registers.esp: 1638244 registers.edi: 0 registers.eax: 6437247 registers.ebp: 3887226900 registers.edx: 1259 registers.ebx: 6427924 registers.esi: 0 registers.ecx: 875316418	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 56 e9 7b 00 00 00 5f 55 exception.symbol: 2023+0x229b48 exception.instruction: in eax, dx exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2267976 exception.address: 0x629b48 registers.esp: 1638236 registers.edi: 8990430 registers.eax: 1447909480 registers.ebp: 3887226900 registers.edx: 22104 registers.ebx: 1961431221 registers.esi: 6461093 registers.ecx: 20	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: 0f 3f 07 0b 64 8f 05 00 00 00 00 83 c4 04 83 fb exception.symbol: 2023+0x22c7fc exception.address: 0x62c7fc exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc000001d exception.offset: 2279420 registers.esp: 1638236 registers.edi: 8990430 registers.eax: 1 registers.ebp: 3887226900 registers.edx: 22104 registers.ebx: 0 registers.esi: 6461093 registers.ecx: 20	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: ed 81 fb 68 58 4d 56 75 0a c7 85 cd 28 9a 18 01 exception.symbol: 2023+0x22b6d6 exception.instruction: in eax, dx exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2275030 exception.address: 0x62b6d6 registers.esp: 1638236 registers.edi: 8990430 registers.eax: 1447909480 registers.ebp: 3887226900 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 6461093 registers.ecx: 10	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 51 89 2c 24 bd dd 63 de 24 81 e5 fb 10 e3 04 exception.symbol: 2023+0x23002e exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2293806 exception.address: 0x63002e registers.esp: 1638240 registers.edi: 8990430 registers.eax: 31459 registers.ebp: 3887226900 registers.edx: 6488020 registers.ebx: 62475406 registers.esi: 10 registers.ecx: 3023437824	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb e9 87 01 00 00 81 e6 a3 48 57 7c 55 bd 22 7e exception.symbol: 2023+0x23093e exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2296126 exception.address: 0x63093e registers.esp: 1638244 registers.edi: 283664480 registers.eax: 31459 registers.ebp: 3887226900 registers.edx: 6491723 registers.ebx: 62475406 registers.esi: 0 registers.ecx: 3023437824	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: cd 01 eb 00 6a 00 52 e8 03 00 00 00 20 5a c3 5a exception.symbol: 2023+0x23109c exception.instruction: int 1 exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000005 exception.offset: 2298012 exception.address: 0x63109c registers.esp: 1638204 registers.edi: 0 registers.eax: 1638204 registers.ebp: 3887226900 registers.edx: 25659 registers.ebx: 6492572 registers.esi: 4076010104 registers.ecx: 9507	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 81 c1 c4 70 ba 62 81 e9 d8 3d 50 5a 81 c1 cf exception.symbol: 2023+0x23afb8 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2338744 exception.address: 0x63afb8 registers.esp: 1638240 registers.edi: 5007626 registers.eax: 31670 registers.ebp: 3887226900 registers.edx: 6 registers.ebx: 62475628 registers.esi: 1961366544 registers.ecx: 6531817	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 31 d2 ff 34 0a ff 34 24 8b 3c 24 e9 41 01 00 exception.symbol: 2023+0x23b0a8 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2338984 exception.address: 0x63b0a8 registers.esp: 1638244 registers.edi: 5007626 registers.eax: 31670 registers.ebp: 3887226900 registers.edx: 6 registers.ebx: 62475628 registers.esi: 1961366544 registers.ecx: 6563487	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 57 e9 bf 01 00 00 56 e9 e7 01 00 00 58 81 ec exception.symbol: 2023+0x23ac59 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2337881 exception.address: 0x63ac59 registers.esp: 1638244 registers.edi: 322689 registers.eax: 31670 registers.ebp: 3887226900 registers.edx: 4294938648 registers.ebx: 62475628 registers.esi: 1961366544 registers.ecx: 6563487	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 81 c1 3b 1b a6 05 03 0c 24 57 bf 16 61 9f 57 exception.symbol: 2023+0x23bc71 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2342001 exception.address: 0x63bc71 registers.esp: 1638240 registers.edi: 322689 registers.eax: 29212 registers.ebp: 3887226900 registers.edx: 4294938648 registers.ebx: 431445265 registers.esi: 1961366544 registers.ecx: 6535079	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 68 00 00 00 00 ff 34 24 8b 14 24 81 c4 04 00 exception.symbol: 2023+0x23bc16 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2341910 exception.address: 0x63bc16 registers.esp: 1638244 registers.edi: 322689 registers.eax: 29212 registers.ebp: 3887226900 registers.edx: 4294938648 registers.ebx: 431445265 registers.esi: 1961366544 registers.ecx: 6564291	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb e9 6a fc ff ff 01 f5 51 56 be c3 51 8f 2a 89 exception.symbol: 2023+0x23bce9 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2342121 exception.address: 0x63bce9 registers.esp: 1638244 registers.edi: 262633 registers.eax: 29212 registers.ebp: 3887226900 registers.edx: 4294940456 registers.ebx: 431445265 registers.esi: 1961366544 registers.ecx: 6564291	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb e9 22 07 00 00 5a e9 db 01 00 00 83 ec 04 89 exception.symbol: 2023+0x240f28 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2363176 exception.address: 0x640f28 registers.esp: 1638236 registers.edi: 262633 registers.eax: 30752 registers.ebp: 3887226900 registers.edx: 272662422 registers.ebx: 277111585 registers.esi: 1968179844 registers.ecx: 6587287	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 68 44 38 83 06 ff 34 24 e9 2c fc ff ff 81 ec exception.symbol: 2023+0x240f53 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2363219 exception.address: 0x640f53 registers.esp: 1638236 registers.edi: 262633 registers.eax: 30752 registers.ebp: 3887226900 registers.edx: 0 registers.ebx: 277111585 registers.esi: 605325655 registers.ecx: 6559347	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb e9 ac fd ff ff 81 c5 04 00 00 00 87 2c 24 e9 exception.symbol: 2023+0x241ec8 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2367176 exception.address: 0x641ec8 registers.esp: 1638236 registers.edi: 262633 registers.eax: 25239 registers.ebp: 3887226900 registers.edx: 0 registers.ebx: 1057469776 registers.esi: 605325655 registers.ecx: 6584809	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 83 ec 04 89 34 24 68 47 28 0c 54 e9 3d 00 00 exception.symbol: 2023+0x2418f2 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2365682 exception.address: 0x6418f2 registers.esp: 1638236 registers.edi: 0 registers.eax: 25239 registers.ebp: 3887226900 registers.edx: 65001 registers.ebx: 1057469776 registers.esi: 605325655 registers.ecx: 6562201	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 68 65 7e 00 00 89 34 24 57 bf 5e 02 c6 0b e9 exception.symbol: 2023+0x24e2e6 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2417382 exception.address: 0x64e2e6 registers.esp: 1638232 registers.edi: 1325437200 registers.eax: 29278 registers.ebp: 3887226900 registers.edx: 6605698 registers.ebx: 6605698 registers.esi: 5016349 registers.ecx: 6610839	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 51 e9 24 02 00 00 f7 d7 e9 fa 04 00 00 5d 68 exception.symbol: 2023+0x24e33f exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2417471 exception.address: 0x64e33f registers.esp: 1638236 registers.edi: 1325437200 registers.eax: 7657 registers.ebp: 3887226900 registers.edx: 4294940644 registers.ebx: 6605698 registers.esi: 5016349 registers.ecx: 6640117	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 51 68 b6 2f 17 7b 59 e9 9a 04 00 00 89 e2 e9 exception.symbol: 2023+0x260c2f exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2493487 exception.address: 0x660c2f registers.esp: 1638204 registers.edi: 6681962 registers.eax: 25413 registers.ebp: 3887226900 registers.edx: 2130566132 registers.ebx: 4294944668 registers.esi: 6711937 registers.ecx: 1342204512	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 51 b9 c1 35 4f 4a 51 b9 ac 44 b3 7d 01 cf 59 exception.symbol: 2023+0x2626f6 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2500342 exception.address: 0x6626f6 registers.esp: 1638200 registers.edi: 6691606 registers.eax: 32768 registers.ebp: 3887226900 registers.edx: 2130566132 registers.ebx: 1468867711 registers.esi: 507836444 registers.ecx: 1971924092	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb e9 a0 f8 ff ff 57 bf 70 3a d0 52 e9 98 f6 ff exception.symbol: 2023+0x2625f1 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2500081 exception.address: 0x6625f1 registers.esp: 1638204 registers.edi: 6724374 registers.eax: 32768 registers.ebp: 3887226900 registers.edx: 4294937668 registers.ebx: 1375758944 registers.esi: 507836444 registers.ecx: 1971924092	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 83 ec 04 89 14 24 54 5a 51 e9 bd f7 ff ff 01 exception.symbol: 2023+0x263645 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2504261 exception.address: 0x663645 registers.esp: 1638204 registers.edi: 6699303 registers.eax: 44777 registers.ebp: 3887226900 registers.edx: 2130566132 registers.ebx: 13468 registers.esi: 0 registers.ecx: 0	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb e9 89 f7 ff ff 58 81 ef f1 11 e5 63 53 51 e9 exception.symbol: 2023+0x264d97 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2510231 exception.address: 0x664d97 registers.esp: 1638204 registers.edi: 6731774 registers.eax: 36585 registers.ebp: 3887226900 registers.edx: 2130566132 registers.ebx: 956266117 registers.esi: 4294941000 registers.ecx: 1971924092	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 68 3f 50 00 00 89 3c 24 68 c4 20 8a 03 8b 3c exception.symbol: 2023+0x268871 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2525297 exception.address: 0x668871 registers.esp: 1638204 registers.edi: 0 registers.eax: 4294937316 registers.ebp: 3887226900 registers.edx: 2130566132 registers.ebx: 6752025 registers.esi: 4294941000 registers.ecx: 100073	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 83 ec 04 89 2c 24 bd 60 34 8c 4b e9 f6 02 00 exception.symbol: 2023+0x269b6d exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2530157 exception.address: 0x669b6d registers.esp: 1638200 registers.edi: 6723245 registers.eax: 31937 registers.ebp: 3887226900 registers.edx: 2130565922 registers.ebx: 6723843 registers.esi: 958160863 registers.ecx: 17408	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb e9 14 06 00 00 fb 83 ec 04 89 2c 24 bd 60 34 exception.symbol: 2023+0x269b67 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2530151 exception.address: 0x669b67 registers.esp: 1638204 registers.edi: 6723245 registers.eax: 31937 registers.ebp: 3887226900 registers.edx: 2130565922 registers.ebx: 6755780 registers.esi: 958160863 registers.ecx: 17408	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 68 68 5a 00 00 89 14 24 e9 6c fe ff ff 52 e9 exception.symbol: 2023+0x269fee exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2531310 exception.address: 0x669fee registers.esp: 1638204 registers.edi: 6723245 registers.eax: 31937 registers.ebp: 3887226900 registers.edx: 1149799821 registers.ebx: 6755780 registers.esi: 4294938072 registers.ecx: 17408	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 50 e9 e9 00 00 00 05 84 a1 ba 3a 01 c2 58 e9 exception.symbol: 2023+0x26a8ba exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2533562 exception.address: 0x66a8ba registers.esp: 1638200 registers.edi: 6697939 registers.eax: 27349 registers.ebp: 3887226900 registers.edx: 2130566132 registers.ebx: 6727046 registers.esi: 4399104 registers.ecx: 1971924092	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 31 f6 ff 34 33 81 04 24 30 6b 82 19 ff 34 24 exception.symbol: 2023+0x26ae52 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2534994 exception.address: 0x66ae52 registers.esp: 1638204 registers.edi: 6697939 registers.eax: 27349 registers.ebp: 3887226900 registers.edx: 2130566132 registers.ebx: 6754395 registers.esi: 4399104 registers.ecx: 1971924092	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 51 81 ec 04 00 00 00 89 2c 24 68 5b 47 1e 04 exception.symbol: 2023+0x26ae28 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2534952 exception.address: 0x66ae28 registers.esp: 1638204 registers.edi: 81129 registers.eax: 27349 registers.ebp: 3887226900 registers.edx: 2130566132 registers.ebx: 6754395 registers.esi: 4294942500 registers.ecx: 1971924092	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 51 68 dc 6e 9e 2b ff 34 24 59 56 89 e6 81 c6 exception.symbol: 2023+0x27250f exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2565391 exception.address: 0x67250f registers.esp: 1638200 registers.edi: 81129 registers.eax: 27188 registers.ebp: 3887226900 registers.edx: 2130566132 registers.ebx: 6757589 registers.esi: 2001271517 registers.ecx: 3023437824	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 56 55 57 bf 66 05 cf 15 4f 47 81 ef 4c 83 f8 exception.symbol: 2023+0x271dea exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2563562 exception.address: 0x671dea registers.esp: 1638204 registers.edi: 81129 registers.eax: 4294943032 registers.ebp: 3887226900 registers.edx: 2130566132 registers.ebx: 6784777 registers.esi: 2001271517 registers.ecx: 3370945933	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 81 c6 33 51 50 61 57 bf 4c 6d ac 37 e9 00 00 exception.symbol: 2023+0x27d826 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2611238 exception.address: 0x67d826 registers.esp: 1638200 registers.edi: 6788492 registers.eax: 30943 registers.ebp: 3887226900 registers.edx: 2130566132 registers.ebx: 1970536422 registers.esi: 6802920 registers.ecx: 0	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 68 42 28 00 00 e9 aa fc ff ff 5e 55 e9 26 fd exception.symbol: 2023+0x27d5a5 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2610597 exception.address: 0x67d5a5 registers.esp: 1638204 registers.edi: 6788492 registers.eax: 30943 registers.ebp: 3887226900 registers.edx: 2130566132 registers.ebx: 1970536422 registers.esi: 6833863 registers.ecx: 0	1
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: fb 56 be d4 1a 94 76 55 89 f5 89 e9 8b 2c 24 81 exception.symbol: 2023+0x27d0e1 exception.instruction: sti exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2609377 exception.address: 0x67d0e1 registers.esp: 1638204 registers.edi: 6788492 registers.eax: 0 registers.ebp: 3887226900 registers.edx: 2130566132 registers.ebx: 2045349261 registers.esi: 6805823 registers.ecx: 0	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (20 events)

Time & API	Arguments	Status
NtProtectVirtualMemory March 29, 2023, 10:35 a.m.	process_identifier: 3020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7750f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 10:35 a.m.	process_identifier: 3020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x77480000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 10:35 a.m.	process_identifier: 3020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 331776 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:35 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x042a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:35 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04340000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:35 a.m.	process_identifier: 3020 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04350000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:35 a.m.	process_identifier: 3020 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04360000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:35 a.m.	process_identifier: 3020 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04370000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:35 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04370000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:35 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04370000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:35 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04370000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:35 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04370000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:35 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04370000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:35 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04370000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:35 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04370000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:35 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04370000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:35 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04370000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:35 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04370000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 29, 2023, 10:35 a.m.	process_identifier: 3020 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04370000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 29, 2023, 10:35 a.m.	process_identifier: 3020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74222000 process_handle: 0xffffffff	1

Foreign language identified in PE resource (50 out of 51 events)

name

TEXTINCLUDE

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000bebc0

size

0x00000151

name

TEXTINCLUDE

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000bebc0

size

0x00000151

name

TEXTINCLUDE

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000bebc0

size

0x00000151

name

RT_CURSOR

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000bf0b0

size

0x000000b4

name

RT_CURSOR

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000bf0b0

size

0x000000b4

name

RT_CURSOR

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000bf0b0

size

0x000000b4

name

RT_CURSOR

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000bf0b0

size

0x000000b4

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c07b8

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c07b8

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c07b8

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c07b8

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c07b8

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c07b8

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c07b8

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c07b8

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c07b8

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c07b8

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c07b8

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c07b8

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c07b8

size

0x00000144

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c07b8

size

0x00000144

name

RT_MENU

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c1f38

size

0x00000284

name

RT_MENU

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c1f38

size

0x00000284

name

RT_DIALOG

language

LANG_CHINESE

filetype

empty

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c3180

size

0x0000018c

name

RT_DIALOG

language

LANG_CHINESE

filetype

empty

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c3180

size

0x0000018c

name

RT_DIALOG

language

LANG_CHINESE

filetype

empty

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c3180

size

0x0000018c

name

RT_DIALOG

language

LANG_CHINESE

filetype

empty

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c3180

size

0x0000018c

name

RT_DIALOG

language

LANG_CHINESE

filetype

empty

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c3180

size

0x0000018c

name

RT_DIALOG

language

LANG_CHINESE

filetype

empty

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c3180

size

0x0000018c

name

RT_DIALOG

language

LANG_CHINESE

filetype

empty

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c3180

size

0x0000018c

name

RT_DIALOG

language

LANG_CHINESE

filetype

empty

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c3180

size

0x0000018c

name

RT_DIALOG

language

LANG_CHINESE

filetype

empty

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c3180

size

0x0000018c

name

RT_DIALOG

language

LANG_CHINESE

filetype

empty

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c3180

size

0x0000018c

name

RT_STRING

language

LANG_CHINESE

filetype

empty

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c3bc8

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

filetype

empty

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c3bc8

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

filetype

empty

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c3bc8

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

filetype

empty

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c3bc8

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

filetype

empty

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c3bc8

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

filetype

empty

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c3bc8

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

filetype

empty

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c3bc8

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

filetype

empty

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c3bc8

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

filetype

empty

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c3bc8

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

filetype

empty

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c3bc8

size

0x00000024

name

RT_STRING

language

LANG_CHINESE

filetype

empty

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c3bc8

size

0x00000024

name

RT_GROUP_CURSOR

language

LANG_CHINESE

filetype

empty

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c3c14

size

0x00000022

name

RT_GROUP_CURSOR

language

LANG_CHINESE

filetype

empty

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c3c14

size

0x00000022

name

RT_GROUP_CURSOR

language

LANG_CHINESE

filetype

empty

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000c3c14

size

0x00000022

name

RT_GROUP_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x004300fa

size

0x00000014

name

RT_GROUP_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x004300fa

size

0x00000014

name

RT_GROUP_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x004300fa

size

0x00000014

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\2023.03.28-000125689.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\2023.03.28-000125689.exe

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (8 events)

Time & API	Arguments	Status	Return
Process32NextW March 29, 2023, 10:35 a.m.	snapshot_handle: 0x000001ec process_name: mobsync.exe process_identifier: 2444	1	1
Process32NextW March 29, 2023, 10:35 a.m.	snapshot_handle: 0x000001ec process_name: tvnserver.exe process_identifier: 2584	1	1
Process32NextW March 29, 2023, 10:35 a.m.	snapshot_handle: 0x000001ec process_name: tvnserver.exe process_identifier: 2660	1	1
Process32NextW March 29, 2023, 10:35 a.m.	snapshot_handle: 0x000001ec process_name: pw.exe process_identifier: 2692	1	1
Process32NextW March 29, 2023, 10:35 a.m.	snapshot_handle: 0x000001ec process_name: cmd.exe process_identifier: 2948	1	1
Process32NextW March 29, 2023, 10:35 a.m.	snapshot_handle: 0x000001ec process_name: conhost.exe process_identifier: 2956	1	1
Process32NextW March 29, 2023, 10:35 a.m.	snapshot_handle: 0x000001ec process_name: 2023.03.28-000125689.exe process_identifier: 3020	1	1
Process32NextW March 29, 2023, 10:35 a.m.	snapshot_handle: 0x000001ec process_name: pw.exe process_identifier: 3040	1	1

The binary likely contains encrypted or compressed data indicative of a packer (4 events)

section

{u'size_of_data': u'0x00051000', u'virtual_address': u'0x00001000', u'entropy': 7.981002741728273, u'name': u' \\x00 ', u'virtual_size': u'0x000bd000'}

entropy

7.98100274173

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00146000', u'virtual_address': u'0x002eb000', u'entropy': 7.947455212850124, u'name': u'upbczvhn', u'virtual_size': u'0x00146000'}

entropy

7.94745521285

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00001000', u'virtual_address': u'0x00431000', u'entropy': 7.850369017963889, u'name': u'niplqgdr', u'virtual_size': u'0x00001000'}

entropy

7.85036901796

description

A section with a high entropy has been found

entropy

0.985507246377

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 event)

process

system

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: ff1705151c831c4cfb94f418f7321c598cf1e16f

Checks for the presence of known devices from debuggers and forensic tools (3 events)

file	\??\SICE
file	\??\SIWVID
file	\??\NTICE

Checks for the presence of known windows from debuggers and forensic tools (20 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA March 29, 2023, 10:35 a.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA March 29, 2023, 10:35 a.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA March 29, 2023, 10:35 a.m.	class_name: pediy06 window_name:		0	0
FindWindowA March 29, 2023, 10:35 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA March 29, 2023, 10:35 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA March 29, 2023, 10:35 a.m.	class_name: #0 window_name: File Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA March 29, 2023, 10:35 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA March 29, 2023, 10:35 a.m.	class_name: #0 window_name: Process Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA March 29, 2023, 10:35 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA March 29, 2023, 10:35 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA March 29, 2023, 10:35 a.m.	class_name: #0 window_name: Registry Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA March 29, 2023, 10:35 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA March 29, 2023, 10:35 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA March 29, 2023, 10:35 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA March 29, 2023, 10:35 a.m.	class_name: #0 window_name: File Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA March 29, 2023, 10:35 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA March 29, 2023, 10:35 a.m.	class_name: #0 window_name: Process Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA March 29, 2023, 10:35 a.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA March 29, 2023, 10:35 a.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA March 29, 2023, 10:35 a.m.	class_name: pediy06 window_name:		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Detects VirtualBox through the presence of a registry key (1 event)

registry

HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ March 29, 2023, 10:35 a.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 56 e9 7b 00 00 00 5f 55 exception.symbol: 2023+0x229b48 exception.instruction: in eax, dx exception.module: 2023.03.28-000125689.exe exception.exception_code: 0xc0000096 exception.offset: 2267976 exception.address: 0x629b48 registers.esp: 1638236 registers.edi: 8990430 registers.eax: 1447909480 registers.ebp: 3887226900 registers.edx: 22104 registers.ebx: 1961431221 registers.esi: 6461093 registers.ecx: 20	1	0	0

Detects the presence of Wine emulator (1 event)

registry

HKEY_CURRENT_USER\Software\Wine

File has been identified by 27 AntiVirus engines on VirusTotal as malicious (27 events)

Bkav	W32.AIDetectNet.01
tehtris	Generic.Malware
FireEye	Generic.mg.147ca2fb0887fd3d
Malwarebytes	Trojan.Agent.Generic
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
K7GW	Trojan ( 004eb1bf1 )
K7AntiVirus	Trojan ( 004eb1bf1 )
BitDefenderTheta	Gen:NN.ZexaF.36344.Nz1aaK8TDMob
Cyren	W32/FlyAgent.D.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Packed.Themida.HEK
Cynet	Malicious (score: 100)
APEX	Malicious
Sophos	Generic ML PUA (PUA)
McAfee-GW-Edition	BehavesLike.Win32.Generic.tc
Trapmine	suspicious.low.ml.score
SentinelOne	Static AI - Suspicious PE
Gridinsoft	Trojan.Heur!.030120A1
Microsoft	Trojan:Win32/Wacatac.B!ml
Google	Detected
Acronis	suspicious
Cylance	unsafe
Zoner	Probably Heur.ExeHeaderL
Rising	Trojan.Generic@AI.98 (RDML:4WjpE2c7NHWdtGFy/V3ekg)
Ikarus	Trojan.Crypt

2023.03.28-000125689.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All