Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 18, 2023, 7:41 a.m.	Sept. 18, 2023, 7:43 a.m.

Size	1.1MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`87243804ebf481b95392b3ec64774297`
SHA256	`bf9c7574e3ca23a96e317b42385aee11a982ab20649a6954d507e9c76b4044b5`
CRC32	`22AE3EFD`
ssdeep	`24576:e8JiMsfQ2FsbQM9ULXwbZnr9UbjAyFEHn7h98ll2cXVuF0wG1oVNMzV:emTRMM9WXwlr9TyyHnE/2cXVborMx`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Is_DotNET_EXE - (no description)

Archevod_XWorm.exe "C:\Users\test22\AppData\Local\Temp\Archevod_XWorm.exe"
1952

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (5 events)

Time & API	Arguments	Status	Return
GetComputerNameA Sept. 18, 2023, 7:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2023, 7:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2023, 7:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 18, 2023, 7:41 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 18, 2023, 7:41 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 18, 2023, 7:41 a.m.			0	0
IsDebuggerPresent Sept. 18, 2023, 7:41 a.m.			0	0
IsDebuggerPresent Sept. 18, 2023, 7:41 a.m.			0	0
IsDebuggerPresent Sept. 18, 2023, 7:41 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 18, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c130a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c130e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 7:41 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c130e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section
section	.data\x00\x94\x04

The executable uses a known packer (1 event)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (43 events)

Time & API	Arguments	Status
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x198aa3 @ 0x2f8aa3 archevod_xworm+0x19656a @ 0x2f656a archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf300 exception.instruction: ud2 exception.module: Archevod_XWorm.exe exception.exception_code: 0xc000001d exception.offset: 848640 exception.address: 0x22f300 registers.esp: 7798008 registers.edi: 4047088 registers.eax: 0 registers.ebp: 7798036 registers.edx: 2 registers.ebx: 2499697260 registers.esi: 1523712 registers.ecx: 37435280	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x198aa3 @ 0x2f8aa3 archevod_xworm+0x19656a @ 0x2f656a archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf300 exception.instruction: ud2 exception.module: Archevod_XWorm.exe exception.exception_code: 0xc000001d exception.offset: 848640 exception.address: 0x22f300 registers.esp: 7798008 registers.edi: 7798008 registers.eax: 0 registers.ebp: 7798036 registers.edx: 2 registers.ebx: 2290454 registers.esi: 0 registers.ecx: 7798044	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x18fb7d @ 0x2efb7d archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf2d5 exception.instruction: div eax exception.module: Archevod_XWorm.exe exception.exception_code: 0xc0000094 exception.offset: 848597 exception.address: 0x22f2d5 registers.esp: 7797936 registers.edi: 2839024 registers.eax: 0 registers.ebp: 7797964 registers.edx: 0 registers.ebx: 4292296704 registers.esi: 1523712 registers.ecx: 1523712	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x18fb7d @ 0x2efb7d archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf300 exception.instruction: ud2 exception.module: Archevod_XWorm.exe exception.exception_code: 0xc000001d exception.offset: 848640 exception.address: 0x22f300 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 2 registers.ebx: 2290411 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x18fb7d @ 0x2efb7d archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf300 exception.instruction: ud2 exception.module: Archevod_XWorm.exe exception.exception_code: 0xc000001d exception.offset: 848640 exception.address: 0x22f300 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 2 registers.ebx: 2290454 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x18fb7d @ 0x2efb7d archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf2d5 exception.instruction: div eax exception.module: Archevod_XWorm.exe exception.exception_code: 0xc0000094 exception.offset: 848597 exception.address: 0x22f2d5 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 0 registers.ebx: 2290454 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x18fb7d @ 0x2efb7d archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf2d5 exception.instruction: div eax exception.module: Archevod_XWorm.exe exception.exception_code: 0xc0000094 exception.offset: 848597 exception.address: 0x22f2d5 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 0 registers.ebx: 2290411 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x18fb7d @ 0x2efb7d archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf2d5 exception.instruction: div eax exception.module: Archevod_XWorm.exe exception.exception_code: 0xc0000094 exception.offset: 848597 exception.address: 0x22f2d5 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 0 registers.ebx: 2290411 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x18fb7d @ 0x2efb7d archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf2d5 exception.instruction: div eax exception.module: Archevod_XWorm.exe exception.exception_code: 0xc0000094 exception.offset: 848597 exception.address: 0x22f2d5 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 0 registers.ebx: 2290411 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x18fb7d @ 0x2efb7d archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf300 exception.instruction: ud2 exception.module: Archevod_XWorm.exe exception.exception_code: 0xc000001d exception.offset: 848640 exception.address: 0x22f300 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 2 registers.ebx: 2290411 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x18fe30 @ 0x2efe30 archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf2d5 exception.instruction: div eax exception.module: Archevod_XWorm.exe exception.exception_code: 0xc0000094 exception.offset: 848597 exception.address: 0x22f2d5 registers.esp: 7797936 registers.edi: 2839024 registers.eax: 0 registers.ebp: 7797964 registers.edx: 0 registers.ebx: 4292296704 registers.esi: 1523712 registers.ecx: 3496840201	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x18fe30 @ 0x2efe30 archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf300 exception.instruction: ud2 exception.module: Archevod_XWorm.exe exception.exception_code: 0xc000001d exception.offset: 848640 exception.address: 0x22f300 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 2 registers.ebx: 2290411 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x18fe30 @ 0x2efe30 archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf300 exception.instruction: ud2 exception.module: Archevod_XWorm.exe exception.exception_code: 0xc000001d exception.offset: 848640 exception.address: 0x22f300 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 2 registers.ebx: 2290454 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x18fe30 @ 0x2efe30 archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf2d5 exception.instruction: div eax exception.module: Archevod_XWorm.exe exception.exception_code: 0xc0000094 exception.offset: 848597 exception.address: 0x22f2d5 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 0 registers.ebx: 2290454 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x18fe30 @ 0x2efe30 archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf300 exception.instruction: ud2 exception.module: Archevod_XWorm.exe exception.exception_code: 0xc000001d exception.offset: 848640 exception.address: 0x22f300 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 2 registers.ebx: 2290411 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x18fe30 @ 0x2efe30 archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf2d5 exception.instruction: div eax exception.module: Archevod_XWorm.exe exception.exception_code: 0xc0000094 exception.offset: 848597 exception.address: 0x22f2d5 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 0 registers.ebx: 2290454 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x18fe30 @ 0x2efe30 archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf2d5 exception.instruction: div eax exception.module: Archevod_XWorm.exe exception.exception_code: 0xc0000094 exception.offset: 848597 exception.address: 0x22f2d5 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 0 registers.ebx: 2290411 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x18fe60 @ 0x2efe60 archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: cc 68 b8 d1 79 43 e9 9a d2 fe ff b0 d7 23 68 83 exception.symbol: archevod_xworm+0x19419b exception.instruction: int3 exception.module: Archevod_XWorm.exe exception.exception_code: 0x80000003 exception.offset: 1655195 exception.address: 0x2f419b registers.esp: 7797936 registers.edi: 2837069 registers.eax: 2324 registers.ebp: 7797964 registers.edx: 7797972 registers.ebx: 4292296704 registers.esi: 1525319 registers.ecx: 0	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: exception.instruction_r: cc 68 2d e6 79 43 e9 d2 a6 fe ff 09 0f f8 80 ea exception.symbol: archevod_xworm+0x196d63 exception.instruction: int3 exception.module: Archevod_XWorm.exe exception.exception_code: 0x80000003 exception.offset: 1666403 exception.address: 0x2f6d63 registers.esp: 7797936 registers.edi: 2839024 registers.eax: 4 registers.ebp: 1111705675 registers.edx: 7797760 registers.ebx: 4292296704 registers.esi: 1523712 registers.ecx: 773128192	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x18ffc8 @ 0x2effc8 archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf2d5 exception.instruction: div eax exception.module: Archevod_XWorm.exe exception.exception_code: 0xc0000094 exception.offset: 848597 exception.address: 0x22f2d5 registers.esp: 7797936 registers.edi: 2839024 registers.eax: 0 registers.ebp: 7797964 registers.edx: 0 registers.ebx: 4292296704 registers.esi: 1523712 registers.ecx: 7797964	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x18ffc8 @ 0x2effc8 archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf300 exception.instruction: ud2 exception.module: Archevod_XWorm.exe exception.exception_code: 0xc000001d exception.offset: 848640 exception.address: 0x22f300 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 2 registers.ebx: 2290411 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x18ffc8 @ 0x2effc8 archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf300 exception.instruction: ud2 exception.module: Archevod_XWorm.exe exception.exception_code: 0xc000001d exception.offset: 848640 exception.address: 0x22f300 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 2 registers.ebx: 2290454 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x18ffc8 @ 0x2effc8 archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf300 exception.instruction: ud2 exception.module: Archevod_XWorm.exe exception.exception_code: 0xc000001d exception.offset: 848640 exception.address: 0x22f300 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 2 registers.ebx: 2290454 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x18ffc8 @ 0x2effc8 archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf300 exception.instruction: ud2 exception.module: Archevod_XWorm.exe exception.exception_code: 0xc000001d exception.offset: 848640 exception.address: 0x22f300 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 2 registers.ebx: 2290454 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x18ffc8 @ 0x2effc8 archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf2d5 exception.instruction: div eax exception.module: Archevod_XWorm.exe exception.exception_code: 0xc0000094 exception.offset: 848597 exception.address: 0x22f2d5 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 0 registers.ebx: 2290454 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x193083 @ 0x2f3083 archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: ed 68 24 87 79 43 e9 14 9d ff ff d5 8c 72 5c 97 exception.symbol: archevod_xworm+0x187721 exception.instruction: in eax, dx exception.module: Archevod_XWorm.exe exception.exception_code: 0xc0000096 exception.offset: 1603361 exception.address: 0x2e7721 registers.esp: 7797924 registers.edi: 2839024 registers.eax: 1447909480 registers.ebp: 7797952 registers.edx: 22104 registers.ebx: 0 registers.esi: 2819460 registers.ecx: 10	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x1930ab @ 0x2f30ab archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: 0f 3f 68 65 cb 79 43 e9 79 e4 fe ff 38 59 5a c5 exception.symbol: archevod_xworm+0x192fbb exception.address: 0x2f2fbb exception.module: Archevod_XWorm.exe exception.exception_code: 0xc000001d exception.offset: 1650619 registers.esp: 7797924 registers.edi: 2839024 registers.eax: 1 registers.ebp: 7797952 registers.edx: 0 registers.ebx: 0 registers.esi: 2819460 registers.ecx: 0	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x19018a @ 0x2f018a archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf2d5 exception.instruction: div eax exception.module: Archevod_XWorm.exe exception.exception_code: 0xc0000094 exception.offset: 848597 exception.address: 0x22f2d5 registers.esp: 7797936 registers.edi: 2839024 registers.eax: 0 registers.ebp: 7797964 registers.edx: 0 registers.ebx: 4292296704 registers.esi: 1523712 registers.ecx: 0	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x19018a @ 0x2f018a archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf2d5 exception.instruction: div eax exception.module: Archevod_XWorm.exe exception.exception_code: 0xc0000094 exception.offset: 848597 exception.address: 0x22f2d5 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 0 registers.ebx: 2290411 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x19018a @ 0x2f018a archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf300 exception.instruction: ud2 exception.module: Archevod_XWorm.exe exception.exception_code: 0xc000001d exception.offset: 848640 exception.address: 0x22f300 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 2 registers.ebx: 2290411 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x19018a @ 0x2f018a archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf2d5 exception.instruction: div eax exception.module: Archevod_XWorm.exe exception.exception_code: 0xc0000094 exception.offset: 848597 exception.address: 0x22f2d5 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 0 registers.ebx: 2290454 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x19018a @ 0x2f018a archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf300 exception.instruction: ud2 exception.module: Archevod_XWorm.exe exception.exception_code: 0xc000001d exception.offset: 848640 exception.address: 0x22f300 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 2 registers.ebx: 2290411 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x19018a @ 0x2f018a archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf2d5 exception.instruction: div eax exception.module: Archevod_XWorm.exe exception.exception_code: 0xc0000094 exception.offset: 848597 exception.address: 0x22f2d5 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 0 registers.ebx: 2290454 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x1902b1 @ 0x2f02b1 archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf300 exception.instruction: ud2 exception.module: Archevod_XWorm.exe exception.exception_code: 0xc000001d exception.offset: 848640 exception.address: 0x22f300 registers.esp: 7797936 registers.edi: 2839024 registers.eax: 0 registers.ebp: 7797964 registers.edx: 2 registers.ebx: 4292296704 registers.esi: 1523712 registers.ecx: 7566181	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x1902b1 @ 0x2f02b1 archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf2d5 exception.instruction: div eax exception.module: Archevod_XWorm.exe exception.exception_code: 0xc0000094 exception.offset: 848597 exception.address: 0x22f2d5 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 0 registers.ebx: 2290454 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x1902b1 @ 0x2f02b1 archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf300 exception.instruction: ud2 exception.module: Archevod_XWorm.exe exception.exception_code: 0xc000001d exception.offset: 848640 exception.address: 0x22f300 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 2 registers.ebx: 2290411 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x1902b1 @ 0x2f02b1 archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf2d5 exception.instruction: div eax exception.module: Archevod_XWorm.exe exception.exception_code: 0xc0000094 exception.offset: 848597 exception.address: 0x22f2d5 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 0 registers.ebx: 2290454 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x1902b1 @ 0x2f02b1 archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf300 exception.instruction: ud2 exception.module: Archevod_XWorm.exe exception.exception_code: 0xc000001d exception.offset: 848640 exception.address: 0x22f300 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 2 registers.ebx: 2290411 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x1902b1 @ 0x2f02b1 archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf2d5 exception.instruction: div eax exception.module: Archevod_XWorm.exe exception.exception_code: 0xc0000094 exception.offset: 848597 exception.address: 0x22f2d5 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 0 registers.ebx: 2290454 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x1902b1 @ 0x2f02b1 archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: f7 f0 e8 3c 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf2d5 exception.instruction: div eax exception.module: Archevod_XWorm.exe exception.exception_code: 0xc0000094 exception.offset: 848597 exception.address: 0x22f2d5 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 0 registers.ebx: 2290411 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x1902b1 @ 0x2f02b1 archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf300 exception.instruction: ud2 exception.module: Archevod_XWorm.exe exception.exception_code: 0xc000001d exception.offset: 848640 exception.address: 0x22f300 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 2 registers.ebx: 2290411 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x1902b1 @ 0x2f02b1 archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf300 exception.instruction: ud2 exception.module: Archevod_XWorm.exe exception.exception_code: 0xc000001d exception.offset: 848640 exception.address: 0x22f300 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 2 registers.ebx: 2290454 registers.esi: 0 registers.ecx: 7797972	1
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x1902b1 @ 0x2f02b1 archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: 0f 0b e8 11 2d 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: archevod_xworm+0xcf300 exception.instruction: ud2 exception.module: Archevod_XWorm.exe exception.exception_code: 0xc000001d exception.offset: 848640 exception.address: 0x22f300 registers.esp: 7797936 registers.edi: 7797936 registers.eax: 0 registers.ebp: 7797964 registers.edx: 2 registers.ebx: 2290454 registers.esi: 0 registers.ecx: 7797972	1

Allocates read-write-execute memory (usually to unpack itself) (45 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02380000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00610000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00620000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02384000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02394000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 147456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02394000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023b4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023b4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 32768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00160000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02de0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02f90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e22000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 262144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02580000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02580000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02262000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0228c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ab0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0226a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02296000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0229a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02297000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ab1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ab2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ab3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ab4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 7:41 a.m.	process_identifier: 1952 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0226c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Sept. 18, 2023, 7:41 a.m.	total_number_of_free_bytes: 9935671296 free_bytes_available: 9935671296 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Executes one or more WMI queries (1 event)

wmi	Select * from Win32_ComputerSystem

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (10 events)

Time & API	Arguments	Status	Return
Process32NextW Sept. 18, 2023, 7:41 a.m.	snapshot_handle: 0x00000118 process_name: mobsync.exe process_identifier: 1692	1	1
Process32NextW Sept. 18, 2023, 7:41 a.m.	snapshot_handle: 0x00000118 process_name: pw.exe process_identifier: 760	1	1
Process32NextW Sept. 18, 2023, 7:41 a.m.	snapshot_handle: 0x00000118 process_name: wsqmcons.exe process_identifier: 880	1	1
Process32NextW Sept. 18, 2023, 7:41 a.m.	snapshot_handle: 0x00000118 process_name: taskhost.exe process_identifier: 1836	1	1
Process32NextW Sept. 18, 2023, 7:41 a.m.	snapshot_handle: 0x00000118 process_name: sdclt.exe process_identifier: 660	1	1
Process32NextW Sept. 18, 2023, 7:41 a.m.	snapshot_handle: 0x00000118 process_name: cmd.exe process_identifier: 1504	1	1
Process32NextW Sept. 18, 2023, 7:41 a.m.	snapshot_handle: 0x00000118 process_name: conhost.exe process_identifier: 1516	1	1
Process32NextW Sept. 18, 2023, 7:41 a.m.	snapshot_handle: 0x00000118 process_name: SearchFilterHost.exe process_identifier: 808	1	1
Process32NextW Sept. 18, 2023, 7:41 a.m.	snapshot_handle: 0x00000118 process_name: Archevod_XWorm.exe process_identifier: 1952	1	1
Process32NextW Sept. 18, 2023, 7:41 a.m.	snapshot_handle: 0x00000118 process_name: pw.exe process_identifier: 2076	1	1

The binary likely contains encrypted or compressed data indicative of a packer (4 events)

section

{u'size_of_data': u'0x00005e00', u'virtual_address': u'0x00002000', u'entropy': 7.969178100272086, u'name': u'', u'virtual_size': u'0x0000c000'}

entropy

7.96917810027

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x0002ba00', u'virtual_address': u'0x00014000', u'entropy': 7.9978227236468165, u'name': u'', u'virtual_size': u'0x00280000'}

entropy

7.99782272365

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x000e4000', u'virtual_address': u'0x00294000', u'entropy': 7.976048192455042, u'name': u'.data\\x00\\x94\\x04', u'virtual_size': u'0x000e4000'}

entropy

7.97604819246

description

A section with a high entropy has been found

entropy

0.997752808989

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 18, 2023, 7:41 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Executes one or more WMI queries which can be used to identify virtual machines (1 event)

wmi	Select * from Win32_ComputerSystem

Checks for the presence of known devices from debuggers and forensic tools (3 events)

file	\??\SICE
file	\??\SIWDEBUG
file	\??\NTICE

Checks for the presence of known windows from debuggers and forensic tools (1 event)

Time & API	Arguments	Status	Return	Repeated
FindWindowA Sept. 18, 2023, 7:41 a.m.	class_name: OLLYDBG window_name:		0	0

A process performed obfuscation on information about the computer or sent it to a remote location indicative of CnC Traffic/Preperations. (2 events)

Time & API	Arguments	Status	Return	Repeated
CryptHashData Sept. 18, 2023, 7:41 a.m.	buffer: 2test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520 hash_handle: 0x00c12ce8 flags: 0	1	1	0
CryptHashData Sept. 18, 2023, 7:41 a.m.	buffer: 2test22TEST22-PCMicrosoft Windows NT 6.1.7601 Service Pack 134252779520 hash_handle: 0x00c12ce8 flags: 0	1	1	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 18, 2023, 7:41 a.m.	stacktrace: archevod_xworm+0x193083 @ 0x2f3083 archevod_xworm+0x19657d @ 0x2f657d archevod_xworm+0x27b1cd @ 0x3db1cd exception.instruction_r: ed 68 24 87 79 43 e9 14 9d ff ff d5 8c 72 5c 97 exception.symbol: archevod_xworm+0x187721 exception.instruction: in eax, dx exception.module: Archevod_XWorm.exe exception.exception_code: 0xc0000096 exception.offset: 1603361 exception.address: 0x2e7721 registers.esp: 7797924 registers.edi: 2839024 registers.eax: 1447909480 registers.ebp: 7797952 registers.edx: 22104 registers.ebx: 0 registers.esi: 2819460 registers.ecx: 10	1	0	0

Archevod_XWorm.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All