Summary | ZeroBOX

setup.exe

PE64 PE File
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 26, 2023, 5:37 p.m. Oct. 26, 2023, 5:40 p.m.
Size 9.7MB
Type PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5 8a22c4b4e8b911a51322dfd78fe799c4
SHA256 5337415a9069931bb4b3c68559d2ed226afa5e64e9d66165d6a9f65400f259d9
CRC32 FC8A36FB
ssdeep 196608:qj3WTTMoCZ632bpr3FGRrOoIXWMLwtxAIu2buwO8+VQfMy2W1Wc3W4aJX:KGTMfZU2FrVGRrOoIXWMLIxAR2bI8jU9
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • themida_packer - themida packer

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section
section .imports
section .themida
section .boot
Time & API Arguments Status Return Repeated

__exception__

stacktrace:
RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefd4fa49d
setup+0xd361bd @ 0x1408c61bd
setup+0xe6de07 @ 0x1409fde07
HeapWalk-0x1ce0 kernel32+0x0 @ 0x76c10000
0x39fe08
0x39fe08
0x39fe08
0x43fc94
0x41311f
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea
0x43c28076d813ea

exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00
exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d
exception.instruction: add rsp, 0xc8
exception.module: KERNELBASE.dll
exception.exception_code: 0xc000008e
exception.offset: 42141
exception.address: 0x7fefd4fa49d
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 1994472144
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800608
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 3800616
registers.rdi: 5374128128
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:
RtlRestoreContext+0x293 __chkstk-0x1fe ntdll+0x50bd2 @ 0x76d80bd2

exception.instruction_r: 48 cf 48 83 ec 30 4c 8b c4 48 81 ec d0 04 00 00
exception.symbol: RtlRestoreContext+0x293 __chkstk-0x1fe ntdll+0x50bd2
exception.instruction: iretq
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 330706
exception.address: 0x76d80bd2
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 3798784
registers.rsi: 0
registers.r10: 0
registers.rbx: 5376962593
registers.rsp: 3800696
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 1993721121
registers.rdi: 0
registers.rax: 1994370705
registers.r13: 0
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

process_identifier: 2540
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076e27000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2540
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076d80000
process_handle: 0xffffffffffffffff
1 0 0
section {u'size_of_data': u'0x00004dda', u'virtual_address': u'0x00001000', u'entropy': 7.970947843197413, u'name': u' ', u'virtual_size': u'0x0000b3f8'} entropy 7.9709478432 description A section with a high entropy has been found
section {u'size_of_data': u'0x006aa851', u'virtual_address': u'0x0000d000', u'entropy': 7.937106971960612, u'name': u' ', u'virtual_size': u'0x0097bf80'} entropy 7.93710697196 description A section with a high entropy has been found
section {u'size_of_data': u'0x00001889', u'virtual_address': u'0x00989000', u'entropy': 7.9341305549891405, u'name': u' ', u'virtual_size': u'0x00003060'} entropy 7.93413055499 description A section with a high entropy has been found
section {u'size_of_data': u'0x00000655', u'virtual_address': u'0x0098d000', u'entropy': 7.523653049706825, u'name': u' ', u'virtual_size': u'0x00000bac'} entropy 7.52365304971 description A section with a high entropy has been found
section {u'size_of_data': u'0x0000020a', u'virtual_address': u'0x0098e000', u'entropy': 7.427093439790048, u'name': u' ', u'virtual_size': u'0x00000754'} entropy 7.42709343979 description A section with a high entropy has been found
section {u'size_of_data': u'0x0000033e', u'virtual_address': u'0x00996000', u'entropy': 7.66640475700459, u'name': u' ', u'virtual_size': u'0x000006c0'} entropy 7.666404757 description A section with a high entropy has been found
section {u'size_of_data': u'0x002fc400', u'virtual_address': u'0x00ee1000', u'entropy': 7.963703320114366, u'name': u'.boot', u'virtual_size': u'0x002fc400'} entropy 7.96370332011 description A section with a high entropy has been found
entropy 0.999668269669 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

__anomaly__

tid: 2544
message: Encountered 65537 exceptions, quitting.
subcategory: exception
function_name:
1 0 0
Bkav W64.AIDetectMalware
Lionic Trojan.Win64.Agentb.trtl
DrWeb Trojan.Siggen21.47132
MicroWorld-eScan Trojan.Generic.34244006
Skyhigh BehavesLike.Win64.Expiro.tc
ALYac Trojan.Generic.34244006
Malwarebytes Trojan.FakeChrome
VIPRE Trojan.Generic.34244006
Sangfor Trojan.Win32.Packed.Vk8r
K7AntiVirus Trojan ( 005ad1191 )
BitDefender Trojan.Generic.34244006
K7GW Trojan ( 005ad1191 )
Cybereason malicious.4c0265
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win64/Packed.Themida.QK
Kaspersky Trojan.Win32.Agent.xbfosi
Alibaba Packed:Win64/Themida.c3a12263
Tencent Malware.Win32.Gencirc.10bf3062
Sophos Mal/Generic-S
F-Secure Trojan.TR/Agent.jxvri
Zillya Trojan.Agent.Win32.3740063
Trapmine suspicious.low.ml.score
FireEye Generic.mg.8a22c4b4e8b911a5
Emsisoft Trojan.Generic.34244006 (B)
SentinelOne Static AI - Suspicious PE
MAX malware (ai score=86)
Google Detected
Avira TR/Agent.jxvri
Varist W64/ABRisk.YGOH-4709
Antiy-AVL Trojan/Win32.Sabsik
Microsoft Trojan:Win32/Znyonm
Gridinsoft Trojan.Win64.Gen.bot
Arcabit Trojan.Generic.D20A85A6
ViRobot Trojan.Win.Z.Themida.10177592
ZoneAlarm Trojan.Win32.Agent.xbfosi
GData Trojan.Generic.34244006
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Generic.R589137
McAfee Artemis!8A22C4B4E8B9
DeepInstinct MALICIOUS
Cylance unsafe
Rising Trojan.Agent!8.B1E (CLOUD)
Ikarus PUA.Themida
Fortinet PossibleThreat.MTG.H
AVG Win64:Evo-gen [Trj]
Avast Win64:Evo-gen [Trj]
CrowdStrike win/malicious_confidence_100% (W)