Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Nov. 25, 2023, 5:53 p.m.	Nov. 25, 2023, 6:03 p.m.

Size	1.9MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`f6c58c6f968a8216b9b92a56bd14d421`
SHA256	`7ab95ba29fd65216ae854a664092c3e2c0d7a7986ab8880bee77d3dc74a97467`
CRC32	`005E63FE`
ssdeep	`49152:52pOlurcBHvEDrzmJGpKAmLWF4GWeNMTzUT0C:cxrmHvGrzmEcwFKeNOU4C`
Yara	Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) PE_Header_Zero - PE File Signature UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

b.exe "C:\Users\test22\AppData\Local\Temp\b.exe"
2692

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

One or more processes crashed (50 out of 65536 events)

Time & API	Arguments	Status
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x76f89e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x755f3120 b+0x1cea58 @ 0x5cea58 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x76f89e58 registers.esp: 1627016 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627060 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2621440	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x756331df b+0x1cea5c @ 0x5cea5c exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1627068 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627120 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2696	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x76f89e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x755f3120 b+0x1cea58 @ 0x5cea58 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x76f89e58 registers.esp: 1627016 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627060 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2621440	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x756331df b+0x1cea5c @ 0x5cea5c exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1627068 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627120 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2696	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x76f89e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x755f3120 b+0x1cea58 @ 0x5cea58 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x76f89e58 registers.esp: 1627016 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627060 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2621440	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x756331df b+0x1cea5c @ 0x5cea5c exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1627068 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627120 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2696	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x76f89e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x755f3120 b+0x1cea58 @ 0x5cea58 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x76f89e58 registers.esp: 1627016 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627060 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2621440	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x756331df b+0x1cea5c @ 0x5cea5c exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1627068 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627120 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2696	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x76f89e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x755f3120 b+0x1cea58 @ 0x5cea58 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x76f89e58 registers.esp: 1627016 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627060 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2621440	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x756331df b+0x1cea5c @ 0x5cea5c exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1627068 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627120 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2696	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x76f89e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x755f3120 b+0x1cea58 @ 0x5cea58 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x76f89e58 registers.esp: 1627016 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627060 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2621440	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x756331df b+0x1cea5c @ 0x5cea5c exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1627068 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627120 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2696	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x76f89e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x755f3120 b+0x1cea58 @ 0x5cea58 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x76f89e58 registers.esp: 1627016 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627060 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2621440	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x756331df b+0x1cea5c @ 0x5cea5c exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1627068 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627120 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2696	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x76f89e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x755f3120 b+0x1cea58 @ 0x5cea58 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x76f89e58 registers.esp: 1627016 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627060 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2621440	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x756331df b+0x1cea5c @ 0x5cea5c exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1627068 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627120 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2696	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x76f89e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x755f3120 b+0x1cea58 @ 0x5cea58 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x76f89e58 registers.esp: 1627016 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627060 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2621440	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x756331df b+0x1cea5c @ 0x5cea5c exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1627068 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627120 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2696	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x76f89e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x755f3120 b+0x1cea58 @ 0x5cea58 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x76f89e58 registers.esp: 1627016 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627060 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2621440	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x756331df b+0x1cea5c @ 0x5cea5c exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1627068 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627120 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2696	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x76f89e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x755f3120 b+0x1cea58 @ 0x5cea58 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x76f89e58 registers.esp: 1627016 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627060 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2621440	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x756331df b+0x1cea5c @ 0x5cea5c exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1627068 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627120 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2696	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x76f89e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x755f3120 b+0x1cea58 @ 0x5cea58 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x76f89e58 registers.esp: 1627016 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627060 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2621440	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x756331df b+0x1cea5c @ 0x5cea5c exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1627068 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627120 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2696	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x76f89e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x755f3120 b+0x1cea58 @ 0x5cea58 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x76f89e58 registers.esp: 1627016 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627060 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2621440	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x756331df b+0x1cea5c @ 0x5cea5c exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1627068 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627120 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2696	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x76f89e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x755f3120 b+0x1cea58 @ 0x5cea58 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x76f89e58 registers.esp: 1627016 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627060 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2621440	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x756331df b+0x1cea5c @ 0x5cea5c exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1627068 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627120 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2696	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x76f89e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x755f3120 b+0x1cea58 @ 0x5cea58 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x76f89e58 registers.esp: 1627016 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627060 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2621440	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x756331df b+0x1cea5c @ 0x5cea5c exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1627068 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627120 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2696	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x76f89e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x755f3120 b+0x1cea58 @ 0x5cea58 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x76f89e58 registers.esp: 1627016 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627060 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2621440	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x756331df b+0x1cea5c @ 0x5cea5c exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1627068 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627120 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2696	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x76f89e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x755f3120 b+0x1cea58 @ 0x5cea58 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x76f89e58 registers.esp: 1627016 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627060 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2621440	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x756331df b+0x1cea5c @ 0x5cea5c exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1627068 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627120 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2696	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x76f89e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x755f3120 b+0x1cea58 @ 0x5cea58 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x76f89e58 registers.esp: 1627016 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627060 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2621440	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x756331df b+0x1cea5c @ 0x5cea5c exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1627068 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627120 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2696	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x76f89e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x755f3120 b+0x1cea58 @ 0x5cea58 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x76f89e58 registers.esp: 1627016 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627060 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2621440	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x756331df b+0x1cea5c @ 0x5cea5c exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1627068 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627120 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2696	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x76f89e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x755f3120 b+0x1cea58 @ 0x5cea58 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x76f89e58 registers.esp: 1627016 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627060 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2621440	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x756331df b+0x1cea5c @ 0x5cea5c exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1627068 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627120 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2696	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x76f89e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x755f3120 b+0x1cea58 @ 0x5cea58 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x76f89e58 registers.esp: 1627016 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627060 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2621440	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x756331df b+0x1cea5c @ 0x5cea5c exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1627068 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627120 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2696	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x76f89e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x755f3120 b+0x1cea58 @ 0x5cea58 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x76f89e58 registers.esp: 1627016 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627060 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2621440	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x756331df b+0x1cea5c @ 0x5cea5c exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1627068 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627120 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2696	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x76f89e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x755f3120 b+0x1cea58 @ 0x5cea58 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x76f89e58 registers.esp: 1627016 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627060 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2621440	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x756331df b+0x1cea5c @ 0x5cea5c exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1627068 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627120 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2696	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x76f89e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x755f3120 b+0x1cea58 @ 0x5cea58 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x76f89e58 registers.esp: 1627016 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627060 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2621440	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x756331df b+0x1cea5c @ 0x5cea5c exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1627068 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627120 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2696	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: _vsnprintf+0xa9 strncpy_s-0x79 ntdll+0x79e31 @ 0x76f89e31 GetProfileStringW+0x5b74 EnumResourceNamesW-0x40041 kernel32+0x43120 @ 0x755f3120 b+0x1cea58 @ 0x5cea58 exception.instruction_r: 80 78 07 05 0f 84 64 8a 01 00 f6 40 07 3f 0f 84 exception.symbol: _vsnprintf+0xd0 strncpy_s-0x52 ntdll+0x79e58 exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 499288 exception.address: 0x76f89e58 registers.esp: 1627016 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627060 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 2621440	1
__exception__ Nov. 25, 2023, 5:53 p.m.	stacktrace: LocalFlags+0x50 LocalHandle-0xee kernel32+0x831df @ 0x756331df b+0x1cea5c @ 0x5cea5c exception.instruction_r: 80 78 07 05 0f 84 27 56 02 00 f6 40 07 3f 0f 84 exception.symbol: RtlGetUserInfoHeap+0x4e RtlQueueWorkItem-0x3e7 ntdll+0x67cbf exception.instruction: cmp byte ptr [eax + 7], 5 exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 425151 exception.address: 0x76f77cbf registers.esp: 1627068 registers.edi: 2621440 registers.eax: 4294967288 registers.ebp: 1627120 registers.edx: 6 registers.ebx: 0 registers.esi: 0 registers.ecx: 2696	1

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Nov. 25, 2023, 5:53 p.m.	process_identifier: 2692 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 1802240 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021e0000 process_handle: 0xffffffff	1	0	0

Foreign language identified in PE resource (16 events)

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0056ce08

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0056ce08

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0056ce08

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0056ce08

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0056ce08

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0056ce08

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0056ce08

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0056ce08

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0056ce08

size

0x00000468

name

RT_ICON

language

LANG_SERBIAN

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0056ce08

size

0x00000468

name

RT_STRING

language

LANG_SERBIAN

filetype

data

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0056e9e0

size

0x00000202

name

RT_STRING

language

LANG_SERBIAN

filetype

data

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0056e9e0

size

0x00000202

name

RT_STRING

language

LANG_SERBIAN

filetype

data

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0056e9e0

size

0x00000202

name

RT_STRING

language

LANG_SERBIAN

filetype

data

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0056e9e0

size

0x00000202

name

RT_GROUP_ICON

language

LANG_SERBIAN

filetype

data

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0056d270

size

0x00000068

name

RT_GROUP_ICON

language

LANG_SERBIAN

filetype

data

sublanguage

SUBLANG_SERBIAN_LATIN

offset

0x0056d270

size

0x00000068

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x001d5600', u'virtual_address': u'0x00001000', u'entropy': 7.972232041516892, u'name': u'.text', u'virtual_size': u'0x001d5582'}

entropy

7.97223204152

description

A section with a high entropy has been found

entropy

0.966040648315

description

Overall entropy of this PE file is high

Tries to unhook Windows functions monitored by Cuckoo (1 event)

Time & API	Arguments	Status	Return	Repeated
__anomaly__ Nov. 25, 2023, 5:53 p.m.	tid: 2696 message: Encountered 65537 exceptions, quitting. subcategory: exception function_name:	1	0	0

File has been identified by 50 AntiVirus engines on VirusTotal as malicious (50 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.Packed2.45946
MicroWorld-eScan	Trojan.GenericKD.70563144
FireEye	Generic.mg.f6c58c6f968a8216
Skyhigh	BehavesLike.Win32.Generic.tc
McAfee	GenericRXWL-OS!F6C58C6F968A
Malwarebytes	Trojan.MalPack.GS
Sangfor	Virus.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
K7GW	Trojan ( 005ae5d61 )
K7AntiVirus	Trojan ( 005ae5d61 )
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Kryptik.HVJO
APEX	Malicious
Kaspersky	HEUR:Trojan.Win32.Fsysna.gen
BitDefender	Trojan.GenericKD.70563144
Avast	Win32:RansomX-gen [Ransom]
Tencent	Trojan.Win32.Obfuscated.gen
Emsisoft	Trojan.GenericKD.70563144 (B)
F-Secure	Trojan.TR/Crypt.Agent.qlisp
TrendMicro	Trojan.Win32.SMOKELOADER.YXDKXZ
Trapmine	malicious.high.ml.score
Sophos	Troj/Krypt-VK
SentinelOne	Static AI - Malicious PE
MAX	malware (ai score=82)
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/Crypt.Agent.qlisp
Antiy-AVL	Trojan/Win32.GenKryptik
Kingsoft	Win32.Troj.Unknown.a
Microsoft	Ransom:Win32/StopCrypt.ZTQ!MTB
Gridinsoft	Ransom.Win32.STOP.tr!n
Arcabit	Trojan.Generic.D434B548
ZoneAlarm	HEUR:Trojan.Win32.Fsysna.gen
GData	Win32.Trojan.Agent.GDUTU8
Cynet	Malicious (score: 100)
AhnLab-V3	Ransomware/Win.Hpgandcrab.R609862
VBA32	BScope.Trojan.Sabsik.FL
Cylance	unsafe
Panda	Trj/RansomGen.A
TrendMicro-HouseCall	Trojan.Win32.SMOKELOADER.YXDKXZ
Rising	Trojan.Generic@AI.100 (RDML:q/ccRDKAgCAtXYGkS5ZtIA)
Ikarus	Win32.Outbreak
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	PossibleThreat.MTG.H
AVG	Win32:RansomX-gen [Ransom]
DeepInstinct	MALICIOUS

b.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All