Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Jan. 26, 2024, 9:01 a.m.	Jan. 26, 2024, 9:19 a.m.

Size	727.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`8b5cf3d102548da37888f34d3d468e27`
SHA256	`3e8e1eae92427c05d36bbc665721382af5972780e0a7cd44e33f63684b1cf3e2`
CRC32	`EB51E18E`
ssdeep	`12288:mh1Fk70TnvjcXHKkdNTYkpfxQmclBuFTEAtvqsuIGnyd30w4KA9LdX+/UwS0iSbq:Ak70Trc31dNckBxQmUBuFTEAtCsuI9d8`
PDB Path
Yara	Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) MALWARE_Win_VT_RedLine - Detects RedLine infostealer UltraVNC_Zero - UltraVNC PE_Header_Zero - PE File Signature UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

MRK.exe "C:\Users\test22\AppData\Local\Temp\MRK.exe"
1836

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
143.95.79.226	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 26, 2024, 9:01 a.m.			0	0
IsDebuggerPresent Jan. 26, 2024, 9:01 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return
CryptExportKey Jan. 26, 2024, 9:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006458e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 26, 2024, 9:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006458e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 26, 2024, 9:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00645920 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 26, 2024, 9:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00645920 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 26, 2024, 9:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006459e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 26, 2024, 9:01 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006459e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 26, 2024, 9:01 a.m.		1	1	0

One or more processes crashed (50 out of 148 events)

Time & API	Arguments	Status
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: f3 aa 8b 45 f0 8b 4d 08 8b 55 10 03 c8 2b d0 52 exception.symbol: mrk+0xf088 exception.instruction: stosb byte ptr es:[edi], al exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61576 exception.address: 0x40f088 registers.esp: 1636996 registers.edi: 4350244 registers.eax: 0 registers.ebp: 1637012 registers.edx: 0 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 12	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4353968 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 4688	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4358064 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 4656	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4362160 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 4624	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4366256 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 4592	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4370352 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 4560	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4374448 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 4528	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4378544 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 4496	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4382640 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 4464	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4386736 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 4432	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4390832 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 4400	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4394928 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 4368	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4399024 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 4336	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4403120 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 4304	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4407216 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 4272	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4411312 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 4240	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4415408 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 4208	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4419504 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 4176	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4423600 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 4144	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4427696 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 4112	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4431792 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 4080	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4435888 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 4048	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4439984 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 4016	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4444080 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 3984	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4448176 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 3952	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4452272 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 3920	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4456368 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 3888	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4460464 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 3856	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4464560 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 3824	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4468656 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 3792	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4472752 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 3760	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4476848 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 3728	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4480944 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 3696	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4485040 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 3664	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4489136 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 3632	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4493232 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 3600	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4497328 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 3568	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4501424 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 3536	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4505520 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 3504	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4509616 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 3472	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4513712 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 3440	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4517808 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 3408	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4521904 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 3376	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4526000 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 3344	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4530096 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 3312	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4534192 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 3280	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4538288 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 3248	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4542384 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 3216	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4546480 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 3184	1
__exception__ Jan. 26, 2024, 9:01 a.m.	stacktrace: mrk+0xf054 @ 0x40f054 mrk+0xf0a0 @ 0x40f0a0 mrk+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: mrk+0xefff exception.address: 0x40efff exception.module: MRK.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4550576 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 118 registers.ebx: 0 registers.esi: 4980768 registers.ecx: 3152	1

Allocates read-write-execute memory (usually to unpack itself) (30 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 region_size: 1835008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02330000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02220000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73eb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73eb2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02370000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02530000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00572000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02221000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02222000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0057c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02223000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02224000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01efb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ef7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02510000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ef5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02511000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02518000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0252f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02520000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02519000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0251a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 26, 2024, 9:01 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0251d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00093e00', u'virtual_address': u'0x00026000', u'entropy': 7.999488273792361, u'name': u'.rsrc', u'virtual_size': u'0x00093d60'}

entropy

7.99948827379

description

A section with a high entropy has been found

entropy

0.814177563661

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Jan. 26, 2024, 9:01 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host

143.95.79.226

File has been identified by 29 AntiVirus engines on VirusTotal as malicious (29 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.SpyGate.m!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.Generic.bc
Cylance	unsafe
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.b6e4ec
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
APEX	Malicious
McAfee	Artemis!8B5CF3D10254
Kaspersky	UDS:DangerousObject.Multi.Generic
Rising	Trojan.Generic@AI.99 (RDML:0hByYueZ4+fTBw9IH1AsrA)
FireEye	Generic.mg.8b5cf3d102548da3
Sophos	Mal/Generic-S (PUA)
Ikarus	Win32.Outbreak
Webroot	W32.Malware.Gen
Google	Detected
Kingsoft	malware.kb.a.998
Gridinsoft	Spy.Win32.Gen.tr
Microsoft	Backdoor:Win32/Bladabindi!ml
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Varist	W32/ABRisk.RFEG-7153
BitDefenderTheta	Gen:NN.ZexaF.36680.Tq0@am0HWqb
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.Crypt.MSIL
SentinelOne	Static AI - Malicious PE
CrowdStrike	win/malicious_confidence_90% (D)

MRK.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All