Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Jan. 27, 2024, 3:52 p.m.	Jan. 27, 2024, 4:20 p.m.

Size	471.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`810da00c69d55e89dca3bfe9a6f6a420`
SHA256	`64a21d074850a4e8dd28a846e8f9e5d72d5549dc68d9ded2e9bff99f730f4d80`
CRC32	`F764D4E0`
ssdeep	`12288:Lh1Fk70Tnvjc52gSbBJKrk+bLcIW1SIoQT79Y4AyGItHYO2E89:Rk70Trcu2oqLISIoQT7C8pHFRQ`
PDB Path
Yara	Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) MALWARE_Win_VT_RedLine - Detects RedLine infostealer UltraVNC_Zero - UltraVNC PE_Header_Zero - PE File Signature UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

rdxx1.exe "C:\Users\test22\AppData\Local\Temp\rdxx1.exe"
804

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 27, 2024, 3:52 p.m.			0	0
IsDebuggerPresent Jan. 27, 2024, 3:52 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (5 events)

Time & API	Arguments	Status	Return
CryptExportKey Jan. 27, 2024, 3:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00585890 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2024, 3:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00585890 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2024, 3:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005858d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2024, 3:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005858d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 27, 2024, 3:52 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00585990 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 27, 2024, 3:52 p.m.		1	1	0

One or more processes crashed (50 out of 84 events)

Time & API	Arguments	Status
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: f3 aa 8b 45 f0 8b 4d 08 8b 55 10 03 c8 2b d0 52 exception.symbol: rdxx1+0xf088 exception.instruction: stosb byte ptr es:[edi], al exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61576 exception.address: 0x40f088 registers.esp: 1636996 registers.edi: 4350244 registers.eax: 0 registers.ebp: 1637012 registers.edx: 0 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 12	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4353968 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 2640	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4358064 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 2608	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4362160 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 2576	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4366256 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 2544	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4370352 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 2512	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4374448 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 2480	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4378544 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 2448	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4382640 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 2416	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4386736 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 2384	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4390832 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 2352	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4394928 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 2320	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4399024 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 2288	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4403120 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 2256	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4407216 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 2224	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4411312 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 2192	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4415408 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 2160	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4419504 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 2128	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4423600 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 2096	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4427696 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 2064	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4431792 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 2032	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4435888 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 2000	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4439984 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 1968	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4444080 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 1936	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4448176 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 1904	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4452272 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 1872	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4456368 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 1840	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4460464 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 1808	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4464560 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 1776	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4468656 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 1744	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4472752 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 1712	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4476848 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 1680	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4480944 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 1648	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4485040 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 1616	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4489136 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 1584	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4493232 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 1552	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4497328 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 1520	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4501424 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 1488	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4505520 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 1456	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4509616 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 1424	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4513712 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 1392	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4517808 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 1360	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4521904 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 1328	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4526000 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 1296	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4530096 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 1264	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4534192 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 1232	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4538288 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 1200	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4542384 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 1168	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4546480 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 1136	1
__exception__ Jan. 27, 2024, 3:52 p.m.	stacktrace: rdxx1+0xf054 @ 0x40f054 rdxx1+0xf0a0 @ 0x40f0a0 rdxx1+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: rdxx1+0xefff exception.address: 0x40efff exception.module: rdxx1.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4550576 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 11 registers.ebx: 0 registers.esi: 32505928 registers.ecx: 1104	1

Allocates read-write-execute memory (usually to unpack itself) (21 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Jan. 27, 2024, 3:52 p.m.	process_identifier: 804 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02070000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2024, 3:52 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02210000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2024, 3:52 p.m.	process_identifier: 804 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02250000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2024, 3:52 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02430000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2024, 3:52 p.m.	process_identifier: 804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ed1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2024, 3:52 p.m.	process_identifier: 804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ed2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2024, 3:52 p.m.	process_identifier: 804 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02250000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2024, 3:52 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2024, 3:52 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2024, 3:52 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02431000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2024, 3:52 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02432000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2024, 3:52 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2024, 3:52 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2024, 3:52 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02433000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2024, 3:52 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2024, 3:52 p.m.	process_identifier: 804 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02434000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2024, 3:52 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0051b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2024, 3:52 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00517000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2024, 3:52 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x048f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2024, 3:52 p.m.	process_identifier: 804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00515000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2024, 3:52 p.m.	process_identifier: 804 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x048f1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00053e00', u'virtual_address': u'0x00026000', u'entropy': 7.998658003422873, u'name': u'.rsrc', u'virtual_size': u'0x00053d20'}

entropy

7.99865800342

description

A section with a high entropy has been found

entropy

0.71307120085

description

Overall entropy of this PE file is high

File has been identified by 34 AntiVirus engines on VirusTotal as malicious (34 events)

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.Generic.gc
Cylance	unsafe
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.e48ac2
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of MSIL/Kryptik.AKTF
APEX	Malicious
McAfee	Artemis!810DA00C69D5
Avast	Win32:TrojanX-gen [Trj]
Kaspersky	UDS:DangerousObject.Multi.Generic
Alibaba	Trojan:MSIL/Kryptik.470860b8
Rising	Trojan.Generic@AI.99 (RDML:6jPh7P8b2KS2n6WoWKUjfQ)
TrendMicro	TrojanSpy.Win32.REDLINE.YXEA1Z
FireEye	Generic.mg.810da00c69d55e89
Sophos	Mal/Generic-S (PUA)
Ikarus	Trojan.MSIL.PSW
Google	Detected
Kingsoft	Win32.Troj.Undef.a
Gridinsoft	Malware.Win32.RedLine.tr
Microsoft	Backdoor:Win32/Bladabindi!ml
ZoneAlarm	Trojan-Spy.Win32.Stealer.fbwq
GData	Win32.Trojan.Agent.DXSWIS
BitDefenderTheta	Gen:NN.ZexaF.36680.Dq0@a48m@gc
DeepInstinct	MALICIOUS
Malwarebytes	MachineLearning/Anomalous.95%
Tencent	Msil.Trojan.Kryptik.Qgil
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
AVG	Win32:TrojanX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (W)

rdxx1.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All