Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	May 28, 2024, 10:42 a.m.	May 28, 2024, 10:44 a.m.

Size	1.1MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`cbaa1a61c93704f1540e48a8dd9bac14`
SHA256	`44c5191f1061cc9340498b5841ac6b3e2488ca5b5e5e8a812687bbf864125a61`
CRC32	`5BF7AB8A`
ssdeep	`24576:ak70TrcQpr36EV4vthwS9GX/rm4pGul+ZEnGKVT:akQTAQ36vE7rbG8tGKx`
PDB Path
Yara	Malicious_Library_Zero - Malicious_Library MALWARE_Win_VT_RedLine - Detects RedLine infostealer UltraVNC_Zero - UltraVNC PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

GGWS_UPLOAD.exe "C:\Users\test22\AppData\Local\Temp\GGWS_UPLOAD.exe"
2052

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 26, 2024, 8:49 p.m.			0	0
IsDebuggerPresent May 26, 2024, 8:49 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return
CryptExportKey May 26, 2024, 8:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00690b08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2024, 8:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00690b08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2024, 8:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00690b48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2024, 8:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00690b48 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2024, 8:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00690b88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 26, 2024, 8:49 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00690b88 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 26, 2024, 8:49 p.m.		1	1	0

One or more processes crashed (50 out of 252 events)

Time & API	Arguments	Status
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: f3 aa 8b 45 f0 8b 4d 08 8b 55 10 03 c8 2b d0 52 exception.symbol: ggws_upload+0xf088 exception.instruction: stosb byte ptr es:[edi], al exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61576 exception.address: 0x40f088 registers.esp: 1636996 registers.edi: 4367324 registers.eax: 0 registers.ebp: 1637012 registers.edx: 0 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 4	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4370400 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 8007	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4374496 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7975	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4378592 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7943	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4382688 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7911	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4386784 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7879	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4390880 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7847	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4394976 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7815	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4399072 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7783	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4403168 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7751	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4407264 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7719	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4411360 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7687	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4415456 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7655	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4419552 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7623	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4423648 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7591	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4427744 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7559	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4431840 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7527	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4435936 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7495	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4440032 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7463	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4444128 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7431	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4448224 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7399	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4452320 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7367	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4456416 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7335	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4460512 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7303	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4464608 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7271	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4468704 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7239	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4472800 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7207	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4476896 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7175	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4480992 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7143	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4485088 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7111	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4489184 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7079	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4493280 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7047	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4497376 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 7015	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4501472 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 6983	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4505568 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 6951	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4509664 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 6919	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4513760 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 6887	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4517856 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 6855	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4521952 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 6823	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4526048 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 6791	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4530144 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 6759	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4534240 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 6727	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4538336 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 6695	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4542432 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 6663	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4546528 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 6631	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4550624 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 6599	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4554720 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 6567	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4558816 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 6535	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4562912 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 6503	1
__exception__ May 26, 2024, 8:49 p.m.	stacktrace: ggws_upload+0xf054 @ 0x40f054 ggws_upload+0xf0a0 @ 0x40f0a0 ggws_upload+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws_upload+0xeff0 exception.address: 0x40eff0 exception.module: GGWS_UPLOAD.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4567008 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 22 registers.ebx: 0 registers.esi: 7733280 registers.ecx: 6471	1

Allocates read-write-execute memory (usually to unpack itself) (33 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02460000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02590000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02710000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ea1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ea2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02310000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02340000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02711000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02712000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02713000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02714000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0210b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02107000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02105000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 40960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b71000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b7b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d64000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b7c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051f1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02716000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 26, 2024, 8:49 p.m.	process_identifier: 2052 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0271a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000ffa00', u'virtual_address': u'0x00026000', u'entropy': 7.993774534092373, u'name': u'.rsrc', u'virtual_size': u'0x000ff8e8'}

entropy

7.99377453409

description

A section with a high entropy has been found

entropy

0.883369330454

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 26, 2024, 8:49 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Multi
Skyhigh	BehavesLike.Win32.Generic.tc
ALYac	Trojan.GenericKD.72888496
Cylance	unsafe
VIPRE	Trojan.GenericKD.72888496
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Riskware ( 00584baa1 )
BitDefender	Trojan.GenericKD.72888496
K7GW	Riskware ( 00584baa1 )
Arcabit	Trojan.Generic.D45830B0
VirIT	Trojan.Win32.Genus.VUC
Symantec	Trojan.Gen.MBT
tehtris	Generic.Malware
APEX	Malicious
McAfee	Artemis!CBAA1A61C937
Avast	Win32:Malware-gen
Kaspersky	UDS:DangerousObject.Multi.Generic
MicroWorld-eScan	Trojan.GenericKD.72888496
Rising	Trojan.Generic@AI.100 (RDML:PRsJ4+rQ8uqlMwKHh6D/pA)
Emsisoft	Trojan.GenericKD.72888496 (B)
TrendMicro	TrojanSpy.Win32.REDLINE.YXEEZZ
McAfeeD	ti!44C5191F1061
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.cbaa1a61c93704f1
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.Crypt
Webroot	W32.Trojan.GenKD
Google	Detected
MAX	malware (ai score=86)
Kingsoft	Win32.Troj.Unknown.a
Gridinsoft	Trojan.Win32.Agent.sa
Microsoft	Trojan:Win32/Casdet!rfn
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Trojan.GenericKD.72888496
Varist	W32/ABRisk.DWPL-6486
AhnLab-V3	Trojan/Win.Generic.C5626683
BitDefenderTheta	Gen:NN.ZexaF.36804.ir0@auzIPtb
DeepInstinct	MALICIOUS
Malwarebytes	Spyware.Stealer
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TrojanSpy.Win32.REDLINE.YXEEZZ
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.1728101.susgen
Fortinet	W32/PossibleThreat
AVG	Win32:Malware-gen
Paloalto	generic.ml

GGWS_UPLOAD.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All