Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 9, 2024, 3:14 p.m.	Aug. 9, 2024, 3:16 p.m.

Size	2.3MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`486b72c59c13d478f33938c5c25d7e98`
SHA256	`c3ce590201400708a39bbe8eb700aef9281431863de629a9b3f463da690bdcb0`
CRC32	`3FD8F633`
ssdeep	`49152:sb9crquleYywNqjR8lYk9Y1mhso+oqgt9Sf1nP8yy:sboeYyAq8lYP1mhsnoJt9S9P7y`
Yara	PE_Header_Zero - PE File Signature themida_packer - themida packer IsPE32 - (no description)

random.exe "C:\Users\test22\AppData\Local\Temp\random.exe"
2548
- schtasks.exe schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
  2768
- schtasks.exe schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
  2852

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
193.233.132.62	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Aug. 9, 2024, 3:14 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Aug. 9, 2024, 3:14 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (50 out of 59 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:14 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:15 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:15 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:15 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:15 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:15 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:15 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:15 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:15 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:15 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:15 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:15 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:15 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:15 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:15 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:15 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:15 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:15 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:15 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:15 p.m.			0	0
IsDebuggerPresent Aug. 9, 2024, 3:15 p.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Aug. 9, 2024, 3:14 p.m.	buffer: SUCCESS: The scheduled task "MPGPH131 HR" has successfully been created. console_handle: 0x00000007	1	1	0
WriteConsoleW Aug. 9, 2024, 3:14 p.m.	buffer: SUCCESS: The scheduled task "MPGPH131 LG" has successfully been created. console_handle: 0x00000007	1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (6 events)

section	\x00
section	.idata
section
section	nyqsokdy
section	conhnjhr
section	.taggant

One or more processes crashed (50 out of 130 events)

Time & API	Arguments	Status
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: fb e9 4e 01 00 00 60 8b 74 24 24 8b 7c 24 28 fc exception.symbol: random+0x4090b9 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 4231353 exception.address: 0x13190b9 registers.esp: 2882540 registers.edi: 0 registers.eax: 1 registers.ebp: 2882556 registers.edx: 21794816 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb bf fd 3f b7 35 e9 d0 09 00 00 81 c4 04 00 00 exception.symbol: random+0x13e2cf exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 1303247 exception.address: 0x104e2cf registers.esp: 2882508 registers.edi: 1968898280 registers.eax: 28448 registers.ebp: 4007116820 registers.edx: 15794176 registers.ebx: 375073574 registers.esi: 3 registers.ecx: 17124739	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb ba 27 0d ae 6e 81 f2 7b 47 7f 3b e9 08 00 00 exception.symbol: random+0x13e9c2 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 1305026 exception.address: 0x104e9c2 registers.esp: 2882508 registers.edi: 0 registers.eax: 28448 registers.ebp: 4007116820 registers.edx: 15794176 registers.ebx: 322689 registers.esi: 3 registers.ecx: 17099955	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 57 c7 04 24 23 12 ba 4f 81 0c 24 ae 86 f2 7b exception.symbol: random+0x13f69e exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 1308318 exception.address: 0x104f69e registers.esp: 2882508 registers.edi: 0 registers.eax: 30402 registers.ebp: 4007116820 registers.edx: 17130735 registers.ebx: 322689 registers.esi: 3 registers.ecx: 1020817601	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb e9 00 00 00 00 68 3a e4 42 24 89 04 24 89 34 exception.symbol: random+0x13f93e exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 1308990 exception.address: 0x104f93e registers.esp: 2882508 registers.edi: 0 registers.eax: 30402 registers.ebp: 4007116820 registers.edx: 17130735 registers.ebx: 240873 registers.esi: 3 registers.ecx: 4294939900	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb e9 e1 fe ff ff 83 c4 04 e9 2e fc ff ff 5b 52 exception.symbol: random+0x2c720f exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2912783 exception.address: 0x11d720f registers.esp: 2882504 registers.edi: 17136444 registers.eax: 27215 registers.ebp: 4007116820 registers.edx: 18705921 registers.ebx: 1273856 registers.esi: 18705442 registers.ecx: 2120286208	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb be f4 b9 df 1e 56 89 3c 24 83 ec 04 e9 50 fb exception.symbol: random+0x2c7747 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2914119 exception.address: 0x11d7747 registers.esp: 2882508 registers.edi: 17136444 registers.eax: 27215 registers.ebp: 4007116820 registers.edx: 18733136 registers.ebx: 1273856 registers.esi: 18705442 registers.ecx: 2120286208	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 53 e9 0e f7 ff ff fb be f4 b9 df 1e 56 89 3c exception.symbol: random+0x2c7740 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2914112 exception.address: 0x11d7740 registers.esp: 2882508 registers.edi: 17136444 registers.eax: 27215 registers.ebp: 4007116820 registers.edx: 18733136 registers.ebx: 4019664232 registers.esi: 4294942820 registers.ecx: 2120286208	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 29 d2 ff 34 0a 8b 1c 24 51 e9 d3 00 00 00 81 exception.symbol: random+0x2ccb71 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2935665 exception.address: 0x11dcb71 registers.esp: 2882508 registers.edi: 17136444 registers.eax: 29298 registers.ebp: 4007116820 registers.edx: 2130566132 registers.ebx: 58327930 registers.esi: 4294942820 registers.ecx: 18757180	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 68 84 83 fe 24 e9 d9 fc ff ff 89 14 24 55 bd exception.symbol: random+0x2ccd5b exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2936155 exception.address: 0x11dcd5b registers.esp: 2882508 registers.edi: 17136444 registers.eax: 29298 registers.ebp: 4007116820 registers.edx: 4294940624 registers.ebx: 50665 registers.esi: 4294942820 registers.ecx: 18757180	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 05 e3 36 6f 71 03 04 24 68 a1 a2 35 66 e9 5c exception.symbol: random+0x2d4127 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2965799 exception.address: 0x11e4127 registers.esp: 2882504 registers.edi: 6303136 registers.eax: 18759533 registers.ebp: 4007116820 registers.edx: 0 registers.ebx: 18732497 registers.esi: 0 registers.ecx: 1969148396	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 29 db ff 34 03 ff 34 24 ff 34 24 e9 2a 00 00 exception.symbol: random+0x2d444e exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2966606 exception.address: 0x11e444e registers.esp: 2882508 registers.edi: 6303136 registers.eax: 18785452 registers.ebp: 4007116820 registers.edx: 0 registers.ebx: 18732497 registers.esi: 0 registers.ecx: 1969148396	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 81 ec 04 00 00 00 89 2c 24 e9 19 00 00 00 b8 exception.symbol: random+0x2d4964 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2967908 exception.address: 0x11e4964 registers.esp: 2882508 registers.edi: 6303136 registers.eax: 18785452 registers.ebp: 4007116820 registers.edx: 1114345 registers.ebx: 4294944044 registers.esi: 0 registers.ecx: 1969148396	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 53 e9 32 07 00 00 5f 81 exception.symbol: random+0x2d84a9 exception.instruction: in eax, dx exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2983081 exception.address: 0x11e84a9 registers.esp: 2882500 registers.edi: 6303136 registers.eax: 1447909480 registers.ebp: 4007116820 registers.edx: 22104 registers.ebx: 1969033397 registers.esi: 18766364 registers.ecx: 20	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: 0f 3f 07 0b 64 8f 05 00 00 00 00 83 c4 04 83 fb exception.symbol: random+0x2d5c47 exception.address: 0x11e5c47 exception.module: random.exe exception.exception_code: 0xc000001d exception.offset: 2972743 registers.esp: 2882500 registers.edi: 6303136 registers.eax: 1 registers.ebp: 4007116820 registers.edx: 22104 registers.ebx: 0 registers.esi: 18766364 registers.ecx: 20	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: ed 81 fb 68 58 4d 56 75 0a c7 85 dc 3b 2d 12 01 exception.symbol: random+0x2da4b4 exception.instruction: in eax, dx exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2991284 exception.address: 0x11ea4b4 registers.esp: 2882500 registers.edi: 6303136 registers.eax: 1447909480 registers.ebp: 4007116820 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 18766364 registers.ecx: 10	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 50 89 3c 24 50 c7 04 24 9d 5f bb 33 ff 0c 24 exception.symbol: random+0x2dea11 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3009041 exception.address: 0x11eea11 registers.esp: 2882508 registers.edi: 18828574 registers.eax: 6379 registers.ebp: 4007116820 registers.edx: 4294943240 registers.ebx: 2461609 registers.esi: 10 registers.ecx: 2120286208	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: cd 01 eb 00 e9 0a 00 00 00 3d d0 65 47 d7 3e ab exception.symbol: random+0x2df444 exception.instruction: int 1 exception.module: random.exe exception.exception_code: 0xc0000005 exception.offset: 3011652 exception.address: 0x11ef444 registers.esp: 2882468 registers.edi: 0 registers.eax: 2882468 registers.ebp: 4007116820 registers.edx: 18805782 registers.ebx: 18806151 registers.esi: 18805642 registers.ecx: 18805802	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb e9 bb 03 00 00 f7 df 81 c7 e0 a7 ac 06 e9 e5 exception.symbol: random+0x2edd3f exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3071295 exception.address: 0x11fdd3f registers.esp: 2882508 registers.edi: 18890647 registers.eax: 26651 registers.ebp: 4007116820 registers.edx: 6 registers.ebx: 2461831 registers.esi: 1968968720 registers.ecx: 0	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb b9 20 f3 6f 7b e9 b8 f3 ff ff 51 c7 04 24 47 exception.symbol: random+0x2ee3e8 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3073000 exception.address: 0x11fe3e8 registers.esp: 2882508 registers.edi: 18867183 registers.eax: 604292945 registers.ebp: 4007116820 registers.edx: 0 registers.ebx: 2461831 registers.esi: 1968968720 registers.ecx: 0	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 83 ec 04 89 3c 24 89 1c 24 68 d7 f5 44 6d 5b exception.symbol: random+0x2ee949 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3074377 exception.address: 0x11fe949 registers.esp: 2882508 registers.edi: 18867183 registers.eax: 28545 registers.ebp: 4007116820 registers.edx: 0 registers.ebx: 606898519 registers.esi: 4294941168 registers.ecx: 18896152	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 50 57 56 e9 71 02 00 00 81 ec 04 00 00 00 89 exception.symbol: random+0x2ef16f exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3076463 exception.address: 0x11ff16f registers.esp: 2882504 registers.edi: 18867183 registers.eax: 26478 registers.ebp: 4007116820 registers.edx: 1671346343 registers.ebx: 606898519 registers.esi: 4294941168 registers.ecx: 18870438	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 53 bb 49 78 e3 7f e9 a9 02 00 00 bd 01 00 00 exception.symbol: random+0x2ef241 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3076673 exception.address: 0x11ff241 registers.esp: 2882508 registers.edi: 18867183 registers.eax: 26478 registers.ebp: 4007116820 registers.edx: 262633 registers.ebx: 4294943580 registers.esi: 4294941168 registers.ecx: 18896916	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 81 eb e8 32 fb 6f 50 b8 44 99 fb 7d 05 22 09 exception.symbol: random+0x2fc11d exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3129629 exception.address: 0x120c11d registers.esp: 2882496 registers.edi: 4022871035 registers.eax: 27372 registers.ebp: 4007116820 registers.edx: 2130566132 registers.ebx: 18922120 registers.esi: 4027042491 registers.ecx: 2120286208	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 50 89 1c 24 89 04 24 c7 04 24 94 44 fc 1c 53 exception.symbol: random+0x2fc313 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3130131 exception.address: 0x120c313 registers.esp: 2882500 registers.edi: 4022871035 registers.eax: 27372 registers.ebp: 4007116820 registers.edx: 2130566132 registers.ebx: 18949492 registers.esi: 4027042491 registers.ecx: 2120286208	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 55 c7 04 24 9f 97 26 6f ff 34 24 ff 34 24 8b exception.symbol: random+0x2fbeb7 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3129015 exception.address: 0x120beb7 registers.esp: 2882500 registers.edi: 30185 registers.eax: 4294943144 registers.ebp: 4007116820 registers.edx: 2130566132 registers.ebx: 18949492 registers.esi: 4027042491 registers.ecx: 2120286208	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 52 e9 4a fc ff ff 83 c4 04 81 c4 04 00 00 00 exception.symbol: random+0x3195c8 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3249608 exception.address: 0x12295c8 registers.esp: 2882464 registers.edi: 19037599 registers.eax: 19042811 registers.ebp: 4007116820 registers.edx: 2130566132 registers.ebx: 19037599 registers.esi: 19037599 registers.ecx: 2120286208	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 68 8d 5b 04 37 89 04 24 b8 6f 40 3d 6d 91 e9 exception.symbol: random+0x31999f exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3250591 exception.address: 0x122999f registers.esp: 2882468 registers.edi: 19037599 registers.eax: 19045673 registers.ebp: 4007116820 registers.edx: 2130566132 registers.ebx: 0 registers.esi: 19037599 registers.ecx: 24570195	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 55 bd 98 65 b3 4d 81 ed 2f 15 b7 6f c1 ed 02 exception.symbol: random+0x31a7a2 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3254178 exception.address: 0x122a7a2 registers.esp: 2882464 registers.edi: 19037599 registers.eax: 27287 registers.ebp: 4007116820 registers.edx: 19046105 registers.ebx: 0 registers.esi: 19037599 registers.ecx: 823017480	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 31 c0 ff 34 10 ff 34 24 e9 a1 02 00 00 89 1c exception.symbol: random+0x31a047 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3252295 exception.address: 0x122a047 registers.esp: 2882468 registers.edi: 19037599 registers.eax: 27287 registers.ebp: 4007116820 registers.edx: 19073392 registers.ebx: 0 registers.esi: 19037599 registers.ecx: 823017480	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 68 87 27 39 6d 89 14 24 e9 36 05 00 00 c1 ea exception.symbol: random+0x31a095 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3252373 exception.address: 0x122a095 registers.esp: 2882468 registers.edi: 19037599 registers.eax: 4294942440 registers.ebp: 4007116820 registers.edx: 19073392 registers.ebx: 0 registers.esi: 19037599 registers.ecx: 1375758944	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 55 bd 78 49 fd 5c 81 cd 91 00 f9 2d 81 c5 07 exception.symbol: random+0x31b92c exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3258668 exception.address: 0x122b92c registers.esp: 2882464 registers.edi: 19049231 registers.eax: 19051286 registers.ebp: 4007116820 registers.edx: 19071088 registers.ebx: 328167433 registers.esi: 19048567 registers.ecx: 0	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 68 55 81 89 14 e9 f2 06 00 00 81 c3 21 ff 7e exception.symbol: random+0x31b765 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3258213 exception.address: 0x122b765 registers.esp: 2882468 registers.edi: 19049231 registers.eax: 19054357 registers.ebp: 4007116820 registers.edx: 0 registers.ebx: 328167433 registers.esi: 606898514 registers.ecx: 0	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 53 89 e3 57 bf 2a d1 75 5f c1 ef 04 81 f7 16 exception.symbol: random+0x31c88f exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3262607 exception.address: 0x122c88f registers.esp: 2882464 registers.edi: 19049231 registers.eax: 19054631 registers.ebp: 4007116820 registers.edx: 357815295 registers.ebx: 328167433 registers.esi: 606898514 registers.ecx: 0	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb bf 45 ee 8e 4f c1 ef 02 e9 37 f9 ff ff 89 f2 exception.symbol: random+0x31ca06 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3262982 exception.address: 0x122ca06 registers.esp: 2882468 registers.edi: 19049231 registers.eax: 19083910 registers.ebp: 4007116820 registers.edx: 357815295 registers.ebx: 328167433 registers.esi: 606898514 registers.ecx: 0	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 68 92 c4 e2 4d 89 0c 24 53 c7 04 24 4e 4d a6 exception.symbol: random+0x31c418 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3261464 exception.address: 0x122c418 registers.esp: 2882468 registers.edi: 4294940632 registers.eax: 19083910 registers.ebp: 4007116820 registers.edx: 357815295 registers.ebx: 328167433 registers.esi: 606898514 registers.ecx: 604292944	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 68 18 a2 ab 23 89 14 24 51 b9 2d ba b7 6f 50 exception.symbol: random+0x31cd30 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3263792 exception.address: 0x122cd30 registers.esp: 2882468 registers.edi: 4294940632 registers.eax: 4294942336 registers.ebp: 4007116820 registers.edx: 1973833038 registers.ebx: 1019256205 registers.esi: 19085479 registers.ecx: 1850548832	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 81 c1 59 47 af 6f 81 e9 b1 93 df 79 81 e9 34 exception.symbol: random+0x3230ab exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3289259 exception.address: 0x12330ab registers.esp: 2882464 registers.edi: 287856588 registers.eax: 29390 registers.ebp: 4007116820 registers.edx: 19080607 registers.ebx: 65786 registers.esi: 19058815 registers.ecx: 19081225	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb e9 e2 03 00 00 43 83 ec 04 89 14 24 ba 30 5b exception.symbol: random+0x3228c3 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3287235 exception.address: 0x12328c3 registers.esp: 2882468 registers.edi: 287856588 registers.eax: 29390 registers.ebp: 4007116820 registers.edx: 19080607 registers.ebx: 94185 registers.esi: 4294940984 registers.ecx: 19110615	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 83 ec 04 89 34 24 c7 04 24 0c 0c 72 28 89 1c exception.symbol: random+0x326450 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3302480 exception.address: 0x1236450 registers.esp: 2882468 registers.edi: 287856588 registers.eax: 27103 registers.ebp: 4007116820 registers.edx: 19080607 registers.ebx: 1978711661 registers.esi: 4294940984 registers.ecx: 19121052	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 68 be 68 52 4b 89 0c 24 68 7f 0c 2d 5b 89 34 exception.symbol: random+0x325df7 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3300855 exception.address: 0x1235df7 registers.esp: 2882468 registers.edi: 287856588 registers.eax: 27103 registers.ebp: 4007116820 registers.edx: 0 registers.ebx: 3939837675 registers.esi: 4294940984 registers.ecx: 19096956	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 55 e9 66 04 00 00 8b 14 24 81 c4 04 00 00 00 exception.symbol: random+0x326ce0 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3304672 exception.address: 0x1236ce0 registers.esp: 2882468 registers.edi: 19125537 registers.eax: 26808 registers.ebp: 4007116820 registers.edx: 19098255 registers.ebx: 3939837676 registers.esi: 1305428167 registers.ecx: 19111375	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 53 c7 04 24 18 a8 77 5f c1 24 24 01 ff 04 24 exception.symbol: random+0x326eb1 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3305137 exception.address: 0x1236eb1 registers.esp: 2882468 registers.edi: 19101681 registers.eax: 26808 registers.ebp: 4007116820 registers.edx: 19098255 registers.ebx: 0 registers.esi: 1305428167 registers.ecx: 322689	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 51 53 bb 0f eb ff 7f e9 a9 01 00 00 09 da 5b exception.symbol: random+0x339b91 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3382161 exception.address: 0x1249b91 registers.esp: 2882464 registers.edi: 4124925318 registers.eax: 19174725 registers.ebp: 4007116820 registers.edx: 4124925318 registers.ebx: 19158279 registers.esi: 3916040 registers.ecx: 18875039	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 83 ec 04 89 2c 24 c7 04 24 98 8f eb 77 ff 04 exception.symbol: random+0x339e23 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3382819 exception.address: 0x1249e23 registers.esp: 2882468 registers.edi: 4124925318 registers.eax: 19206059 registers.ebp: 4007116820 registers.edx: 4124925318 registers.ebx: 19158279 registers.esi: 3916040 registers.ecx: 18875039	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 51 81 ec 04 00 00 00 89 2c 24 e9 00 00 00 00 exception.symbol: random+0x339b4d exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3382093 exception.address: 0x1249b4d registers.esp: 2882468 registers.edi: 4124925318 registers.eax: 19177475 registers.ebp: 4007116820 registers.edx: 0 registers.ebx: 2298801283 registers.esi: 3916040 registers.ecx: 18875039	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 52 89 04 24 e9 3c fe ff ff 5e 01 d6 5a 56 ff exception.symbol: random+0x3417e1 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3413985 exception.address: 0x12517e1 registers.esp: 2882468 registers.edi: 4025705772 registers.eax: 30583 registers.ebp: 4007116820 registers.edx: 1629304 registers.ebx: 4025970495 registers.esi: 19237349 registers.ecx: 20834187	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 51 b9 62 fa f1 1b 50 b8 e6 ce ff 6b c1 e8 04 exception.symbol: random+0x341455 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3413077 exception.address: 0x1251455 registers.esp: 2882468 registers.edi: 19130711 registers.eax: 30583 registers.ebp: 4007116820 registers.edx: 1629304 registers.ebx: 4025970495 registers.esi: 19237349 registers.ecx: 4294939824	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 53 52 56 68 c1 bc d9 7e 5e 81 f6 60 b8 36 13 exception.symbol: random+0x34a686 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3450502 exception.address: 0x125a686 registers.esp: 2882468 registers.edi: 19222865 registers.eax: 30689 registers.ebp: 4007116820 registers.edx: 322689 registers.ebx: 4294940132 registers.esi: 19237349 registers.ecx: 19273858	1
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: fb 81 c1 00 bc ef 3b 57 e9 d4 09 00 00 8b 0c 24 exception.symbol: random+0x35376a exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 3487594 exception.address: 0x126376a registers.esp: 2882464 registers.edi: 4124925318 registers.eax: 31907 registers.ebp: 4007116820 registers.edx: 4124925318 registers.ebx: 19260175 registers.esi: 3916040 registers.ecx: 19281708	1

Allocates read-write-execute memory (usually to unpack itself) (40 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76faf000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f20000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 589824 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00f11000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00590000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00be0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bf0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ca0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00cb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ea0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00eb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ec0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02920000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02930000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02940000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 9, 2024, 3:14 p.m.	process_identifier: 2548 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

random.exe tried to sleep 1052 seconds, actually delayed analysis time by 1052 seconds

Creates a suspicious process (2 events)

cmdline	schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
cmdline	schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW Aug. 9, 2024, 3:14 p.m.	thread_identifier: 2772 thread_handle: 0x000001a0 process_identifier: 2768 current_directory: filepath: track: 1 command_line: schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x000001a4	1	1	0
CreateProcessInternalW Aug. 9, 2024, 3:14 p.m.	thread_identifier: 2856 thread_handle: 0x000001ac process_identifier: 2852 current_directory: filepath: track: 1 command_line: schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x000001a8	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (4 events)

section

{u'size_of_data': u'0x0008f400', u'virtual_address': u'0x00001000', u'entropy': 7.991716402025224, u'name': u' \\x00 ', u'virtual_size': u'0x00137000'}

entropy

7.99171640203

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00001800', u'virtual_address': u'0x00138000', u'entropy': 7.350505783824077, u'name': u'.rsrc', u'virtual_size': u'0x00002e70'}

entropy

7.35050578382

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x001aee00', u'virtual_address': u'0x00409000', u'entropy': 7.952495827205456, u'name': u'nyqsokdy', u'virtual_size': u'0x001af000'}

entropy

7.95249582721

description

A section with a high entropy has been found

entropy

0.995460440986

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 event)

process

system

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
cmdline	schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Communicates with host for which no DNS query was performed (1 event)

host

193.233.132.62

Checks for the presence of known devices from debuggers and forensic tools (3 events)

file	\??\SICE
file	\??\SIWVID
file	\??\NTICE

Checks for the presence of known windows from debuggers and forensic tools (50 out of 341 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: pediy06 window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: #0 window_name: File Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: #0 window_name: Process Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: #0 window_name: Registry Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: #0 window_name: File Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: #0 window_name: Process Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: pediy06 window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: pediy06 window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: pediy06 window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: pediy06 window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: pediy06 window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: pediy06 window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA Aug. 9, 2024, 3:14 p.m.	class_name: 18467-41 window_name:		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Installs itself for autorun at Windows startup (3 events)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\RageMP131	reg_value	C:\Users\test22\AppData\Local\RageMP131\RageMP131.exe
cmdline	schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
cmdline	schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Uses Sysinternals tools in order to add additional command line functionality (2 events)

cmdline	schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
cmdline	schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Aug. 9, 2024, 3:14 p.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 53 e9 32 07 00 00 5f 81 exception.symbol: random+0x2d84a9 exception.instruction: in eax, dx exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 2983081 exception.address: 0x11e84a9 registers.esp: 2882500 registers.edi: 6303136 registers.eax: 1447909480 registers.ebp: 4007116820 registers.edx: 22104 registers.ebx: 1969033397 registers.esi: 18766364 registers.ecx: 20	1	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

193.233.132.62:50500

File has been identified by 45 AntiVirus engines on VirusTotal as malicious (45 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.RisePro.i!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.Nitol.vc
ALYac	Gen:Variant.Zusy.537941
Cylance	unsafe
VIPRE	Gen:Variant.Zusy.537941
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 005376ae1 )
BitDefender	Gen:Variant.Zusy.537941
K7GW	Trojan ( 005376ae1 )
Cybereason	malicious.96c6ba
Arcabit	Trojan.Zusy.D83555
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Packed.Themida.HZB
McAfee	RisePro-FWJD!486B72C59C13
Avast	Win32:TrojanX-gen [Trj]
Kaspersky	VHO:Trojan-PSW.Win32.RisePro.gen
MicroWorld-eScan	Gen:Variant.Zusy.537941
Rising	Stealer.RisePro!8.176E1 (CLOUD)
Emsisoft	Gen:Variant.Zusy.537941 (B)
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.486b72c59c13d478
Sophos	Mal/RisePro-A
Ikarus	Trojan.Win32.Themida
Google	Detected
MAX	malware (ai score=80)
Kingsoft	Win32.HeurC.KVMH008.a
Gridinsoft	Trojan.Heur!.038120A1
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm	VHO:Trojan-PSW.Win32.RisePro.gen
GData	Gen:Variant.Zusy.537941
AhnLab-V3	Trojan/Win.TrojanX-gen.R636436
BitDefenderTheta	Gen:NN.ZexaF.36744.qE0aaOMp95kk
DeepInstinct	MALICIOUS
VBA32	BScope.TrojanPSW.RisePro
Malwarebytes	Trojan.MalPack
Zoner	Probably Heur.ExeHeaderL
Tencent	Win32.Trojan.Generic.Xylw
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Themida.370B!tr
AVG	Win32:TrojanX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (D)

random.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All