Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 11, 2024, 2:25 p.m.	Aug. 11, 2024, 3:20 p.m.

Size	6.1MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`e2b0ca22d48c42d262cf6015565a106c`
SHA256	`d9d996d7ff1501de587ba3bb7f15e9d3ea3f81b58a8a20348f1e229158c5b01e`
CRC32	`BA488192`
ssdeep	`98304:SaMZXSmGU+Ex+69ryNwVDfwqWPSvMjBLjwoNcZUpxkTGDDRJf8QWU4MXOEWyY8MB:S/GVK+N8YqWPS3ZEWTGDD4qXZoZ`
PDB Path
Yara	Malicious_Library_Zero - Malicious_Library MALWARE_Win_VT_RedLine - Detects RedLine infostealer PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file UltraVNC_Zero - UltraVNC Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

GGWS.exe "C:\Users\test22\AppData\Local\Temp\GGWS.exe"
2576

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
47.104.173.216	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49164 -> 47.104.173.216:8082	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 47.104.173.216:8082 -> 192.168.56.101:49164	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 47.104.173.216:8082 -> 192.168.56.101:49164	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 47.104.173.216:8082 -> 192.168.56.101:49164	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.101:49164 -> 47.104.173.216:8082	2016141	ET INFO Executable Download from dotted-quad Host	Potentially Bad Traffic
TCP 47.104.173.216:8082 -> 192.168.56.101:49164	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 47.104.173.216:8082 -> 192.168.56.101:49164	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 11, 2024, 2:25 p.m.			0	0
IsDebuggerPresent Aug. 11, 2024, 2:25 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 11, 2024, 2:25 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c12770 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 11, 2024, 2:25 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c12be8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 11, 2024, 2:25 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c149e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 11, 2024, 2:25 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c149e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 11, 2024, 2:25 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c14968 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 11, 2024, 2:25 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00c14968 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 11, 2024, 2:25 p.m.		1	1	0

One or more processes crashed (50 out of 1522 events)

Time & API	Arguments	Status
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: f3 aa 8b 45 f0 8b 4d 08 8b 55 10 03 c8 2b d0 52 exception.symbol: ggws+0xf088 exception.instruction: stosb byte ptr es:[edi], al exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61576 exception.address: 0x40f088 registers.esp: 1636996 registers.edi: 4367324 registers.eax: 0 registers.ebp: 1637012 registers.edx: 0 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 4	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4370400 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 48631	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4374496 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 48599	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4378592 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 48567	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4382688 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 48535	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4386784 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 48503	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4390880 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 48471	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4394976 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 48439	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4399072 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 48407	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4403168 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 48375	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4407264 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 48343	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4411360 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 48311	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4415456 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 48279	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4419552 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 48247	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4423648 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 48215	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4427744 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 48183	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4431840 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 48151	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4435936 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 48119	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4440032 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 48087	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4444128 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 48055	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4448224 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 48023	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4452320 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47991	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4456416 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47959	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4460512 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47927	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4464608 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47895	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4468704 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47863	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4472800 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47831	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4476896 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47799	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4480992 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47767	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4485088 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47735	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4489184 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47703	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4493280 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47671	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4497376 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47639	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4501472 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47607	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4505568 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47575	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4509664 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47543	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4513760 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47511	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4517856 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47479	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4521952 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47447	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4526048 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47415	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4530144 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47383	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4534240 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47351	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4538336 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47319	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4542432 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47287	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4546528 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47255	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4550624 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47223	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4554720 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47191	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4558816 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47159	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4562912 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47127	1
__exception__ Aug. 11, 2024, 2:25 p.m.	stacktrace: ggws+0xf054 @ 0x40f054 ggws+0xf0a0 @ 0x40f0a0 ggws+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: ggws+0xeff0 exception.address: 0x40eff0 exception.module: GGWS.exe exception.exception_code: 0xc0000005 exception.offset: 61424 registers.esp: 1636940 registers.edi: 4567008 registers.eax: 4367328 registers.ebp: 1636944 registers.edx: 26 registers.ebx: 0 registers.esi: 38076448 registers.ecx: 47095	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (37 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03340000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03520000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02310000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03560000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03740000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02311000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02312000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02313000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02314000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0235b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02357000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x034c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02355000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x034c1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02306000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0230a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02307000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x034ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03730000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735d4000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x034cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x034cf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73272000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02316000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0231a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06100000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06101000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0230b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:25 p.m.	process_identifier: 2576 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06102000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\GGWSUpdate.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\GGWSUpdate.exe

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Aug. 11, 2024, 2:25 p.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x005f5200', u'virtual_address': u'0x00026000', u'entropy': 7.999710936377812, u'name': u'.rsrc', u'virtual_size': u'0x005f50bc'}

entropy

7.99971093638

description

A section with a high entropy has been found

entropy

0.97834977147

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Aug. 11, 2024, 2:25 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host

47.104.173.216

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Aug. 11, 2024, 2:25 p.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

Generates some ICMP traffic

File has been identified by 42 AntiVirus engines on VirusTotal as malicious (42 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.Sality.vc
ALYac	Trojan.GenericKD.73308487
Cylance	Unsafe
VIPRE	Trojan.GenericKD.73308487
K7AntiVirus	Riskware ( 00584baa1 )
BitDefender	Trojan.GenericKD.73308487
K7GW	Riskware ( 00584baa1 )
Cybereason	malicious.2d48c4
VirIT	Trojan.Win32.Genus.VUC
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	UDS:DangerousObject.Multi.Generic
MicroWorld-eScan	Trojan.GenericKD.73308487
Emsisoft	Trojan.GenericKD.73308487 (B)
TrendMicro	TrojanSpy.Win32.REDLINE.YXEFZZ
McAfeeD	ti!D9D996D7FF15
FireEye	Generic.mg.e2b0ca22d48c42d2
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
Google	Detected
MAX	malware (ai score=81)
Kingsoft	MSIL.Trojan.Convagent.gen
Arcabit	Trojan.Generic.D45E9947
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Trojan.GenericKD.73308487
Varist	W32/ABRisk.GKJT-8038
BitDefenderTheta	Gen:NN.ZexaF.36810.@t0@aGq61vk
DeepInstinct	MALICIOUS
Malwarebytes	Spyware.Stealer
Ikarus	Packet.DotNetReactor
TrendMicro-HouseCall	TrojanSpy.Win32.REDLINE.YXEFZZ
MaxSecure	Trojan.Malware.1728101.susgen
AVG	Win32:Malware-gen
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_60% (W)
alibabacloud	Trojan

GGWS.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All