Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 30, 2024, 9:33 a.m.	Sept. 30, 2024, 10 a.m.

Size	741.9KB
Type	MS-DOS executable, MZ for MS-DOS
MD5	`9cfc9f5f8a781cbf07b23cc803b9d098`
SHA256	`63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7`
CRC32	`69582E65`
ssdeep	`12288:ltTuh645I8jWtJ8OgL27rd69bk5NCgGhSFB79gYhLIf6EQ9EYcw1Fk:lIg4kt0Kd6F6CNzYhUiEWEYcws`
Yara	PE_Header_Zero - PE File Signature anti_vm_detect - Possibly employs anti-virtualization techniques IsPE32 - (no description) UPX_Zero - UPX packed file

63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe "C:\Users\test22\AppData\Local\Temp\63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe"
2548
- explorer.exe c:\windows\resources\themes\explorer.exe
  2644
  - spoolsv.exe c:\windows\resources\spoolsv.exe SE
    2712
    - svchost.exe c:\windows\resources\svchost.exe
      2764
      - spoolsv.exe c:\windows\resources\spoolsv.exe PR
        2816
      - schtasks.exe schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 10:35 /f
        2928
      - schtasks.exe schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 10:36 /f
        16816
  - explorer.exe C:\Windows\Explorer.exe
    2884

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (7 events)

Time & API	Arguments	Status	Return
GetComputerNameA Sept. 30, 2024, 9:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 30, 2024, 9:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 30, 2024, 9:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 30, 2024, 9:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 30, 2024, 9:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:33 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 30, 2024, 9:34 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 30, 2024, 9:33 a.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Sept. 30, 2024, 9:33 a.m.	buffer: SUCCESS: The scheduled task "svchost" has successfully been created. console_handle: 0x00000007	1	1	0
WriteConsoleW Sept. 30, 2024, 9:34 a.m.	buffer: SUCCESS: The scheduled task "svchost" has successfully been created. console_handle: 0x00000007	1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

The executable uses a known packer (1 event)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (50 out of 171 events)

Time & API	Arguments	Status
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x17113d @ 0x57113d 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: f7 f0 e8 10 e8 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd921d exception.instruction: div eax exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc0000094 exception.offset: 889373 exception.address: 0x4d921d registers.esp: 1638132 registers.edi: 5664908 registers.eax: 0 registers.ebp: 1638160 registers.edx: 0 registers.ebx: 46412800 registers.esi: 3 registers.ecx: 1638148	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16fd08 @ 0x56fd08 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: f7 f0 e8 10 e8 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd921d exception.instruction: div eax exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc0000094 exception.offset: 889373 exception.address: 0x4d921d registers.esp: 1638076 registers.edi: 5664908 registers.eax: 0 registers.ebp: 1638104 registers.edx: 0 registers.ebx: 135168 registers.esi: 4329472 registers.ecx: 4329472	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16fd08 @ 0x56fd08 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: 0f 0b e8 e5 e7 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd9248 exception.instruction: ud2 exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc000001d exception.offset: 889416 exception.address: 0x4d9248 registers.esp: 1638076 registers.edi: 1638076 registers.eax: 0 registers.ebp: 1638104 registers.edx: 2 registers.ebx: 5083699 registers.esi: 0 registers.ecx: 1638112	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16fd08 @ 0x56fd08 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: f7 f0 e8 10 e8 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd921d exception.instruction: div eax exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc0000094 exception.offset: 889373 exception.address: 0x4d921d registers.esp: 1638076 registers.edi: 1638076 registers.eax: 0 registers.ebp: 1638104 registers.edx: 0 registers.ebx: 5083742 registers.esi: 0 registers.ecx: 1638112	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16fd08 @ 0x56fd08 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: f7 f0 e8 10 e8 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd921d exception.instruction: div eax exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc0000094 exception.offset: 889373 exception.address: 0x4d921d registers.esp: 1638076 registers.edi: 1638076 registers.eax: 0 registers.ebp: 1638104 registers.edx: 0 registers.ebx: 5083699 registers.esi: 0 registers.ecx: 1638112	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16fd08 @ 0x56fd08 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: f7 f0 e8 10 e8 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd921d exception.instruction: div eax exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc0000094 exception.offset: 889373 exception.address: 0x4d921d registers.esp: 1638076 registers.edi: 1638076 registers.eax: 0 registers.ebp: 1638104 registers.edx: 0 registers.ebx: 5083699 registers.esi: 0 registers.ecx: 1638112	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16fe34 @ 0x56fe34 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: 0f 0b e8 e5 e7 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd9248 exception.instruction: ud2 exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc000001d exception.offset: 889416 exception.address: 0x4d9248 registers.esp: 1638076 registers.edi: 5664908 registers.eax: 0 registers.ebp: 1638104 registers.edx: 2 registers.ebx: 135168 registers.esi: 4329472 registers.ecx: 1210487117	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16fe48 @ 0x56fe48 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: cc c6 45 ff 01 33 c0 5a 59 59 64 89 10 eb 0a e9 exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xfca9d exception.instruction: int3 exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0x80000003 exception.offset: 1034909 exception.address: 0x4fca9d registers.esp: 1638076 registers.edi: 5655117 registers.eax: 2324 registers.ebp: 1638104 registers.edx: 49523816 registers.ebx: 135168 registers.esi: 4343367 registers.ecx: 1	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: exception.instruction_r: cc c6 45 ff 01 33 c0 5a 59 59 64 89 10 eb 0a e9 exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xfcd6e exception.instruction: int3 exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0x80000003 exception.offset: 1035630 exception.address: 0x4fcd6e registers.esp: 1638076 registers.edi: 5664908 registers.eax: 4 registers.ebp: 1111705675 registers.edx: 1637888 registers.ebx: 135168 registers.esi: 4329472 registers.ecx: 2131296256	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16ff06 @ 0x56ff06 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: f7 f0 e8 10 e8 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd921d exception.instruction: div eax exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc0000094 exception.offset: 889373 exception.address: 0x4d921d registers.esp: 1638076 registers.edi: 5664908 registers.eax: 0 registers.ebp: 1638104 registers.edx: 0 registers.ebx: 135168 registers.esi: 4329472 registers.ecx: 582	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16ff06 @ 0x56ff06 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: f7 f0 e8 10 e8 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd921d exception.instruction: div eax exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc0000094 exception.offset: 889373 exception.address: 0x4d921d registers.esp: 1638076 registers.edi: 1638076 registers.eax: 0 registers.ebp: 1638104 registers.edx: 0 registers.ebx: 5083699 registers.esi: 0 registers.ecx: 1638112	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16ff06 @ 0x56ff06 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: f7 f0 e8 10 e8 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd921d exception.instruction: div eax exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc0000094 exception.offset: 889373 exception.address: 0x4d921d registers.esp: 1638076 registers.edi: 1638076 registers.eax: 0 registers.ebp: 1638104 registers.edx: 0 registers.ebx: 5083699 registers.esi: 0 registers.ecx: 1638112	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16ff06 @ 0x56ff06 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: f7 f0 e8 10 e8 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd921d exception.instruction: div eax exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc0000094 exception.offset: 889373 exception.address: 0x4d921d registers.esp: 1638076 registers.edi: 1638076 registers.eax: 0 registers.ebp: 1638104 registers.edx: 0 registers.ebx: 5083699 registers.esi: 0 registers.ecx: 1638112	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16ff06 @ 0x56ff06 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: 0f 0b e8 e5 e7 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd9248 exception.instruction: ud2 exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc000001d exception.offset: 889416 exception.address: 0x4d9248 registers.esp: 1638076 registers.edi: 1638076 registers.eax: 0 registers.ebp: 1638104 registers.edx: 2 registers.ebx: 5083699 registers.esi: 0 registers.ecx: 1638112	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16ff06 @ 0x56ff06 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: 0f 0b e8 e5 e7 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd9248 exception.instruction: ud2 exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc000001d exception.offset: 889416 exception.address: 0x4d9248 registers.esp: 1638076 registers.edi: 1638076 registers.eax: 0 registers.ebp: 1638104 registers.edx: 2 registers.ebx: 5083742 registers.esi: 0 registers.ecx: 1638112	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x170000 @ 0x570000 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: 0f 0b e8 e5 e7 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd9248 exception.instruction: ud2 exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc000001d exception.offset: 889416 exception.address: 0x4d9248 registers.esp: 1638076 registers.edi: 5664908 registers.eax: 0 registers.ebp: 1638104 registers.edx: 2 registers.ebx: 135168 registers.esi: 4329472 registers.ecx: 2152800010	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x170000 @ 0x570000 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: f7 f0 e8 10 e8 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd921d exception.instruction: div eax exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc0000094 exception.offset: 889373 exception.address: 0x4d921d registers.esp: 1638076 registers.edi: 1638076 registers.eax: 0 registers.ebp: 1638104 registers.edx: 0 registers.ebx: 5083742 registers.esi: 0 registers.ecx: 1638112	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x170000 @ 0x570000 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: f7 f0 e8 10 e8 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd921d exception.instruction: div eax exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc0000094 exception.offset: 889373 exception.address: 0x4d921d registers.esp: 1638076 registers.edi: 1638076 registers.eax: 0 registers.ebp: 1638104 registers.edx: 0 registers.ebx: 5083699 registers.esi: 0 registers.ecx: 1638112	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x170000 @ 0x570000 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: 0f 0b e8 e5 e7 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd9248 exception.instruction: ud2 exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc000001d exception.offset: 889416 exception.address: 0x4d9248 registers.esp: 1638076 registers.edi: 1638076 registers.eax: 0 registers.ebp: 1638104 registers.edx: 2 registers.ebx: 5083699 registers.esi: 0 registers.ecx: 1638112	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x170000 @ 0x570000 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: f7 f0 e8 10 e8 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd921d exception.instruction: div eax exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc0000094 exception.offset: 889373 exception.address: 0x4d921d registers.esp: 1638076 registers.edi: 1638076 registers.eax: 0 registers.ebp: 1638104 registers.edx: 0 registers.ebx: 5083742 registers.esi: 0 registers.ecx: 1638112	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x170000 @ 0x570000 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: 0f 0b e8 e5 e7 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd9248 exception.instruction: ud2 exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc000001d exception.offset: 889416 exception.address: 0x4d9248 registers.esp: 1638076 registers.edi: 1638076 registers.eax: 0 registers.ebp: 1638104 registers.edx: 2 registers.ebx: 5083699 registers.esi: 0 registers.ecx: 1638112	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x170000 @ 0x570000 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: f7 f0 e8 10 e8 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd921d exception.instruction: div eax exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc0000094 exception.offset: 889373 exception.address: 0x4d921d registers.esp: 1638076 registers.edi: 1638076 registers.eax: 0 registers.ebp: 1638104 registers.edx: 0 registers.ebx: 5083742 registers.esi: 0 registers.ecx: 1638112	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x170096 @ 0x570096 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: f7 f0 e8 10 e8 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd921d exception.instruction: div eax exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc0000094 exception.offset: 889373 exception.address: 0x4d921d registers.esp: 1638076 registers.edi: 5664908 registers.eax: 0 registers.ebp: 1638104 registers.edx: 0 registers.ebx: 135168 registers.esi: 4329472 registers.ecx: 270013951	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x170096 @ 0x570096 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: f7 f0 e8 10 e8 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd921d exception.instruction: div eax exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc0000094 exception.offset: 889373 exception.address: 0x4d921d registers.esp: 1638076 registers.edi: 1638076 registers.eax: 0 registers.ebp: 1638104 registers.edx: 0 registers.ebx: 5083699 registers.esi: 0 registers.ecx: 1638112	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x170096 @ 0x570096 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: f7 f0 e8 10 e8 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd921d exception.instruction: div eax exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc0000094 exception.offset: 889373 exception.address: 0x4d921d registers.esp: 1638076 registers.edi: 1638076 registers.eax: 0 registers.ebp: 1638104 registers.edx: 0 registers.ebx: 5083699 registers.esi: 0 registers.ecx: 1638112	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x170096 @ 0x570096 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: f7 f0 e8 10 e8 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd921d exception.instruction: div eax exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc0000094 exception.offset: 889373 exception.address: 0x4d921d registers.esp: 1638076 registers.edi: 1638076 registers.eax: 0 registers.ebp: 1638104 registers.edx: 0 registers.ebx: 5083699 registers.esi: 0 registers.ecx: 1638112	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x170096 @ 0x570096 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: f7 f0 e8 10 e8 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd921d exception.instruction: div eax exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc0000094 exception.offset: 889373 exception.address: 0x4d921d registers.esp: 1638076 registers.edi: 1638076 registers.eax: 0 registers.ebp: 1638104 registers.edx: 0 registers.ebx: 5083699 registers.esi: 0 registers.ecx: 1638112	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x170096 @ 0x570096 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: f7 f0 e8 10 e8 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd921d exception.instruction: div eax exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc0000094 exception.offset: 889373 exception.address: 0x4d921d registers.esp: 1638076 registers.edi: 1638076 registers.eax: 0 registers.ebp: 1638104 registers.edx: 0 registers.ebx: 5083699 registers.esi: 0 registers.ecx: 1638112	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x170096 @ 0x570096 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: 0f 0b e8 e5 e7 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd9248 exception.instruction: ud2 exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc000001d exception.offset: 889416 exception.address: 0x4d9248 registers.esp: 1638076 registers.edi: 1638076 registers.eax: 0 registers.ebp: 1638104 registers.edx: 2 registers.ebx: 5083699 registers.esi: 0 registers.ecx: 1638112	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x170096 @ 0x570096 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: f7 f0 e8 10 e8 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd921d exception.instruction: div eax exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc0000094 exception.offset: 889373 exception.address: 0x4d921d registers.esp: 1638076 registers.edi: 1638076 registers.eax: 0 registers.ebp: 1638104 registers.edx: 0 registers.ebx: 5083742 registers.esi: 0 registers.ecx: 1638112	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x170096 @ 0x570096 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16b4c4 @ 0x56b4c4 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x107898 @ 0x507898 exception.instruction_r: 0f 0b e8 e5 e7 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0xd9248 exception.instruction: ud2 exception.module: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe exception.exception_code: 0xc000001d exception.offset: 889416 exception.address: 0x4d9248 registers.esp: 1638076 registers.edi: 1638076 registers.eax: 0 registers.ebp: 1638104 registers.edx: 2 registers.ebx: 5083699 registers.esi: 0 registers.ecx: 1638112	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1636400 registers.edi: 12460192 registers.eax: 1636400 registers.ebp: 1636480 registers.edx: 0 registers.ebx: 12460192 registers.esi: 12460192 registers.ecx: 2	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16d67d @ 0x56d67d 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x16d492 @ 0x56d492 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7+0x25452 @ 0x425452 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x76ee1544 registers.esp: 53279716 registers.edi: 53280312 registers.eax: 47047681 registers.ebp: 53280328 registers.edx: 32768 registers.ebx: 47047924 registers.esi: 32768 registers.ecx: 53280312	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: explorer+0x17113d @ 0x57113d explorer+0x107898 @ 0x507898 exception.instruction_r: f7 f0 e8 10 e8 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: explorer+0xd921d exception.instruction: div eax exception.module: explorer.exe exception.exception_code: 0xc0000094 exception.offset: 889373 exception.address: 0x4d921d registers.esp: 1638132 registers.edi: 5664908 registers.eax: 0 registers.ebp: 1638160 registers.edx: 0 registers.ebx: 43594696 registers.esi: 3 registers.ecx: 1638148	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: explorer+0x17113d @ 0x57113d explorer+0x107898 @ 0x507898 exception.instruction_r: 0f 0b e8 e5 e7 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: explorer+0xd9248 exception.instruction: ud2 exception.module: explorer.exe exception.exception_code: 0xc000001d exception.offset: 889416 exception.address: 0x4d9248 registers.esp: 1638132 registers.edi: 1638132 registers.eax: 0 registers.ebp: 1638160 registers.edx: 2 registers.ebx: 5083699 registers.esi: 0 registers.ecx: 1638340	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: explorer+0x17113d @ 0x57113d explorer+0x107898 @ 0x507898 exception.instruction_r: 0f 0b e8 e5 e7 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: explorer+0xd9248 exception.instruction: ud2 exception.module: explorer.exe exception.exception_code: 0xc000001d exception.offset: 889416 exception.address: 0x4d9248 registers.esp: 1638132 registers.edi: 1638132 registers.eax: 0 registers.ebp: 1638160 registers.edx: 2 registers.ebx: 5083742 registers.esi: 0 registers.ecx: 1638340	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: explorer+0x17113d @ 0x57113d explorer+0x107898 @ 0x507898 exception.instruction_r: 0f 0b e8 e5 e7 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: explorer+0xd9248 exception.instruction: ud2 exception.module: explorer.exe exception.exception_code: 0xc000001d exception.offset: 889416 exception.address: 0x4d9248 registers.esp: 1638132 registers.edi: 1638132 registers.eax: 0 registers.ebp: 1638160 registers.edx: 2 registers.ebx: 5083742 registers.esi: 0 registers.ecx: 1638340	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: explorer+0x17113d @ 0x57113d explorer+0x107898 @ 0x507898 exception.instruction_r: 0f 0b e8 e5 e7 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: explorer+0xd9248 exception.instruction: ud2 exception.module: explorer.exe exception.exception_code: 0xc000001d exception.offset: 889416 exception.address: 0x4d9248 registers.esp: 1638132 registers.edi: 1638132 registers.eax: 0 registers.ebp: 1638160 registers.edx: 2 registers.ebx: 5083742 registers.esi: 0 registers.ecx: 1638340	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: explorer+0x17113d @ 0x57113d explorer+0x107898 @ 0x507898 exception.instruction_r: 0f 0b e8 e5 e7 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: explorer+0xd9248 exception.instruction: ud2 exception.module: explorer.exe exception.exception_code: 0xc000001d exception.offset: 889416 exception.address: 0x4d9248 registers.esp: 1638132 registers.edi: 1638132 registers.eax: 0 registers.ebp: 1638160 registers.edx: 2 registers.ebx: 5083742 registers.esi: 0 registers.ecx: 1638340	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: explorer+0x17113d @ 0x57113d explorer+0x107898 @ 0x507898 exception.instruction_r: 0f 0b e8 e5 e7 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: explorer+0xd9248 exception.instruction: ud2 exception.module: explorer.exe exception.exception_code: 0xc000001d exception.offset: 889416 exception.address: 0x4d9248 registers.esp: 1638132 registers.edi: 1638132 registers.eax: 0 registers.ebp: 1638160 registers.edx: 2 registers.ebx: 5083742 registers.esi: 0 registers.ecx: 1638340	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: explorer+0x17113d @ 0x57113d explorer+0x107898 @ 0x507898 exception.instruction_r: f7 f0 e8 10 e8 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: explorer+0xd921d exception.instruction: div eax exception.module: explorer.exe exception.exception_code: 0xc0000094 exception.offset: 889373 exception.address: 0x4d921d registers.esp: 1638132 registers.edi: 1638132 registers.eax: 0 registers.ebp: 1638160 registers.edx: 0 registers.ebx: 5083742 registers.esi: 0 registers.ecx: 1638340	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: explorer+0x17113d @ 0x57113d explorer+0x107898 @ 0x507898 exception.instruction_r: 0f 0b e8 e5 e7 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: explorer+0xd9248 exception.instruction: ud2 exception.module: explorer.exe exception.exception_code: 0xc000001d exception.offset: 889416 exception.address: 0x4d9248 registers.esp: 1638132 registers.edi: 1638132 registers.eax: 0 registers.ebp: 1638160 registers.edx: 2 registers.ebx: 5083699 registers.esi: 0 registers.ecx: 1638340	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: explorer+0x16fd08 @ 0x56fd08 explorer+0x16b4c4 @ 0x56b4c4 explorer+0x107898 @ 0x507898 exception.instruction_r: f7 f0 e8 10 e8 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: explorer+0xd921d exception.instruction: div eax exception.module: explorer.exe exception.exception_code: 0xc0000094 exception.offset: 889373 exception.address: 0x4d921d registers.esp: 1638076 registers.edi: 5664908 registers.eax: 0 registers.ebp: 1638104 registers.edx: 0 registers.ebx: 135168 registers.esi: 4329472 registers.ecx: 4329472	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: explorer+0x16fd08 @ 0x56fd08 explorer+0x16b4c4 @ 0x56b4c4 explorer+0x107898 @ 0x507898 exception.instruction_r: f7 f0 e8 10 e8 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: explorer+0xd921d exception.instruction: div eax exception.module: explorer.exe exception.exception_code: 0xc0000094 exception.offset: 889373 exception.address: 0x4d921d registers.esp: 1638076 registers.edi: 1638076 registers.eax: 0 registers.ebp: 1638104 registers.edx: 0 registers.ebx: 5083699 registers.esi: 0 registers.ecx: 1638112	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: explorer+0x16fd08 @ 0x56fd08 explorer+0x16b4c4 @ 0x56b4c4 explorer+0x107898 @ 0x507898 exception.instruction_r: 0f 0b e8 e5 e7 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: explorer+0xd9248 exception.instruction: ud2 exception.module: explorer.exe exception.exception_code: 0xc000001d exception.offset: 889416 exception.address: 0x4d9248 registers.esp: 1638076 registers.edi: 1638076 registers.eax: 0 registers.ebp: 1638104 registers.edx: 2 registers.ebx: 5083699 registers.esi: 0 registers.ecx: 1638112	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: explorer+0x16fe34 @ 0x56fe34 explorer+0x16b4c4 @ 0x56b4c4 explorer+0x107898 @ 0x507898 exception.instruction_r: 0f 0b e8 e5 e7 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: explorer+0xd9248 exception.instruction: ud2 exception.module: explorer.exe exception.exception_code: 0xc000001d exception.offset: 889416 exception.address: 0x4d9248 registers.esp: 1638076 registers.edi: 5664908 registers.eax: 0 registers.ebp: 1638104 registers.edx: 2 registers.ebx: 135168 registers.esi: 4329472 registers.ecx: 0	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: explorer+0x16fe34 @ 0x56fe34 explorer+0x16b4c4 @ 0x56b4c4 explorer+0x107898 @ 0x507898 exception.instruction_r: f7 f0 e8 10 e8 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: explorer+0xd921d exception.instruction: div eax exception.module: explorer.exe exception.exception_code: 0xc0000094 exception.offset: 889373 exception.address: 0x4d921d registers.esp: 1638076 registers.edi: 1638076 registers.eax: 0 registers.ebp: 1638104 registers.edx: 0 registers.ebx: 5083742 registers.esi: 0 registers.ecx: 1638112	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: explorer+0x16fe34 @ 0x56fe34 explorer+0x16b4c4 @ 0x56b4c4 explorer+0x107898 @ 0x507898 exception.instruction_r: 0f 0b e8 e5 e7 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: explorer+0xd9248 exception.instruction: ud2 exception.module: explorer.exe exception.exception_code: 0xc000001d exception.offset: 889416 exception.address: 0x4d9248 registers.esp: 1638076 registers.edi: 1638076 registers.eax: 0 registers.ebp: 1638104 registers.edx: 2 registers.ebx: 5083699 registers.esi: 0 registers.ecx: 1638112	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: explorer+0x16fe34 @ 0x56fe34 explorer+0x16b4c4 @ 0x56b4c4 explorer+0x107898 @ 0x507898 exception.instruction_r: 0f 0b e8 e5 e7 00 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: explorer+0xd9248 exception.instruction: ud2 exception.module: explorer.exe exception.exception_code: 0xc000001d exception.offset: 889416 exception.address: 0x4d9248 registers.esp: 1638076 registers.edi: 1638076 registers.eax: 0 registers.ebp: 1638104 registers.edx: 2 registers.ebx: 5083742 registers.esi: 0 registers.ecx: 1638112	1
__exception__ Sept. 30, 2024, 9:33 a.m.	stacktrace: explorer+0x16fe48 @ 0x56fe48 explorer+0x16b4c4 @ 0x56b4c4 explorer+0x107898 @ 0x507898 exception.instruction_r: cc c6 45 ff 01 33 c0 5a 59 59 64 89 10 eb 0a e9 exception.symbol: explorer+0xfca9d exception.instruction: int3 exception.module: explorer.exe exception.exception_code: 0x80000003 exception.offset: 1034909 exception.address: 0x4fca9d registers.esp: 1638076 registers.edi: 5655117 registers.eax: 2324 registers.ebp: 1638104 registers.edx: 49982568 registers.ebx: 135168 registers.esi: 4343367 registers.ecx: 1	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 94 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2548 region_size: 2715648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02980000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2548 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00930000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2548 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c24000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2548 region_size: 147456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c24000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2548 region_size: 638976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c44000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2548 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ce0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2548 region_size: 573440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02eb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2548 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02f3c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2548 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c44000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2548 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02f3c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2548 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c54000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2548 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c54000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2548 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c54000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2548 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c54000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2548 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c54000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2548 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c54000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734c2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2644 region_size: 2715648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2644 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02970000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2644 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2644 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02974000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2644 region_size: 147456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02974000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2644 region_size: 638976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02994000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2644 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2644 region_size: 573440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02f20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2644 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02fac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2644 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02994000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2644 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02fac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2644 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2644 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2644 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2644 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2644 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2644 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2644 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x734c2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2712 region_size: 2715648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2712 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02cb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00860000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2712 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02cb4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2712 region_size: 147456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02cb4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2712 region_size: 638976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02cd4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2712 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2712 region_size: 311296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02db0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2712 region_size: 262144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2712 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02df8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2712 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02cd4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2712 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ce4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2712 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ce4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2712 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ce8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

A process attempted to delay the analysis task. (2 events)

description	explorer.exe tried to sleep 216 seconds, actually delayed analysis time by 216 seconds
description	svchost.exe tried to sleep 274 seconds, actually delayed analysis time by 274 seconds

Creates executable files on the filesystem (3 events)

file	c:\Windows\resources\svchost.exe
file	c:\Windows\resources\Themes\explorer.exe
file	c:\Windows\resources\spoolsv.exe

Creates a suspicious process (3 events)

cmdline	schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 10:36 /f
cmdline	schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 10:35 /f
cmdline	c:\windows\resources\svchost.exe

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (50 out of 606 events)

Time & API	Arguments	Status	Return
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000138 process_name: pw.exe process_identifier: 2328	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000138 process_name: taskhost.exe process_identifier: 2372	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000138 process_name: sdclt.exe process_identifier: 2380	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000138 process_name: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe process_identifier: 2548	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000134 process_name: schtasks.exe process_identifier: 2600	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000134 process_name: conhost.exe process_identifier: 2608	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x000007ec process_name: ọ相ۡǲ㲣直㳎直à process_identifier: 4294967294		0
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000b3c process_name: explorer.exe process_identifier: 2644	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000b3c process_name: spoolsv.exe process_identifier: 2712	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000b3c process_name: svchost.exe process_identifier: 2764	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000b3c process_name: spoolsv.exe process_identifier: 2816	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000b3c process_name: explorer.exe process_identifier: 2884	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000b3c process_name: inject-x86.exe process_identifier: 2180	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000b3c process_name: inject-x86.exe process_identifier: 2192	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000b3c process_name: svchost.exe process_identifier: 2188	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000b3c process_name: is32bit.exe process_identifier: 3376	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000b3c process_name: inject-x86.exe process_identifier: 3508	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000b3c process_name: inject-x86.exe process_identifier: 4004	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000b3c process_name: is32bit.exe process_identifier: 3836	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000b3c process_name: inject-x86.exe process_identifier: 648	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000aa8 process_name: is32bit.exe process_identifier: 2080	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000d84 process_name: inject-x86.exe process_identifier: 2820	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000e14 process_name: inject-x86.exe process_identifier: 3028	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000ea4 process_name: is32bit.exe process_identifier: 940	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000f34 process_name: inject-x86.exe process_identifier: 2272	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000fc8 process_name: inject-x86.exe process_identifier: 2580	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00001060 process_name: inject-x86.exe process_identifier: 2888	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x000010f4 process_name: inject-x86.exe process_identifier: 3012	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00001188 process_name: inject-x86.exe process_identifier: 2116	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x0000121c process_name: inject-x86.exe process_identifier: 2536	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x000012b0 process_name: is32bit.exe process_identifier: 3068	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x000013d4 process_name: is32bit.exe process_identifier: 2064	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x0000173c process_name: inject-x86.exe process_identifier: 3312	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00003914 process_name: inject-x86.exe process_identifier: 4764	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x000039a4 process_name: inject-x86.exe process_identifier: 4888	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00003a34 process_name: is32bit.exe process_identifier: 4972	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00003cf8 process_name: inject-x86.exe process_identifier: 4408	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00003ea0 process_name: is32bit.exe process_identifier: 4860	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00004a28 process_name: inject-x86.exe process_identifier: 5136	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00004a28 process_name: is32bit.exe process_identifier: 5144	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00005034 process_name: inject-x86.exe process_identifier: 6040	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00005148 process_name: inject-x86.exe process_identifier: 5204	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x000051d4 process_name: inject-x86.exe process_identifier: 5312	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x000053f8 process_name: inject-x86.exe process_identifier: 5748	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00005620 process_name: is32bit.exe process_identifier: 5132	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00006048 process_name: is32bit.exe process_identifier: 4176	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00006158 process_name: inject-x86.exe process_identifier: 5724	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00006158 process_name: inject-x86.exe process_identifier: 5920	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x000060d4 process_name: is32bit.exe process_identifier: 5524	1	1
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00006494 process_name: inject-x86.exe process_identifier: 6468	1	1

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 30, 2024, 9:33 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x02d30000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x00009000', u'virtual_address': u'0x00001000', u'entropy': 7.8514017943379155, u'name': u'', u'virtual_size': u'0x0001a000'}

entropy

7.85140179434

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00099000', u'virtual_address': u'0x002d9000', u'entropy': 7.9394609720362945, u'name': u'.data', u'virtual_size': u'0x00099000'}

entropy

7.93946097204

description

A section with a high entropy has been found

entropy

0.987804878049

description

Overall entropy of this PE file is high

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (50 out of 110 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000138 process_name: 63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe process_identifier: 2548		0	0
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000b3c process_name: spoolsv.exe process_identifier: 2712		0	0
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000138 process_name: explorer.exe process_identifier: 2644		0	0
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000a1c process_name: svchost.exe process_identifier: 2764		0	0
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000aa0 process_name: explorer.exe process_identifier: 2884		0	0
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00000ea4 process_name: svchost.exe process_identifier: 2188		0	0
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x000024d4 process_name: svchost.exe process_identifier: 2188		0	0
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00002b98 process_name: svchost.exe process_identifier: 2188		0	0
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00003b50 process_name: svchost.exe process_identifier: 2188		0	0
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00005034 process_name: svchost.exe process_identifier: 2188		0	0
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00005598 process_name: svchost.exe process_identifier: 2188		0	0
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00005af0 process_name: svchost.exe process_identifier: 2188		0	0
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00006b84 process_name: svchost.exe process_identifier: 2188		0	0
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x000091dc process_name: svchost.exe process_identifier: 2188		0	0
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x0000a194 process_name: svchost.exe process_identifier: 2188		0	0
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x0000a6a0 process_name: inject-x86.exe process_identifier: 9636		0	0
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x0000b1d0 process_name: inject-x86.exe process_identifier: 9992		0	0
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x0000b6e0 process_name: svchost.exe process_identifier: 2188		0	0
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x0000c3fc process_name: svchost.exe process_identifier: 2188		0	0
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x0000cb80 process_name: svchost.exe process_identifier: 2188		0	0
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x0000d20c process_name: svchost.exe process_identifier: 2188		0	0
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x0000dc1c process_name: svchost.exe process_identifier: 2188		0	0
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x0000e120 process_name: is32bit.exe process_identifier: 12212		0	0
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x0000e730 process_name: svchost.exe process_identifier: 2188		0	0
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x0000f258 process_name: conhost.exe process_identifier: 12296		0	0
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x0000f8f0 process_name: is32bit.exe process_identifier: 12664		0	0
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x0000fe04 process_name: svchost.exe process_identifier: 2188		0	0
Process32NextW Sept. 30, 2024, 9:33 a.m.	snapshot_handle: 0x00010544 process_name: taskhost.exe process_identifier: 14176		0	0
Process32NextW Sept. 30, 2024, 9:34 a.m.	snapshot_handle: 0x00011890 process_name: taskhost.exe process_identifier: 14176		0	0
Process32NextW Sept. 30, 2024, 9:34 a.m.	snapshot_handle: 0x00011ed4 process_name: taskhost.exe process_identifier: 14176		0	0
Process32NextW Sept. 30, 2024, 9:34 a.m.	snapshot_handle: 0x000145dc process_name: taskhost.exe process_identifier: 14176		0	0
Process32NextW Sept. 30, 2024, 9:34 a.m.	snapshot_handle: 0x0001525c process_name: taskhost.exe process_identifier: 14176		0	0
Process32NextW Sept. 30, 2024, 9:34 a.m.	snapshot_handle: 0x00015918 process_name: taskhost.exe process_identifier: 14176		0	0
Process32NextW Sept. 30, 2024, 9:34 a.m.	snapshot_handle: 0x0001661c process_name: taskhost.exe process_identifier: 14176		0	0
Process32NextW Sept. 30, 2024, 9:34 a.m.	snapshot_handle: 0x00017f78 process_name: taskhost.exe process_identifier: 14176		0	0
Process32NextW Sept. 30, 2024, 9:34 a.m.	snapshot_handle: 0x0001852c process_name: taskhost.exe process_identifier: 14176		0	0
Process32NextW Sept. 30, 2024, 9:34 a.m.	snapshot_handle: 0x00019220 process_name: taskhost.exe process_identifier: 14176		0	0
Process32NextW Sept. 30, 2024, 9:34 a.m.	snapshot_handle: 0x00019fb8 process_name: taskhost.exe process_identifier: 14176		0	0
Process32NextW Sept. 30, 2024, 9:34 a.m.	snapshot_handle: 0x0001a680 process_name: taskhost.exe process_identifier: 14176		0	0
Process32NextW Sept. 30, 2024, 9:34 a.m.	snapshot_handle: 0x0001b408 process_name: inject-x86.exe process_identifier: 21852		0	0
Process32NextW Sept. 30, 2024, 9:34 a.m.	snapshot_handle: 0x0001ba44 process_name: taskhost.exe process_identifier: 14176		0	0
Process32NextW Sept. 30, 2024, 9:34 a.m.	snapshot_handle: 0x0001df98 process_name: taskhost.exe process_identifier: 14176		0	0
Process32NextW Sept. 30, 2024, 9:34 a.m.	snapshot_handle: 0x0001eb20 process_name: taskhost.exe process_identifier: 14176		0	0
Process32NextW Sept. 30, 2024, 9:34 a.m.	snapshot_handle: 0x0001f260 process_name: inject-x86.exe process_identifier: 25224		0	0
Process32NextW Sept. 30, 2024, 9:34 a.m.	snapshot_handle: 0x0001f8b0 process_name: taskhost.exe process_identifier: 14176		0	0
Process32NextW Sept. 30, 2024, 9:34 a.m.	snapshot_handle: 0x0001ffec process_name: inject-x86.exe process_identifier: 24760		0	0
Process32NextW Sept. 30, 2024, 9:34 a.m.	snapshot_handle: 0x00020750 process_name: taskhost.exe process_identifier: 14176		0	0
Process32NextW Sept. 30, 2024, 9:34 a.m.	snapshot_handle: 0x00020e0c process_name: taskhost.exe process_identifier: 14176		0	0
Process32NextW Sept. 30, 2024, 9:34 a.m.	snapshot_handle: 0x0002154c process_name: taskhost.exe process_identifier: 14176		0	0
Process32NextW Sept. 30, 2024, 9:34 a.m.	snapshot_handle: 0x00022cb0 process_name: taskhost.exe process_identifier: 14176		0	0

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 10:36 /f
cmdline	schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 10:35 /f

Checks for the presence of known devices from debuggers and forensic tools (3 events)

file	\??\SICE
file	\??\SIWDEBUG
file	\??\NTICE

Checks for the presence of known windows from debuggers and forensic tools (5 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA Sept. 30, 2024, 9:33 a.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Sept. 30, 2024, 9:33 a.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Sept. 30, 2024, 9:33 a.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Sept. 30, 2024, 9:33 a.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Sept. 30, 2024, 9:33 a.m.	class_name: OLLYDBG window_name:		0	0

Installs itself for autorun at Windows startup (8 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer	reg_value	c:\windows\resources\themes\explorer.exe RO
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost	reg_value	c:\windows\resources\svchost.exe RO
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer	reg_value	c:\windows\resources\themes\explorer.exe RO
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost	reg_value	c:\windows\resources\svchost.exe RO
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer	reg_value	c:\windows\resources\themes\explorer.exe RO
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost	reg_value	c:\windows\resources\svchost.exe RO
cmdline	schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 10:36 /f
cmdline	schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 10:35 /f

Queries information on disks, possibly for anti-virtualization (2 events)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile Sept. 30, 2024, 9:33 a.m.	create_disposition: 1 (FILE_OPEN) file_handle: 0x00000130 filepath: \??\Scsi0: desired_access: 0xc0100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 0 () filepath_r: \??\Scsi0: create_options: 96 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 0 (FILE_SUPERSEDED) share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	1	0	0
DeviceIoControl Sept. 30, 2024, 9:33 a.m.	input_buffer: SCSIDISK ì control_code: 315400 () device_handle: 0x00000130 output_buffer: <INVALID POINTER>		0	0

Creates a slightly modified copy of itself (3 events)

description	Possibly a polymorphic version of itself	file	{u'size': 759723, u'yara': [{u'strings': [u'TVo='], u'meta': {u'ini_date': u'2020-06-03', u'description': u'PE File Signature', u'author': u'r0d'}, u'name': u'PE_Header_Zero', u'offsets': {u'signature': [[0L, 0]]}}, {u'strings': [u'Dz8HCw=='], u'meta': {u'description': u'Possibly employs anti-virtualization techniques', u'author': u'nex'}, u'name': u'anti_vm_detect', u'offsets': {u'virtualpc': [[355998L, 0]]}}, {u'strings': [], u'meta': {u'description': u'(no description)'}, u'name': u'IsPE32', u'offsets': {}}, {u'strings': [u'OWFiY2RlZg==', u'Y2Vzc29y'], u'meta': {u'date': u'2021-05-13', u'update': u'2021-06-22', u'description': u'UPX packed file', u'author': u'r0d'}, u'name': u'UPX_Zero', u'offsets': {u's55': [[45261L, 1], [45592L, 1]], u's192': [[138155L, 0]]}}], u'sha1': u'e88d17d529c9e099717900636e5bd2f12c4c3455', u'name': u'802abe5195c325f9_svchost.exe', u'filepath': u'C:\\Windows\\Resources\\svchost.exe', u'sha512': u'e5f0f118718aa64b64d961bd3b907c6a8e26e5f20e2f6f397dc6b3b8d6d06959e1318bbf22df01550e220d0ee3e4a5b0bf83c262a50433bfebe6a6e66fbd091e', u'urls': [], u'crc32': u'A41AB369', u'path': u'/home/cuckoo/.cuckoo/storage/analyses/54324/files/802abe5195c325f9_svchost.exe', u'ssdeep': u'12288:ltTuh645I8jWtJ8OgL27rd69bk5NCgGhSFB79gYhLIf6EQ9EYcw1FJ:lIg4kt0Kd6F6CNzYhUiEWEYcwB', u'sha256': u'802abe5195c325f94c4366d6251d29ec17ef36826c93a9632ad231dd3378fd89', u'type': u'MS-DOS executable, MZ for MS-DOS', u'pids': [2712], u'md5': u'5717799a91236f33fd5a9ceabaf0e12f', u'virustotal': {u'summary': {u'error': u'resource has not been scanned yet'}}}
description	Possibly a polymorphic version of itself	file	{u'size': 759817, u'yara': [{u'strings': [u'TVo='], u'meta': {u'ini_date': u'2020-06-03', u'description': u'PE File Signature', u'author': u'r0d'}, u'name': u'PE_Header_Zero', u'offsets': {u'signature': [[0L, 0]]}}, {u'strings': [u'Dz8HCw=='], u'meta': {u'description': u'Possibly employs anti-virtualization techniques', u'author': u'nex'}, u'name': u'anti_vm_detect', u'offsets': {u'virtualpc': [[355998L, 0]]}}, {u'strings': [], u'meta': {u'description': u'(no description)'}, u'name': u'IsPE32', u'offsets': {}}, {u'strings': [u'OWFiY2RlZg==', u'Y2Vzc29y'], u'meta': {u'date': u'2021-05-13', u'update': u'2021-06-22', u'description': u'UPX packed file', u'author': u'r0d'}, u'name': u'UPX_Zero', u'offsets': {u's55': [[45261L, 1], [45592L, 1]], u's192': [[138155L, 0]]}}], u'sha1': u'f8b18a71a4f4328326e84af814f787cbb2345b1c', u'name': u'f462ee3f58111245_explorer.exe', u'filepath': u'C:\\Windows\\Resources\\Themes\\explorer.exe', u'sha512': u'801758f2234ed9f54322df51cee5b558c21998221653bc419d55d3202767055917cce19566b428d0541d55d9114e0973d49a2b57f75754b0420027cabad3a3f8', u'urls': [], u'crc32': u'A17E93F4', u'path': u'/home/cuckoo/.cuckoo/storage/analyses/54324/files/f462ee3f58111245_explorer.exe', u'ssdeep': u'12288:ltTuh645I8jWtJ8OgL27rd69bk5NCgGhSFB79gYhLIf6EQ9EYcw1Fx:lIg4kt0Kd6F6CNzYhUiEWEYcwJ', u'sha256': u'f462ee3f58111245aa9de0c3af8185d4105580c6e1d30a67f223c1994476ed28', u'type': u'MS-DOS executable, MZ for MS-DOS', u'pids': [2548], u'md5': u'af42b430d289031c20b260c9d4c6b34d', u'virustotal': {u'summary': {u'error': u'resource has not been scanned yet'}}}
description	Possibly a polymorphic version of itself	file	{u'size': 759656, u'yara': [{u'strings': [u'TVo='], u'meta': {u'ini_date': u'2020-06-03', u'description': u'PE File Signature', u'author': u'r0d'}, u'name': u'PE_Header_Zero', u'offsets': {u'signature': [[0L, 0]]}}, {u'strings': [u'Dz8HCw=='], u'meta': {u'description': u'Possibly employs anti-virtualization techniques', u'author': u'nex'}, u'name': u'anti_vm_detect', u'offsets': {u'virtualpc': [[355998L, 0]]}}, {u'strings': [], u'meta': {u'description': u'(no description)'}, u'name': u'IsPE32', u'offsets': {}}, {u'strings': [u'OWFiY2RlZg==', u'Y2Vzc29y'], u'meta': {u'date': u'2021-05-13', u'update': u'2021-06-22', u'description': u'UPX packed file', u'author': u'r0d'}, u'name': u'UPX_Zero', u'offsets': {u's55': [[45261L, 1], [45592L, 1]], u's192': [[138155L, 0]]}}], u'sha1': u'9130b09a7004409a5d3afc3ba05ce278040995aa', u'name': u'c5d9efa38f28c42a_spoolsv.exe', u'filepath': u'C:\\Windows\\Resources\\spoolsv.exe', u'sha512': u'ed03c8bef6ecf18540b00142639233c492108fc06bcd6f549b62496d52edd60cd2842689bf1585040baac9d5ae2028370b9900bfb3d14854cda82c7601dcfcb3', u'urls': [], u'crc32': u'D2E33EC3', u'path': u'/home/cuckoo/.cuckoo/storage/analyses/54324/files/c5d9efa38f28c42a_spoolsv.exe', u'ssdeep': u'12288:ltTuh645I8jWtJ8OgL27rd69bk5NCgGhSFB79gYhLIf6EQ9EYcw1FM:lIg4kt0Kd6F6CNzYhUiEWEYcwE', u'sha256': u'c5d9efa38f28c42aec78b0fa95125219e18e3b8d8674f75bca59249e702afd07', u'type': u'MS-DOS executable, MZ for MS-DOS', u'pids': [2644], u'md5': u'1a4ab4a94cb3eb89a5ac30cdc5f99188', u'virustotal': {u'summary': {u'error': u'resource has not been scanned yet'}}}

Expresses interest in specific running processes (9 events)

process: potential process injection target	lsass.exe
process	searchindexer.exe
process: potential process injection target	csrss.exe
process: potential process injection target	explorer.exe
process: potential process injection target	smss.exe
process: potential process injection target	wininit.exe
process	taskhost.exe
process	audiodg.exe
process: potential process injection target	svchost.exe

Resumed a suspended thread in a remote process potentially indicative of process injection (50 out of 2324 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2644 resumed a thread in remote process 2764
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00000b38 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00000bc8 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00000c5c suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00000cec suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00000d7c suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00000e0c suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00000e9c suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00000f2c suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00000fbc suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00001054 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x000010e8 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x0000117c suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00001210 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x000012a4 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00001338 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x000013cc suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00001460 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x000014f4 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00001584 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00001614 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x000016a8 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00001734 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x000017c4 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x0000185c suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x000018f0 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00001980 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00001a10 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00001aa0 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00001b30 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00001bc0 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00001c54 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00001ce4 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00001d74 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00001e04 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00001e94 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00001f24 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00001fb4 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00002048 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x000020d8 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00002168 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x000021f8 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00002288 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x00002318 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x000023a8 suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x0000243c suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x000024cc suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x0000255c suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x000025ec suspend_count: 0 process_identifier: 2764	1	0	0
NtResumeThread Sept. 30, 2024, 9:33 a.m.	thread_handle: 0x0000267c suspend_count: 0 process_identifier: 2764	1	0	0

Attempts to modify Explorer settings to prevent hidden files from being displayed (1 event)

registry

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden

Stops Windows services (2 events)

service	Schedule (regkey HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Schedule\Start)
service	SharedAccess (regkey HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Start)

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.leZI
tehtris	Generic.Malware
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.Generic.bc
ALYac	Trojan.GenericKD.72607681
Cylance	Unsafe
VIPRE	Trojan.GenericKD.72607681
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Trojan.GenericKD.72607681
K7GW	Trojan ( 005ab5f21 )
K7AntiVirus	Trojan ( 005abfeb1 )
Arcabit	Trojan.Generic.D453E7C1
VirIT	Trojan.Win32.AgentT.DZEB
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	Win32/VB.NBI
APEX	Malicious
Avast	Win32:TrojanX-gen [Trj]
ClamAV	Win.Ransomware.Cryptor-9845758-0
Kaspersky	HEUR:Trojan-Dropper.Win32.Convagent.gen
Alibaba	Virus:Win32/Ransomware.ca4457da
MicroWorld-eScan	Trojan.GenericKD.72607681
Rising	Trojan.VB!8.B20 (TFE:4:UG4z3p4iLQJ)
Emsisoft	Trojan.GenericKD.72607681 (B)
F-Secure	Trojan.TR/Patched.Ren.Gen
Zillya	Trojan.Generic.Win32.1795567
McAfeeD	Real Protect-LS!9CFC9F5F8A78
Trapmine	malicious.high.ml.score
CTX	exe.trojan.generic
Sophos	Mal/Agent-AUZ
SentinelOne	Static AI - Malicious PE
FireEye	Generic.mg.9cfc9f5f8a781cbf
Google	Detected
Avira	TR/Patched.Ren.Gen
Antiy-AVL	GrayWare/Win32.EnigmaProtect.a
Kingsoft	malware.kb.b.769
Gridinsoft	Trojan.Win32.Agent.oa!s1
Microsoft	Trojan:Win32/Swisyn!pz
ZoneAlarm	HEUR:Trojan-Dropper.Win32.Convagent.gen
GData	Win32.Trojan.PSE.9YXFF3
Varist	W32/VB_Agent.A.gen!Eldorado
McAfee	GenericRXWO-FA!9CFC9F5F8A78
TACHYON	Trojan/W32.Convagent.759706
DeepInstinct	MALICIOUS
VBA32	TScope.Malware-Cryptor.SB
Malwarebytes	Generic.Malware.AI.DDS
Ikarus	Virus.Win32.VB
Panda	Trj/CI.A

63747acb643b84a943895e5f34d34858e4ad9a6e58cdf222e3e703d6666af0e7.exe.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All