Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Jan. 13, 2025, 2:59 p.m.	Jan. 13, 2025, 4:07 p.m.

Size	4.3MB
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5	`555040b23d9b4a8ec38b23117c76a7f7`
SHA256	`ffefd6fdbbdbf07ae19294b9eeb2ec360cd1de2981cfcf057a7b1d37342ca736`
CRC32	`BEB56341`
ssdeep	`98304:sszaqqSzah3gWjscz0+8shRYoYkxuULQueMDdXs9VxeL9:sszzqNhgWj70+8cRLYCzvDNscZ`
Yara	themida_packer - themida packer PE_Header_Zero - PE File Signature anti_vm_detect - Possibly employs anti-virtualization techniques IsPE32 - (no description) UPX_Zero - UPX packed file

random.exe "C:\Users\test22\AppData\Local\Temp\random.exe"
2544

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 13, 2025, 2:59 p.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (6 events)

section	\x00
section	.idata
section
section	nluivgyi
section	ovpsxccj
section	.taggant

One or more processes crashed (50 out of 115 events)

Time & API	Arguments	Status
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: fb e9 4e 01 00 00 60 8b 74 24 24 8b 7c 24 28 fc exception.symbol: random+0xa480b9 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 10780857 exception.address: 0x12d80b9 registers.esp: 5700160 registers.edi: 0 registers.eax: 1 registers.ebp: 5700176 registers.edx: 21577728 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 52 e9 1d ff ff ff 89 e2 e9 5d 00 00 00 2d f1 exception.symbol: random+0x6b00e4 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 7012580 exception.address: 0xf400e4 registers.esp: 5700124 registers.edi: 1968898280 registers.eax: 15990083 registers.ebp: 3998933012 registers.edx: 8978432 registers.ebx: 1969127424 registers.esi: 3 registers.ecx: 1969094656	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 29 d2 ff 34 02 ff 34 24 ff 34 24 5e 68 9e a6 exception.symbol: random+0x6b0539 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 7013689 exception.address: 0xf40539 registers.esp: 5700128 registers.edi: 1968898280 registers.eax: 16021293 registers.ebp: 3998933012 registers.edx: 8978432 registers.ebx: 1969127424 registers.esi: 3 registers.ecx: 1969094656	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 50 e9 0b 00 00 00 89 da 5b 09 d6 5a e9 33 f7 exception.symbol: random+0x6b0696 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 7014038 exception.address: 0xf40696 registers.esp: 5700128 registers.edi: 1968898280 registers.eax: 16021293 registers.ebp: 3998933012 registers.edx: 4294938772 registers.ebx: 1969127424 registers.esi: 714899304 registers.ecx: 1969094656	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 52 c7 04 24 5b 13 d5 5f 89 2c 24 52 e9 6b f9 exception.symbol: random+0x6b1384 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 7017348 exception.address: 0xf41384 registers.esp: 5700128 registers.edi: 16025605 registers.eax: 32460 registers.ebp: 3998933012 registers.edx: 1343823837 registers.ebx: 1969127424 registers.esi: 714899304 registers.ecx: 1445847705	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb e9 ef ff ff ff 81 c1 04 00 00 00 e9 10 00 00 exception.symbol: random+0x6b0a2f exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 7014959 exception.address: 0xf40a2f registers.esp: 5700128 registers.edi: 15996293 registers.eax: 241897 registers.ebp: 3998933012 registers.edx: 1343823837 registers.ebx: 1969127424 registers.esi: 714899304 registers.ecx: 0	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb e9 07 fd ff ff f7 db c1 e3 02 43 81 eb 1c 14 exception.symbol: random+0x833f48 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8601416 exception.address: 0x10c3f48 registers.esp: 5700124 registers.edi: 16029699 registers.eax: 26091 registers.ebp: 3998933012 registers.edx: 2345 registers.ebx: 6991872 registers.esi: 17578600 registers.ecx: 2104688640	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb ba 86 2f 6c 1d 57 89 04 24 68 f7 2e 09 5f 89 exception.symbol: random+0x83459d exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8603037 exception.address: 0x10c459d registers.esp: 5700128 registers.edi: 4294944316 registers.eax: 26091 registers.ebp: 3998933012 registers.edx: 2345 registers.ebx: 3924134229 registers.esi: 17604691 registers.ecx: 2104688640	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 56 81 ec 04 00 00 00 89 34 24 e9 ca 00 00 00 exception.symbol: random+0x83a2ee exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8626926 exception.address: 0x10ca2ee registers.esp: 5700128 registers.edi: 0 registers.eax: 28668 registers.ebp: 3998933012 registers.edx: 50665 registers.ebx: 0 registers.esi: 17606813 registers.ecx: 0	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 31 ff e9 74 00 00 00 01 c1 8b 04 24 81 c4 04 exception.symbol: random+0x83bb2f exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8633135 exception.address: 0x10cbb2f registers.esp: 5700128 registers.edi: 0 registers.eax: 17642002 registers.ebp: 3998933012 registers.edx: 50665 registers.ebx: 714365854 registers.esi: 17606813 registers.ecx: 190810497	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 57 bf f4 87 7d 6b 81 c7 a6 a1 59 d9 57 50 b8 exception.symbol: random+0x83b45f exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8631391 exception.address: 0x10cb45f registers.esp: 5700128 registers.edi: 4294937616 registers.eax: 17642002 registers.ebp: 3998933012 registers.edx: 50665 registers.ebx: 714365854 registers.esi: 134889 registers.ecx: 190810497	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 68 b4 17 2e 3b 89 04 24 exception.symbol: random+0x846bb9 exception.instruction: in eax, dx exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8678329 exception.address: 0x10d6bb9 registers.esp: 5700120 registers.edi: 23080472 registers.eax: 1447909480 registers.ebp: 3998933012 registers.edx: 22104 registers.ebx: 1969033397 registers.esi: 17641708 registers.ecx: 20	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: 0f 3f 07 0b 64 8f 05 00 00 00 00 83 c4 04 83 fb exception.symbol: random+0x84853d exception.address: 0x10d853d exception.module: random.exe exception.exception_code: 0xc000001d exception.offset: 8684861 registers.esp: 5700120 registers.edi: 23080472 registers.eax: 1 registers.ebp: 3998933012 registers.edx: 22104 registers.ebx: 0 registers.esi: 17641708 registers.ecx: 20	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: ed 81 fb 68 58 4d 56 75 0a c7 85 4e 36 99 12 01 exception.symbol: random+0x844410 exception.instruction: in eax, dx exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8668176 exception.address: 0x10d4410 registers.esp: 5700120 registers.edi: 23080472 registers.eax: 1447909480 registers.ebp: 3998933012 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 17641708 registers.ecx: 10	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 31 c9 ff 34 08 ff 34 24 8b 14 24 55 54 5d 52 exception.symbol: random+0x84c1ba exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8700346 exception.address: 0x10dc1ba registers.esp: 5700128 registers.edi: 23080472 registers.eax: 17710169 registers.ebp: 3998933012 registers.edx: 2130566132 registers.ebx: 38460843 registers.esi: 10 registers.ecx: 2104688640	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 52 57 bf b2 3e 6e 3f e9 5f 00 00 00 5c 2d e8 exception.symbol: random+0x84c613 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8701459 exception.address: 0x10dc613 registers.esp: 5700128 registers.edi: 23080472 registers.eax: 17710169 registers.ebp: 3998933012 registers.edx: 926400096 registers.ebx: 38460843 registers.esi: 10 registers.ecx: 4294937896	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: cd 01 eb 00 6a 00 52 e8 03 00 00 00 20 5a c3 5a exception.symbol: random+0x84cbbe exception.instruction: int 1 exception.module: random.exe exception.exception_code: 0xc0000005 exception.offset: 8702910 exception.address: 0x10dcbbe registers.esp: 5700088 registers.edi: 0 registers.eax: 5700088 registers.ebp: 3998933012 registers.edx: 562917407 registers.ebx: 17681706 registers.esi: 52522 registers.ecx: 562914240	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 50 54 58 05 04 00 00 00 83 e8 04 87 04 24 5c exception.symbol: random+0x85bdd0 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8764880 exception.address: 0x10ebdd0 registers.esp: 5700128 registers.edi: 15982998 registers.eax: 33024 registers.ebp: 3998933012 registers.edx: 17774954 registers.ebx: 38461096 registers.esi: 1968968720 registers.ecx: 0	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 55 c7 04 24 b0 67 ff 5f ff 0c 24 e9 82 01 00 exception.symbol: random+0x85bf36 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8765238 exception.address: 0x10ebf36 registers.esp: 5700128 registers.edi: 15982998 registers.eax: 33024 registers.ebp: 3998933012 registers.edx: 17745238 registers.ebx: 0 registers.esi: 3142799953 registers.ecx: 0	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb e9 20 00 00 00 01 e9 81 c1 36 04 f1 75 ff 34 exception.symbol: random+0x85d27b exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8770171 exception.address: 0x10ed27b registers.esp: 5700124 registers.edi: 15982998 registers.eax: 29884 registers.ebp: 3998933012 registers.edx: 17745682 registers.ebx: 55045749 registers.esi: 3142799953 registers.ecx: 891973604	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 55 89 3c 24 51 68 00 0a eb 7d 59 41 81 f1 9d exception.symbol: random+0x85ccf1 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8768753 exception.address: 0x10eccf1 registers.esp: 5700128 registers.edi: 15982998 registers.eax: 4294940664 registers.ebp: 3998933012 registers.edx: 17775566 registers.ebx: 1179202795 registers.esi: 3142799953 registers.ecx: 891973604	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 52 51 89 34 24 50 b8 29 50 ed 77 89 c6 58 ba exception.symbol: random+0x85e12e exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8773934 exception.address: 0x10ee12e registers.esp: 5700128 registers.edi: 15982998 registers.eax: 32807 registers.ebp: 3998933012 registers.edx: 17784197 registers.ebx: 262633 registers.esi: 3142799953 registers.ecx: 4294937488	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 68 0c b8 82 2e 89 14 24 89 0c 24 52 89 2c 24 exception.symbol: random+0x867520 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8811808 exception.address: 0x10f7520 registers.esp: 5700116 registers.edi: 15982998 registers.eax: 32310 registers.ebp: 3998933012 registers.edx: 2130566132 registers.ebx: 1192492490 registers.esi: 17789457 registers.ecx: 2104688640	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 68 2f 42 2e 33 89 1c 24 c7 04 24 57 24 ac 39 exception.symbol: random+0x86783e exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8812606 exception.address: 0x10f783e registers.esp: 5700120 registers.edi: 15982998 registers.eax: 32310 registers.ebp: 3998933012 registers.edx: 2130566132 registers.ebx: 1192492490 registers.esi: 17821767 registers.ecx: 2104688640	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb e9 67 03 00 00 5d ff 34 24 e9 b0 02 00 00 81 exception.symbol: random+0x86767c exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8812156 exception.address: 0x10f767c registers.esp: 5700120 registers.edi: 15982998 registers.eax: 1783979243 registers.ebp: 3998933012 registers.edx: 2130566132 registers.ebx: 1192492490 registers.esi: 17792455 registers.ecx: 0	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 51 c7 04 24 e2 5b c1 2a 81 04 24 b5 7c f6 65 exception.symbol: random+0x883cfc exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8928508 exception.address: 0x1113cfc registers.esp: 5700088 registers.edi: 17931295 registers.eax: 25947 registers.ebp: 3998933012 registers.edx: 2130566132 registers.ebx: 17899669 registers.esi: 17899731 registers.ecx: 2104688640	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb e9 68 00 00 00 55 89 e5 81 c5 04 00 00 00 81 exception.symbol: random+0x883de8 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8928744 exception.address: 0x1113de8 registers.esp: 5700088 registers.edi: 17908219 registers.eax: 15290962 registers.ebp: 3998933012 registers.edx: 2130566132 registers.ebx: 0 registers.esi: 17899731 registers.ecx: 2104688640	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 31 db ff 34 18 68 ae fb 7e 5b e9 7d 06 00 00 exception.symbol: random+0x88466b exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8930923 exception.address: 0x111466b registers.esp: 5700088 registers.edi: 17908219 registers.eax: 17935352 registers.ebp: 3998933012 registers.edx: 2138878087 registers.ebx: 0 registers.esi: 17899731 registers.ecx: 2104688640	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb e9 94 01 00 00 be 76 b5 ee 7a 81 c2 9a 99 b7 exception.symbol: random+0x884a6b exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8931947 exception.address: 0x1114a6b registers.esp: 5700088 registers.edi: 17908219 registers.eax: 17935352 registers.ebp: 3998933012 registers.edx: 310716768 registers.ebx: 4294943468 registers.esi: 17899731 registers.ecx: 2104688640	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb e9 3e fe ff ff 81 c2 cb 03 f7 3f 81 c2 ea fd exception.symbol: random+0x8859bb exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8935867 exception.address: 0x11159bb registers.esp: 5700088 registers.edi: 17908219 registers.eax: 1108320 registers.ebp: 3998933012 registers.edx: 17946177 registers.ebx: 4294937620 registers.esi: 17899731 registers.ecx: 1859972148	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 81 ea 00 53 df 3f 50 e9 3a 00 00 00 89 3c 24 exception.symbol: random+0x886ecf exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8941263 exception.address: 0x1116ecf registers.esp: 5700084 registers.edi: 17956487 registers.eax: 31691 registers.ebp: 3998933012 registers.edx: 17917543 registers.ebx: 4294937620 registers.esi: 17916531 registers.ecx: 0	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 50 89 0c 24 56 be 18 52 b8 7f 57 bf a4 81 fd exception.symbol: random+0x886e7e exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8941182 exception.address: 0x1116e7e registers.esp: 5700088 registers.edi: 17956487 registers.eax: 31691 registers.ebp: 3998933012 registers.edx: 17949234 registers.ebx: 4294937620 registers.esi: 17916531 registers.ecx: 0	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb e9 61 0b 00 00 b9 1a e3 f7 56 29 cf 59 8b 04 exception.symbol: random+0x88670a exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8939274 exception.address: 0x111670a registers.esp: 5700088 registers.edi: 17956487 registers.eax: 31691 registers.ebp: 3998933012 registers.edx: 17920814 registers.ebx: 4294937620 registers.esi: 0 registers.ecx: 7858514	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 81 ee 07 a5 4d 7d 03 34 24 55 89 04 24 e9 7d exception.symbol: random+0x88ba25 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8960549 exception.address: 0x111ba25 registers.esp: 5700084 registers.edi: 17956487 registers.eax: 31511 registers.ebp: 3998933012 registers.edx: 17935282 registers.ebx: 15996958 registers.esi: 17936531 registers.ecx: 1971716238	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 68 c4 87 bc 6b 89 04 24 53 e9 23 00 00 00 50 exception.symbol: random+0x88b88b exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8960139 exception.address: 0x111b88b registers.esp: 5700088 registers.edi: 17956487 registers.eax: 31511 registers.ebp: 3998933012 registers.edx: 17935282 registers.ebx: 15996958 registers.esi: 17968042 registers.ecx: 1971716238	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 56 c7 04 24 00 79 73 67 81 04 24 59 02 8c 14 exception.symbol: random+0x88b416 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8958998 exception.address: 0x111b416 registers.esp: 5700088 registers.edi: 17956487 registers.eax: 31511 registers.ebp: 3998933012 registers.edx: 0 registers.ebx: 15996958 registers.esi: 17939342 registers.ecx: 82921	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 56 89 e6 81 c6 04 00 00 00 83 ee 04 87 34 24 exception.symbol: random+0x88c769 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8963945 exception.address: 0x111c769 registers.esp: 5700088 registers.edi: 17956487 registers.eax: 24811 registers.ebp: 3998933012 registers.edx: 17942923 registers.ebx: 15996958 registers.esi: 17939342 registers.ecx: 0	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb e9 75 00 00 00 57 e9 ad 01 00 00 56 55 bd 04 exception.symbol: random+0x88f29e exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8975006 exception.address: 0x111f29e registers.esp: 5700088 registers.edi: 17956487 registers.eax: 17982138 registers.ebp: 3998933012 registers.edx: 915634205 registers.ebx: 15996958 registers.esi: 17939342 registers.ecx: 1836917967	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb e9 98 fa ff ff 2d b2 5b 60 79 01 d8 81 ec 04 exception.symbol: random+0x88f07f exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8974463 exception.address: 0x111f07f registers.esp: 5700088 registers.edi: 17956487 registers.eax: 17954334 registers.ebp: 3998933012 registers.edx: 81129 registers.ebx: 0 registers.esi: 17939342 registers.ecx: 1836917967	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 81 ec 04 00 00 00 89 34 24 57 e9 33 fc ff ff exception.symbol: random+0x890903 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8980739 exception.address: 0x1120903 registers.esp: 5700088 registers.edi: 1539450575 registers.eax: 32194 registers.ebp: 3998933012 registers.edx: 604277074 registers.ebx: 0 registers.esi: 17960841 registers.ecx: 1024	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 53 89 2c 24 81 ec 04 00 00 00 89 14 24 e9 54 exception.symbol: random+0x896a7c exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 9005692 exception.address: 0x1126a7c registers.esp: 5700084 registers.edi: 17982346 registers.eax: 26307 registers.ebp: 3998933012 registers.edx: 2130566132 registers.ebx: 2147483650 registers.esi: 17962554 registers.ecx: 2104688640	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 51 68 0a 6d e1 36 8b 0c 24 e9 e0 08 00 00 81 exception.symbol: random+0x896461 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 9004129 exception.address: 0x1126461 registers.esp: 5700088 registers.edi: 17985153 registers.eax: 26307 registers.ebp: 3998933012 registers.edx: 0 registers.ebx: 604292945 registers.esi: 17962554 registers.ecx: 2104688640	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 31 c0 ff 34 06 ff 34 24 59 53 89 e3 81 c3 04 exception.symbol: random+0x8a2c3f exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 9055295 exception.address: 0x1132c3f registers.esp: 5700088 registers.edi: 18010892 registers.eax: 27552 registers.ebp: 3998933012 registers.edx: 2130566132 registers.ebx: 1971716070 registers.esi: 18059617 registers.ecx: 0	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb ba 9c 5d 9b 10 57 c7 04 24 95 dd e3 26 89 3c exception.symbol: random+0x8a2c5f exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 9055327 exception.address: 0x1132c5f registers.esp: 5700088 registers.edi: 18010892 registers.eax: 4294942324 registers.ebp: 3998933012 registers.edx: 2130566132 registers.ebx: 1971716070 registers.esi: 18059617 registers.ecx: 604292950	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 83 ec 04 89 14 24 e9 4b f9 ff ff 55 54 e9 4b exception.symbol: random+0x8b4e6b exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 9129579 exception.address: 0x1144e6b registers.esp: 5700084 registers.edi: 18105619 registers.eax: 32268 registers.ebp: 3998933012 registers.edx: 2130566132 registers.ebx: 1185993 registers.esi: 2817358 registers.ecx: 2148669913	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 51 89 04 24 50 89 34 24 68 ff fd fb 7f 8b 34 exception.symbol: random+0x8b4ade exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 9128670 exception.address: 0x1144ade registers.esp: 5700088 registers.edi: 18137887 registers.eax: 322689 registers.ebp: 3998933012 registers.edx: 2130566132 registers.ebx: 1185993 registers.esi: 2817358 registers.ecx: 4294938032	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 57 e9 e3 ff ff ff 89 c2 ff 34 24 8b 04 24 e9 exception.symbol: random+0x8c1eb8 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 9182904 exception.address: 0x1151eb8 registers.esp: 5700084 registers.edi: 17652848 registers.eax: 30896 registers.ebp: 3998933012 registers.edx: 2130566132 registers.ebx: 80703863 registers.esi: 18160828 registers.ecx: 2104688640	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 57 68 65 81 6f 37 e9 e6 fb ff ff 81 c1 04 00 exception.symbol: random+0x8c2359 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 9184089 exception.address: 0x1152359 registers.esp: 5700088 registers.edi: 17652848 registers.eax: 30896 registers.ebp: 3998933012 registers.edx: 0 registers.ebx: 80703863 registers.esi: 18163940 registers.ecx: 2067276904	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb 53 bb 2d a2 fb 7e 87 f3 46 31 f3 31 de 31 f3 exception.symbol: random+0x8c470f exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 9193231 exception.address: 0x115470f registers.esp: 5700084 registers.edi: 4015504484 registers.eax: 28841 registers.ebp: 3998933012 registers.edx: 74255849 registers.ebx: 67241224 registers.esi: 35816788 registers.ecx: 18169827	1
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: fb e9 19 00 00 00 83 c4 04 83 ec 04 89 14 24 e9 exception.symbol: random+0x8c4537 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 9192759 exception.address: 0x1154537 registers.esp: 5700088 registers.edi: 604292946 registers.eax: 28841 registers.ebp: 3998933012 registers.edx: 74255849 registers.ebx: 67241224 registers.esi: 4294940988 registers.ecx: 18198668	1

Allocates read-write-execute memory (usually to unpack itself) (39 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76faf000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f20000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 2658304 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00891000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00790000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00870000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00880000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x014a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x014b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x014c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x014d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x014a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x014a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x014a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x014a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x014a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x014a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x014e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01530000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x015c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x015d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x015e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x015f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02e20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02eb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ec0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02f10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02f20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02f30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02f40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03150000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03160000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x031b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x031c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x031d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x014a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x014a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x014a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 13, 2025, 2:59 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x014a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x00288200', u'virtual_address': u'0x00001000', u'entropy': 7.988237822721041, u'name': u' \\x00 ', u'virtual_size': u'0x006ab000'}

entropy

7.98823782272

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x001ba200', u'virtual_address': u'0x00a48000', u'entropy': 7.9567548460497255, u'name': u'nluivgyi', u'virtual_size': u'0x001bb000'}

entropy

7.95675484605

description

A section with a high entropy has been found

entropy

0.997483989021

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 event)

process

system

Checks for the presence of known devices from debuggers and forensic tools (3 events)

file	\??\SICE
file	\??\SIWVID
file	\??\NTICE

Checks for the presence of known windows from debuggers and forensic tools (17 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA Jan. 13, 2025, 2:59 p.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA Jan. 13, 2025, 2:59 p.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA Jan. 13, 2025, 2:59 p.m.	class_name: pediy06 window_name:		0	0
FindWindowA Jan. 13, 2025, 2:59 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Jan. 13, 2025, 2:59 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Jan. 13, 2025, 2:59 p.m.	class_name: #0 window_name: File Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA Jan. 13, 2025, 2:59 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Jan. 13, 2025, 2:59 p.m.	class_name: #0 window_name: Process Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA Jan. 13, 2025, 2:59 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Jan. 13, 2025, 2:59 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA Jan. 13, 2025, 2:59 p.m.	class_name: #0 window_name: Registry Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA Jan. 13, 2025, 2:59 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA Jan. 13, 2025, 2:59 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Jan. 13, 2025, 2:59 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA Jan. 13, 2025, 2:59 p.m.	class_name: #0 window_name: File Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA Jan. 13, 2025, 2:59 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Jan. 13, 2025, 2:59 p.m.	class_name: #0 window_name: Process Monitor - Sysinternals: www.sysinternals.com		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Jan. 13, 2025, 2:59 p.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 68 b4 17 2e 3b 89 04 24 exception.symbol: random+0x846bb9 exception.instruction: in eax, dx exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 8678329 exception.address: 0x10d6bb9 registers.esp: 5700120 registers.edi: 23080472 registers.eax: 1447909480 registers.ebp: 3998933012 registers.edx: 22104 registers.ebx: 1969033397 registers.esi: 17641708 registers.ecx: 20	1	0	0

File has been identified by 35 AntiVirus engines on VirusTotal as malicious (35 events)

Bkav	W32.AIDetectMalware
Cynet	Malicious (score: 99)
Skyhigh	BehavesLike.Win32.Generic.rc
ALYac	Gen:Variant.Zusy.571903
Cylance	Unsafe
VIPRE	Gen:Variant.Zusy.571903
CrowdStrike	win/malicious_confidence_70% (D)
BitDefender	Gen:Variant.Zusy.571903
Arcabit	Trojan.Zusy.D8B9FF
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Packed.Themida.HZB
APEX	Malicious
Avast	Win32:Evo-gen [Trj]
Kaspersky	HEUR:Trojan-Downloader.Win32.Phpw.gen
MicroWorld-eScan	Gen:Variant.Zusy.571903
Rising	Trojan.Agent!1.11740 (CLASSIC)
Emsisoft	Gen:Variant.Zusy.571903 (B)
F-Secure	Trojan.TR/Crypt.TPM.Gen
McAfeeD	Real Protect-LS!555040B23D9B
Trapmine	malicious.moderate.ml.score
CTX	exe.unknown.zusy
SentinelOne	Static AI - Malicious PE
FireEye	Gen:Variant.Zusy.571903
Google	Detected
Avira	TR/Crypt.TPM.Gen
Gridinsoft	Trojan.Heur!.038120A1
Microsoft	Trojan:Win32/Obfuscator
GData	Gen:Variant.Zusy.571903
DeepInstinct	MALICIOUS
Malwarebytes	Malware.AI.3598381804
Ikarus	Trojan.Win32.LummaStealer
huorong	HEUR:TrojanSpy/Stealer.ay
Fortinet	W32/Themida.HZB!tr
AVG	Win32:Evo-gen [Trj]

random.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All