Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	May 4, 2025, 12:41 p.m.	May 4, 2025, 12:43 p.m.

Size	3.1MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`7ffe3fce01c5e8e192d722ab4f0fe2ab`
SHA256	`d7d7a968b030fc13462423b2c45489cbc83d865914a4cd1ace2210e5487ffab5`
CRC32	`A3061319`
ssdeep	`49152:tuxc0eWRwZhv6GGBMCfSC7xoaYt+gSOPvrJrCqygr93ESegTEH+PkRmll8Np3:5fv6FRaF7tnrCqy0GiEePkElup3`
Yara	PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description)

4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe "C:\Users\test22\AppData\Local\Temp\4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe"
1280

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (3 events)

Time & API	Arguments	Status	Return
GetComputerNameA May 4, 2025, 12:41 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 4, 2025, 12:41 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 4, 2025, 12:41 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 4, 2025, 12:41 p.m.			0	0
IsDebuggerPresent May 4, 2025, 12:41 p.m.			0	0
IsDebuggerPresent May 4, 2025, 12:41 p.m.			0	0
IsDebuggerPresent May 4, 2025, 12:41 p.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

One or more processes crashed (31 events)

Time & API	Arguments	Status
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x40f128 @ 0x53f128 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a1d9 exception.instruction: div eax exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc0000094 exception.offset: 3645913 exception.address: 0x4aa1d9 registers.esp: 9697380 registers.edi: 5480588 registers.eax: 0 registers.ebp: 9697408 registers.edx: 0 registers.ebx: 41890652 registers.esi: 3 registers.ecx: 41890652	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x40f128 @ 0x53f128 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a204 exception.instruction: ud2 exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc000001d exception.offset: 3645956 exception.address: 0x4aa204 registers.esp: 9697380 registers.edi: 9697380 registers.eax: 0 registers.ebp: 9697408 registers.edx: 2 registers.ebx: 4891119 registers.esi: 0 registers.ecx: 9697588	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x40f128 @ 0x53f128 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a204 exception.instruction: ud2 exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc000001d exception.offset: 3645956 exception.address: 0x4aa204 registers.esp: 9697380 registers.edi: 9697380 registers.eax: 0 registers.ebp: 9697408 registers.edx: 2 registers.ebx: 4891162 registers.esi: 0 registers.ecx: 9697588	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x411243 @ 0x541243 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4157dd @ 0x5457dd 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a1d9 exception.instruction: div eax exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc0000094 exception.offset: 3645913 exception.address: 0x4aa1d9 registers.esp: 9697332 registers.edi: 5480588 registers.eax: 0 registers.ebp: 9697360 registers.edx: 0 registers.ebx: 4294918144 registers.esi: 4145152 registers.ecx: 4145152	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x411243 @ 0x541243 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4157dd @ 0x5457dd 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a1d9 exception.instruction: div eax exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc0000094 exception.offset: 3645913 exception.address: 0x4aa1d9 registers.esp: 9697332 registers.edi: 9697332 registers.eax: 0 registers.ebp: 9697360 registers.edx: 0 registers.ebx: 4891119 registers.esi: 0 registers.ecx: 9697368	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x411243 @ 0x541243 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4157dd @ 0x5457dd 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a1d9 exception.instruction: div eax exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc0000094 exception.offset: 3645913 exception.address: 0x4aa1d9 registers.esp: 9697332 registers.edi: 9697332 registers.eax: 0 registers.ebp: 9697360 registers.edx: 0 registers.ebx: 4891119 registers.esi: 0 registers.ecx: 9697368	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x41131f @ 0x54131f 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4157dd @ 0x5457dd 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a204 exception.instruction: ud2 exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc000001d exception.offset: 3645956 exception.address: 0x4aa204 registers.esp: 9697332 registers.edi: 5480588 registers.eax: 0 registers.ebp: 9697360 registers.edx: 2 registers.ebx: 4294918144 registers.esi: 4145152 registers.ecx: 811984021	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x41131f @ 0x54131f 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4157dd @ 0x5457dd 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a204 exception.instruction: ud2 exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc000001d exception.offset: 3645956 exception.address: 0x4aa204 registers.esp: 9697332 registers.edi: 9697332 registers.eax: 0 registers.ebp: 9697360 registers.edx: 2 registers.ebx: 4891162 registers.esi: 0 registers.ecx: 9697368	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x41131f @ 0x54131f 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4157dd @ 0x5457dd 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a1d9 exception.instruction: div eax exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc0000094 exception.offset: 3645913 exception.address: 0x4aa1d9 registers.esp: 9697332 registers.edi: 9697332 registers.eax: 0 registers.ebp: 9697360 registers.edx: 0 registers.ebx: 4891162 registers.esi: 0 registers.ecx: 9697368	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x41131f @ 0x54131f 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4157dd @ 0x5457dd 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a204 exception.instruction: ud2 exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc000001d exception.offset: 3645956 exception.address: 0x4aa204 registers.esp: 9697332 registers.edi: 9697332 registers.eax: 0 registers.ebp: 9697360 registers.edx: 2 registers.ebx: 4891119 registers.esi: 0 registers.ecx: 9697368	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x41131f @ 0x54131f 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4157dd @ 0x5457dd 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a1d9 exception.instruction: div eax exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc0000094 exception.offset: 3645913 exception.address: 0x4aa1d9 registers.esp: 9697332 registers.edi: 9697332 registers.eax: 0 registers.ebp: 9697360 registers.edx: 0 registers.ebx: 4891162 registers.esi: 0 registers.ecx: 9697368	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4113f1 @ 0x5413f1 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4157dd @ 0x5457dd 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a1d9 exception.instruction: div eax exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc0000094 exception.offset: 3645913 exception.address: 0x4aa1d9 registers.esp: 9697332 registers.edi: 5480588 registers.eax: 0 registers.ebp: 9697360 registers.edx: 0 registers.ebx: 4294918144 registers.esi: 4145152 registers.ecx: 9697360	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4113f1 @ 0x5413f1 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4157dd @ 0x5457dd 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a204 exception.instruction: ud2 exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc000001d exception.offset: 3645956 exception.address: 0x4aa204 registers.esp: 9697332 registers.edi: 9697332 registers.eax: 0 registers.ebp: 9697360 registers.edx: 2 registers.ebx: 4891119 registers.esi: 0 registers.ecx: 9697368	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4113f1 @ 0x5413f1 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4157dd @ 0x5457dd 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a204 exception.instruction: ud2 exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc000001d exception.offset: 3645956 exception.address: 0x4aa204 registers.esp: 9697332 registers.edi: 9697332 registers.eax: 0 registers.ebp: 9697360 registers.edx: 2 registers.ebx: 4891162 registers.esi: 0 registers.ecx: 9697368	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4113f1 @ 0x5413f1 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4157dd @ 0x5457dd 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a1d9 exception.instruction: div eax exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc0000094 exception.offset: 3645913 exception.address: 0x4aa1d9 registers.esp: 9697332 registers.edi: 9697332 registers.eax: 0 registers.ebp: 9697360 registers.edx: 0 registers.ebx: 4891162 registers.esi: 0 registers.ecx: 9697368	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4113f1 @ 0x5413f1 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4157dd @ 0x5457dd 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a204 exception.instruction: ud2 exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc000001d exception.offset: 3645956 exception.address: 0x4aa204 registers.esp: 9697332 registers.edi: 9697332 registers.eax: 0 registers.ebp: 9697360 registers.edx: 2 registers.ebx: 4891119 registers.esi: 0 registers.ecx: 9697368	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4114eb @ 0x5414eb 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4157dd @ 0x5457dd 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a1d9 exception.instruction: div eax exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc0000094 exception.offset: 3645913 exception.address: 0x4aa1d9 registers.esp: 9697332 registers.edi: 5480588 registers.eax: 0 registers.ebp: 9697360 registers.edx: 0 registers.ebx: 4294918144 registers.esi: 4145152 registers.ecx: 2392019361	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4114eb @ 0x5414eb 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4157dd @ 0x5457dd 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a204 exception.instruction: ud2 exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc000001d exception.offset: 3645956 exception.address: 0x4aa204 registers.esp: 9697332 registers.edi: 9697332 registers.eax: 0 registers.ebp: 9697360 registers.edx: 2 registers.ebx: 4891119 registers.esi: 0 registers.ecx: 9697368	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4114eb @ 0x5414eb 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4157dd @ 0x5457dd 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a204 exception.instruction: ud2 exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc000001d exception.offset: 3645956 exception.address: 0x4aa204 registers.esp: 9697332 registers.edi: 9697332 registers.eax: 0 registers.ebp: 9697360 registers.edx: 2 registers.ebx: 4891162 registers.esi: 0 registers.ecx: 9697368	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4114eb @ 0x5414eb 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4157dd @ 0x5457dd 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a204 exception.instruction: ud2 exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc000001d exception.offset: 3645956 exception.address: 0x4aa204 registers.esp: 9697332 registers.edi: 9697332 registers.eax: 0 registers.ebp: 9697360 registers.edx: 2 registers.ebx: 4891162 registers.esi: 0 registers.ecx: 9697368	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4114eb @ 0x5414eb 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4157dd @ 0x5457dd 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a204 exception.instruction: ud2 exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc000001d exception.offset: 3645956 exception.address: 0x4aa204 registers.esp: 9697332 registers.edi: 9697332 registers.eax: 0 registers.ebp: 9697360 registers.edx: 2 registers.ebx: 4891162 registers.esi: 0 registers.ecx: 9697368	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4114eb @ 0x5414eb 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4157dd @ 0x5457dd 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a1d9 exception.instruction: div eax exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc0000094 exception.offset: 3645913 exception.address: 0x4aa1d9 registers.esp: 9697332 registers.edi: 9697332 registers.eax: 0 registers.ebp: 9697360 registers.edx: 0 registers.ebx: 4891162 registers.esi: 0 registers.ecx: 9697368	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4114eb @ 0x5414eb 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4157dd @ 0x5457dd 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a204 exception.instruction: ud2 exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc000001d exception.offset: 3645956 exception.address: 0x4aa204 registers.esp: 9697332 registers.edi: 9697332 registers.eax: 0 registers.ebp: 9697360 registers.edx: 2 registers.ebx: 4891119 registers.esi: 0 registers.ecx: 9697368	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4114eb @ 0x5414eb 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4157dd @ 0x5457dd 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a204 exception.instruction: ud2 exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc000001d exception.offset: 3645956 exception.address: 0x4aa204 registers.esp: 9697332 registers.edi: 9697332 registers.eax: 0 registers.ebp: 9697360 registers.edx: 2 registers.ebx: 4891162 registers.esi: 0 registers.ecx: 9697368	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x411581 @ 0x541581 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4157dd @ 0x5457dd 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a204 exception.instruction: ud2 exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc000001d exception.offset: 3645956 exception.address: 0x4aa204 registers.esp: 9697332 registers.edi: 5480588 registers.eax: 0 registers.ebp: 9697360 registers.edx: 2 registers.ebx: 4294918144 registers.esi: 4145152 registers.ecx: 944269624	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x411581 @ 0x541581 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4157dd @ 0x5457dd 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a1d9 exception.instruction: div eax exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc0000094 exception.offset: 3645913 exception.address: 0x4aa1d9 registers.esp: 9697332 registers.edi: 9697332 registers.eax: 0 registers.ebp: 9697360 registers.edx: 0 registers.ebx: 4891162 registers.esi: 0 registers.ecx: 9697368	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x411581 @ 0x541581 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4157dd @ 0x5457dd 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a1d9 exception.instruction: div eax exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc0000094 exception.offset: 3645913 exception.address: 0x4aa1d9 registers.esp: 9697332 registers.edi: 9697332 registers.eax: 0 registers.ebp: 9697360 registers.edx: 0 registers.ebx: 4891119 registers.esi: 0 registers.ecx: 9697368	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x411581 @ 0x541581 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4157dd @ 0x5457dd 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a1d9 exception.instruction: div eax exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc0000094 exception.offset: 3645913 exception.address: 0x4aa1d9 registers.esp: 9697332 registers.edi: 9697332 registers.eax: 0 registers.ebp: 9697360 registers.edx: 0 registers.ebx: 4891119 registers.esi: 0 registers.ecx: 9697368	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x411581 @ 0x541581 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4157dd @ 0x5457dd 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a1d9 exception.instruction: div eax exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc0000094 exception.offset: 3645913 exception.address: 0x4aa1d9 registers.esp: 9697332 registers.edi: 9697332 registers.eax: 0 registers.ebp: 9697360 registers.edx: 0 registers.ebx: 4891119 registers.esi: 0 registers.ecx: 9697368	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x411581 @ 0x541581 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4157dd @ 0x5457dd 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: f7 f0 e8 f8 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a1d9 exception.instruction: div eax exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc0000094 exception.offset: 3645913 exception.address: 0x4aa1d9 registers.esp: 9697332 registers.edi: 9697332 registers.eax: 0 registers.ebp: 9697360 registers.edx: 0 registers.ebx: 4891119 registers.esi: 0 registers.ecx: 9697368	1
__exception__ May 4, 2025, 12:41 p.m.	stacktrace: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x411581 @ 0x541581 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x4157dd @ 0x5457dd 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x39d8dc @ 0x4cd8dc exception.instruction_r: 0f 0b e8 cd 2f 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: 4b307d76-5a71-44ea-bd7c-9e2cc8323175+0x37a204 exception.instruction: ud2 exception.module: 4b307d76-5a71-44ea-bd7c-9e2cc8323175.exe exception.exception_code: 0xc000001d exception.offset: 3645956 exception.address: 0x4aa204 registers.esp: 9697332 registers.edi: 9697332 registers.eax: 0 registers.ebp: 9697360 registers.edx: 2 registers.ebx: 4891119 registers.esi: 0 registers.ecx: 9697368	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 1819 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 2936832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02500000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027d4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 147456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027d4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02804000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02804000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02814000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02818000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02818000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 2637824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03280000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02818000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02818000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00130000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03280000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x033c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e22000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 851968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03280000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03310000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02e80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a5b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a57000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a55000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02e81000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a46000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a4a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a47000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02e88000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02eaf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ea0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00132000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00132000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00132000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00132000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00132000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00132000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00132000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00132000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00132000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00132000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00132000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00132000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00132000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00132000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 4, 2025, 12:41 p.m.	process_identifier: 1280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00132000 process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (3 events)

section

{u'size_of_data': u'0x00281200', u'virtual_address': u'0x00002000', u'entropy': 7.999915887784825, u'name': u'', u'virtual_size': u'0x002bc000'}

entropy

7.99991588778

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00095000', u'virtual_address': u'0x005c2000', u'entropy': 7.937495489930819, u'name': u'.data', u'virtual_size': u'0x00096000'}

entropy

7.93749548993

description

A section with a high entropy has been found

entropy

0.999683694449

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 4, 2025, 12:41 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Queries information on disks, possibly for anti-virtualization (2 events)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile May 4, 2025, 12:41 p.m.	create_disposition: 1 (FILE_OPEN) file_handle: 0x00000110 filepath: \??\Scsi0: desired_access: 0xc0100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 0 () filepath_r: \??\Scsi0: create_options: 96 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 0 (FILE_SUPERSEDED) share_access: 3 (FILE_SHARE_READ\|FILE_SHARE_WRITE)	1	0	0
DeviceIoControl May 4, 2025, 12:41 p.m.	input_buffer: SCSIDISK ì control_code: 315400 () device_handle: 0x00000110 output_buffer: <INVALID POINTER>		0	0

File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 events)

Bkav	W32.AIDetectMalware
Lionic	Worm.Win32.Generic.ma5y
CAT-QuickHeal	Trojan.Ghanarava.17462654650fe2ab
Skyhigh	BehavesLike.Win32.Generic.wc
ALYac	Gen:Variant.Fragtor.827916
Cylance	Unsafe
VIPRE	Gen:Variant.Fragtor.827916
Sangfor	Suspicious.Win32.Save.ins
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Gen:Variant.Fragtor.827916
K7GW	Trojan ( 000046bb1 )
K7AntiVirus	Trojan ( 000046bb1 )
Arcabit	Trojan.Fragtor.DCA20C
VirIT	Trojan.Win32.Genus.XVP
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Packed.Enigma.AAF
APEX	Malicious
Avast	WAT:Blacked-E
ClamAV	Win.Trojan.Scar-6903583-0
Kaspersky	Trojan.Win32.Packed.kld
Alibaba	Packed:Win32/Enigma.92b0a029
MicroWorld-eScan	Gen:Variant.Fragtor.827916
Emsisoft	Gen:Variant.Fragtor.827916 (B)
F-Secure	Heuristic.HEUR/AGEN.1327682
Zillya	Trojan.Enigma.Win32.12716
TrendMicro	Trojan.Win32.AMADEY.YXFDJZ
McAfeeD	Real Protect-LS!7FFE3FCE01C5
Trapmine	malicious.high.ml.score
CTX	exe.trojan.enigma
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
Jiangmin	Trojan.Generic.huioy
Webroot	W32.Backdoor.Dcrat
Google	Detected
Avira	HEUR/AGEN.1327682
Antiy-AVL	Trojan[Packed]/Win32.Enigma
Kingsoft	malware.kb.b.880
Xcitium	Malware@#353s4abvgapkp
Microsoft	Trojan:Win32/Multiverze!rfn
ViRobot	Trojan.Win.Z.Fragtor.3238400
GData	Gen:Variant.Fragtor.827916
Varist	W32/Trojan.FFG.gen!Eldorado
AhnLab-V3	Trojan/Win32.Gen
McAfee	Artemis!7FFE3FCE01C5
DeepInstinct	MALICIOUS
VBA32	BScope.Trojan.Fuerboos
Malwarebytes	Generic.Malware.AI.DDS
Ikarus	Trojan.Win32.VBKrypt
Panda	Trj/Chgt.AD

4b307d76-5a71-44ea-bd7c-9e2cc8323175

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All