Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 28, 2025, 9:17 a.m.	April 28, 2025, 9:22 a.m.

Size	607.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`bb16dde30b851185630ccdc3416b29b8`
SHA256	`160ecaf1237207b658ae38660d9eff724683ab8d8c7a94074453dd59daebcf21`
CRC32	`A24ACE92`
ssdeep	`12288:lHxTOhPWba55P92+uByQdqN6NVOez2lnXByQVQjnrlqaJfi4:lRTo55F2/yQdqc8ezqn/GrlqaJfi`
PDB Path	Dism.pdb
Yara	PE_Header_Zero - PE File Signature Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet Malicious_Packer_Zero - Malicious Packer Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file

competive.exe "C:\Users\test22\AppData\Local\Temp\competive.exe"
2548

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
109.176.30.246	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW April 28, 2025, 9:18 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2025, 9:18 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2025, 9:18 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2025, 9:18 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2025, 9:18 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2025, 9:18 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2025, 9:18 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2025, 9:18 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2025, 9:18 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2025, 9:18 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2025, 9:18 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2025, 9:18 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 28, 2025, 9:18 a.m.			0	0
IsDebuggerPresent April 28, 2025, 9:18 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (5 events)

Time & API	Arguments	Status	Return
CryptExportKey April 28, 2025, 9:18 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00659be8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 8	1	1
CryptExportKey April 28, 2025, 9:18 a.m.	buffer: f vpÁÂ ~ÞM8µX¬ &¼W#lñåB_½<^£ crypto_handle: 0x00659be8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 8	1	1
CryptExportKey April 28, 2025, 9:18 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00659be8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 9:18 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00659be8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 9:18 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00659ce8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

Dism.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 28, 2025, 9:18 a.m.		1	1	0

The file contains an unknown PE resource name possibly indicative of a packer (2 events)

resource name	MUI
resource name	WEVT_TEMPLATE

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 148 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f70000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02090000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f70000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f70000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02040000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02250000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02390000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00832000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f9b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f97000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f95000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02041000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02042000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0083a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0083c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02043000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0470c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02044000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04726000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0472c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04729000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a91000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a98000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a99000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0470d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a9a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a9b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04bdf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04bd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a9c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0470e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05050000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 61440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05051000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c71000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c72000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c73000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 9:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c74000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Steals private information from local Internet browsers (50 out of 113 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 39
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 38
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 35
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 34
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 37
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 36
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 31
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 30
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 33
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 32
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 28
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 29
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 22
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 23
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 20
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 21
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 26
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 27
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 24
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 25
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 59
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 58
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 53
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 52
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 51
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 50
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 57
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 56
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 55
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 54
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 3
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 2
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 0
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 7
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 6
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 5
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 4
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 9
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 8
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 48
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 49
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 40
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 41
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 42

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses April 28, 2025, 9:18 a.m.	flags: 1158 family: 0	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00062800', u'virtual_address': u'0x00038000', u'entropy': 7.996236979455912, u'name': u'.reloc', u'virtual_size': u'0x00062800'}

entropy

7.99623697946

description

A section with a high entropy has been found

entropy

0.650165016502

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW April 28, 2025, 9:18 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: bcec2d3ba2c66474be24dfa1b6a008224589b2ff

Communicates with host for which no DNS query was performed (1 event)

host

109.176.30.246

Attempts to identify installed AV products by installation directory (2 events)

file	C:\Users\test22\AppData\Local\AVAST Software\Browser\User Data
file	C:\Users\test22\AppData\Local\AVG\Browser\User Data

A process attempted to delay the analysis task. (1 event)

description

competive.exe tried to sleep 2728187 seconds, actually delayed analysis time by 2728187 seconds

Attempts to access Bitcoin/ALTCoin wallets (2 events)

file	C:\Users\test22\AppData\Roaming\Electrum\config
file	C:\Users\test22\AppData\Roaming\Electrum\wallets

Executes one or more WMI queries (2 events)

wmi	Select * from AntivirusProduct
wmi	SELECT * FROM win32_operatingsystem

Appends a known CryptoMix ransomware file extension to files that have been encrypted (1 event)

file	C:\Users\test22\AppData\Roaming\Exodus\exodus.wallet

File has been identified by 41 AntiVirus engines on VirusTotal as malicious (41 events)

Bkav	W32.AIDetectMalware
Cynet	Malicious (score: 99)
CAT-QuickHeal	cld.backdoor.crysan
Skyhigh	BehavesLike.Win32.Generic.jc
ALYac	Gen:Variant.Zusy.589978
Cylance	Unsafe
VIPRE	Gen:Variant.Zusy.589978
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (W)
BitDefender	Gen:Variant.Zusy.589978
Arcabit	Trojan.Zusy.D9009A
VirIT	Trojan.Win32.GenHeur.B
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Generik.ETVNQSM
Avast	Win32:Malware-gen
Kaspersky	HEUR:Backdoor.Win32.Crysan.gen
Alibaba	Backdoor:Win32/Crysan.2f2b0b8c
MicroWorld-eScan	Gen:Variant.Zusy.589978
Rising	Trojan.Injector!1.127AD (CLASSIC)
Emsisoft	Gen:Variant.Zusy.589978 (B)
F-Secure	Trojan.TR/Patched.Gen
McAfeeD	ti!160ECAF12372
Trapmine	malicious.high.ml.score
CTX	exe.trojan.crysan
Sophos	Mal/Generic-S
Google	Detected
Avira	TR/Patched.Gen
Antiy-AVL	Trojan/Win32.Agentb
Gridinsoft	Trojan.Win32.Downloader.sa
Microsoft	Trojan:Win32/Sabsik.EN.A!ml
GData	Gen:Variant.Zusy.589978
Varist	W32/ABTrojan.UHSG-3956
McAfee	Artemis!BB16DDE30B85
DeepInstinct	MALICIOUS
Ikarus	Trojan.Patched
Panda	Trj/Chgt.AD
Tencent	Win32.Backdoor.Crysan.Mjgl
AVG	Win32:Malware-gen
Paloalto	generic.ml
alibabacloud	Backdoor:Win/Crysan.gyf

competive.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All