Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 3, 2025, 4:38 p.m.	May 3, 2025, 4:49 p.m.

Size	4.8MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`36e4ae56336fc479cea6ae5cec915584`
SHA256	`9431f488d49e820e4222662185f8b1f06a43575c67a04f3b1f08f5724208b994`
CRC32	`7A833EAB`
ssdeep	`98304:rg+d5Kiyja43o4QFbgyhxUoRM5Q5k+xHYYtQ9z7RuQYLFTad2bfhn9:cM5lY0b/fVZ5iYCqB5jh`
Yara	themida_packer - themida packer PE_Header_Zero - PE File Signature mzp_file_format - MZP(Delphi) file format anti_vm_detect - Possibly employs anti-virtualization techniques IsPE32 - (no description) UPX_Zero - UPX packed file

random.exe "C:\Users\test22\AppData\Local\Temp\random.exe"
2548

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW May 3, 2025, 4:38 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW May 3, 2025, 4:38 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (15 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 3, 2025, 4:38 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:38 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:38 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:38 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:38 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:38 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:38 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:38 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:38 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:38 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:38 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:38 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:38 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:38 p.m.			0	0
IsDebuggerPresent May 3, 2025, 4:38 p.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (6 events)

section	\x00
section	.idata
section
section	nvqxtyiv
section	shevungj
section	.taggant

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

TREGQWEFA

One or more processes crashed (50 out of 702 events)

Time & API	Arguments	Status
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: fb e9 4e 01 00 00 60 8b 74 24 24 8b 7c 24 28 fc exception.symbol: random+0x7370b9 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 7565497 exception.address: 0xb370b9 registers.esp: 1638276 registers.edi: 0 registers.eax: 1 registers.ebp: 1638292 registers.edx: 13770752 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 83 ec 04 89 2c 24 51 89 04 24 e9 00 00 00 00 exception.symbol: random+0x457620 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 4552224 exception.address: 0x857620 registers.esp: 1638244 registers.edi: 1968898280 registers.eax: 27790 registers.ebp: 3998765076 registers.edx: 4135066984 registers.ebx: 1968952541 registers.esi: 8747514 registers.ecx: 0	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 55 e9 9e f5 ff ff c1 e6 03 51 b9 1b c6 bf 7e exception.symbol: random+0x4585b5 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 4556213 exception.address: 0x8585b5 registers.esp: 1638240 registers.edi: 1968898280 registers.eax: 27469 registers.ebp: 3998765076 registers.edx: 8747825 registers.ebx: 1232497167 registers.esi: 8747514 registers.ecx: 0	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb e9 7f fe ff ff 29 f1 5e 50 b8 79 e4 d7 17 e9 exception.symbol: random+0x457da9 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 4554153 exception.address: 0x857da9 registers.esp: 1638244 registers.edi: 234729 registers.eax: 4294942644 registers.ebp: 3998765076 registers.edx: 8775294 registers.ebx: 1232497167 registers.esi: 8747514 registers.ecx: 0	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 68 6a 09 df 77 5e 81 ec 04 00 00 00 89 04 24 exception.symbol: random+0x5d228e exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6103694 exception.address: 0x9d228e registers.esp: 1638244 registers.edi: 8783040 registers.eax: 10326080 registers.ebp: 3998765076 registers.edx: 2345 registers.ebx: 913408 registers.esi: 10297351 registers.ecx: 2140536832	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 55 68 84 63 08 57 89 1c 24 68 45 74 ff 5d 8b exception.symbol: random+0x5d2812 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6105106 exception.address: 0x9d2812 registers.esp: 1638244 registers.edi: 8783040 registers.eax: 10326080 registers.ebp: 3998765076 registers.edx: 2345 registers.ebx: 3909414019 registers.esi: 4294942348 registers.ecx: 2140536832	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb e9 08 fa ff ff bb f4 7b 3f 7b 81 f3 88 48 b7 exception.symbol: random+0x5d8961 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6130017 exception.address: 0x9d8961 registers.esp: 1638244 registers.edi: 94 registers.eax: 28492 registers.ebp: 3998765076 registers.edx: 0 registers.ebx: 10320436 registers.esi: 10351066 registers.ecx: 10320436	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 51 e9 12 fe ff ff ba ef 40 fb 63 31 54 24 04 exception.symbol: random+0x5d89b3 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6130099 exception.address: 0x9d89b3 registers.esp: 1638244 registers.edi: 50665 registers.eax: 28492 registers.ebp: 3998765076 registers.edx: 0 registers.ebx: 10320436 registers.esi: 10325654 registers.ecx: 0	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 68 4a 44 18 0d 89 2c 24 e9 00 00 00 00 bd 13 exception.symbol: random+0x5da31d exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6136605 exception.address: 0x9da31d registers.esp: 1638240 registers.edi: 50665 registers.eax: 28523 registers.ebp: 3998765076 registers.edx: 392385183 registers.ebx: 362030933 registers.esi: 10325654 registers.ecx: 10328023	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 53 c7 04 24 43 bd bd 4f 81 24 24 31 8c ed 7b exception.symbol: random+0x5d9ba0 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6134688 exception.address: 0x9d9ba0 registers.esp: 1638244 registers.edi: 50665 registers.eax: 28523 registers.ebp: 3998765076 registers.edx: 392385183 registers.ebx: 362030933 registers.esi: 10325654 registers.ecx: 10356546	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 50 b8 b8 2f f9 7f bb 00 48 70 ee 29 c3 58 56 exception.symbol: random+0x5da214 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6136340 exception.address: 0x9da214 registers.esp: 1638244 registers.edi: 50665 registers.eax: 4294941856 registers.ebp: 3998765076 registers.edx: 1259 registers.ebx: 362030933 registers.esi: 10325654 registers.ecx: 10356546	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 55 54 e9 f0 23 00 00 50 exception.symbol: random+0x5e2215 exception.instruction: in eax, dx exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6169109 exception.address: 0x9e2215 registers.esp: 1638236 registers.edi: 15412776 registers.eax: 1447909480 registers.ebp: 3998765076 registers.edx: 22104 registers.ebx: 1969033397 registers.esi: 10360287 registers.ecx: 20	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: 0f 3f 07 0b 64 8f 05 00 00 00 00 83 c4 04 83 fb exception.symbol: random+0x5e40c3 exception.address: 0x9e40c3 exception.module: random.exe exception.exception_code: 0xc000001d exception.offset: 6176963 registers.esp: 1638236 registers.edi: 15412776 registers.eax: 1 registers.ebp: 3998765076 registers.edx: 22104 registers.ebx: 0 registers.esi: 10360287 registers.ecx: 20	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: ed 81 fb 68 58 4d 56 75 0a c7 85 1b 37 2d 12 01 exception.symbol: random+0x5e2db0 exception.instruction: in eax, dx exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6172080 exception.address: 0x9e2db0 registers.esp: 1638236 registers.edi: 15412776 registers.eax: 1447909480 registers.ebp: 3998765076 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 10360287 registers.ecx: 10	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: cd 01 eb 00 f9 81 e1 cf 15 80 47 64 8f 05 00 00 exception.symbol: random+0x5ea3e1 exception.instruction: int 1 exception.module: random.exe exception.exception_code: 0xc0000005 exception.offset: 6202337 exception.address: 0x9ea3e1 registers.esp: 1638204 registers.edi: 0 registers.eax: 1638204 registers.ebp: 3998765076 registers.edx: 26065 registers.ebx: 10396945 registers.esi: 2140243864 registers.ecx: 1607827019	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb e9 54 01 00 00 68 15 5d 4d 66 89 2c 24 bd 9d exception.symbol: random+0x5eaefe exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6205182 exception.address: 0x9eaefe registers.esp: 1638240 registers.edi: 15412776 registers.eax: 31500 registers.ebp: 3998765076 registers.edx: 10397188 registers.ebx: 36061390 registers.esi: 10397878 registers.ecx: 1125261477	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb e9 48 fe ff ff 81 ee 31 c9 fb 71 03 34 24 e9 exception.symbol: random+0x5eafe6 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6205414 exception.address: 0x9eafe6 registers.esp: 1638244 registers.edi: 15412776 registers.eax: 31500 registers.ebp: 3998765076 registers.edx: 2283 registers.ebx: 0 registers.esi: 10400662 registers.ecx: 1125261477	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 83 ec 04 89 14 24 e9 56 f6 ff ff 5f 83 ea 04 exception.symbol: random+0x5fa7b4 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6268852 exception.address: 0x9fa7b4 registers.esp: 1638244 registers.edi: 8736838 registers.eax: 10486463 registers.ebp: 3998765076 registers.edx: 6 registers.ebx: 36061612 registers.esi: 1968968720 registers.ecx: 0	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 57 57 c7 04 24 15 02 92 3e 8b 3c 24 50 e9 20 exception.symbol: random+0x5fa93a exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6269242 exception.address: 0x9fa93a registers.esp: 1638244 registers.edi: 8736838 registers.eax: 10486463 registers.ebp: 3998765076 registers.edx: 6 registers.ebx: 4294944432 registers.esi: 1968968720 registers.ecx: 1567056	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb ba c3 f3 ee 3d 31 ea e9 e8 02 00 00 b8 bd 35 exception.symbol: random+0x5fac69 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6270057 exception.address: 0x9fac69 registers.esp: 1638244 registers.edi: 8736838 registers.eax: 10492950 registers.ebp: 3998765076 registers.edx: 373470171 registers.ebx: 4294944432 registers.esi: 1968968720 registers.ecx: 1049756181	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 68 72 5a b3 17 89 1c 24 e9 9a 08 00 00 83 c4 exception.symbol: random+0x5fac07 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6269959 exception.address: 0x9fac07 registers.esp: 1638244 registers.edi: 8736838 registers.eax: 10466546 registers.ebp: 3998765076 registers.edx: 0 registers.ebx: 2179041617 registers.esi: 1968968720 registers.ecx: 1049756181	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 53 50 54 8b 04 24 83 c4 04 e9 fa f9 ff ff 8b exception.symbol: random+0x5fe99b exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6285723 exception.address: 0x9fe99b registers.esp: 1638240 registers.edi: 8736838 registers.eax: 30175 registers.ebp: 3998765076 registers.edx: 10478432 registers.ebx: 889193028 registers.esi: 1970711072 registers.ecx: 1026039501	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb e9 02 06 00 00 0d 34 72 66 0f 2d 2f c2 ca 77 exception.symbol: random+0x5fe3ba exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6284218 exception.address: 0x9fe3ba registers.esp: 1638244 registers.edi: 8736838 registers.eax: 30175 registers.ebp: 3998765076 registers.edx: 10508607 registers.ebx: 889193028 registers.esi: 1970711072 registers.ecx: 1026039501	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 50 b8 00 02 de 33 68 c4 bc 5f 04 89 2c 24 e9 exception.symbol: random+0x5fea8f exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6285967 exception.address: 0x9fea8f registers.esp: 1638244 registers.edi: 4294939780 registers.eax: 30175 registers.ebp: 3998765076 registers.edx: 10508607 registers.ebx: 889193028 registers.esi: 204265 registers.ecx: 1026039501	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 57 89 e7 81 c7 04 00 00 00 51 b9 00 98 ab 46 exception.symbol: random+0x606e30 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6319664 exception.address: 0xa06e30 registers.esp: 1638236 registers.edi: 4294939780 registers.eax: 32114 registers.ebp: 3998765076 registers.edx: 84201 registers.ebx: 0 registers.esi: 204265 registers.ecx: 10514353	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 81 ec 04 00 00 00 89 14 24 57 89 24 24 81 04 exception.symbol: random+0x61273b exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6367035 exception.address: 0xa1273b registers.esp: 1638236 registers.edi: 144 registers.eax: 30829 registers.ebp: 3998765076 registers.edx: 0 registers.ebx: 10549945 registers.esi: 759139942 registers.ecx: 10591815	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb b8 15 eb be 7d c1 e8 04 81 ec 04 00 00 00 e9 exception.symbol: random+0x612eac exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6368940 exception.address: 0xa12eac registers.esp: 1638236 registers.edi: 144 registers.eax: 30829 registers.ebp: 3998765076 registers.edx: 1358981728 registers.ebx: 10549945 registers.esi: 0 registers.ecx: 10564263	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb e9 56 00 00 00 83 c4 04 29 f9 53 bb da c0 3a exception.symbol: random+0x625fcf exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6447055 exception.address: 0xa25fcf registers.esp: 1638200 registers.edi: 10635578 registers.eax: 28926 registers.ebp: 3998765076 registers.edx: 2130566132 registers.ebx: 18746 registers.esi: 10639932 registers.ecx: 2140536832	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 68 39 b7 d4 01 89 1c 24 68 e7 4f 05 1b 89 04 exception.symbol: random+0x6260fb exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6447355 exception.address: 0xa260fb registers.esp: 1638204 registers.edi: 10635578 registers.eax: 28926 registers.ebp: 3998765076 registers.edx: 0 registers.ebx: 18746 registers.esi: 10642866 registers.ecx: 2298801283	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 81 ea 16 d9 77 5f 81 ea ac 15 f5 7e 03 14 24 exception.symbol: random+0x626e13 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6450707 exception.address: 0xa26e13 registers.esp: 1638200 registers.edi: 10635578 registers.eax: 27018 registers.ebp: 3998765076 registers.edx: 10643282 registers.ebx: 1641031874 registers.esi: 10642866 registers.ecx: 1978555357	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 68 fa 6c e1 0f 89 14 24 e9 dd 00 00 00 c7 04 exception.symbol: random+0x626862 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6449250 exception.address: 0xa26862 registers.esp: 1638204 registers.edi: 10635578 registers.eax: 2503172192 registers.ebp: 3998765076 registers.edx: 10646688 registers.ebx: 0 registers.esi: 10642866 registers.ecx: 1978555357	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 81 c2 a0 fe e3 7f 81 ea 1a 5c fb 6f 03 14 24 exception.symbol: random+0x6279c4 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6453700 exception.address: 0xa279c4 registers.esp: 1638200 registers.edi: 10647415 registers.eax: 27156 registers.ebp: 3998765076 registers.edx: 10647935 registers.ebx: 1043027478 registers.esi: 10646719 registers.ecx: 0	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb e9 30 03 00 00 89 e2 81 c2 04 00 00 00 57 e9 exception.symbol: random+0x627c4f exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6454351 exception.address: 0xa27c4f registers.esp: 1638204 registers.edi: 10647415 registers.eax: 27156 registers.ebp: 3998765076 registers.edx: 10675091 registers.ebx: 1043027478 registers.esi: 10646719 registers.ecx: 0	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb e9 44 00 00 00 89 34 24 54 5e e9 3e 03 00 00 exception.symbol: random+0x6280aa exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6455466 exception.address: 0xa280aa registers.esp: 1638204 registers.edi: 10647415 registers.eax: 27156 registers.ebp: 3998765076 registers.edx: 10675091 registers.ebx: 264276832 registers.esi: 4294943060 registers.ecx: 0	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 55 89 0c 24 b9 15 1d ef 7d e9 7a fc ff ff 89 exception.symbol: random+0x6291fc exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6459900 exception.address: 0xa291fc registers.esp: 1638200 registers.edi: 10647415 registers.eax: 10653087 registers.ebp: 3998765076 registers.edx: 1337937663 registers.ebx: 264276832 registers.esi: 4294943060 registers.ecx: 1433098415	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 68 52 4c 18 72 89 3c 24 68 83 52 e6 06 89 14 exception.symbol: random+0x6295b6 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6460854 exception.address: 0xa295b6 registers.esp: 1638204 registers.edi: 10647415 registers.eax: 10683999 registers.ebp: 3998765076 registers.edx: 948936077 registers.ebx: 4294939404 registers.esi: 4294943060 registers.ecx: 1433098415	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 50 56 be 01 79 d2 7c 89 f0 e9 5e f9 ff ff 81 exception.symbol: random+0x62face exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6486734 exception.address: 0xa2face registers.esp: 1638200 registers.edi: 10647415 registers.eax: 27052 registers.ebp: 3998765076 registers.edx: 0 registers.ebx: 10678809 registers.esi: 4294943060 registers.ecx: 1971716238	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 53 89 04 24 89 2c 24 c7 04 24 ab fd 61 67 89 exception.symbol: random+0x62fcfd exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6487293 exception.address: 0xa2fcfd registers.esp: 1638204 registers.edi: 10647415 registers.eax: 27052 registers.ebp: 3998765076 registers.edx: 0 registers.ebx: 10705861 registers.esi: 4294943060 registers.ecx: 1971716238	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 52 89 2c 24 89 04 24 e9 3e 02 00 00 5b e9 8f exception.symbol: random+0x62f863 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6486115 exception.address: 0xa2f863 registers.esp: 1638204 registers.edi: 10647415 registers.eax: 518606933 registers.ebp: 3998765076 registers.edx: 0 registers.ebx: 10682333 registers.esi: 4294943060 registers.ecx: 0	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 56 e9 5b 00 00 00 01 e9 5d 01 c1 e9 e9 f7 ff exception.symbol: random+0x6309b6 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6490550 exception.address: 0xa309b6 registers.esp: 1638200 registers.edi: 10647415 registers.eax: 24994 registers.ebp: 3998765076 registers.edx: 10682757 registers.ebx: 1501674380 registers.esi: 4294943060 registers.ecx: 1499812883	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 31 c0 50 89 e0 05 04 00 00 00 83 e8 04 e9 e1 exception.symbol: random+0x6303e2 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6489058 exception.address: 0xa303e2 registers.esp: 1638204 registers.edi: 10647415 registers.eax: 24994 registers.ebp: 3998765076 registers.edx: 10707751 registers.ebx: 1501674380 registers.esi: 4294943060 registers.ecx: 1499812883	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 50 e9 2c 00 00 00 89 04 24 e9 90 03 00 00 31 exception.symbol: random+0x6306bd exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6489789 exception.address: 0xa306bd registers.esp: 1638204 registers.edi: 10647415 registers.eax: 4294944764 registers.ebp: 3998765076 registers.edx: 10707751 registers.ebx: 1501674380 registers.esi: 4294943060 registers.ecx: 3939837675	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 50 b8 fd d2 fd 2c 81 ee 55 3c ff 4f 01 c6 81 exception.symbol: random+0x631b27 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6495015 exception.address: 0xa31b27 registers.esp: 1638200 registers.edi: 10686023 registers.eax: 28638 registers.ebp: 3998765076 registers.edx: 3814612776 registers.ebx: 1501674381 registers.esi: 10686590 registers.ecx: 55820	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 52 89 0c 24 b9 1a 1d d7 23 50 89 e0 05 04 00 exception.symbol: random+0x631228 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6492712 exception.address: 0xa31228 registers.esp: 1638204 registers.edi: 10686023 registers.eax: 4294942072 registers.ebp: 3998765076 registers.edx: 3814612776 registers.ebx: 1501674381 registers.esi: 10715228 registers.ecx: 81129	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb e9 4a 01 00 00 5c e9 a3 03 00 00 01 ce e9 9f exception.symbol: random+0x63dc38 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6544440 exception.address: 0xa3dc38 registers.esp: 1638204 registers.edi: 10714902 registers.eax: 0 registers.ebp: 3998765076 registers.edx: 3635413096 registers.ebx: 10714870 registers.esi: 10714866 registers.ecx: 10741083	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 81 c7 21 85 7c 47 81 c7 a0 26 de 17 e9 22 fe exception.symbol: random+0x63efba exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6549434 exception.address: 0xa3efba registers.esp: 1638200 registers.edi: 10741516 registers.eax: 29627 registers.ebp: 3998765076 registers.edx: 1865923628 registers.ebx: 1525153396 registers.esi: 10714866 registers.ecx: 10741083	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 29 d2 ff 34 3a ff 34 24 8b 1c 24 e9 15 01 00 exception.symbol: random+0x63ef2e exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6549294 exception.address: 0xa3ef2e registers.esp: 1638204 registers.edi: 10771143 registers.eax: 29627 registers.ebp: 3998765076 registers.edx: 1865923628 registers.ebx: 1525153396 registers.esi: 10714866 registers.ecx: 10741083	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 68 fa 32 2b 70 89 1c 24 c7 04 24 d2 49 c7 5e exception.symbol: random+0x63f168 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6549864 exception.address: 0xa3f168 registers.esp: 1638204 registers.edi: 10771143 registers.eax: 29627 registers.ebp: 3998765076 registers.edx: 4294940744 registers.ebx: 47966544 registers.esi: 10714866 registers.ecx: 10741083	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 57 68 28 20 3f 2d 89 1c 24 c7 04 24 9b 6b 9f exception.symbol: random+0x654f32 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6639410 exception.address: 0xa54f32 registers.esp: 1638204 registers.edi: 10821784 registers.eax: 32215 registers.ebp: 3998765076 registers.edx: 2130566132 registers.ebx: 1971716070 registers.esi: 64340232 registers.ecx: 10865616	1
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: fb 83 ec 04 89 04 24 c7 04 24 82 4c cf 6b c1 24 exception.symbol: random+0x6555b4 exception.instruction: sti exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6641076 exception.address: 0xa555b4 registers.esp: 1638204 registers.edi: 10821784 registers.eax: 4294937772 registers.ebp: 3998765076 registers.edx: 604275024 registers.ebx: 1971716070 registers.esi: 64340232 registers.ecx: 10865616	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 76 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76faf000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76f20000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 344064 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04800000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04810000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04820000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04830000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04840000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ce0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04cf0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04840000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04840000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04840000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04840000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04840000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04840000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04da0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04db0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04840000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04840000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04840000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04dc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04dd0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04de0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04df0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ea0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04eb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ec0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ed0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2025, 4:38 p.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04ee0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

random.exe tried to sleep 251 seconds, actually delayed analysis time by 251 seconds

The binary likely contains encrypted or compressed data indicative of a packer (4 events)

section

{u'size_of_data': u'0x00053a00', u'virtual_address': u'0x00001000', u'entropy': 7.982911909173677, u'name': u' \\x00 ', u'virtual_size': u'0x000df000'}

entropy

7.98291190917

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00299000', u'virtual_address': u'0x000e0000', u'entropy': 7.996104084220596, u'name': u'.rsrc', u'virtual_size': u'0x00373c8c'}

entropy

7.99610408422

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x001e9400', u'virtual_address': u'0x00737000', u'entropy': 7.8930006918537075, u'name': u'nvqxtyiv', u'virtual_size': u'0x001ea000'}

entropy

7.89300069185

description

A section with a high entropy has been found

entropy

0.997883917775

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 event)

process

system

Checks for the presence of known devices from debuggers and forensic tools (3 events)

file	\??\SICE
file	\??\SIWVID
file	\??\NTICE

Checks for the presence of known windows from debuggers and forensic tools (50 out of 95 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA May 3, 2025, 4:38 p.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: pediy06 window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: #0 window_name: File Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: #0 window_name: Process Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: RegmonClass window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: #0 window_name: Registry Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: FilemonClass window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: #0 window_name: File Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: #0 window_name: Process Monitor - Sysinternals: www.sysinternals.com		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: pediy06 window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: pediy06 window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: pediy06 window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: pediy06 window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: 18467-41 window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: Filemonclass window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: pediy06 window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: OLLYDBG window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: GBDYLLO window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: pediy06 window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: Regmonclass window_name:		0	0
FindWindowA May 3, 2025, 4:38 p.m.	class_name: 18467-41 window_name:		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ May 3, 2025, 4:38 p.m.	stacktrace: exception.instruction_r: ed 64 8f 05 00 00 00 00 55 54 e9 f0 23 00 00 50 exception.symbol: random+0x5e2215 exception.instruction: in eax, dx exception.module: random.exe exception.exception_code: 0xc0000096 exception.offset: 6169109 exception.address: 0x9e2215 registers.esp: 1638236 registers.edi: 15412776 registers.eax: 1447909480 registers.ebp: 3998765076 registers.edx: 22104 registers.ebx: 1969033397 registers.esi: 10360287 registers.ecx: 20	1	0	0

File has been identified by 37 AntiVirus engines on VirusTotal as malicious (37 events)

Bkav	W32.AIDetectMalware
tehtris	Generic.Malware
ALYac	Gen:Variant.Zusy.590200
Cylance	Unsafe
VIPRE	Gen:Variant.Zusy.590200
CrowdStrike	win/malicious_confidence_100% (D)
BitDefender	Gen:Variant.Zusy.590200
Arcabit	Trojan.Zusy.D90178
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Packed.Themida.HZB
APEX	Malicious
Avast	Win32:Evo-gen [Trj]
Kaspersky	HEUR:Trojan-Downloader.Win32.Generic
MicroWorld-eScan	Gen:Variant.Zusy.590200
Rising	Trojan.Agent!1.12CC2 (CLASSIC)
Emsisoft	Gen:Variant.Zusy.590200 (B)
McAfeeD	ti!9431F488D49E
Trapmine	malicious.high.ml.score
CTX	exe.unknown.zusy
SentinelOne	Static AI - Malicious PE
Google	Detected
Kingsoft	malware.kb.b.930
Gridinsoft	Trojan.Heur!.038121A1
Microsoft	Trojan:Win32/Sabsik.EN.B!ml
GData	Gen:Variant.Zusy.590200
AhnLab-V3	Packed/Win.MalwareX-gen.C5756556
Malwarebytes	Malware.AI.915394609
Ikarus	Trojan.Win32.Krypt
Zoner	Probably Heur.ExeHeaderL
TrendMicro-HouseCall	Trojan.Win32.VSX.PE04C9Z
Tencent	Trojan.Win32.Agent.cdd
huorong	HEUR:TrojanSpy/Stealer.cd
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Agent.TH!tr
AVG	Win32:Evo-gen [Trj]
Panda	Trj/Genetic.gen

random.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All