VMProtect,2.exePE analysis report - Suspicious

1 process(es) observed; malicious behavior: registry_persistence

Statically visible checks (RDTSC/CPUID/red-pill instructions, anti-debug APIs) plus runtime evasion signals. Instruction-level interception at runtime requires hypervisor introspection (VMI).

Calls counted inside the running sample by in-process hooks. Scored means the call crossed the threshold that separates a deliberate check from what ordinary software does; a call that scored nothing is still listed, with the reason.

How to read the numbers: a repeated call is sampled at 1, 10, 100 and so on while the run is live and made exact when the process exits, so a count is a floor and not a total. The count kept for a name is the highest a single process reported, not a sum across the process tree. The hooks are placed a few seconds after a process starts, so a check made in the first moments of a launch is missed - and a sample that exits in those first seconds is never watched at all.

Modules the sample asked for by name while it ran, recorded inside its own process. Loads from system and installed-program directories are counted but not listed - what is listed is a module from somewhere else, a load that failed, or one whose loader is the question.

What this list cannot say: only an explicit LoadLibrary call is recorded, so a module the sample brought in through its own import table never appears here - absence from this list is not absence from the process. There is no signature check behind these rows, so an unlisted module is not a module that was verified. The hooks are placed a few seconds after a process starts, so the first loads of a launch are missed.

1 captured text was read and unwrapped locally. No address was recovered from any of them, and none of them was hiding its own contents behind an encoding or a format string. This is a result, not a gap.

These operations were captured but carry no pid this tree could match, so they are not shown against any node above.

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".

The sample ran and none of what it wrote was a payload this run kept and examined. That is a measured absence rather than an unasked question.

File operation times: 2 timed

No operations match your filter.

External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.

Earlier analyses of the identical file, matched by SHA-256. Same bytes, same questions - what this platform found the last time it looked is evidence about the file in front of you now.

Hash lookups only - the sample itself is never uploaded to any third party.

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

title: Auto-generated registry behavior rule (sandbox scan 2931)
id: sandbox-auto-2931-reg
status: experimental
description: Auto-generated from sandbox scan 2931
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains:
            - 'SOFTWARE\QtProject'
            - 'SOFTWARE\QtProject\OrganizationDefaults'
            - 'Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU\'
            - 'SOFTWARE\Microsoft'
            - 'SOFTWARE\Microsoft\Windows'
            - 'SOFTWARE\Microsoft\Windows\CurrentVersion'
            - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer'
            - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32'
    condition: selection
level: medium

Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).