Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	April 9, 2021, 11:32 a.m.	April 9, 2021, 11:55 a.m.

Size	1.5MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`903b6e45e6ee66750cb682e67944dcf3`
SHA256	`b1adf30c5cb4c1a7c06e877308d0f0e32f6ea1b21105de5db7583a889d089373`
CRC32	`3AB20149`
ssdeep	`49152:X22xfVuLXEVjt1gJjunV2TdPXWw347ileX:X22xfVakj78unVs9Ww34gw`
PDB Path	Z:\Users\wizzlabs\Desktop\Working Products\Special Random\multitimer 1\BestZip\obj\Release\BustaRiri.pdb
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen win_registry - Affect system registries win_files_operation - Affect private profile PE_Header_Zero - PE File Signature Zero OS_Processor_Check_Zero - OS Processor Check Signature Zero IsPE32 - (no description) IsNET_EXE - (no description) IsWindowsGUI - (no description) IsPacked - Entropy Check HasDebugData - DebugData Check

One.exe "C:\Users\test22\AppData\Local\Temp\One.exe"
3332
- multitimer.exe "C:\Users\test22\AppData\Local\Temp\TORK0JL5WI\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
  8752
  - multitimer.exe "C:\Users\test22\AppData\Local\Temp\TORK0JL5WI\multitimer.exe" 1 101
    4496

Name	Response	Post-Analysis Lookup
digitalassets.ams3.digitaloceanspaces.com	A 5.101.110.225	5.101.110.225
greataccesstoserver.com	A 159.89.4.33	159.89.4.33

IP Address	Status	Action
159.89.4.33	Active	Moloch
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch
5.101.110.225	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW April 9, 2021, 11:25 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 9, 2021, 11:25 a.m.			0	0
IsDebuggerPresent April 9, 2021, 11:25 a.m.			0	0
IsDebuggerPresent April 9, 2021, 11:25 a.m.			0	0
IsDebuggerPresent April 9, 2021, 11:26 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

Z:\Users\wizzlabs\Desktop\Working Products\Special Random\multitimer 1\BestZip\obj\Release\BustaRiri.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 9, 2021, 11:25 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header				suspicious_request	GET http://greataccesstoserver.com/files/ScHost.exe
suspicious_features	GET method with no useragent header				suspicious_request	GET http://greataccesstoserver.com/files/ScHost.exe.config

Performs some HTTP requests (2 events)

request	GET http://greataccesstoserver.com/files/ScHost.exe
request	GET http://greataccesstoserver.com/files/ScHost.exe.config

Allocates read-write-execute memory (usually to unpack itself) (50 out of 203 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000007e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000940000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2451000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2aeb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 2424832 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002320000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000024f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2454000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2454000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2454000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2454000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92cba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d6c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d96000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ccc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92de0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92cbb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92cdb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d0c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92cdd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92e20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92e21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92cb2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92cca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d0d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92ccb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92e30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92e31000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92e32000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92e33000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92e34000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92e35000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 9, 2021, 11:25 a.m.	process_identifier: 3332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92e36000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\TORK0JL5WI\multitimer.exe

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\TORK0JL5WI\multitimer.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\TORK0JL5WI\multitimer.exe

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses April 9, 2021, 11:25 a.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0015a800', u'virtual_address': u'0x00002000', u'entropy': 7.878542650869902, u'name': u'.text', u'virtual_size': u'0x0015a620'}

entropy

7.87854265087

description

A section with a high entropy has been found

entropy

0.891318327974

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 39 AntiVirus engines on VirusTotal as malicious (39 events)

Elastic	malicious (high confidence)
DrWeb	Adware.WizzMonetize.1
MicroWorld-eScan	Trojan.GenericKD.36660565
FireEye	Generic.mg.903b6e45e6ee6675
McAfee	Artemis!903B6E45E6EE
Cylance	Unsafe
Sangfor	Suspicious.Win32.WizremProc.A1
K7AntiVirus	Adware ( 00506b141 )
K7GW	Adware ( 00506b141 )
CrowdStrike	win/malicious_confidence_60% (W)
BitDefenderTheta	Gen:NN.ZemsilF.34670.Hn0@aO6U6E
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Adware.CsdiMonetize.F
APEX	Malicious
Avast	Win32:AdwareX-gen [Adw]
Kaspersky	HEUR:Trojan-Spy.MSIL.Stealer.gen
BitDefender	Trojan.GenericKD.36660565
NANO-Antivirus	Trojan.Win32.GenericKD.eoucic
Paloalto	generic.ml
Rising	Spyware.Stealer!8.3090 (CLOUD)
Ad-Aware	Trojan.GenericKD.36660565
Emsisoft	Trojan.GenericKD.36660565 (B)
McAfee-GW-Edition	Artemis!PUP
Sophos	Generic Reputation PUA (PUA)
Ikarus	PUA.Generic
Avira	ADWARE/CsdiMonetize.eltil
MAX	malware (ai score=88)
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Microsoft	PUA:Win32/Bitrepeyp.A
AegisLab	Riskware.Win32.Generic.1!c
GData	Win32.Application.Agent.AD7IWH
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.Generic.C4386187
Malwarebytes	Malware.AI.3846164771
SentinelOne	Static AI - Malicious PE
Fortinet	Adware/CsdiMonetize
AVG	Win32:AdwareX-gen [Adw]
Cybereason	malicious.740f60
Qihoo-360	Win32/Adware.Generic.HgIASSUA

One.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All