ALL.TXT

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 27, 2021, 9:45 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory April 27, 2021, 9:45 a.m.	process_identifier: 6988 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1	0	0

Yara rule detected in process memory (12 events)

description	Take screenshot				rule	screenshot
description	Affect system registries				rule	win_registry
description	Affect system token				rule	win_token
description	Affect private profile				rule	win_files_operation
description	(no description)				rule	DebuggerCheck__GlobalFlags
description	(no description)				rule	DebuggerCheck__QueryInfo
description	(no description)				rule	DebuggerHiding__Thread
description	(no description)				rule	DebuggerHiding__Active
description	(no description)				rule	ThreadControl__Context
description	(no description)				rule	SEH__vectored
description	Checks if being debugged				rule	anti_dbg
description	Bypass DEP				rule	disable_dep

Communicates with host for which no DNS query was performed (1 event)

host	172.217.25.14

File has been identified by 12 AntiVirus engines on VirusTotal as malicious (12 events)

MicroWorld-eScan	Heur.BZC.PZQ.Boxter.794.C1C92E66
FireEye	Heur.BZC.PZQ.Boxter.794.C1C92E66
ALYac	Heur.BZC.PZQ.Boxter.794.C1C92E66
Symantec	ISB.Downloader!gen281
ESET-NOD32	PowerShell/TrojanDownloader.Agent.DTA
Avast	Script:SNH-gen [Trj]
BitDefender	Heur.BZC.PZQ.Boxter.794.C1C92E66
Ad-Aware	Heur.BZC.PZQ.Boxter.794.C1C92E66
Arcabit	Heur.BZC.PZQ.Boxter.794.C1C92E66
GData	Heur.BZC.PZQ.Boxter.794.C1C92E66
MAX	malware (ai score=83)
AVG	Script:SNH-gen [Trj]