Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Aug. 19, 2021, 9:36 a.m.	Aug. 19, 2021, 9:45 a.m.

Size	392.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`1edf6239fdc16549861e1b187c396ce2`
SHA256	`8defe9e761e45c1d2b7d8aecd4073068f2026d20eff14d247028618bc7e6ed73`
CRC32	`AEB66C59`
ssdeep	`6144:C1cifszl2Utbj/frvUZTc6kJpmZXHOKvsyedvMSQ84gJvlcNhBADInsM+:C02evTkW/XysLQ84YvlyBA01+`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) IsPE32 - (no description)

microsoft.exe "C:\Users\test22\AppData\Local\Temp\microsoft.exe"
2348
- microsoft.exe C:\Users\test22\AppData\Local\Temp\microsoft.exe
  1148

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 19, 2021, 9:36 a.m.			0	0
IsDebuggerPresent Aug. 19, 2021, 9:36 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey Aug. 19, 2021, 9:36 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004c62c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 19, 2021, 9:36 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004c6a08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Aug. 19, 2021, 9:36 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004c6a08 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 19, 2021, 9:36 a.m.		1	1	0

One or more processes crashed (4 events)

Time & API	Arguments	Status
__exception__ Aug. 19, 2021, 9:36 a.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x76a6b37e 0x51a416d 0x51a40e2 0x51a177e 0x51a11e3 0x519fdb9 0x4d90b37 system+0x1d3f63 @ 0x70033f63 0x1fa0810 0x1fa064a system+0x1f9799 @ 0x70c99799 system+0x1f92c8 @ 0x70c992c8 system+0x1eca74 @ 0x70c8ca74 system+0x1ec868 @ 0x70c8c868 system+0x1f82b8 @ 0x70c982b8 system+0x1ee54d @ 0x70c8e54d system+0x1f70ea @ 0x70c970ea system+0x1e56c0 @ 0x70c856c0 system+0x1f8215 @ 0x70c98215 system+0x1f6f75 @ 0x70c96f75 system+0x1ee251 @ 0x70c8e251 system+0x1ee229 @ 0x70c8e229 system+0x1ee170 @ 0x70c8e170 0x59a08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75576de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75576e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x77af011a system+0x1ebc85 @ 0x70c8bc85 system+0x1f683b @ 0x70c9683b system+0x1a5e44 @ 0x70c45e44 system+0x1fd8a0 @ 0x70c9d8a0 system+0x1fd792 @ 0x70c9d792 system+0x1a14bd @ 0x70c414bd 0x1fa007a DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x740df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74d37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74d34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x76a6b479 registers.esp: 4253864 registers.edi: 1969676232 registers.eax: 720896 registers.ebp: 4254068 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ Aug. 19, 2021, 9:36 a.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x76a6b37e 0x51a416d 0x51a40e2 0x51a177e 0x51a11e3 0x519fdb9 0x4d90b37 system+0x1d3f63 @ 0x70033f63 0x1fa0810 0x1fa064a system+0x1f9799 @ 0x70c99799 system+0x1f92c8 @ 0x70c992c8 system+0x1eca74 @ 0x70c8ca74 system+0x1ec868 @ 0x70c8c868 system+0x1f82b8 @ 0x70c982b8 system+0x1ee54d @ 0x70c8e54d system+0x1f70ea @ 0x70c970ea system+0x1e56c0 @ 0x70c856c0 system+0x1f8215 @ 0x70c98215 system+0x1f6f75 @ 0x70c96f75 system+0x1ee251 @ 0x70c8e251 system+0x1ee229 @ 0x70c8e229 system+0x1ee170 @ 0x70c8e170 0x59a08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75576de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75576e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x77af011a system+0x1ebc85 @ 0x70c8bc85 system+0x1f683b @ 0x70c9683b system+0x1a5e44 @ 0x70c45e44 system+0x1fd8a0 @ 0x70c9d8a0 system+0x1fd792 @ 0x70c9d792 system+0x1a14bd @ 0x70c414bd 0x1fa007a DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x740df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74d37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74d34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x76a6b479 registers.esp: 4253864 registers.edi: 1969676232 registers.eax: 720896 registers.ebp: 4254068 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ Aug. 19, 2021, 9:36 a.m.	stacktrace: K32EnumProcessModules+0x18 RegisterApplicationRestart-0x1be kernel32+0x3b37e @ 0x76a6b37e 0x51a416d 0x51a40e2 0x51a177e 0x51a11e3 0x519fdb9 0x4d90b37 system+0x1d3f63 @ 0x70033f63 0x1fa0810 0x1fa064a system+0x1f9799 @ 0x70c99799 system+0x1f92c8 @ 0x70c992c8 system+0x1eca74 @ 0x70c8ca74 system+0x1ec868 @ 0x70c8c868 system+0x1f82b8 @ 0x70c982b8 system+0x1ee54d @ 0x70c8e54d system+0x1f70ea @ 0x70c970ea system+0x1e56c0 @ 0x70c856c0 system+0x1f8215 @ 0x70c98215 system+0x1f6f75 @ 0x70c96f75 system+0x1ee251 @ 0x70c8e251 system+0x1ee229 @ 0x70c8e229 system+0x1ee170 @ 0x70c8e170 0x59a08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75576d3a GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x75576de8 GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x75576e44 KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x77af011a system+0x1ebc85 @ 0x70c8bc85 system+0x1f683b @ 0x70c9683b system+0x1a5e44 @ 0x70c45e44 system+0x1fd8a0 @ 0x70c9d8a0 system+0x1fd792 @ 0x70c9d792 system+0x1a14bd @ 0x70c414bd 0x1fa007a DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x731a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x731b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x731b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x732674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73267610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x732f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x732f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x732f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x732f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x740df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74d37f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74d34de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77b19ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77b19ea5 exception.instruction_r: 89 04 91 c7 45 fc fe ff ff ff ff 45 10 81 7d 10 exception.symbol: K32EnumProcessModules+0x113 RegisterApplicationRestart-0xc3 kernel32+0x3b479 exception.instruction: mov dword ptr [ecx + edx*4], eax exception.module: KERNEL32.dll exception.exception_code: 0xc0000005 exception.offset: 242809 exception.address: 0x76a6b479 registers.esp: 4253864 registers.edi: 1969676232 registers.eax: 720896 registers.ebp: 4254068 registers.edx: 0 registers.ebx: 0 registers.esi: 1 registers.ecx: 0	1
__exception__ Aug. 19, 2021, 9:36 a.m.	stacktrace: microsoft+0x14130 @ 0x414130 microsoft+0x14261 @ 0x414261 0x3dff2c exception.instruction_r: 8b 41 04 8b 31 03 c6 39 45 f8 73 03 89 45 f8 83 exception.symbol: microsoft+0x1226c exception.instruction: mov eax, dword ptr [ecx + 4] exception.module: microsoft.exe exception.exception_code: 0xc0000005 exception.offset: 74348 exception.address: 0x41226c registers.esp: 4060612 registers.edi: 9866138 registers.eax: 537104605 registers.ebp: 4060816 registers.edx: 44727 registers.ebx: 0 registers.esi: 2416115933 registers.ecx: 10145805	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (41 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00570000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00620000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x731a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x731a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e80000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01eb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00582000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fa0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70692000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fa1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fa8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fa9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01faa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fae000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01faf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d9f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05190000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 57344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05191000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0519f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0058c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0059f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051a3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2348 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x051a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 1148 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00405000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 1148 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00405000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (6 events)

file	C:\Users\test22\AppData\Local\Temp\OLE23.dll
file	C:\Users\test22\AppData\Local\Temp\GDl32.dll
file	C:\Program Files\Common Files\System\symsrv.dll
file	C:\Users\test22\AppData\Local\Temp\PSAPl.dll
file	C:\Windows\System32\dlcoer.dll
file	C:\Users\test22\AppData\Local\Temp\conres.dll

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00061200', u'virtual_address': u'0x00002000', u'entropy': 7.994960029883361, u'name': u'.text', u'virtual_size': u'0x0006107c'}

entropy

7.99496002988

description

A section with a high entropy has been found

entropy

0.991071428571

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Aug. 19, 2021, 9:36 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (17 events)

description	Communications use DNS	rule	Network_DNS
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	email clients info stealer	rule	infoStealer_emailClients_Zero
description	File Downloader	rule	Network_Downloader
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Install itself for autorun at Windows startup	rule	Persistence

Terminates another process (4 events)

Time & API	Arguments	Status
NtTerminateProcess Aug. 19, 2021, 9:36 a.m.	status_code: 0xffffffff process_identifier: 2132 process_handle: 0x000002d0
NtTerminateProcess Aug. 19, 2021, 9:36 a.m.	status_code: 0xffffffff process_identifier: 2132 process_handle: 0x000002d0	1
NtTerminateProcess Aug. 19, 2021, 9:36 a.m.	status_code: 0xffffffff process_identifier: 1460 process_handle: 0x000002d8
NtTerminateProcess Aug. 19, 2021, 9:36 a.m.	status_code: 0xffffffff process_identifier: 1460 process_handle: 0x000002d8	1

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 2d47993a82ab8456c29f06ef97b1149c73649478

Allocates execute permission to another process indicative of possible code injection (3 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2132 region_size: 1433600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002c8		3221225496
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 1460 region_size: 1433600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002cc		3221225496
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 1148 region_size: 1433600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002d4	1	0

Manipulates memory of a non-child process indicative of process injection (4 events)

Time & API	Arguments	Return	Repeated
Process injection	Process 2348 manipulating memory of non-child process 2132
Process injection	Process 2348 manipulating memory of non-child process 1460
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2132 region_size: 1433600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002c8	3221225496	0
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 1460 region_size: 1433600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002cc	3221225496	0

Potential code injection by writing to the memory of another process (3 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Aug. 19, 2021, 9:36 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $n·ÇìäÇìäÇìäã_äÆìäÎäÆìäã]äÅìäàmäÆìäànäÄìäÂàäÆìäÎäÃìäÎäØìäÇìä5ìäT å°ìäTåÆìäRichÇìäPELrìE_àRP(^p@à@ª,0©p.textwPR `.rdata\|NpPV@@.dataÐíÀ¨¦@À.relocà°N@B.bssÐ`@@ base_address: 0x00400000 process_identifier: 1148 process_handle: 0x000002d4	1	1
WriteProcessMemory Aug. 19, 2021, 9:36 a.m.	buffer: 2t Ï&÷Ú.diÀKïÁOL Xf(x-mL5ÿ§V:àN;ÒÄî¶ÊÔB;k?úÜñ:=þÉDDàà^/éO´\| óÜ[ R¥é#"_÷Q\£¾0H¡Ó¹J1õ`k¡1$«"æ/øQò w ø×Ò\ÄD \<n¤®öw!ÂÁæNWöñX#¢c¦E.`(÷¼\|Fdç÷°=jÀºªÄ¹=ÇÚ7 base_address: 0x0055d000 process_identifier: 1148 process_handle: 0x000002d4	1	1
WriteProcessMemory Aug. 19, 2021, 9:36 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1148 process_handle: 0x000002d4	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Aug. 19, 2021, 9:36 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $n·ÇìäÇìäÇìäã_äÆìäÎäÆìäã]äÅìäàmäÆìäànäÄìäÂàäÆìäÎäÃìäÎäØìäÇìä5ìäT å°ìäTåÆìäRichÇìäPELrìE_àRP(^p@à@ª,0©p.textwPR `.rdata\|NpPV@@.dataÐíÀ¨¦@À.relocà°N@B.bssÐ`@@ base_address: 0x00400000 process_identifier: 1148 process_handle: 0x000002d4	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2348 called NtSetContextThread to modify thread in remote process 1148
NtSetContextThread Aug. 19, 2021, 9:36 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4218408 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000002d8 process_identifier: 1148	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2348 resumed a thread in remote process 1148
NtResumeThread Aug. 19, 2021, 9:36 a.m.	thread_handle: 0x000002d8 suspend_count: 1 process_identifier: 1148	1	0	0

Executed a process and injected code into it, probably while unpacking (28 events)

Time & API	Arguments	Status	Return
NtResumeThread Aug. 19, 2021, 9:36 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2348	1	0
NtResumeThread Aug. 19, 2021, 9:36 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2348	1	0
NtResumeThread Aug. 19, 2021, 9:36 a.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 2348	1	0
NtResumeThread Aug. 19, 2021, 9:36 a.m.	thread_handle: 0x000002ac suspend_count: 1 process_identifier: 2348	1	0
NtGetContextThread Aug. 19, 2021, 9:36 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Aug. 19, 2021, 9:36 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread Aug. 19, 2021, 9:36 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2348	1	0
NtGetContextThread Aug. 19, 2021, 9:36 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Aug. 19, 2021, 9:36 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread Aug. 19, 2021, 9:36 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 2348	1	0
CreateProcessInternalW Aug. 19, 2021, 9:36 a.m.	thread_identifier: 1660 thread_handle: 0x000002c4 process_identifier: 2132 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\microsoft.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000002c8	1	1
NtGetContextThread Aug. 19, 2021, 9:36 a.m.	thread_handle: 0x000002c4	1	0
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 2132 region_size: 1433600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002c8		3221225496
CreateProcessInternalW Aug. 19, 2021, 9:36 a.m.	thread_identifier: 2104 thread_handle: 0x000002d0 process_identifier: 1460 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\microsoft.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000002cc	1	1
NtGetContextThread Aug. 19, 2021, 9:36 a.m.	thread_handle: 0x000002d0	1	0
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 1460 region_size: 1433600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002cc		3221225496
CreateProcessInternalW Aug. 19, 2021, 9:36 a.m.	thread_identifier: 1772 thread_handle: 0x000002d8 process_identifier: 1148 current_directory: filepath: track: 1 command_line: C:\Users\test22\AppData\Local\Temp\microsoft.exe filepath_r: stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000002d4	1	1
NtGetContextThread Aug. 19, 2021, 9:36 a.m.	thread_handle: 0x000002d8	1	0
NtAllocateVirtualMemory Aug. 19, 2021, 9:36 a.m.	process_identifier: 1148 region_size: 1433600 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002d4	1	0
WriteProcessMemory Aug. 19, 2021, 9:36 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $n·ÇìäÇìäÇìäã_äÆìäÎäÆìäã]äÅìäàmäÆìäànäÄìäÂàäÆìäÎäÃìäÎäØìäÇìä5ìäT å°ìäTåÆìäRichÇìäPELrìE_àRP(^p@à@ª,0©p.textwPR `.rdata\|NpPV@@.dataÐíÀ¨¦@À.relocà°N@B.bssÐ`@@ base_address: 0x00400000 process_identifier: 1148 process_handle: 0x000002d4	1	1
WriteProcessMemory Aug. 19, 2021, 9:36 a.m.	buffer: base_address: 0x00401000 process_identifier: 1148 process_handle: 0x000002d4	1	1
WriteProcessMemory Aug. 19, 2021, 9:36 a.m.	buffer: base_address: 0x00417000 process_identifier: 1148 process_handle: 0x000002d4	1	1
WriteProcessMemory Aug. 19, 2021, 9:36 a.m.	buffer: base_address: 0x0041c000 process_identifier: 1148 process_handle: 0x000002d4	1	1
WriteProcessMemory Aug. 19, 2021, 9:36 a.m.	buffer: base_address: 0x0055b000 process_identifier: 1148 process_handle: 0x000002d4	1	1
WriteProcessMemory Aug. 19, 2021, 9:36 a.m.	buffer: 2t Ï&÷Ú.diÀKïÁOL Xf(x-mL5ÿ§V:àN;ÒÄî¶ÊÔB;k?úÜñ:=þÉDDàà^/éO´\| óÜ[ R¥é#"_÷Q\£¾0H¡Ó¹J1õ`k¡1$«"æ/øQò w ø×Ò\ÄD \<n¤®öw!ÂÁæNWöñX#¢c¦E.`(÷¼\|Fdç÷°=jÀºªÄ¹=ÇÚ7 base_address: 0x0055d000 process_identifier: 1148 process_handle: 0x000002d4	1	1
WriteProcessMemory Aug. 19, 2021, 9:36 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1148 process_handle: 0x000002d4	1	1
NtSetContextThread Aug. 19, 2021, 9:36 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4218408 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000002d8 process_identifier: 1148	1	0
NtResumeThread Aug. 19, 2021, 9:36 a.m.	thread_handle: 0x000002d8 suspend_count: 1 process_identifier: 1148	1	0

File has been identified by 32 AntiVirus engines on VirusTotal as malicious (32 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.1edf6239fdc16549
McAfee	AgentTesla-FDAW!1EDF6239FDC1
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.f18c89
Cyren	W32/Jigsaw.A1.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.ACMN
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.MSIL.Dnoper.gen
Avast	FileRepMalware
Sophos	Mal/Generic-S
TrendMicro	TrojanSpy.MSIL.AVEMARIA.WLDW
McAfee-GW-Edition	BehavesLike.Win32.Trojan.fc
Emsisoft	Trojan.GenericKD.46820831 (B)
Ikarus	Trojan.Inject
Webroot	W32.Malware.Gen
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
GData	Win32.Malware.Injector.IO2OKP
Cynet	Malicious (score: 100)
BitDefenderTheta	Gen:NN.ZemsilF.34088.ym0@aOn8B7g
Malwarebytes	MachineLearning/Anomalous.96%
TrendMicro-HouseCall	TROJ_GEN.R06CH0CHI21
SentinelOne	Static AI - Malicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	MSIL/Kryptik.ABUB!tr
MaxSecure	Trojan.Malware.300983.susgen
AVG	FileRepMalware
CrowdStrike	win/malicious_confidence_90% (W)

microsoft.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All