Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 7, 2021, 11:55 a.m.	Sept. 7, 2021, 12:01 p.m.

Size	502.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`9008f0b5ea0867bbeda8161d183e7a3d`
SHA256	`e39651b7db144a87399dbae669d07030ba023bc83792dddf7ba2b5dad67a4c0e`
CRC32	`D17B2613`
ssdeep	`6144:cTEgdc0YsXAGbgiIN2RSBIdLLVDKlh/i+n55QBcEuDb8F92LyaB0SLKcTR3K:cTEgdfYWbgcdOB5Q+4daB0SLKcdK`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check Is_DotNET_EXE - (no description) Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

wef.exe "C:\Users\test22\AppData\Local\Temp\wef.exe"
568

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
121.254.136.57	Active	Moloch
185.65.135.234	Active	Moloch
34.97.69.225	Active	Moloch
208.95.112.1	Active	Moloch
3.232.36.43	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 7, 2021, 11:48 a.m.			0	0
IsDebuggerPresent Sept. 7, 2021, 11:48 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 7, 2021, 11:48 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 53 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000710000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000860000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1451000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1aeb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000710000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000790000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1452000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1454000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1454000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1454000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1454000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d6c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d96000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91ccc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91df0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cdb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cbb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d0c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cdd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cb2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e41000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91ccb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e51000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d0d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e52000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e53000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefb037000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e54000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 7, 2021, 11:48 a.m.	process_identifier: 568 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91e55000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Communicates with host for which no DNS query was performed (5 events)

host	121.254.136.57
host	185.65.135.234
host	34.97.69.225
host	208.95.112.1
host	3.232.36.43

Generates some ICMP traffic

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

192.168.56.102:49189

File has been identified by 50 AntiVirus engines on VirusTotal as malicious (50 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	IL:Trojan.MSILZilla.2050
FireEye	Generic.mg.9008f0b5ea0867bb
CAT-QuickHeal	Trojan.MsilFC.S15413537
McAfee	GenericRXKZ-ZO!9008F0B5EA08
Zillya	Trojan.Agent.Win32.1554504
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 0056b6611 )
K7GW	Trojan ( 005690671 )
Cybereason	malicious.5ea086
BitDefenderTheta	Gen:NN.ZemsilF.34126.Fm0@am26N6n
Cyren	W32/MSIL_Mintluks.A.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Agent.BPH
TrendMicro-HouseCall	TSPY_TINCLEX.SM1
ClamAV	Win.Packed.Downeks-6898097-0
Kaspersky	HEUR:Trojan.MSIL.Quasar.gen
BitDefender	IL:Trojan.MSILZilla.2050
SUPERAntiSpyware	Backdoor.Quasar/Variant
Avast	MSIL:Quasar-A [Rat]
Ad-Aware	IL:Trojan.MSILZilla.2050
Sophos	ML/PE-A + Mal/Quasar-A
DrWeb	Trojan.MulDrop13.10660
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TSPY_TINCLEX.SM1
McAfee-GW-Edition	BehavesLike.Win32.Generic.hh
SentinelOne	Static AI - Malicious PE
Emsisoft	Trojan.Agent (A)
APEX	Malicious
Jiangmin	Trojan.MSIL.oyqd
Webroot	W32.Trojan.Quasar
Avira	HEUR/AGEN.1135947
Antiy-AVL	Trojan/Generic.ASMalwS.3095045
Gridinsoft	Spy.Win32.Keylogger.dd!n
Microsoft	Backdoor:MSIL/Quasar.GG!MTB
ZoneAlarm	HEUR:Trojan.MSIL.Quasar.gen
GData	MSIL.Backdoor.Quasar.B
Cynet	Malicious (score: 100)
AhnLab-V3	Backdoor/Win32.QuasarRAT.R341693
ALYac	IL:Trojan.MSILZilla.2050
MAX	malware (ai score=89)
VBA32	TScope.Trojan.MSIL
Malwarebytes	Generic.Worm.Autorun.DDS
Yandex	Trojan.Agent!3HdnXAY6hTo
Ikarus	Backdoor.Win32.Xiclog
eGambit	Unsafe.AI_Score_98%
Fortinet	MSIL/Agent.BPH!tr
AVG	MSIL:Quasar-A [Rat]
CrowdStrike	win/malicious_confidence_80% (D)
MaxSecure	Trojan.Malware.73405263.susgen

wef.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All