popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

Emotet Gen1 NSIS Generic Malware ASPack UPX Malicious Library Malicious Packer Admin Tool (Sysinternals etc ...) PWS ScreenShot KeyLogger Anti_VM OS Processor Check AntiDebug PE File PE32 .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 19, 2021, 10:42 a.m. Sept. 19, 2021, 10:51 a.m.
Size 894.5KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 66ce1420280eceebeab924165f28b7bb
SHA256 56331fa6c35d48c153e5004cb8574c36e2c16f3bb339e53549dc28ec7ad0f232
CRC32 D53837F0
ssdeep 12288:dYxaM8KuQyczJgn/6Zpbx35rzFlKArMmeEX43aeiJi6So8c3SPsIPfhXL:RjQHzE6Z1//Vrr3fn+Pft
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch
92.119.113.140 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: ERROR:
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: The system cannot find the file specified.
console_handle: 0x0000000b
1 1 0
file C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 589824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00370000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1116
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72741000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1116
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72742000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 1048576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005d0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00690000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00412000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00445000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0044b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00447000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0042c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00800000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0041a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0043a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00437000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0042a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00801000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00802000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1116
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x71fb2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00436000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef58000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef40000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00805000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0042d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00806000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00807000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00808000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00809000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0080a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0080b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0080c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0080d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0080e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0080f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04990000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04991000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04992000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04994000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04995000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04996000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04997000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04998000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04999000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0499a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1116
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0499b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Program Files (x86)\Microsoft Office\Office12\DSSM.EXE
file C:\Program Files (x86)\Hnc\HncUtils\HncUpdate.exe
file C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdateCore.exe
file C:\Program Files (x86)\Microsoft Office\Office12\REGFORM.EXE
file C:\Python27\Lib\site-packages\setuptools\cli-32.exe
file C:\Program Files (x86)\Common Files\microsoft shared\OFFICE12\ODSERV.EXE
file C:\Python27\Scripts\easy_install.exe
file C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
file C:\MSOCache\All Users\{90120000-0030-0000-0000-0000000FF1CE}-C\ose.exe
file C:\Python27\Lib\site-packages\pip\_vendor\distlib\w32.exe
file C:\Program Files (x86)\Hnc\Common80\HimTrayIcon.exe
file C:\Program Files (x86)\Hnc\Hwp80\HwpFinder.exe
file C:\Program Files (x86)\Microsoft Office\Office12\SELFCERT.EXE
file C:\Program Files (x86)\Microsoft Office\Office12\PPTVIEW.EXE
file C:\Program Files (x86)\Microsoft Office\Office12\MSPUB.EXE
file C:\Program Files (x86)\EditPlus\editplus.exe
file C:\Python27\Lib\site-packages\pip\_vendor\distlib\t64.exe
file C:\Program Files (x86)\Hnc\Hwp80\HwpPrnMng.exe
file C:\Python27\Lib\site-packages\pip\_vendor\distlib\t32.exe
file C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE
file C:\Program Files (x86)\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE
file C:\MSOCache\All Users\{90120000-006E-0412-0000-0000000FF1CE}-C\DW20.EXE
file C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdateComRegisterShell64.exe
file C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdateBroker.exe
file C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler64.exe
file C:\util\TCPView\Tcpvcon.exe
file C:\Program Files (x86)\Google\Chrome\Application\65.0.3325.181\Installer\chrmstp.exe
file C:\Program Files (x86)\Hnc\Common80\HncReporter.exe
file C:\Program Files (x86)\Microsoft Office\Office12\1042\ONELEV.EXE
file C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file C:\Program Files (x86)\Hnc\Hwp80\HncPUAConverter.exe
file C:\Program Files (x86)\Microsoft Office\Office12\MSTORE.EXE
file C:\Program Files (x86)\Hnc\HncDic80\HncDic.exe
file C:\Program Files (x86)\Microsoft Office\Office12\MSTORDB.EXE
file C:\Program Files (x86)\Common Files\microsoft shared\OFFICE12\ACECNFLT.EXE
file C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdate.exe
file C:\Program Files (x86)\Hnc\Hwp80\Hwp.exe
file C:\Program Files (x86)\Hnc\HncUtils\KeyLayout\KeyLayout.exe
file C:\util\dotnet4.5.exe
file C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\winamp58_3660_beta_full_en-us[1].exe
file C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
file C:\Program Files (x86)\Microsoft Office\Office12\INFOPATH.EXE
file C:\Program Files (x86)\Microsoft Office\Office12\GrooveMigrator.exe
file C:\Program Files (x86)\Hnc\PDF80\x64\HNCE2PPRCONV80.exe
file C:\Program Files (x86)\Hnc\Common80\him\HJIMESV.EXE
file C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdateOnDemand.exe
file C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\OINFOP12.EXE
file C:\Program Files (x86)\Hnc\Common80\OdfConverter.exe
file C:\Program Files (x86)\Common Files\microsoft shared\IME12\SHARED\IMEPADSV.EXE
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PaJrxje" /XML "C:\Users\test22\AppData\Local\Temp\tmpEEAE.tmp"
cmdline schtasks.exe /Create /TN "Updates\PaJrxje" /XML "C:\Users\test22\AppData\Local\Temp\tmpEEAE.tmp"
file C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\winamp58_3660_beta_full_en-us[1].exe
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: schtasks.exe
parameters: /Create /TN "Updates\PaJrxje" /XML "C:\Users\test22\AppData\Local\Temp\tmpEEAE.tmp"
filepath: schtasks.exe
1 1 0
section {u'size_of_data': u'0x000b4800', u'virtual_address': u'0x00002000', u'entropy': 7.787527706006205, u'name': u'.text', u'virtual_size': u'0x000b471c'} entropy 7.78752770601 description A section with a high entropy has been found
entropy 0.807606263982 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Run a KeyLogger rule KeyLogger
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PaJrxje" /XML "C:\Users\test22\AppData\Local\Temp\tmpEEAE.tmp"
cmdline schtasks.exe /Create /TN "Updates\PaJrxje" /XML "C:\Users\test22\AppData\Local\Temp\tmpEEAE.tmp"
host 92.119.113.140
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1940
region_size: 110592
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000046c
1 0 0
registry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion
registry HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\(Default) reg_value C:\Windows\svchost.com "%1" %*
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*àŽ t*䀐@°@Pd€ÌpCODE,rt `DATAx@ÀBSS™¨ |À.idatadP |@À.tls`†À.rdatap†@P.relocÌ€ˆ@P.rsrcŽ@P°¢@P
base_address: 0x00400000
process_identifier: 1940
process_handle: 0x0000046c
1 1 0

WriteProcessMemory

 buffer: @2‹À@@@t@ @„#@ËÌÈÉ×ÏÈÍÎÛØÚÙÊÜÝÞßàáãäå@Error‹ÀRuntime error at 00000000‹À0123456789ABCDEFÿÿÿÿ=@@´F@ÌN@O@ØY@äY@øY@üY@üY@Z@$Z@LZ@PZ@Z@´Z@àZ@ @øà€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿ @ ,Eí͘û¤W€É<AïË½ïW‡Ý{JÖçöJÞ>…@}ü„{댐íêÄþGÌA2ÿœNۂõ¥Ð2ªË+^þÇºãW—Ë µáÙnÊXý±.štÛNóĞt“îâhî„‹À`ˆ²òTø5ýœ‘@@
base_address: 0x00409000
process_identifier: 1940
process_handle: 0x0000046c
1 1 0

WriteProcessMemory

 buffer: XRÜPàS4Q T@QLTPQ€T\QÌTpQ U€QöVôQÄW(R8XLRfR~R–R®RÊRØRèRôRSS&S8SJS\SnS|SŠS–S²S¾SÐSìSþST.T>TZTjTŽTœTªT¸TÚTìTüTU$U.U@UVUfU~UŽUšU²UÂUÖUìUVV&V4VJVZVlVzVŠVœV¨V¶VÆVÔVèVWWW,W:WFWVWbWvWŠW WºWÐWÜWêWøWX XX&XDXTXkernel32.dllDeleteCriticalSectionLeaveCriticalSectionEnterCriticalSectionInitializeCriticalSectionVirtualFreeVirtualAllocLocalFreeLocalAllocGetVersionGetCurrentThreadIdGetThreadLocaleGetStartupInfoAGetLocaleInfoAGetCommandLineAFreeLibraryExitProcessWriteFileUnhandledExceptionFilterRtlUnwindRaiseExceptionGetStdHandleuser32.dllGetKeyboardTypeMessageBoxAadvapi32.dllRegQueryValueExARegOpenKeyExARegCloseKeyoleaut32.dllSysFreeStringSysReAllocStringLenkernel32.dllTlsSetValueTlsGetValueLocalAllocGetModuleHandleAadvapi32.dllRegSetValueExARegOpenKeyExARegCloseKeykernel32.dllWriteFileWinExecSetFilePointerSetFileAttributesASetEndOfFileSetCurrentDirectoryAReleaseMutexReadFileGetWindowsDirectoryAGetTempPathAGetShortPathNameAGetModuleFileNameAGetLogicalDriveStringsAGetLocalTimeGetLastErrorGetFileSizeGetFileAttributesAGetDriveTypeAGetCommandLineAFreeLibraryFindNextFileAFindFirstFileAFindCloseDeleteFileACreateMutexACreateFileACreateDirectoryACloseHandlegdi32.dllStretchDIBitsSetDIBitsSelectObjectGetObjectAGetDIBitsDeleteObjectDeleteDCCreateSolidBrushCreateDIBSectionCreateCompatibleDCCreateCompatibleBitmapBitBltuser32.dllReleaseDCGetSysColorGetIconInfoGetDCFillRectDestroyIconCopyImageCharLowerBuffAshell32.dllShellExecuteAExtractIconA
base_address: 0x00415000
process_identifier: 1940
process_handle: 0x0000046c
1 1 0

WriteProcessMemory

 buffer: `A`A@pA
base_address: 0x00417000
process_identifier: 1940
process_handle: 0x0000046c
1 1 0

WriteProcessMemory

 buffer:  0 000"0*020:0B0J0R0Z0b0j0r0z0‚0Š0’0¾0Æ0Î0Ö0Þ0æ0î0ö0ÿ0 1(11—1ß2V3¥3ë3þ3t4¸4ù4-595T5ç567r77š7¥7­7·7Á7Ë7á7ç7õ7888&8,848F8R8a8m8u8€8†8“8™8³8º8Ä8Î8Ø8ä8ï89999/9:9[9s9’9ª9²9ò9:W:w:•:¿;Ì;ÿ;<<'<0<;<D<K<Z<a<ƒ<Ü<ä<i=‡=Œ=’=þ=>>>b>k>>§>³>»>î>?2?\?e?u?}?ƒ?Œ?“?˜?ž?±?º?Ø?Þ?æ? 00(0@0L0T0k0z0Š0ª0Â0æ0î0ô0ú0,1P1n1~1„1Œ1ñ1ü12 22$2u2|2Œ2–2œ2¤2ª2°2·2Á2h3‘3¯3»3Ã34#4+4O4o4—4°4É4Ú4ï4ü45Ù5…668A8Q8g8…8›8²8Ç899*929H9`9n9¢9¾9Ê9Þ9è9û9+:X:a:“:œ:Ñ:Ø:ú:G;o;·<ß<æ<þ< =T=\=g=“=¨=ó=>>N>R>X>\>a>h>n>v>>>˜>Ä>Ï>ì>ö>?%?/?7?=?K?f?{?…?Š?©?®?³?Õ?é?0 N0W0}0Š0466?6:7C7¡;²;ò;ù; <)<2<><E<Ä< =/=;=B=L=V=m=~=‹=’=–=œ= =¦=­=±=Ë=Ô=Ý=é=ó=>/>@>J>R>Z>b>j>’>¼>Ê>Ï>è>ø> ??&?+?0?7?>?H?_?k?x?Š?—?£?°?Â?È?â?ê?ò?ú?@0 00:0B0J0R0Z0b0j0r0z0‚0Š0’0š0¢0ª0²0º0Â0Ê0Ò0Ú0â0ê0ò0ú01 111"1*121:1B1J1R1Z1b1j1r1z1‚1Š1’1§1³1À1Ò1ß1ë1ø1 22#202B2J2R2_2k2x2Š2—2£2°2Â2Ï2Û2è2ú233 323?3K3X3j3w3ƒ33¢3¯3»3È3Ú3ç3ó3444$4(4,484<4@4L4P4T4`4d4h4t4x4|4ˆ4Œ4•4¡4n5í9Ê:ò:;<Y<‘<Ù<Z=ž=ù=>Ô>ï>?¨?ê?P\ 0b0¸0å0]1¹12I22¸23¸3ü3 4œ4À4é45»5ß5ü5~66_8H9®9,;:;A;H;c;o;Š;˜;Ÿ;¦;Ý;‚<¢<š?¼?Ê?`L0Œ3“3Î4‚5¶6ô:(;=;c;Ø;„<<Â<ç<ó<û<===*=:=Z=ì=>A>v>§>Ã>ý>?K?Œ?º?p˜ 040R0…0«0·0Ä0Ö0å011I1™1²12-2É2_3n34o4Ñ4ß4y5ª5Â5Ö5 6J6Œ6¯6ì67U7w7Ö7u8’8 9_9d9w9°9»9Ò9:.:E:c:z:²:ê:;;e;;­;<<¤<==u=¸=.>c>¤>¾>ñ> ?Æ?ñ?€h030F0X0\0`0d0h0l0p0t0x0|0€0„0ˆ0Œ00”0˜0œ0 0¤0¨0¬0°0´0¸0¼0À0Ä0È0Ì0Ð0Ô0Ø0à0ù011%191M1a11Ë120004080è0ì0ð0ô0ø0ü0111111 1$1(122p000 0
base_address: 0x00418000
process_identifier: 1940
process_handle: 0x0000046c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0xfffde008
process_identifier: 1940
process_handle: 0x0000046c
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*àŽ t*䀐@°@Pd€ÌpCODE,rt `DATAx@ÀBSS™¨ |À.idatadP |@À.tls`†À.rdatap†@P.relocÌ€ˆ@P.rsrcŽ@P°¢@P
base_address: 0x00400000
process_identifier: 1940
process_handle: 0x0000046c
1 1 0
Process injection Process 1116 called NtSetContextThread to modify thread in remote process 1940
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4227300
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000470
process_identifier: 1940
1 0 0
Process injection Process 1116 resumed a thread in remote process 1940
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000470
suspend_count: 1
process_identifier: 1940
1 0 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions
registry HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Tools
Time & API Arguments Status Return Repeated

LdrGetProcedureAddress

 ordinal: 0
function_address: 0x0056d640
function_name: wine_get_unix_file_name
module: KERNEL32
module_address: 0x75720000
3221225785 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 1116
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 1116
1 0 0

NtResumeThread

 thread_handle: 0x00000188
suspend_count: 1
process_identifier: 1116
1 0 0

NtResumeThread

 thread_handle: 0x00000280
suspend_count: 1
process_identifier: 1116
1 0 0

NtResumeThread

 thread_handle: 0x000002d0
suspend_count: 1
process_identifier: 1116
1 0 0

NtResumeThread

 thread_handle: 0x00000310
suspend_count: 1
process_identifier: 1116
1 0 0

NtResumeThread

 thread_handle: 0x00000344
suspend_count: 1
process_identifier: 1116
1 0 0

CreateProcessInternalW

 thread_identifier: 3032
thread_handle: 0x000004a8
process_identifier: 2832
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PaJrxje" /XML "C:\Users\test22\AppData\Local\Temp\tmpEEAE.tmp"
filepath_r: C:\Windows\System32\schtasks.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000004b0
1 1 0

CreateProcessInternalW

 thread_identifier: 2716
thread_handle: 0x00000470
process_identifier: 1940
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
track: 1
command_line:
filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000046c
1 1 0

NtGetContextThread

 thread_handle: 0x00000470
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1940
region_size: 110592
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000046c
1 0 0

WriteProcessMemory

 buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*àŽ t*䀐@°@Pd€ÌpCODE,rt `DATAx@ÀBSS™¨ |À.idatadP |@À.tls`†À.rdatap†@P.relocÌ€ˆ@P.rsrcŽ@P°¢@P
base_address: 0x00400000
process_identifier: 1940
process_handle: 0x0000046c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 1940
process_handle: 0x0000046c
1 1 0

WriteProcessMemory

 buffer: @2‹À@@@t@ @„#@ËÌÈÉ×ÏÈÍÎÛØÚÙÊÜÝÞßàáãäå@Error‹ÀRuntime error at 00000000‹À0123456789ABCDEFÿÿÿÿ=@@´F@ÌN@O@ØY@äY@øY@üY@üY@Z@$Z@LZ@PZ@Z@´Z@àZ@ @øà€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿ @ ,Eí͘û¤W€É<AïË½ïW‡Ý{JÖçöJÞ>…@}ü„{댐íêÄþGÌA2ÿœNۂõ¥Ð2ªË+^þÇºãW—Ë µáÙnÊXý±.štÛNóĞt“îâhî„‹À`ˆ²òTø5ýœ‘@@
base_address: 0x00409000
process_identifier: 1940
process_handle: 0x0000046c
1 1 0

WriteProcessMemory

 buffer: XRÜPàS4Q T@QLTPQ€T\QÌTpQ U€QöVôQÄW(R8XLRfR~R–R®RÊRØRèRôRSS&S8SJS\SnS|SŠS–S²S¾SÐSìSþST.T>TZTjTŽTœTªT¸TÚTìTüTU$U.U@UVUfU~UŽUšU²UÂUÖUìUVV&V4VJVZVlVzVŠVœV¨V¶VÆVÔVèVWWW,W:WFWVWbWvWŠW WºWÐWÜWêWøWX XX&XDXTXkernel32.dllDeleteCriticalSectionLeaveCriticalSectionEnterCriticalSectionInitializeCriticalSectionVirtualFreeVirtualAllocLocalFreeLocalAllocGetVersionGetCurrentThreadIdGetThreadLocaleGetStartupInfoAGetLocaleInfoAGetCommandLineAFreeLibraryExitProcessWriteFileUnhandledExceptionFilterRtlUnwindRaiseExceptionGetStdHandleuser32.dllGetKeyboardTypeMessageBoxAadvapi32.dllRegQueryValueExARegOpenKeyExARegCloseKeyoleaut32.dllSysFreeStringSysReAllocStringLenkernel32.dllTlsSetValueTlsGetValueLocalAllocGetModuleHandleAadvapi32.dllRegSetValueExARegOpenKeyExARegCloseKeykernel32.dllWriteFileWinExecSetFilePointerSetFileAttributesASetEndOfFileSetCurrentDirectoryAReleaseMutexReadFileGetWindowsDirectoryAGetTempPathAGetShortPathNameAGetModuleFileNameAGetLogicalDriveStringsAGetLocalTimeGetLastErrorGetFileSizeGetFileAttributesAGetDriveTypeAGetCommandLineAFreeLibraryFindNextFileAFindFirstFileAFindCloseDeleteFileACreateMutexACreateFileACreateDirectoryACloseHandlegdi32.dllStretchDIBitsSetDIBitsSelectObjectGetObjectAGetDIBitsDeleteObjectDeleteDCCreateSolidBrushCreateDIBSectionCreateCompatibleDCCreateCompatibleBitmapBitBltuser32.dllReleaseDCGetSysColorGetIconInfoGetDCFillRectDestroyIconCopyImageCharLowerBuffAshell32.dllShellExecuteAExtractIconA
base_address: 0x00415000
process_identifier: 1940
process_handle: 0x0000046c
1 1 0

WriteProcessMemory

 buffer: `A`A@pA
base_address: 0x00417000
process_identifier: 1940
process_handle: 0x0000046c
1 1 0

WriteProcessMemory

 buffer:  0 000"0*020:0B0J0R0Z0b0j0r0z0‚0Š0’0¾0Æ0Î0Ö0Þ0æ0î0ö0ÿ0 1(11—1ß2V3¥3ë3þ3t4¸4ù4-595T5ç567r77š7¥7­7·7Á7Ë7á7ç7õ7888&8,848F8R8a8m8u8€8†8“8™8³8º8Ä8Î8Ø8ä8ï89999/9:9[9s9’9ª9²9ò9:W:w:•:¿;Ì;ÿ;<<'<0<;<D<K<Z<a<ƒ<Ü<ä<i=‡=Œ=’=þ=>>>b>k>>§>³>»>î>?2?\?e?u?}?ƒ?Œ?“?˜?ž?±?º?Ø?Þ?æ? 00(0@0L0T0k0z0Š0ª0Â0æ0î0ô0ú0,1P1n1~1„1Œ1ñ1ü12 22$2u2|2Œ2–2œ2¤2ª2°2·2Á2h3‘3¯3»3Ã34#4+4O4o4—4°4É4Ú4ï4ü45Ù5…668A8Q8g8…8›8²8Ç899*929H9`9n9¢9¾9Ê9Þ9è9û9+:X:a:“:œ:Ñ:Ø:ú:G;o;·<ß<æ<þ< =T=\=g=“=¨=ó=>>N>R>X>\>a>h>n>v>>>˜>Ä>Ï>ì>ö>?%?/?7?=?K?f?{?…?Š?©?®?³?Õ?é?0 N0W0}0Š0466?6:7C7¡;²;ò;ù; <)<2<><E<Ä< =/=;=B=L=V=m=~=‹=’=–=œ= =¦=­=±=Ë=Ô=Ý=é=ó=>/>@>J>R>Z>b>j>’>¼>Ê>Ï>è>ø> ??&?+?0?7?>?H?_?k?x?Š?—?£?°?Â?È?â?ê?ò?ú?@0 00:0B0J0R0Z0b0j0r0z0‚0Š0’0š0¢0ª0²0º0Â0Ê0Ò0Ú0â0ê0ò0ú01 111"1*121:1B1J1R1Z1b1j1r1z1‚1Š1’1§1³1À1Ò1ß1ë1ø1 22#202B2J2R2_2k2x2Š2—2£2°2Â2Ï2Û2è2ú233 323?3K3X3j3w3ƒ33¢3¯3»3È3Ú3ç3ó3444$4(4,484<4@4L4P4T4`4d4h4t4x4|4ˆ4Œ4•4¡4n5í9Ê:ò:;<Y<‘<Ù<Z=ž=ù=>Ô>ï>?¨?ê?P\ 0b0¸0å0]1¹12I22¸23¸3ü3 4œ4À4é45»5ß5ü5~66_8H9®9,;:;A;H;c;o;Š;˜;Ÿ;¦;Ý;‚<¢<š?¼?Ê?`L0Œ3“3Î4‚5¶6ô:(;=;c;Ø;„<<Â<ç<ó<û<===*=:=Z=ì=>A>v>§>Ã>ý>?K?Œ?º?p˜ 040R0…0«0·0Ä0Ö0å011I1™1²12-2É2_3n34o4Ñ4ß4y5ª5Â5Ö5 6J6Œ6¯6ì67U7w7Ö7u8’8 9_9d9w9°9»9Ò9:.:E:c:z:²:ê:;;e;;­;<<¤<==u=¸=.>c>¤>¾>ñ> ?Æ?ñ?€h030F0X0\0`0d0h0l0p0t0x0|0€0„0ˆ0Œ00”0˜0œ0 0¤0¨0¬0°0´0¸0¼0À0Ä0È0Ì0Ð0Ô0Ø0à0ù011%191M1a11Ë120004080è0ì0ð0ô0ø0ü0111111 1$1(122p000 0
base_address: 0x00418000
process_identifier: 1940
process_handle: 0x0000046c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00419000
process_identifier: 1940
process_handle: 0x0000046c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0xfffde008
process_identifier: 1940
process_handle: 0x0000046c
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4227300
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000470
process_identifier: 1940
1 0 0

NtResumeThread

 thread_handle: 0x00000470
suspend_count: 1
process_identifier: 1940
1 0 0

NtResumeThread

 thread_handle: 0x0000049c
suspend_count: 1
process_identifier: 1116
1 0 0

CreateProcessInternalW

 thread_identifier: 0
thread_handle: 0x00000000
process_identifier: 0
current_directory: C:\Windows\Microsoft.NET\Framework\v4.0.30319
filepath: C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe
track: 0
command_line: "C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000000
0 0
Lionic Trojan.MSIL.Taskun.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.46987097
FireEye Generic.mg.66ce1420280eceeb
McAfee AgentTesla-FDCV!66CE1420280E
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 0058274f1 )
Alibaba Trojan:Win32/starter.ali1000139
K7GW Trojan ( 0058274f1 )
Cybereason malicious.b88eb7
Cyren W32/MSIL_Kryptik.FNY.gen!Eldorado
Symantec Trojan.Gen.2
ESET-NOD32 a variant of MSIL/Kryptik.ACUS
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan.MSIL.Taskun.gen
BitDefender Trojan.GenericKD.46987097
Avast Win32:CrypterX-gen [Trj]
Ad-Aware Trojan.GenericKD.46987097
Sophos Mal/Generic-S
Comodo Malware@#13b7w5qa6ixyu
DrWeb Trojan.PWS.Maria.3
TrendMicro TROJ_FRS.0NA103II21
McAfee-GW-Edition BehavesLike.Win32.Generic.cc
Emsisoft Trojan.GenericKD.46987097 (B)
Ikarus Trojan-Spy.Keylogger.Snake
Avira TR/Kryptik.xuvdh
Kingsoft Win32.Troj.Undef.(kcloud)
Gridinsoft Trojan.Win32.Kryptik.oa
Microsoft Trojan:MSIL/AgentTesla.CUC!MTB
GData Win32.Backdoor.Remcos.A5O7HI
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.AgentTesla.C4635630
ALYac Trojan.GenericKD.46987097
MAX malware (ai score=100)
Malwarebytes Trojan.Crypt.MSIL
TrendMicro-HouseCall TROJ_FRS.0NA103II21
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/GenKryptik.FKSX!tr
Webroot W32.Trojan.Gen
AVG Win32:CrypterX-gen [Trj]
Panda Trj/GdSda.A
CrowdStrike win/malicious_confidence_80% (W)
dead_host 192.168.56.101:49202
dead_host 192.168.56.101:49203