Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 6, 2021, 5:54 p.m.	Oct. 6, 2021, 5:58 p.m.

Size	199.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`d85e65af9f95ec441918502621be13b4`
SHA256	`45c888a043acd745d8a25044c2b336d09f68ca059eb392e3008c13240cfd2539`
CRC32	`7C01585A`
ssdeep	`3072:rDKW1LgppLRHMY0TBfJvjcTp5X0Q12sZkTqZhMmkDzbV70y:rDKW1Lgbdl0TBBvjc/0Q12AkTQ6mk57R`
PDB Path
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library UltraVNC_Zero - UltraVNC

Update.exe "C:\Users\test22\AppData\Local\Temp\Update.exe"
1684

Name	Response	Post-Analysis Lookup
www.teknoarge.com	CNAME teknoarge.com A 212.12.151.74	212.12.151.74

IP Address	Status	Action
164.124.101.2	Active	Moloch
212.12.151.74	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (20 events)

Time & API	Arguments	Status	Return
GetComputerNameW Oct. 6, 2021, 5:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 6, 2021, 5:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 6, 2021, 5:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 6, 2021, 5:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 6, 2021, 5:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 6, 2021, 5:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 6, 2021, 5:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 6, 2021, 5:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 6, 2021, 5:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 6, 2021, 5:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 6, 2021, 5:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 6, 2021, 5:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 6, 2021, 5:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 6, 2021, 5:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 6, 2021, 5:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 6, 2021, 5:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 6, 2021, 5:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 6, 2021, 5:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 6, 2021, 5:54 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 6, 2021, 5:54 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 6, 2021, 5:54 p.m.			0	0
IsDebuggerPresent Oct. 6, 2021, 5:54 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (6 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 6, 2021, 5:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005f7c58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 6, 2021, 5:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005f7c58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 6, 2021, 5:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005f7c98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 6, 2021, 5:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005f7c98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 6, 2021, 5:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005f7d58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 6, 2021, 5:54 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005f7d58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 6, 2021, 5:54 p.m.		1	1	0

One or more processes crashed (20 events)

Time & API	Arguments	Status
__exception__ Oct. 6, 2021, 5:54 p.m.	stacktrace: update+0x1fa2 @ 0x401fa2 exception.instruction_r: f3 aa 8b 45 f0 8b 4d 08 8b 55 10 03 c8 2b d0 52 exception.symbol: update+0xf088 exception.instruction: stosb byte ptr es:[edi], al exception.module: Update.exe exception.exception_code: 0xc0000005 exception.offset: 61576 exception.address: 0x40f088 registers.esp: 1636996 registers.edi: 4350244 registers.eax: 0 registers.ebp: 1637012 registers.edx: 0 registers.ebx: 0 registers.esi: 33292360 registers.ecx: 12	1
__exception__ Oct. 6, 2021, 5:54 p.m.	stacktrace: update+0xf054 @ 0x40f054 update+0xf0a0 @ 0x40f0a0 update+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: update+0xefff exception.address: 0x40efff exception.module: Update.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4353968 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 17 registers.ebx: 0 registers.esi: 33292360 registers.ecx: 464	1
__exception__ Oct. 6, 2021, 5:54 p.m.	stacktrace: update+0xf054 @ 0x40f054 update+0xf0a0 @ 0x40f0a0 update+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: update+0xefff exception.address: 0x40efff exception.module: Update.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4358064 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 17 registers.ebx: 0 registers.esi: 33292360 registers.ecx: 432	1
__exception__ Oct. 6, 2021, 5:54 p.m.	stacktrace: update+0xf054 @ 0x40f054 update+0xf0a0 @ 0x40f0a0 update+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: update+0xefff exception.address: 0x40efff exception.module: Update.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4362160 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 17 registers.ebx: 0 registers.esi: 33292360 registers.ecx: 400	1
__exception__ Oct. 6, 2021, 5:54 p.m.	stacktrace: update+0xf054 @ 0x40f054 update+0xf0a0 @ 0x40f0a0 update+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: update+0xefff exception.address: 0x40efff exception.module: Update.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4366256 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 17 registers.ebx: 0 registers.esi: 33292360 registers.ecx: 368	1
__exception__ Oct. 6, 2021, 5:54 p.m.	stacktrace: update+0xf054 @ 0x40f054 update+0xf0a0 @ 0x40f0a0 update+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: update+0xefff exception.address: 0x40efff exception.module: Update.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4370352 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 17 registers.ebx: 0 registers.esi: 33292360 registers.ecx: 336	1
__exception__ Oct. 6, 2021, 5:54 p.m.	stacktrace: update+0xf054 @ 0x40f054 update+0xf0a0 @ 0x40f0a0 update+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: update+0xefff exception.address: 0x40efff exception.module: Update.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4374448 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 17 registers.ebx: 0 registers.esi: 33292360 registers.ecx: 304	1
__exception__ Oct. 6, 2021, 5:54 p.m.	stacktrace: update+0xf054 @ 0x40f054 update+0xf0a0 @ 0x40f0a0 update+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: update+0xefff exception.address: 0x40efff exception.module: Update.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4378544 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 17 registers.ebx: 0 registers.esi: 33292360 registers.ecx: 272	1
__exception__ Oct. 6, 2021, 5:54 p.m.	stacktrace: update+0xf054 @ 0x40f054 update+0xf0a0 @ 0x40f0a0 update+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: update+0xefff exception.address: 0x40efff exception.module: Update.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4382640 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 17 registers.ebx: 0 registers.esi: 33292360 registers.ecx: 240	1
__exception__ Oct. 6, 2021, 5:54 p.m.	stacktrace: update+0xf054 @ 0x40f054 update+0xf0a0 @ 0x40f0a0 update+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: update+0xefff exception.address: 0x40efff exception.module: Update.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4386736 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 17 registers.ebx: 0 registers.esi: 33292360 registers.ecx: 208	1
__exception__ Oct. 6, 2021, 5:54 p.m.	stacktrace: update+0xf054 @ 0x40f054 update+0xf0a0 @ 0x40f0a0 update+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: update+0xefff exception.address: 0x40efff exception.module: Update.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4390832 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 17 registers.ebx: 0 registers.esi: 33292360 registers.ecx: 176	1
__exception__ Oct. 6, 2021, 5:54 p.m.	stacktrace: update+0xf054 @ 0x40f054 update+0xf0a0 @ 0x40f0a0 update+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: update+0xefff exception.address: 0x40efff exception.module: Update.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4394928 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 17 registers.ebx: 0 registers.esi: 33292360 registers.ecx: 144	1
__exception__ Oct. 6, 2021, 5:54 p.m.	stacktrace: update+0xf054 @ 0x40f054 update+0xf0a0 @ 0x40f0a0 update+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: update+0xefff exception.address: 0x40efff exception.module: Update.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4399024 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 17 registers.ebx: 0 registers.esi: 33292360 registers.ecx: 112	1
__exception__ Oct. 6, 2021, 5:54 p.m.	stacktrace: update+0xf054 @ 0x40f054 update+0xf0a0 @ 0x40f0a0 update+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: update+0xefff exception.address: 0x40efff exception.module: Update.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4403120 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 17 registers.ebx: 0 registers.esi: 33292360 registers.ecx: 80	1
__exception__ Oct. 6, 2021, 5:54 p.m.	stacktrace: update+0xf054 @ 0x40f054 update+0xf0a0 @ 0x40f0a0 update+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: update+0xefff exception.address: 0x40efff exception.module: Update.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4407216 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 17 registers.ebx: 0 registers.esi: 33292360 registers.ecx: 48	1
__exception__ Oct. 6, 2021, 5:54 p.m.	stacktrace: update+0xf054 @ 0x40f054 update+0xf0a0 @ 0x40f0a0 update+0x1fa2 @ 0x401fa2 exception.instruction_r: 66 0f 7f 47 50 66 0f 7f 47 60 66 0f 7f 47 70 8d exception.symbol: update+0xefff exception.address: 0x40efff exception.module: Update.exe exception.exception_code: 0xc0000005 exception.offset: 61439 registers.esp: 1636940 registers.edi: 4411312 registers.eax: 4350256 registers.ebp: 1636944 registers.edx: 17 registers.ebx: 0 registers.esi: 33292360 registers.ecx: 16	1
__exception__ Oct. 6, 2021, 5:54 p.m.	stacktrace: 0x4d268e3 0x4d26778 0x4d25e13 system+0x1e5c55 @ 0x6e885c55 system+0x1ee170 @ 0x6e88e170 0x4fa08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4 DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a system+0x2093cc @ 0x6e8a93cc system+0x1fdca1 @ 0x6e89dca1 system+0x1fd921 @ 0x6e89d921 system+0x1fd792 @ 0x6e89d792 system+0x1a14bd @ 0x6e8414bd 0x488e778 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737 mscorlib+0x2d3711 @ 0x6ff13711 mscorlib+0x308f2d @ 0x6ff48f2d 0x48803c1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737 mscorlib+0x2d3711 @ 0x6ff13711 mscorlib+0x308f2d @ 0x6ff48f2d mscorlib+0x3133fd @ 0x6ff533fd mscorlib+0x9873b1 @ 0x705c73b1 mscorlib+0x97b352 @ 0x705bb352 DllUnregisterServerInternal-0x7666 clr+0x2a8e @ 0x72742a8e DllGetClassObjectInternal+0x37c9b CorDllMainForThunk-0x54860 clr+0xfcd14 @ 0x7283cd14 0x4aa062 update+0x2403 @ 0x402403 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 a0 8b 45 a0 89 45 cc exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4d26bdd registers.esp: 1632668 registers.edi: 1632756 registers.eax: 0 registers.ebp: 1632768 registers.edx: 195 registers.ebx: 1633560 registers.esi: 38560904 registers.ecx: 0	1
__exception__ Oct. 6, 2021, 5:54 p.m.	stacktrace: 0x4d26951 0x4d26778 0x4d25e13 system+0x1e5c55 @ 0x6e885c55 system+0x1ee170 @ 0x6e88e170 0x4fa08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4 DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a system+0x2093cc @ 0x6e8a93cc system+0x1fdca1 @ 0x6e89dca1 system+0x1fd921 @ 0x6e89d921 system+0x1fd792 @ 0x6e89d792 system+0x1a14bd @ 0x6e8414bd 0x488e778 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737 mscorlib+0x2d3711 @ 0x6ff13711 mscorlib+0x308f2d @ 0x6ff48f2d 0x48803c1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737 mscorlib+0x2d3711 @ 0x6ff13711 mscorlib+0x308f2d @ 0x6ff48f2d mscorlib+0x3133fd @ 0x6ff533fd mscorlib+0x9873b1 @ 0x705c73b1 mscorlib+0x97b352 @ 0x705bb352 DllUnregisterServerInternal-0x7666 clr+0x2a8e @ 0x72742a8e DllGetClassObjectInternal+0x37c9b CorDllMainForThunk-0x54860 clr+0xfcd14 @ 0x7283cd14 0x4aa062 update+0x2403 @ 0x402403 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 a0 8b 45 a0 89 45 cc exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4d26bdd registers.esp: 1632668 registers.edi: 1632756 registers.eax: 0 registers.ebp: 1632768 registers.edx: 195 registers.ebx: 1633560 registers.esi: 38560904 registers.ecx: 0	1
__exception__ Oct. 6, 2021, 5:54 p.m.	stacktrace: 0x4d2b375 0x4d26799 0x4d25e13 system+0x1e5c55 @ 0x6e885c55 system+0x1ee170 @ 0x6e88e170 0x4fa08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4 DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a system+0x2093cc @ 0x6e8a93cc system+0x1fdca1 @ 0x6e89dca1 system+0x1fd921 @ 0x6e89d921 system+0x1fd792 @ 0x6e89d792 system+0x1a14bd @ 0x6e8414bd 0x488e778 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737 mscorlib+0x2d3711 @ 0x6ff13711 mscorlib+0x308f2d @ 0x6ff48f2d 0x48803c1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737 mscorlib+0x2d3711 @ 0x6ff13711 mscorlib+0x308f2d @ 0x6ff48f2d mscorlib+0x3133fd @ 0x6ff533fd mscorlib+0x9873b1 @ 0x705c73b1 mscorlib+0x97b352 @ 0x705bb352 DllUnregisterServerInternal-0x7666 clr+0x2a8e @ 0x72742a8e DllGetClassObjectInternal+0x37c9b CorDllMainForThunk-0x54860 clr+0xfcd14 @ 0x7283cd14 0x4aa062 update+0x2403 @ 0x402403 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 a0 8b 45 a0 89 45 cc exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4d26bdd registers.esp: 1632656 registers.edi: 1632744 registers.eax: 0 registers.ebp: 1632756 registers.edx: 195 registers.ebx: 1633560 registers.esi: 38560904 registers.ecx: 0	1
__exception__ Oct. 6, 2021, 5:54 p.m.	stacktrace: 0x4d2b6c6 0x4d267db 0x4d25e13 system+0x1e5c55 @ 0x6e885c55 system+0x1ee170 @ 0x6e88e170 0x4fa08e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x755b62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x755b6d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x755b77c4 DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x755b788a system+0x2093cc @ 0x6e8a93cc system+0x1fdca1 @ 0x6e89dca1 system+0x1fd921 @ 0x6e89d921 system+0x1fd792 @ 0x6e89d792 system+0x1a14bd @ 0x6e8414bd 0x488e778 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737 mscorlib+0x2d3711 @ 0x6ff13711 mscorlib+0x308f2d @ 0x6ff48f2d 0x48803c1 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x727c1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x727c1737 mscorlib+0x2d3711 @ 0x6ff13711 mscorlib+0x308f2d @ 0x6ff48f2d mscorlib+0x3133fd @ 0x6ff533fd mscorlib+0x9873b1 @ 0x705c73b1 mscorlib+0x97b352 @ 0x705bb352 DllUnregisterServerInternal-0x7666 clr+0x2a8e @ 0x72742a8e DllGetClassObjectInternal+0x37c9b CorDllMainForThunk-0x54860 clr+0xfcd14 @ 0x7283cd14 0x4aa062 update+0x2403 @ 0x402403 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 a0 8b 45 a0 89 45 cc exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4d26bdd registers.esp: 1632716 registers.edi: 1632804 registers.eax: 0 registers.ebp: 1632816 registers.edx: 195 registers.ebx: 1633560 registers.esi: 38560904 registers.ecx: 0	1

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET http://www.teknoarge.com/update/islem.php?mod=update&id=14454991&progid=2&oto=1

Performs some HTTP requests (1 event)

request

GET http://www.teknoarge.com/update/islem.php?mod=update&id=14454991&progid=2&oto=1

Allocates read-write-execute memory (usually to unpack itself) (44 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00440000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02220000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72742000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02280000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02420000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02221000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02222000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02223000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02224000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0055b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00557000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04880000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00555000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04881000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0488d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00506000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0050a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00507000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0488e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d25000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72102000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d26000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0xfff40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d27000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d28000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d29000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d2a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d2b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 6, 2021, 5:54 p.m.	process_identifier: 1684 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0050b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Oct. 6, 2021, 5:54 p.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0000fe00', u'virtual_address': u'0x00026000', u'entropy': 7.983442038506796, u'name': u'.rsrc', u'virtual_size': u'0x0000fd54'}

entropy

7.98344203851

description

A section with a high entropy has been found

entropy

0.319899244332

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Oct. 6, 2021, 5:54 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

File has been identified by 42 AntiVirus engines on VirusTotal as malicious (42 events)

Bkav	W32.AIDetect.malware2
Lionic	Trojan.MSIL.Crypt.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.47069525
ALYac	Trojan.GenericKD.47069525
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_70% (D)
Arcabit	Trojan.Generic.D2CE3955
Cyren	W32/Trojan.DAN.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.MSIL.Crypt.vho
BitDefender	Trojan.GenericKD.47069525
Avast	Win32:Malware-gen
Rising	Trojan.Generic@ML.99 (RDML:MyBnAFp5XYIdlZEHq54UhQ)
Ad-Aware	Trojan.GenericKD.47069525
Emsisoft	Trojan.GenericKD.47069525 (B)
McAfee-GW-Edition	BehavesLike.Win32.Generic.cc
FireEye	Generic.mg.d85e65af9f95ec44
Sophos	ML/PE-A
Ikarus	Trojan.MSIL.Crypt
Avira	TR/Kryptik.wtzzq
Antiy-AVL	Trojan/Generic.ASMalwS.34A50CC
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Ransom.Win32.Heur.sa
Microsoft	Backdoor:Win32/Bladabindi!ml
GData	Trojan.GenericKD.47069525
Cynet	Malicious (score: 100)
Acronis	suspicious
McAfee	RDN/Generic BackDoor
MAX	malware (ai score=100)
VBA32	Trojan.MSIL.Crypt
TrendMicro-HouseCall	TROJ_GEN.R067C0PJ321
Tencent	Msil.Trojan.Crypt.Wrgo
SentinelOne	Static AI - Malicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Crypt.VHO!tr
BitDefenderTheta	Gen:NN.ZexaF.34170.mq0@a4YFQKc
AVG	Win32:Malware-gen
Panda	Trj/CI.A

Update.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All