Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Oct. 19, 2021, 9:21 a.m.	Oct. 19, 2021, 9:32 a.m.

Size	455.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`ea9748d43fde0c8942c9f7e47c8cfa37`
SHA256	`5ae2a36a32ceefc6fa2af322192dabf1f453bf0b19f20ee09d42224cf95e5d8b`
CRC32	`2811F019`
ssdeep	`6144:FSkF/Kuq5K1GRVNXjEuZFkLMk/lOF4E91cQHYe:FSkFMo1CNzEusLMkdOFh9/4`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\aero\Shell\\svchost.exe" -Force
1628
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\125.exe" -Force
2208
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Resources\Themes\aero\Shell\\svchost.exe" -Force
2156
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\test22\AppData\Local\Temp\125.exe" -Force
2512

Name	Response	Post-Analysis Lookup
cdn.discordapp.com	A 162.159.135.233 A 162.159.134.233 A 162.159.129.233 A 162.159.130.233 A 162.159.133.233	162.159.130.233

IP Address	Status	Action
162.159.133.233	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49163 -> 162.159.133.233:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49163 162.159.133.233:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2	C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	a6:26:df:21:b9:4f:a7:fb:ae:8d:87:ce:fb:7d:2b:c6:50:8b:ff:da

Queries for the computername (24 events)

Time & API	Arguments	Status	Return
GetComputerNameW Oct. 19, 2021, 9:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 19, 2021, 9:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 19, 2021, 9:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 19, 2021, 9:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 19, 2021, 9:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 19, 2021, 9:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 19, 2021, 9:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 19, 2021, 9:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 19, 2021, 9:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 19, 2021, 9:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 19, 2021, 9:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 19, 2021, 9:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 19, 2021, 9:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 19, 2021, 9:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 19, 2021, 9:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 19, 2021, 9:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 19, 2021, 9:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 19, 2021, 9:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 19, 2021, 9:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 19, 2021, 9:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 19, 2021, 9:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 19, 2021, 9:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 19, 2021, 9:21 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 19, 2021, 9:21 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 19, 2021, 9:21 a.m.			0	0
IsDebuggerPresent Oct. 19, 2021, 9:21 a.m.			0	0
IsDebuggerPresent Oct. 19, 2021, 9:21 a.m.			0	0
IsDebuggerPresent Oct. 19, 2021, 9:21 a.m.			0	0

Command line console output was observed (36 events)

Time & API	Arguments	Status	Return
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Windows\Resources\Themes\aero\Shell\ console_handle: 0x00000053	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: \svchost.exe -Force console_handle: 0x0000005f	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Local\Temp\125. console_handle: 0x00000053	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: exe -Force console_handle: 0x0000005f	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Windows\Resources\Themes\aero\Shell\ console_handle: 0x00000053	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: \svchost.exe -Force console_handle: 0x0000005f	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath C:\Users\test22\AppData\Local\Temp\125. console_handle: 0x00000053	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: exe -Force console_handle: 0x0000005f	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000006b	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: mmandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW Oct. 19, 2021, 9:21 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000083	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 184 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f8f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f630 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f630 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f630 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f230 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f230 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f230 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f230 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f230 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f230 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044ed30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044ed30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044ed30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f830 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f830 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f830 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f3f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f830 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f830 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f830 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f830 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f830 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f830 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f830 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f6f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f6f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f6f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f6f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f6f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f6f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f6f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f6f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f6f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f6f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f6f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f6f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f6f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044f6f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044ee70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044ee70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044ee70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044ee70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044ee70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044ee70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044ee70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0044ee70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00380b38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00380878 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00380878 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 19, 2021, 9:21 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00380878 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 19, 2021, 9:21 a.m.		1	1	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (4 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET https://cdn.discordapp.com/attachments/893177342426509335/899579981057916928/D0541226.jpg
suspicious_features	GET method with no useragent header	suspicious_request	GET https://cdn.discordapp.com/attachments/893177342426509335/899579983847096320/8F5AF8B4.jpg
suspicious_features	GET method with no useragent header	suspicious_request	GET https://cdn.discordapp.com/attachments/893177342426509335/899579986283986974/61AD9E94.jpg
suspicious_features	GET method with no useragent header	suspicious_request	GET https://cdn.discordapp.com/attachments/893177342426509335/899579987907186728/7377E0AD.jpg

Performs some HTTP requests (4 events)

request	GET https://cdn.discordapp.com/attachments/893177342426509335/899579981057916928/D0541226.jpg
request	GET https://cdn.discordapp.com/attachments/893177342426509335/899579983847096320/8F5AF8B4.jpg
request	GET https://cdn.discordapp.com/attachments/893177342426509335/899579986283986974/61AD9E94.jpg
request	GET https://cdn.discordapp.com/attachments/893177342426509335/899579987907186728/7377E0AD.jpg

Allocates read-write-execute memory (usually to unpack itself) (50 out of 548 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c211000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01eda000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6c212000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ed2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ee2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b81000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b82000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f0a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ee3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ee4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f1b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f17000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01edb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f02000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f15000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ee5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f0c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ee6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f1c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f03000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f04000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f05000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f06000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f07000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f08000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f09000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a01000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a02000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a03000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a04000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a05000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a06000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a07000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a08000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a09000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a0a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a0b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a0c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a0d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a0e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a0f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a12000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a13000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 19, 2021, 9:21 a.m.	process_identifier: 1628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a14000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\740c1d45-17f7-47dd-ac2e-be5268c1f8ee\AdvancedRun.exe

Checks for the Locally Unique Identifier on the system for a suspicious privilege (4 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Oct. 19, 2021, 9:21 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Oct. 19, 2021, 9:21 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Oct. 19, 2021, 9:21 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Oct. 19, 2021, 9:21 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (50 out of 176 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe

File has been identified by 23 AntiVirus engines on VirusTotal as malicious (23 events)

Lionic	Trojan.Multi.Generic.4!c
Elastic	malicious (high confidence)
Cylance	Unsafe
Sangfor	Riskware.Win32.Agent.ky
CrowdStrike	win/malicious_confidence_60% (W)
BitDefenderTheta	Gen:NN.ZemsilCO.34218.Cm0@aG7rKrp
Cyren	W32/MSIL_Kryptik.FWP.gen!Eldorado
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.JDC
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
Avast	FileRepMalware
Comodo	TrojWare.Win32.UMal.fytgs@0
McAfee-GW-Edition	BehavesLike.Win32.Generic.gh
Sophos	Mal/Generic-S
Microsoft	Trojan:Win32/Woreflint.A!cl
Cynet	Malicious (score: 100)
McAfee	Artemis!EA9748D43FDE
Malwarebytes	Malware.AI.3140901223
SentinelOne	Static AI - Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen
Webroot	W32.Trojan.Gen
AVG	FileRepMalware

125.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All