Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Nov. 16, 2022, 9:57 a.m.	Nov. 16, 2022, 10:04 a.m.

Size	444.8KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`f8b268092c168d21b281becc65da3dfa`
SHA256	`8480895542ad5e0279f134410f74832287403b25be149fcb263d74e7be07b4de`
CRC32	`29A27699`
ssdeep	`12288:u7VY68KjN0K2swPZD8QdVBhtyyfDhtQcLt9yj:8VIKL2zZoQdVt1havj`
PDB Path	C:\Users\Administrator\Documents\CryptoObfuscator_Output\BNBCFHJHFJJ.pdb
Yara	IsPE32 - (no description) Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature

fire.exe "C:\Users\test22\AppData\Local\Temp\fire.exe"
2548
- RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
  2672
  - ConsoleApp1.exe "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\ConsoleApp1.exe"
    2868
    - csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @".\ftbc3iys.cmdline"
      2968
      - cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\test22\AppData\Local\Temp\RES2788.tmp" "c:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\CSC235216DD3E9146C19A641E7AC7744AC.TMP"
        3052
    - credentials.exe "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\credentials.exe"
      1964
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
showip.net	A 162.55.60.2	162.55.60.2

IP Address	Status	Action
162.55.60.2	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW Nov. 16, 2022, 9:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 16, 2022, 9:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 16, 2022, 9:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 16, 2022, 9:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 16, 2022, 9:57 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 16, 2022, 9:57 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (7 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 16, 2022, 9:57 a.m.			0	0
IsDebuggerPresent Nov. 16, 2022, 9:57 a.m.			0	0
IsDebuggerPresent Nov. 16, 2022, 9:57 a.m.			0	0
IsDebuggerPresent Nov. 16, 2022, 9:57 a.m.			0	0
IsDebuggerPresent Nov. 16, 2022, 9:57 a.m.			0	0
IsDebuggerPresent Nov. 16, 2022, 9:57 a.m.			0	0
IsDebuggerPresent Nov. 16, 2022, 9:57 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (12 events)

Time & API	Arguments	Status	Return
CryptExportKey Nov. 16, 2022, 9:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00d912f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 16, 2022, 9:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00d912f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 16, 2022, 9:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00d912f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 16, 2022, 9:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00d91478 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 16, 2022, 9:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00d91478 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 16, 2022, 9:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00d91478 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 16, 2022, 9:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00d91578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 16, 2022, 9:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00d91578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 16, 2022, 9:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00d91578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 16, 2022, 9:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00d91578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 16, 2022, 9:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00d914f8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 16, 2022, 9:57 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00d91478 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

This executable has a PDB path (1 event)

pdb_path

C:\Users\Administrator\Documents\CryptoObfuscator_Output\BNBCFHJHFJJ.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 16, 2022, 9:57 a.m.		1	1	0

One or more processes crashed (8 events)

Time & API	Arguments	Status
__exception__ Nov. 16, 2022, 9:57 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 3926176 registers.edi: 5921936 registers.eax: 3926176 registers.ebp: 3926256 registers.edx: 0 registers.ebx: 5921936 registers.esi: 5921936 registers.ecx: 2	1
__exception__ Nov. 16, 2022, 9:57 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 3926520 registers.edi: 3926796 registers.eax: 3926520 registers.ebp: 3926600 registers.edx: 0 registers.ebx: 5921936 registers.esi: 3926796 registers.ecx: 2	1
__exception__ Nov. 16, 2022, 9:57 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 3926872 registers.edi: 5921936 registers.eax: 3926872 registers.ebp: 3926952 registers.edx: 0 registers.ebx: 5921936 registers.esi: 5921936 registers.ecx: 2	1
__exception__ Nov. 16, 2022, 9:57 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 3926316 registers.edi: 5921936 registers.eax: 3926316 registers.ebp: 3926396 registers.edx: 0 registers.ebx: 5921936 registers.esi: 5921936 registers.ecx: 2	1
__exception__ Nov. 16, 2022, 9:57 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 3926316 registers.edi: 5921936 registers.eax: 3926316 registers.ebp: 3926396 registers.edx: 0 registers.ebx: 5921936 registers.esi: 5921936 registers.ecx: 2	1
__exception__ Nov. 16, 2022, 9:57 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 3926840 registers.edi: 5921936 registers.eax: 3926840 registers.ebp: 3926920 registers.edx: 0 registers.ebx: 5921936 registers.esi: 5921936 registers.ecx: 2	1
__exception__ Nov. 16, 2022, 9:57 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 3926840 registers.edi: 5921936 registers.eax: 3926840 registers.ebp: 3926920 registers.edx: 0 registers.ebx: 5921936 registers.esi: 5921936 registers.ecx: 2	1
__exception__ Nov. 16, 2022, 9:57 a.m.	stacktrace: 0x7fe94530db6 0x7fe9453033c CoUninitializeEE+0x4c56f GetMetaDataInternalInterface-0x2b1ad clr+0x4f713 @ 0x7fef3bef713 CoUninitializeEE+0x4c09e GetMetaDataInternalInterface-0x2b67e clr+0x4f242 @ 0x7fef3bef242 CoUninitializeEE+0x4c167 GetMetaDataInternalInterface-0x2b5b5 clr+0x4f30b @ 0x7fef3bef30b _CorExeMain+0x335c ClrCreateManagedInstance-0x15ae4 clr+0x1e721c @ 0x7fef3d8721c _CorExeMain+0x3ab6 ClrCreateManagedInstance-0x1538a clr+0x1e7976 @ 0x7fef3d87976 _CorExeMain+0x39b0 ClrCreateManagedInstance-0x15490 clr+0x1e7870 @ 0x7fef3d87870 _CorExeMain+0x3526 ClrCreateManagedInstance-0x1591a clr+0x1e73e6 @ 0x7fef3d873e6 _CorExeMain+0x347e ClrCreateManagedInstance-0x159c2 clr+0x1e733e @ 0x7fef3d8733e _CorExeMain+0x14 ClrCreateManagedInstance-0x18e2c clr+0x1e3ed4 @ 0x7fef3d83ed4 _CorExeMain+0x5d CLRCreateInstance-0x2bd3 mscoreei+0x74e5 @ 0x7fef4e874e5 _CorExeMain+0x69 ND_RU1-0x1707 mscoree+0x5b21 @ 0x7fef4f25b21 BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76c2652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521 exception.instruction_r: 41 80 3c 24 00 49 8b cc e8 9d 5d 40 5e 4c 8b f8 exception.instruction: cmp byte ptr [r12], 0 exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x7fe94530db6 registers.r14: 0 registers.r15: 0 registers.rcx: 1831360 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 1834448 registers.r11: 1829840 registers.r8: 4 registers.r9: 0 registers.rdx: 2841744 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 0 registers.r13: 0	1

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (1 event)

request

GET http://showip.net/

Allocates read-write-execute memory (usually to unpack itself) (50 out of 88 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2548 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00750000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00890000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2548 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ff0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02100000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00592000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x006f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:58 a.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004750000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2868 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72101000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72102000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2868 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00510000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00580000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00570000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2868 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2868 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00571000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2968 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2968 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02690000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2968 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00580000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1

Creates executable files on the filesystem (3 events)

file	c:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\credentials.exe
file	C:\Users\Public\vbsqlite3.dll
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\ConsoleApp1.exe

Drops a binary and executes it (2 events)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\ConsoleApp1.exe
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\credentials.exe

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\credentials.exe
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\ConsoleApp1.exe

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x004c0000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0006b600', u'virtual_address': u'0x00002000', u'entropy': 7.995069842484533, u'name': u'.text', u'virtual_size': u'0x0006b418'}

entropy

7.99506984248

description

A section with a high entropy has been found

entropy

0.982837528604

description

Overall entropy of this PE file is high

Yara rule detected in process memory (10 events)

description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vba
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @".\ftbc3iys.cmdline"

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: c0618e1e96f3bf83e7e39ef38346f2c821494cdc

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2672 region_size: 462848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000021c	1	0	0

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\ConsoleApp1.exe

Harvests credentials from local FTP client softwares (1 event)

registry

HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Nov. 16, 2022, 9:57 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2672 process_handle: 0x0000021c	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2548 called NtSetContextThread to modify thread in remote process 2672
NtSetContextThread Nov. 16, 2022, 9:57 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4207756 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000218 process_identifier: 2672	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2548 resumed a thread in remote process 2672
NtResumeThread Nov. 16, 2022, 9:57 a.m.	thread_handle: 0x00000218 suspend_count: 1 process_identifier: 2672	1	0	0

Executed a process and injected code into it, probably while unpacking (31 events)

Time & API	Arguments	Status	Return
NtResumeThread Nov. 16, 2022, 9:57 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2548	1	0
NtResumeThread Nov. 16, 2022, 9:57 a.m.	thread_handle: 0x00000150 suspend_count: 1 process_identifier: 2548	1	0
NtResumeThread Nov. 16, 2022, 9:57 a.m.	thread_handle: 0x0000018c suspend_count: 1 process_identifier: 2548	1	0
NtResumeThread Nov. 16, 2022, 9:57 a.m.	thread_handle: 0x00000204 suspend_count: 1 process_identifier: 2548	1	0
NtGetContextThread Nov. 16, 2022, 9:57 a.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread Nov. 16, 2022, 9:57 a.m.	thread_handle: 0x000000e4	1	0
NtResumeThread Nov. 16, 2022, 9:57 a.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2548	1	0
NtGetContextThread Nov. 16, 2022, 9:57 a.m.	thread_handle: 0x000000e4	1	0
NtGetContextThread Nov. 16, 2022, 9:57 a.m.	thread_handle: 0x000000e4	1	0
NtResumeThread Nov. 16, 2022, 9:57 a.m.	thread_handle: 0x000000e4 suspend_count: 1 process_identifier: 2548	1	0
CreateProcessInternalW Nov. 16, 2022, 9:57 a.m.	thread_identifier: 2676 thread_handle: 0x00000218 process_identifier: 2672 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe track: 1 command_line: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe" filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000021c	1	1
NtGetContextThread Nov. 16, 2022, 9:57 a.m.	thread_handle: 0x00000218	1	0
NtAllocateVirtualMemory Nov. 16, 2022, 9:57 a.m.	process_identifier: 2672 region_size: 462848 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000021c	1	0
WriteProcessMemory Nov. 16, 2022, 9:57 a.m.	buffer: base_address: 0x00400000 process_identifier: 2672 process_handle: 0x0000021c	1	1
WriteProcessMemory Nov. 16, 2022, 9:57 a.m.	buffer: base_address: 0x00401000 process_identifier: 2672 process_handle: 0x0000021c	1	1
WriteProcessMemory Nov. 16, 2022, 9:57 a.m.	buffer: base_address: 0x0043f000 process_identifier: 2672 process_handle: 0x0000021c	1	1
WriteProcessMemory Nov. 16, 2022, 9:57 a.m.	buffer: base_address: 0x00440000 process_identifier: 2672 process_handle: 0x0000021c	1	1
WriteProcessMemory Nov. 16, 2022, 9:57 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2672 process_handle: 0x0000021c	1	1
NtSetContextThread Nov. 16, 2022, 9:57 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4207756 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000218 process_identifier: 2672	1	0
NtResumeThread Nov. 16, 2022, 9:57 a.m.	thread_handle: 0x00000218 suspend_count: 1 process_identifier: 2672	1	0
CreateProcessInternalW Nov. 16, 2022, 9:57 a.m.	thread_identifier: 2872 thread_handle: 0x00000454 process_identifier: 2868 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\ConsoleApp1.exe track: 1 command_line: "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\ConsoleApp1.exe" filepath_r: C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\ConsoleApp1.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000470	1	1
NtResumeThread Nov. 16, 2022, 9:57 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2868	1	0
NtResumeThread Nov. 16, 2022, 9:57 a.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 2868	1	0
NtResumeThread Nov. 16, 2022, 9:57 a.m.	thread_handle: 0x000001c4 suspend_count: 1 process_identifier: 2868	1	0
CreateProcessInternalW Nov. 16, 2022, 9:57 a.m.	thread_identifier: 2972 thread_handle: 0x00000208 process_identifier: 2968 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @".\ftbc3iys.cmdline" filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 1 process_handle: 0x00000200	1	1
NtResumeThread Nov. 16, 2022, 9:57 a.m.	thread_handle: 0x00000238 suspend_count: 1 process_identifier: 2868	1	0
CreateProcessInternalW Nov. 16, 2022, 9:57 a.m.	thread_identifier: 908 thread_handle: 0x000003ac process_identifier: 1964 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\credentials.exe track: 1 command_line: "C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\credentials.exe" filepath_r: C:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\credentials.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000003b4	1	1
CreateProcessInternalW Nov. 16, 2022, 9:57 a.m.	thread_identifier: 3056 thread_handle: 0x000000f4 process_identifier: 3052 current_directory: filepath: track: 1 command_line: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\test22\AppData\Local\Temp\RES2788.tmp" "c:\Users\test22\AppData\Roaming\Microsoft\Windows\Templates\CSC235216DD3E9146C19A641E7AC7744AC.TMP" filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 1 process_handle: 0x000000f0	1	1
NtResumeThread Nov. 16, 2022, 9:57 a.m.	thread_handle: 0x00000000000000cc suspend_count: 1 process_identifier: 1964	1	0
NtResumeThread Nov. 16, 2022, 9:57 a.m.	thread_handle: 0x000000000000013c suspend_count: 1 process_identifier: 1964	1	0
NtResumeThread Nov. 16, 2022, 9:57 a.m.	thread_handle: 0x0000000000000188 suspend_count: 1 process_identifier: 1964	1	0

File has been identified by 45 AntiVirus engines on VirusTotal as malicious (45 events)

MicroWorld-eScan	Trojan.GenericKD.63637170
FireEye	Generic.mg.f8b268092c168d21
Cylance	Unsafe
Sangfor	Trojan.Win32.Kryptik.Vhp6
K7AntiVirus	Trojan ( 005690671 )
Alibaba	Trojan:MSIL/Kryptik.f78ee21f
K7GW	Trojan ( 005944cf1 )
CrowdStrike	win/malicious_confidence_70% (W)
Arcabit	Trojan.Generic.D3CB06B2
BitDefenderTheta	Gen:NN.ZemsilCO.34796.Bm1@a8pRwhj
Cyren	W32/MSIL_Agent.DSJ.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Kryptik.AFAK
TrendMicro-HouseCall	TROJ_GEN.R002H0CKE22
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.GenericKD.63637170
Cynet	Malicious (score: 99)
Avast	Win32:Trojan-gen
Tencent	Win32.Trojan.FalseSign.Iajl
Ad-Aware	Trojan.GenericKD.63637170
Emsisoft	Trojan.GenericKD.63637170 (B)
DrWeb	Trojan.DownloaderNET.345
VIPRE	Trojan.GenericKD.63637170
McAfee-GW-Edition	Artemis!Trojan
SentinelOne	Static AI - Malicious PE
Avira	HEUR/AGEN.1252470
Antiy-AVL	Trojan/MSIL.Kryptik
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Ransom.Win32.Wacatac.sa
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Trojan.GenericKD.63637170
Google	Detected
AhnLab-V3	Trojan/Win.Injection.C5306117
Acronis	suspicious
McAfee	Artemis!F8B268092C16
MAX	malware (ai score=84)
Malwarebytes	Spyware.DarkCloud
Rising	Trojan.Generic/MSIL@AI.94 (RDM.MSIL:SEPRnA1uevjZ8VWu7VJ6tA)
Ikarus	Trojan.MSIL.Inject
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	MSIL/Kryptik.AFAK!tr
AVG	Win32:Trojan-gen
Cybereason	malicious.ba461d
Panda	Trj/GdSda.A

fire.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All