Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 27, 2023, 10:18 a.m.	March 27, 2023, 10:44 a.m.

Size	215.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`571ce7de07a8e7ad2bb8abae3c625f11`
SHA256	`5746e05d0d33d2e861dde5df9ca23c71cff9275e7b8b81bd711175de46ca7c6d`
CRC32	`1A174F12`
ssdeep	`3072:hTYk3kXPDy4lZXbDNySimBEvF4fTJHqV9vdjmbYYdYUm:N3UPBjbMtyfTlqbdjZ`
Yara	UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description) PE_Header_Zero - PE File Signature

97.exe "C:\Users\test22\AppData\Local\Temp\97.exe"
2548
- csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\t3f2dob5.cmdline"
  2632
  - cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\test22\AppData\Local\Temp\RESF2AD.tmp" "c:\Users\test22\AppData\Local\Temp\CSCC63E9587BCA14F1C8E285259101B6355.TMP"
    2700
- cmd.exe "C:\Windows\System32\cmd.exe" /C move C:\Users\test22\AppData\Local\Temp\97.exe C:\Users\test22\AppData\Local\Temp\\wt67uit.dat
  2784
- cmd.exe "C:\Windows\System32\cmd.exe" /c del C:\Users\test22\AppData\Local\Temp\\*.tmp001
  2840

Name	Response	Post-Analysis Lookup
windowsupdate.microsoft.com	A 20.72.235.82 CNAME redir.update.msft.com.trafficmanager.net	20.72.235.82

IP Address	Status	Action
164.124.101.2	Active	Moloch
20.72.235.82	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49172 -> 20.72.235.82:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 27, 2023, 10:18 a.m.			0	0
IsDebuggerPresent March 27, 2023, 10:18 a.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW March 27, 2023, 10:18 a.m.	buffer: 1 file(s) moved. console_handle: 0x00000007	1	1	0
WriteConsoleW March 27, 2023, 10:18 a.m.	buffer: Could Not Find C:\Users\test22\AppData\Local\Temp\*.tmp001 console_handle: 0x0000000b	1	1	0

Uses Windows APIs to generate a cryptographic key (9 events)

Time & API	Arguments	Status	Return
CryptExportKey March 27, 2023, 10:18 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042fa50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 27, 2023, 10:18 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042fa50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 27, 2023, 10:18 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042fa50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 27, 2023, 10:18 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042fa50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 27, 2023, 10:18 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042fa50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 27, 2023, 10:18 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042fa50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 27, 2023, 10:18 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0042fa50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 27, 2023, 10:18 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00467370 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 27, 2023, 10:18 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00467370 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 27, 2023, 10:18 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (41 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02190000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02350000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02190000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02300000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 1179648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ba0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02301000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02302000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02303000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0050b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00507000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02305000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02307000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00505000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02308000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0230c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0231d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0231e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02910000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0231f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02320000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02321000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02323000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2632 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a20000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2632 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00bd0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 27, 2023, 10:18 a.m.	process_identifier: 2632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00c70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	c:\Users\test22\AppData\Local\Temp\t3f2dob5.dll

Creates a suspicious process (4 events)

cmdline	"C:\Windows\System32\cmd.exe" /c del C:\Users\test22\AppData\Local\Temp\\*.tmp001
cmdline	cmd.exe /C move C:\Users\test22\AppData\Local\Temp\97.exe C:\Users\test22\AppData\Local\Temp\\wt67uit.dat
cmdline	cmd.exe /c del C:\Users\test22\AppData\Local\Temp\\*.tmp001
cmdline	"C:\Windows\System32\cmd.exe" /C move C:\Users\test22\AppData\Local\Temp\97.exe C:\Users\test22\AppData\Local\Temp\\wt67uit.dat

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\t3f2dob5.dll

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW March 27, 2023, 10:18 a.m.	show_type: 0 filepath_r: cmd.exe parameters: /C move C:\Users\test22\AppData\Local\Temp\97.exe C:\Users\test22\AppData\Local\Temp\\wt67uit.dat filepath: cmd.exe	1	1	0
ShellExecuteExW March 27, 2023, 10:18 a.m.	show_type: 0 filepath_r: cmd.exe parameters: /c del C:\Users\test22\AppData\Local\Temp\\*.tmp001 filepath: cmd.exe	1	1	0

Moves the original executable to a new location (1 event)

Time & API	Arguments	Status	Return	Repeated
MoveFileWithProgressW March 27, 2023, 10:18 a.m.	newfilepath_r: C:\Users\test22\AppData\Local\Temp\wt67uit.dat flags: 3 oldfilepath_r: C:\Users\test22\AppData\Local\Temp\97.exe newfilepath: C:\Users\test22\AppData\Local\Temp\wt67uit.dat oldfilepath: C:\Users\test22\AppData\Local\Temp\97.exe	1	1	0

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	"C:\Windows\System32\cmd.exe" /c del C:\Users\test22\AppData\Local\Temp\\*.tmp001
cmdline	cmd.exe /c del C:\Users\test22\AppData\Local\Temp\\*.tmp001
cmdline	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\t3f2dob5.cmdline"

Deletes executed files from disk (2 events)

file	c:\Users\test22\AppData\Local\Temp\CSCC63E9587BCA14F1C8E285259101B6355.TMP
file	C:\Users\test22\AppData\Local\Temp\RESF2AD.tmp

File has been identified by 45 AntiVirus engines on VirusTotal as malicious (45 events)

Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	Trojan.GenericKD.66061923
Malwarebytes	Spyware.Stealer
Sangfor	Trojan.Win32.Agent.Vuis
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Trojan:Win32/Donut.050191e8
K7GW	Spyware ( 005a16751 )
K7AntiVirus	Spyware ( 005a16751 )
Cyren	W32/ABRisk.TGDN-2017
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	MSIL/Spy.Agent.EJX
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Donut.gen
BitDefender	Trojan.GenericKD.66061923
MicroWorld-eScan	Trojan.GenericKD.66061923
Avast	Win32:Trojan-gen
Tencent	Win32.Trojan.Donut.Xwhl
DrWeb	Trojan.MulDrop21.52805
VIPRE	Trojan.GenericKD.66061923
McAfee-GW-Edition	Artemis!Trojan
Trapmine	suspicious.low.ml.score
FireEye	Trojan.GenericKD.66061923
Emsisoft	Trojan.GenericKD.66061923 (B)
GData	Trojan.GenericKD.66061923
Webroot	W32.Trojan.Gen
Avira	TR/Redcap.conqm
MAX	malware (ai score=84)
Antiy-AVL	Trojan/Win32.Wacatac
Gridinsoft	Ransom.Win32.Wacatac.sa
Arcabit	Trojan.Generic.D3F00663
Microsoft	Trojan:Win32/Casdet!rfn
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5400092
McAfee	Artemis!571CE7DE07A8
VBA32	BScope.TrojanPSW.Reline
TrendMicro-HouseCall	TROJ_GEN.R002H0CCO23
Rising	Trojan.Generic@AI.88 (RDML:kdfxKy/kwtJ7jz6gyeYmgA)
Ikarus	Trojan.MSIL.Spy
Fortinet	W32/PossibleThreat
BitDefenderTheta	Gen:NN.ZexaE.36344.nuW@a4aw2ffi
AVG	Win32:Trojan-gen
Panda	Trj/Chgt.AD

97.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All