Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 15, 2023, 7:15 p.m.	May 15, 2023, 7:18 p.m.

Size	1.6MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`a6b930401417a341092dbfd48399c92b`
SHA256	`d66694dbc5c5106beea74c21c818aa95b12e60f4f741e01f1b3a8111fc9ab5a5`
CRC32	`3F0BBFF7`
ssdeep	`24576:RHWmAFrsRiYuNbVpViVNuDjrcBkY7p+MT2fi8f7dOPQfUZtW9RZEnDkrBUFniAKt:+sR+TiangB7pjif9ZIiZEnDk0iAKZ3/`
Yara	UPX_Zero - UPX packed file mzp_file_format - MZP(Delphi) file format Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description)

DZVcjxP.exe "C:\Users\test22\AppData\Local\Temp\DZVcjxP.exe"
2552
- Engine.exe C:\Users\test22\AppData\Local\Temp\SETUP_28161\Engine.exe /TH_ID=_2556 /OriginExe="C:\Users\test22\AppData\Local\Temp\DZVcjxP.exe"
  2668
  - cmd.exe C:\Windows\system32\cmd.exe /c cmd < Dust
    2720
    - cmd.exe cmd
      2780
      - powershell.exe powershell get-process avastui
        2824

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (50 out of 58 events)

Time & API	Arguments	Status	Return
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 15, 2023, 7:16 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 15, 2023, 7:15 p.m.			0	0
IsDebuggerPresent May 15, 2023, 7:16 p.m.			0	0

Command line console output was observed (50 out of 386 events)

Time & API	Arguments	Status	Return
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: Microsoft Windows [Version 6.1.7601] console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: Copyright (c) 2009 Microsoft Corporation. All rights reserved. console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\um0cnqvt.3xx> console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: Set mzeLBGmdPvaeUckuoWZsqJKKSOVDBW=l console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\um0cnqvt.3xx> console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: JUreMlYMZzLLaKyf=DweHNZPJaSMLVOTQ console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: 'JUreMlYMZzLLaKyf' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\um0cnqvt.3xx> console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: zqsozXXjsHY=soIFhXUDIWVhzxakwtERUddyYolrt console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: 'zqsozXXjsHY' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\um0cnqvt.3xx> console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: vaRKwJtyIQYjxbtrPZ=MkjeutwRCHtNRnhACvJaIi console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: 'vaRKwJtyIQYjxbtrPZ' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\um0cnqvt.3xx> console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: vNTIVTqUalbappfKFqSBbDriNiXC=uGXEgQfhvyXCNMDzyrdhMr console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: 'vNTIVTqUalbappfKFqSBbDriNiXC' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\um0cnqvt.3xx> console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: QGnTKLUNWnhkDmOVz=vpUUZKRmNHtGgUrgiXPXFBCawrmAZ console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: 'QGnTKLUNWnhkDmOVz' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\um0cnqvt.3xx> console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: siXhfTnVHOwlYjIfpzofaQyvxUH=SVkdATdWJwEpPkdwVxDf console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: 'siXhfTnVHOwlYjIfpzofaQyvxUH' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\um0cnqvt.3xx> console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: LTysKBAeBSxjWeLDLKyVMGo=ZmuAtAZssSiwyZQsQUoopWToE console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: 'LTysKBAeBSxjWeLDLKyVMGo' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\um0cnqvt.3xx> console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: lKnxXtLfalcZXqTrVtV=bMTNySnqGeGXWGdgTXVedPG console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: 'lKnxXtLfalcZXqTrVtV' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\um0cnqvt.3xx> console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: Set WQWigywPhUqbRKgyGKJdEbrsJEpXpTzHyhQfVdLAqQ=i console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\um0cnqvt.3xx> console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: GSboIPcGyf=mMFnKVtGzA console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: 'GSboIPcGyf' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\um0cnqvt.3xx> console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: aDTZpfYpdNMwKQuw=zbMCPjsCdSwEWls console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: 'aDTZpfYpdNMwKQuw' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\um0cnqvt.3xx> console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: gAUgJGuHWZhMKUIDUOjV=QCdCvTbXFxDcAvfkMGMsyFQZE console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: 'gAUgJGuHWZhMKUIDUOjV' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\um0cnqvt.3xx> console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: clbJiXcNnYEMjMIJsFKslnasoo=DIlMsYFbhAVjFZNYsHqz console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: 'clbJiXcNnYEMjMIJsFKslnasoo' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\um0cnqvt.3xx> console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: IcglghHXRyBYbRthjhOHfcocaysbA=KoOAVjVBeK console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: 'IcglghHXRyBYbRthjhOHfcocaysbA' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\um0cnqvt.3xx> console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: AccxgioJKyxjMKhjTRpWlbQxapXWR=KkrJPqNqtXoOPWfW console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: 'AccxgioJKyxjMKhjTRpWlbQxapXWR' is not recognized as an internal or external command, operable program or batch file. console_handle: 0x0000000b	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: C:\Users\test22\AppData\Local\Temp\um0cnqvt.3xx> console_handle: 0x00000007	1	1
WriteConsoleW May 15, 2023, 7:16 p.m.	buffer: PIqeKSONeE=wtpkRaxpor console_handle: 0x00000007	1	1

Uses Windows APIs to generate a cryptographic key (47 events)

Time & API	Arguments	Status	Return
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a8e30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a93b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a93b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a93b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a95b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a95b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a95b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a95b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a95b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a95b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a8df0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a8df0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a8df0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a93b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a93b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a93b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a89f0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a93b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a93b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a93b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a93b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a93b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a93b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a93b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a9730 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a9730 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a9730 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a9730 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a9730 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a9730 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a9730 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a9730 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a9730 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a9730 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a9730 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a9730 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a9730 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a9730 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a9670 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a9670 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a9670 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a9670 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a9670 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a9670 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a9670 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a9670 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 15, 2023, 7:16 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003a9670 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 15, 2023, 7:16 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 event)

packer

BobSoft Mini Delphi -> BoB / BobSoft

Allocates read-write-execute memory (usually to unpack itself) (50 out of 137 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 15, 2023, 7:15 p.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x733c2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2668 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01dc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2668 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x733c2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 1179648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02940000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72331000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72332000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0271a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0272b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02727000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02712000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02725000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0271c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0272c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02713000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02714000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02715000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02716000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02717000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02718000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02719000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a81000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a82000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a83000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a84000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a85000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a86000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a87000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a88000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a89000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a8a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a8b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a8c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a8d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a8e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a8f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 15, 2023, 7:16 p.m.	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceW May 15, 2023, 7:16 p.m.	number_of_free_clusters: 3252404 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: C:\ total_number_of_clusters: 8362495	1	1	0
GetDiskFreeSpaceExW May 15, 2023, 7:16 p.m.	total_number_of_free_bytes: 0 free_bytes_available: 13321846784 root_path: C:\Users total_number_of_bytes: 34252779520	1	1	0

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\SETUP_28161\Engine.exe

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\um0cnqvt.3xx\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	powershell get-process avastui
cmdline	C:\Windows\system32\cmd.exe /c cmd < Dust

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\SETUP_28161\Engine.exe

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 15, 2023, 7:16 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

File has been identified by 28 AntiVirus engines on VirusTotal as malicious (28 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Agent.Y!c
McAfee	Artemis!A6B930401417
Malwarebytes	Malware.AI.2439934103
Sangfor	Trojan.Win32.Agent.Vr25
Elastic	malicious (moderate confidence)
ESET-NOD32	a variant of Win32/Packed.QSetup.AX suspicious
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Backdoor.Win32.Agent.myuofn
Avast	Win32:Malware-gen
F-Secure	Backdoor.BDS/Agent.yyruh
McAfee-GW-Edition	BehavesLike.Win32.Dropper.tc
Trapmine	malicious.high.ml.score
Sophos	Mal/Generic-S
Webroot	W32.Trojan.Gen
Avira	BDS/Agent.yyruh
Gridinsoft	Ransom.Win32.Wacatac.sa
Xcitium	Malware@#2h7ejnyi605z2
ZoneAlarm	Backdoor.Win32.Agent.myuofn
Microsoft	Trojan:Win32/Wacatac.B!ml
AhnLab-V3	Trojan/Win.Agent.C5424359
Cylance	unsafe
TrendMicro-HouseCall	TROJ_GEN.R002H0DEB23
Rising	Trojan.Generic@AI.86 (RDML:un+porPwAxjQmT0cY85Tdg)
Fortinet	W32/PossibleThreat
AVG	Win32:Malware-gen
DeepInstinct	MALICIOUS

DZVcjxP.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All