Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 20, 2023, 5:30 p.m.	June 20, 2023, 5:32 p.m.

Size	186.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`482df2c11dc09fe2bdafae64e2edec32`
SHA256	`1d6d41fb0bba9acdace2dcd8063da1ade5fae6696d2d34c403df7a352540b415`
CRC32	`34070E59`
ssdeep	`3072:cOhX0N7+f1J5GWp1icKAArDZz4N9GhbkrNEk1WhhOmt+g0RGTt2L5meWF7r:RhEN7+Jp0yN90QEJTOlgKGx2NmJFr`
PDB Path	wextract.pdb
Yara	UPX_Zero - UPX packed file Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet CAB_file_format - CAB archive file Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet IsPE32 - (no description)

ageelectronicie32.exe "C:\Users\test22\AppData\Local\Temp\ageelectronicie32.exe"
3008
- ageelectronic.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\ageelectronic.exe
  904
- ageelectronicc.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\ageelectronicc.exe
  2292

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA June 20, 2023, 5:30 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW June 20, 2023, 5:30 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (6 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent June 20, 2023, 5:30 p.m.			0	0
IsDebuggerPresent June 20, 2023, 5:30 p.m.			0	0
IsDebuggerPresent June 20, 2023, 5:30 p.m.			0	0
IsDebuggerPresent June 20, 2023, 5:30 p.m.			0	0
IsDebuggerPresent June 20, 2023, 5:30 p.m.			0	0
IsDebuggerPresent June 20, 2023, 5:30 p.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

wextract.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 20, 2023, 5:30 p.m.		1	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

AVI

Allocates read-write-execute memory (usually to unpack itself) (50 out of 63 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 3008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e71000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 3008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e12000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 904 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 904 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00860000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73172000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d8b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 904 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 904 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 904 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 904 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00515000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 904 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0051b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 904 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00517000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 904 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73cba000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 904 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00850000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c28000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 904 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73b01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef4ee3000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 2292 region_size: 2555904 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001f90000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 2292 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002180000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef317a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2a95000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2ae1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef317b000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 2292 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002200000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 2292 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002320000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2ae2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2ae2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2ae2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2ae2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2ae2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2ae2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2ae2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2ae2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2ae2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2ae2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2ae2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2ae4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2ae4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2ae4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 2292 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2ae4000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 2292 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 2292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 2292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 20, 2023, 5:30 p.m.	process_identifier: 2292 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 events)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceW June 20, 2023, 5:30 p.m.	number_of_free_clusters: 2227430 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1	0
GetDiskFreeSpaceW June 20, 2023, 5:30 p.m.	number_of_free_clusters: 2227430 sectors_per_cluster: 8 bytes_per_sector: 512 root_path: \ total_number_of_clusters: 8362495	1	1	0

Creates executable files on the filesystem (2 events)

file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\ageelectronicc.exe
file	C:\Users\test22\AppData\Local\Temp\IXP000.TMP\ageelectronic.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00026400', u'virtual_address': u'0x0000c000', u'entropy': 7.355545256826521, u'name': u'.rsrc', u'virtual_size': u'0x00027000'}

entropy

7.35554525683

description

A section with a high entropy has been found

entropy

0.824797843666

description

Overall entropy of this PE file is high

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0

reg_value

rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"

File has been identified by 34 AntiVirus engines on VirusTotal as malicious (34 events)

Elastic	malicious (high confidence)
Malwarebytes	Generic.Malware/Suspicious
Sangfor	Downloader.Win32.Agent.V5sj
Alibaba	Trojan:MSIL/Generic.d90efb12
K7GW	Trojan-Downloader ( 005a01891 )
VirIT	Trojan.Win32.MSIL_Heur.A
Cyren	W32/ABRisk.FJOW-2999
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/TrojanDownloader.Agent.OXE
Cynet	Malicious (score: 100)
APEX	Malicious
Kaspersky	UDS:Trojan-PSW.MSIL.Stealerc.gen
Avast	Win32:TrojanX-gen [Trj]
Tencent	Msil.Trojan-Downloader.Ader.Ymhl
F-Secure	Trojan.TR/Crypt.XPACK.Gen7
TrendMicro	TrojanSpy.Win32.STEALC.YXDFTZ
McAfee-GW-Edition	BehavesLike.Win32.AgentTesla.cc
Sophos	Mal/Generic-S
Avira	TR/Crypt.XPACK.Gen7
Antiy-AVL	GrayWare/Win32.Wacapew
Gridinsoft	Trojan.Win32.Amadey.dg!se47453
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	UDS:Trojan-PSW.Win32.Stealerc.acm
GData	Win32.Trojan.Agent.4OTW1M
Google	Detected
McAfee	Artemis!482DF2C11DC0
Cylance	unsafe
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TrojanSpy.Win32.STEALC.YXDFTZ
Rising	Downloader.Agent!8.B23 (CLOUD)
SentinelOne	Static AI - Suspicious SFX
Fortinet	MSIL/Agent.OXE!tr.dldr
AVG	Win32:TrojanX-gen [Trj]
DeepInstinct	MALICIOUS

ageelectronicie32.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All