Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	May 11, 2024, 7:29 p.m.	May 11, 2024, 7:46 p.m.

Size	819.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`36166d066eca6b22121c54d5ced2b51c`
SHA256	`8ab3fd118f9c8b251b57af13530f3453e1be5a75ee258f51d31b5d49346f1d31`
CRC32	`EEE13895`
ssdeep	`24576:JfnYNSoeuTPZAX/LZN6gJEEEEEEEEEEEEEEEEEEEE:JMuVEEEEEEEEEEEEEEEEEEEE`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature DllRegisterServer_Zero - execute regsvr32.exe IsPE32 - (no description) mzp_file_format - MZP(Delphi) file format UPX_Zero - UPX packed file

hjv.exe "C:\Users\test22\AppData\Local\Temp\hjv.exe"
1932

Name	Response	Post-Analysis Lookup
onedrive.live.com	CNAME odc-web-geo.onedrive.akadns.net CNAME odwebpl.trafficmanager.net.dual-spov-0006.spov-msedge.net CNAME dual-spov-0006.spov-msedge.net CNAME web.fe.1drv.com CNAME odc-web-brs.onedrive.akadns.net A 13.107.139.11 A 13.107.137.11	13.107.139.11

IP Address	Status	Action
13.107.137.11	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49164 -> 13.107.137.11:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

No Suricata TLS

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.itext

The executable uses a known packer (1 event)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ May 11, 2024, 7:29 p.m.	stacktrace: hjv+0x5a76e @ 0x45a76e hjv+0x442f @ 0x40442f hjv+0x4497 @ 0x404497 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: ed 81 fb 68 58 4d 56 75 07 c7 45 fc 01 00 00 00 exception.symbol: hjv+0x5950a exception.instruction: in eax, dx exception.module: hjv.exe exception.exception_code: 0xc0000096 exception.offset: 365834 exception.address: 0x45950a registers.esp: 1637124 registers.edi: 1638216 registers.eax: 1447909480 registers.ebp: 1637152 registers.edx: 22104 registers.ebx: 0 registers.esi: 4557478 registers.ecx: 10	1	0	0
__exception__ May 11, 2024, 7:29 p.m.	stacktrace: 0x2cf75fa 0x2cf762d 0x2cf7548 0x2cee408 0x2d0028d 0x2d07cec DriverCallback+0x4e waveOutOpen-0xa2e winmm+0x3af0 @ 0x73363af0 timeEndPeriod+0x54a timeKillEvent-0x57 winmm+0xa535 @ 0x7336a535 timeEndPeriod+0x449 timeKillEvent-0x158 winmm+0xa434 @ 0x7336a434 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 650502784 registers.edi: 1 registers.eax: 650502784 registers.ebp: 650502864 registers.edx: 0 registers.ebx: 650504588 registers.esi: 649377456 registers.ecx: 7	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 85 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00510000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 1385447420 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b3604 process_handle: 0xffffffff		3221225496
NtAllocateVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 region_size: 600002560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ce0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory May 11, 2024, 7:29 p.m.	process_identifier: 1932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 969572348 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d1e364 process_handle: 0xffffffff		3221225496

Disables proxy possibly for traffic interception (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExA May 11, 2024, 7:29 p.m.	key_handle: 0x000002cc regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) value: 0 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	1	0	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ May 11, 2024, 7:29 p.m.	stacktrace: hjv+0x5a76e @ 0x45a76e hjv+0x442f @ 0x40442f hjv+0x4497 @ 0x404497 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: ed 81 fb 68 58 4d 56 75 07 c7 45 fc 01 00 00 00 exception.symbol: hjv+0x5950a exception.instruction: in eax, dx exception.module: hjv.exe exception.exception_code: 0xc0000096 exception.offset: 365834 exception.address: 0x45950a registers.esp: 1637124 registers.edi: 1638216 registers.eax: 1447909480 registers.ebp: 1637152 registers.edx: 22104 registers.ebx: 0 registers.esi: 4557478 registers.ecx: 10	1	0	0

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Modiloader.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 99)
CAT-QuickHeal	Trojan.Strab
Skyhigh	BehavesLike.Win32.Infected.ch
VIPRE	Trojan.Generic.35844792
Sangfor	Downloader.Win32.Modiloader.V0e1
BitDefender	Trojan.Generic.35844792
Arcabit	Trojan.Generic.D222F2B8
VirIT	Trojan.Win32.Dwnldr.DZA
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/TrojanDownloader.ModiLoader.ACM
APEX	Malicious
McAfee	Artemis!36166D066ECA
Avast	Win32:RATX-gen [Trj]
Kaspersky	HEUR:Trojan.Win32.Strab.gen
MicroWorld-eScan	Trojan.Generic.35844792
Rising	Trojan.Generic@AI.94 (RDML:n/6o8xQkrMwjq3gtAMqHjA)
Emsisoft	Trojan.Generic.35844792 (B)
F-Secure	Trojan.TR/Redcap.cxvad
DrWeb	Trojan.DownLoader46.62650
TrendMicro	Backdoor.Win32.REMCOS.YXEEIZ
Trapmine	suspicious.low.ml.score
FireEye	Trojan.Generic.35844792
Sophos	Mal/Generic-S
Ikarus	Trojan-Spy.MetaStealer
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/Redcap.cxvad
MAX	malware (ai score=89)
Antiy-AVL	Trojan/Win32.Modiloader
Kingsoft	Win32.Trojan.Strab.gen
Microsoft	Trojan:Win32/Remcos.TAQ!MTB
ZoneAlarm	HEUR:Trojan.Win32.Strab.gen
GData	Trojan.Generic.35844792
Varist	W32/Agent.UUWW-8487
AhnLab-V3	Trojan/Win.RATX-gen.R647787
DeepInstinct	MALICIOUS
VBA32	BScope.Backdoor.RmRAT
Malwarebytes	Malware.AI.3968541537
TrendMicro-HouseCall	Backdoor.Win32.REMCOS.YXEEIZ
Tencent	Win32.Trojan.Strab.Tdkl
SentinelOne	Static AI - Suspicious PE
Fortinet	W32/ModiLoader.ABE!tr
AVG	Win32:RATX-gen [Trj]
Paloalto	generic.ml
alibabacloud	Trojan[downloader]:Win/ModiLoader.AWO

hjv.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All