Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 17, 2024, 10:10 p.m.	Aug. 17, 2024, 10:34 p.m.

Size	82.5KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`b9a842469a9ef4ad634afd464133d43b`
SHA256	`5bb165dfb9bd16e63a3ac437506b3ae5db3d7932b2ad752ec0ba6d7dbd1dde6e`
CRC32	`12131507`
ssdeep	`1536:JRrnxLh5fU5qkLfxcc/lSJfQn+vFk1DQQvZ:zrnL2RLfSmlSPUDQQR`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE32 - (no description) UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\d204.dll,DeleteFolder
2172
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\d204.dll,Delete
1720
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\d204.dll,IsEnable
2268
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\d204.dll,IsExist
2356
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\d204.dll,IsTaskValid
2452
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\d204.dll,Run
2544
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\d204.dll,SetEnable
2648
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\d204.dll,Task
2752
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\d204.dll,
2844

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (8 events)

Time & API	Arguments	Status	Return
GetComputerNameW Aug. 17, 2024, 10:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 17, 2024, 10:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 17, 2024, 10:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 17, 2024, 10:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 17, 2024, 10:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 17, 2024, 10:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 17, 2024, 10:10 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Aug. 17, 2024, 10:10 p.m.	computer_name: TEST22-PC	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Aug. 17, 2024, 10:10 p.m.		1	1	0

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ Aug. 17, 2024, 10:10 p.m.	stacktrace: SetEnable+0x413 d204+0x18e3 @ 0x744d18e3 SetEnable+0x9d8 d204+0x1ea8 @ 0x744d1ea8 Task+0x19 IsExist-0x17 d204+0x1469 @ 0x744d1469 rundll32+0x137d @ 0x9c137d rundll32+0x1326 @ 0x9c1326 rundll32+0x1901 @ 0x9c1901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 8a 08 40 84 c9 75 f9 2b c2 c7 45 fc fe ff ff ff exception.symbol: lstrlen+0x1a lstrcmpW-0x3f kernelbase+0xa34a exception.instruction: mov cl, byte ptr [eax] exception.module: KERNELBASE.dll exception.exception_code: 0xc0000005 exception.offset: 41802 exception.address: 0x7559a34a registers.esp: 2488548 registers.edi: 2488840 registers.eax: 1 registers.ebp: 2488588 registers.edx: 2 registers.ebx: 0 registers.esi: 1 registers.ecx: 3	1	0	0
__exception__ Aug. 17, 2024, 10:10 p.m.	stacktrace: MultiByteToWideChar+0x8d WideCharToMultiByte-0x672 kernelbase+0x2f395 @ 0x755bf395 SetEnable+0x499 d204+0x1969 @ 0x744d1969 SetEnable+0x9d8 d204+0x1ea8 @ 0x744d1ea8 Task+0x19 IsExist-0x17 d204+0x1469 @ 0x744d1469 rundll32+0x137d @ 0x9c137d rundll32+0x1326 @ 0x9c1326 rundll32+0x1901 @ 0x9c1901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: 38 06 74 04 46 4a 75 f8 85 d2 75 05 b8 57 00 07 exception.symbol: LCMapStringEx+0x17d GetACP-0x28 kernelbase+0x2da23 exception.instruction: cmp byte ptr [esi], al exception.module: KERNELBASE.dll exception.exception_code: 0xc0000005 exception.offset: 186915 exception.address: 0x755bda23 registers.esp: 2488480 registers.edi: 2488532 registers.eax: 0 registers.ebp: 2488492 registers.edx: 2147483647 registers.ebx: 0 registers.esi: 1 registers.ecx: 2147483647	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (48 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 1720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744df000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 1720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 1720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 1720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 1720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74460000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 1720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744df000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74460000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2172 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744df000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74460000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2268 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744df000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74460000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2356 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2452 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744df000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2452 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2452 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2452 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2452 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74460000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2452 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744df000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743e0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744df000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74460000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744df000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743e0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 17, 2024, 10:10 p.m.	process_identifier: 2752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Skyhigh	RDN/Generic Downloader.x
McAfee	RDN/Generic Downloader.x
Cylance	Unsafe
VIPRE	Gen:Variant.Zusy.539056
Sangfor	Downloader.Win32.Zusy.V5fd
K7AntiVirus	Trojan-Downloader ( 005b08871 )
BitDefender	Gen:Variant.Zusy.539056
K7GW	Trojan-Downloader ( 005b08871 )
Arcabit	Trojan.Zusy.D839B0
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/TrojanDownloader.Agent.HLJ
APEX	Malicious
Avast	Win32:TrojanX-gen [Trj]
Alibaba	TrojanDownloader:Win32/DownLdr.16cf7945
MicroWorld-eScan	Gen:Variant.Zusy.539056
Rising	Downloader.Agent!8.B23 (TFE:6:EYixwlG4JKF)
Emsisoft	Gen:Variant.Zusy.539056 (B)
F-Secure	Trojan.TR/Dldr.Agent.ntqft
Zillya	Downloader.Agent.Win32.552608
TrendMicro	TROJ_GEN.R06CC0PED24
McAfeeD	ti!5BB165DFB9BD
FireEye	Generic.mg.b9a842469a9ef4ad
Sophos	Mal/Generic-R
Google	Detected
Avira	TR/Dldr.Agent.ntqft
MAX	malware (ai score=83)
Antiy-AVL	Trojan/Win32.Wacatac
Kingsoft	malware.kb.a.993
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Gen:Variant.Zusy.539056
Varist	W32/ABDownloader.QPNA-5910
AhnLab-V3	Adware/Win.DropperX-gen.R632765
BitDefenderTheta	Gen:NN.ZedlaF.36810.fu4@aKF!TPdi
DeepInstinct	MALICIOUS
Ikarus	Trojan-Downloader.Win32.Agent
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R06CC0PED24
Tencent	Win32.Trojan-Downloader.Oader.Gajl
huorong	TrojanDownloader/Agent.awv
Fortinet	W32/Agent.HLJ!tr.dldr
AVG	Win32:TrojanX-gen [Trj]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_70% (W)
alibabacloud	Trojan[downloader]:Win/Zusy

d204.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All