# files

firstSeen: 2024-11-29 04:57:47
ssz: 5 Mb
fname: 0405cfea2bb9f26c66efb9c5e3a5aaad
vt: Scan finished
hash: 0405cfea2bb9f26c66efb9c5e3a5aaad
date: 2024-11-29 04:57:47
compiled: Thu, Sep 12 2024, 9:08:14 - 32 Bit DLL
epSectIndex: 6
sects: .text, .rdata, .data, .%?., .%-[, .mo:, .reloc, .rsrc
die: PE: protector: VMProtect(2.X)[-] PE: linker: Microsoft Linker(14.39)[DLL32,signed]
exports: @1 MyUnregisterServer
resNames: 381 \24\2\1033
imphash: c60ea44c29fb9958cdca44c6933240cf
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 442944
epSect: .mo:
details:
APEX                Malicious
AVG                 Win32:MalwareX-gen [Trj]
AhnLab-V3           Trojan/Win.Redcap.R672916
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Avast               Win32:MalwareX-gen [Trj]
Avira               TR/Redcap.vdzex
Bkav                W32.AIDetectMalware
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.BB suspicious
Elastic             malicious (high confidence)
F-Secure            Trojan.TR/Redcap.vdzex
FireEye             Generic.mg.0405cfea2bb9f26c
Fortinet            Riskware/Application
Google              Detected
Gridinsoft          Trojan.Heur!.022120A0
K7AntiVirus         Trojan ( 0059f0351 )
K7GW                Trojan ( 0059f0351 )
Kaspersky           HEUR:Trojan.Win32.TbMA.gen
Malwarebytes        Trojan.MalPack.PES
McAfeeD             Real Protect-LS!0405CFEA2BB9
Microsoft           Trojan:Win32/Redcap.GNZ!MTB
Panda               Trj/Genetic.gen
Rising              Trojan.TbMA!8.E459 (RDMK:cmRtazr/US+AhfL+Fb3vVxQNlPWS)
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.BumbleBee.rc
Symantec            ML.Attribute.HighConfidence
TACHYON             Trojan/W32.Agent.4858192
Tencent             Backdoor.Win64.Runshell_l.16001403
VBA32               BScope.TrojanPSW.Stealer
Varist              W32/Trojan.CZEC-4507
Webroot             Win.Trojan.Gen
Yandex              Riskware.VMProtect!U0btQzBGNZ8
Zillya              Trojan.VMProtect.Win32.100032



firstSeen: 2024-11-29 04:28:49
ssz: 6 Mb
fname: 0455e16ca4c57286413c5f65f4c905c8
vt: Scan finished
hash: 0455e16ca4c57286413c5f65f4c905c8
date: 2024-11-29 04:28:49
compiled: Fri, Dec 11 2009, 21:31:37 - 32 Bit EXE
epSectIndex: 7
sects: .text, .rdata, .data, .CbOb, .`o$, .Y<i, .VCF
die: PE: linker: Microsoft Linker(6.0)[EXE32]
imphash: 4f2901c0f26912f101d33992f03f2ab2
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 3AD86F
epSect: .VCF
details:
ALYac               Gen:Variant.Zusy.540547
APEX                Malicious
AVG                 Win32:Evo-gen [Trj]
AhnLab-V3           Trojan/Win.Generic.R640388
Antiy-AVL           GrayWare/Win32.Wacapew
Arcabit             Trojan.Zusy.D83F83
Avast               Win32:Evo-gen [Trj]
Avira               TR/AVI.Evo.asmzk
BitDefender         Gen:Variant.Zusy.540547
Bkav                W32.AIDetectMalware
CTX                 exe.unknown.zusy
ClamAV              Win.Packed.Kelios-10023944-0
CrowdStrike         win/malicious_confidence_100% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Trojan.Siggen30.9774
ESET-NOD32          a variant of Win32/Packed.VMProtect.AU suspicious
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Zusy.540547 (B)
F-Secure            Trojan.TR/AVI.Evo.asmzk
FireEye             Generic.mg.0455e16ca4c57286
Fortinet            Riskware/Application
GData               Gen:Variant.Zusy.540547
Google              Detected
Gridinsoft          Trojan.Heur!.022120A1
Ikarus              PUA.VMProtect
Jiangmin            TrojanClicker.Cycler.bxn
K7AntiVirus         Trojan ( 0059f3ce1 )
K7GW                Trojan ( 0059f3ce1 )
Kaspersky           Trojan-Clicker.Win32.Cycler.bens
Kingsoft            Win32.HeurC.KVMH008.a
Malwarebytes        Malware.AI.221908809
MaxSecure           Trojan.Malware.300983.susgen
McAfeeD             Real Protect-LS!0455E16CA4C5
MicroWorld-eScan    Gen:Variant.Zusy.540547
Microsoft           Trojan:Win32/PrivateLoader.RC!MTB
NANO-Antivirus      Trojan.Win32.TrjGen.kktpho
Panda               Trj/Genetic.gen
Rising              Trojan.Clicker!8.1972 (TFE:3:hexVX6EEAWG)
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.tc
Sophos              Mal/Generic-S
Symantec            ML.Attribute.HighConfidence
Tencent             Malware.Win32.Gencirc.10bfc6e1
Trapmine            malicious.high.ml.score
VBA32               BScope.TrojanPSW.Coins
VIPRE               Gen:Variant.Zusy.540547
Varist              W32/Unruy.N.gen!Eldorado
Yandex              Riskware.VMProtect!fYDaETDRrmU
Zillya              Trojan.Cycler.Win32.2464
Zoner               Probably Heur.ExeHeaderL



firstSeen: 2024-01-24 09:40:29
ssz: 11 Mb
fname: 04668b31aca1fe6838392508633a17f2
vt: Scan finished
hash: 04668b31aca1fe6838392508633a17f2
date: 2024-08-10 11:07:12
compiled: Thu, Jan 4 2024, 3:42:34 - 32 Bit EXE
epSectIndex: 6
sects: .text, .rdata, .data, .e'?, .>C!, .p^i, .reloc, .rsrc
imphash: 153123d4040bc35e11708d0e085325d5
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: DC0633
epSect: .p^i
details:
AVG                 Win32:MalwareX-gen [Trj]
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Avast               Win32:MalwareX-gen [Trj]
Bkav                W32.AIDetectMalware
Cylance             Unsafe
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.AU suspicious
Fortinet            Riskware/Application
Gridinsoft          Trojan.Win32.Packed.cl
Malwarebytes        Malware.AI.4243824325
McAfee              Artemis!04668B31ACA1
McAfeeD             ti!CA20BDDFE09E
Sangfor             Trojan.Win32.Agent.V7ed
Skyhigh             BehavesLike.Win32.Generic.vc
alibabacloud        VirTool:Win/Packed.VMProtect.AU


die:
PE: protector: VMProtect(2.X)[-]
	    PE: library: Qt(5.X)[-]
	    PE: linker: Microsoft Linker(14.36)[EXE32]

exports:
@1 ??4PageFormat@@QAEAAV0@$$QAV0@@Z
@2 ??4PageFormat@@QAEAAV0@ABV0@@Z
@3 ??4Redaction@@QAEAAV0@ABV0@@Z

resNames:
296     \ICON\1\1033
744     \ICON\2\1033
1640    \ICON\3\1033
1384    \ICON\4\1033
2216    \ICON\5\1033
3752    \ICON\6\1033
1128    \ICON\7\1033
4264    \ICON\8\1033
9640    \ICON\9\1033
16936   \ICON\10\1033
67624   \ICON\11\1033
55108   \ICON\12\1033
174     \GROUP_ICON\IDI_ICON1\1033
864     \VERSION\1\1033
1225    \24\1\1033


firstSeen: 2024-11-29 06:03:00
ssz: 6 Mb
fname: 08f04fb2ca932e90a200e5d4b77a02fe
vt: Scan finished
hash: 08f04fb2ca932e90a200e5d4b77a02fe
date: 2024-11-29 06:03:00
compiled: Fri, Dec 11 2009, 21:31:37 - 32 Bit EXE
epSectIndex: 6
sects: .text, .rdata, .data, .7]D, .K<', .TEs
die: PE: linker: Microsoft Linker(6.0)[EXE32]
imphash: 4f2901c0f26912f101d33992f03f2ab2
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 46EDA1
epSect: .TEs
details:
APEX                Malicious
AVG                 Win32:TrojanX-gen [Trj]
AhnLab-V3           Trojan/Win.Generic.R651028
Antiy-AVL           Trojan/Win32.Agent
Arcabit             Trojan.Kelios.1
Avast               Win32:TrojanX-gen [Trj]
Avira               TR/Crypt.XPACK.Gen
BitDefender         Gen:Heur.Kelios.1
Bkav                W32.AIDetectMalware
CTX                 exe.unknown.kelios
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.AU suspicious
Elastic             malicious (high confidence)
Emsisoft            Gen:Heur.Kelios.1 (B)
F-Secure            Trojan.TR/Crypt.XPACK.Gen
FireEye             Generic.mg.08f04fb2ca932e90
Fortinet            Riskware/Application
GData               Win32.Trojan.PSE.17WGX8P
Google              Detected
Gridinsoft          Trojan.Heur!.022120A1
Ikarus              PUA.VMProtect
Jiangmin            TrojanClicker.Cycler.bxl
K7AntiVirus         Trojan ( 0059f3ce1 )
K7GW                Trojan ( 0059f3ce1 )
Kingsoft            malware.kb.b.988
Malwarebytes        Malware.AI.4246046164
MaxSecure           Trojan.Malware.300983.susgen
McAfee              GenericRXWP-FP!08F04FB2CA93
McAfeeD             Real Protect-LS!08F04FB2CA93
MicroWorld-eScan    Gen:Heur.Kelios.1
Microsoft           Trojan:Win32/PrivateLoader.RC!MTB
NANO-Antivirus      Trojan.Win32.Kelios.kktppb
Panda               Trj/Genetic.gen
Rising              Trojan.Kryptik@AI.96 (RDML:+zWbD0gC0yKi4tKacb8oYg)
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.vc
Sophos              Generic ML PUA (PUA)
Symantec            ML.Attribute.HighConfidence
Tencent             Malware.Win32.Gencirc.10bfc551
Trapmine            malicious.high.ml.score
VBA32               BScope.TrojanPSW.Coins
VIPRE               Gen:Heur.Kelios.1
Varist              W32/Unruy.N.gen!Eldorado
Yandex              Riskware.VMProtect!OCZ3pd+HDXY
Zillya              Trojan.Cycler.Win32.2459
Zoner               Probably Heur.ExeHeaderL
tehtris             Generic.Malware



firstSeen: 2024-11-28 06:47:04
ssz: 6 Mb
fname: 0c58077adcf77043661e98b25ee3d4ae
vt: Scan finished
hash: 0c58077adcf77043661e98b25ee3d4ae
date: 2024-11-29 03:02:40
compiled: Sat, May 6 2017, 16:04:14 - 32 Bit EXE
epSectIndex: 8
sects: .text, .rdata, .data, .8 ,, .htext, .yeJ, .G{L, .J=T, .rsrc
die: PE: library: MFC(4.2)[-] PE: linker: Microsoft Linker(6.0)[EXE32]
imphash: 7e87a01ac42028a7dfe4775bb51d9c2e
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 537848
epSect: .J=T
details:
ALYac               Gen:Variant.Lazy.494320
APEX                Malicious
AVG                 Win32:Evo-gen [Trj]
AhnLab-V3           Trojan/Win.Nitol.R638630
Alibaba             DDoS:Win32/Nitol.e3e2d75b
Antiy-AVL           Trojan[Packed]/Win32.VMProtect.au
Arcabit             Trojan.Lazy.D78AF0
Avast               Win32:Evo-gen [Trj]
Avira               TR/Crypt.XPACK.Gen
BitDefender         Gen:Variant.Lazy.494320
Bkav                W32.AIDetectMalware
CTX                 exe.trojan.nitol
ClamAV              Win.Packed.Vmprotect-10023863-0
CrowdStrike         win/malicious_confidence_100% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Trojan.Siggen30.11365
ESET-NOD32          a variant of Win32/Packed.VMProtect.AU suspicious
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Lazy.494320 (B)
F-Secure            Trojan.TR/Crypt.XPACK.Gen
FireEye             Generic.mg.0c58077adcf77043
Fortinet            Riskware/Application
GData               Gen:Variant.Lazy.494320
Google              Detected
Gridinsoft          Malware.Win32.Nitol.st!n
Ikarus              PUA.VMProtect
Jiangmin            Backdoor.Farfli.hoq
K7AntiVirus         Trojan ( 0059f3ce1 )
K7GW                Trojan ( 0059f3ce1 )
Kaspersky           UDS:Backdoor.Win32.Farfli.cweh
Kingsoft            malware.kb.b.963
Lionic              Trojan.Win32.Nitol.4!c
Malwarebytes        Generic.Malware.AI.DDS
McAfee              Artemis!0C58077ADCF7
McAfeeD             Real Protect-LS!0C58077ADCF7
MicroWorld-eScan    Gen:Variant.Lazy.494320
Microsoft           DDoS:Win32/Nitol!pz
NANO-Antivirus      Trojan.Win32.TrjGen.kkoomr
Paloalto            generic.ml
Panda               Trj/Genetic.gen
Rising              Trojan.Nitol!8.14C6 (TFE:4:CVryPQRwE0E)
Sangfor             Trojan.Win32.Save.a
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.tc
Sophos              Mal/Generic-S
Symantec            ML.Attribute.HighConfidence
TACHYON             Trojan/W32.Agent.6182714
Tencent             Malware.Win32.Gencirc.10bfc093
Trapmine            malicious.high.ml.score
VBA32               BScope.TrojanPSW.Coins
VIPRE               Gen:Variant.Lazy.494320
Varist              W32/VMProtBad.BC.gen!Eldorado
ViRobot             Trojan.Win.Z.Vmprotect.6182714.A
Webroot             W32.Malware.gen
Yandex              Riskware.VMProtect!+YH7Wl4kKzo
Zillya              Backdoor.Farfli.Win32.15999
alibabacloud        DDoS:Win/Nitol.Gen
tehtris             Generic.Malware


resNames:
744     \ICON\1\2052
296     \ICON\2\2052
6156    \ICON\3\2052
744     \ICON\4\2052
296     \ICON\5\2052
3752    \ICON\6\2052
48      \GROUP_ICON\108\2052
48      \GROUP_ICON\128\2052
960     \VERSION\1\1033

fileProps:
CompanyName      Hello World
FileDescription  Clien Local RunProcess
FileVersion      10.0.14393.0 (rs1_release.160715-1616)
InternalName     hello.exe
LegalCopyright   All rights reserved.
OriginalFilename Hello World
ProductName      Hello World® Operating System
ProductVersion   17.000.14393.08


firstSeen: 2024-11-29 01:00:34
ssz: 4 Mb
fname: 0fdd729b49ac9f448c8e8b9eb85bc42a
vt: Scan finished
hash: 0fdd729b49ac9f448c8e8b9eb85bc42a
date: 2024-11-29 01:00:34
compiled: Sun, Aug 1 2010, 10:32:37 - 32 Bit EXE
epSectIndex: 4
sects: ., ., .lol 0, .lol 1, .
die: PE: packer: MPRESS(-)[-] PE: linker: unknown(2.50)[EXE32]
resNames: 611 \24\1\1033
imphash: 65b6862e9898b195f4ef7a1685fd82dd
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 15CB7
epSect: .lol 1
details:
ALYac               GenPack:Trojan.Agent.EXMP
APEX                Malicious
AVG                 Win32:MalwareX-gen [Trj]
Antiy-AVL           GrayWare/Win32.Ausiv.a
Arcabit             GenPack:Trojan.Agent.EXMP
Avast               Win32:MalwareX-gen [Trj]
Avira               TR/Black.Gen2
BitDefender         GenPack:Trojan.Agent.EXMP
Bkav                W32.AIDetectMalware
CAT-QuickHeal       W32.Sivis.V5
CTX                 exe.trojan.exmp
ClamAV              Win.Trojan.Generic-9933070-0
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Win32.HLLP.Siggen.53
ESET-NOD32          a variant of Win32/Ausiv.A
Elastic             malicious (high confidence)
Emsisoft            GenPack:Trojan.Agent.EXMP (B)
F-Secure            Trojan.TR/Black.Gen2
FireEye             Generic.mg.0fdd729b49ac9f44
Fortinet            W32/VMProtect.ACO!tr
GData               GenPack:Trojan.Agent.EXMP
Google              Detected
Gridinsoft          Trojan.Win32.Gen.bot!s4
Ikarus              wormWin32.AutoRun.Delf
Jiangmin            Trojan.Generic.bvcco
K7AntiVirus         Trojan ( 7000001c1 )
K7GW                Trojan ( 7000001c1 )
Kaspersky           HEUR:Trojan.Win32.Generic
Kingsoft            malware.kb.b.997
Malwarebytes        Generic.Malware.AI.DDS
MaxSecure           Trojan.WIN32.generickd.45914965
McAfee              GenericRXDR-HK!0FDD729B49AC
McAfeeD             Real Protect-LS!0FDD729B49AC
MicroWorld-eScan    GenPack:Trojan.Agent.EXMP
Microsoft           Trojan:Win32/Ausiv
Panda               Trj/Genetic.gen
Rising              Trojan.Ausiv!1.A52C (CLASSIC)
Sangfor             Worm.Win32.Save.a
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.rm
Sophos              Mal/VMProtBad-A
Symantec            W32.Suviapen
Tencent             Trojan.Win32.Ausiv.abc
Trapmine            malicious.high.ml.score
VBA32               Trojan.Ausiv
VIPRE               GenPack:Trojan.Agent.EXMP
Varist              W32/Ausiv.F.gen!Eldorado
VirIT               Trojan.Win32.Ausiv.A
Webroot             W32.Trojan.Gen
Xcitium             TrojWare.Win32.Ausiv.A@7gzgk5
Yandex              Trojan.GenAsa!wNuUW5HMkU4
Zillya              Trojan.Heur.Win32.10174
alibabacloud        Trojan:Win/Stone.A
huorong             Trojan/Obfuscated.dm
tehtris             Generic.Malware



firstSeen: 2024-11-29 16:18:08
ssz: 5 Mb
fname: 136bfbdea1894ca3d413e0e8d2416699
vt: Scan finished
hash: 136bfbdea1894ca3d413e0e8d2416699
date: 2024-11-29 16:18:08
compiled: Mon, Mar 18 2024, 10:34:12 - 32 Bit EXE
epSectIndex: 10
sects: .text, .data, .tls, .rdata, .idata, .didata, .edata, .S8t, .PwU, .Nx,, .rsrc
die: PE: linker: Turbo Linker(5.0)[EXE32]
exports: @1 __GetExceptDLLinfo @2 TMethodImplementationIntercept @3 ___CPPdebugHook @4 _Form1
imphash: 4976a671d056b9d0fe363a7fa19bcb31
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 144BC2B
epSect: .Nx,
details:
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Bkav                W32.AIDetectMalware
Cynet               Malicious (score: 100)
FireEye             Generic.mg.136bfbdea1894ca3
Gridinsoft          Trojan.Heur!.022D2021
Malwarebytes        Malware.AI.4286322715
SentinelOne         Static AI - Suspicious PE
Skyhigh             BehavesLike.Win32.Generic.rc
Sophos              Generic ML PUA (PUA)
Trapmine            suspicious.low.ml.score
Zillya              Trojan.VMProtect.Win32.92569



firstSeen: 2024-11-29 16:25:21
ssz: 2 Mb
fname: 1c85972b9aa48c66a6ce8c7a5c9801cc
vt: Scan finished
hash: 1c85972b9aa48c66a6ce8c7a5c9801cc
date: 2024-11-29 16:25:21
compiled: Tue, May 7 2024, 12:27:29 - 32 Bit EXE
epSectIndex: 6
sects: .text, .rdata, .data, .1Q[, .),E, .sc=, .reloc
die: PE: linker: Microsoft Linker(14.29)[EXE32]
imphash: 847bf44a6099ee7a9c215a232e218aab
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 1A9119
epSect: .sc=
details:
ALYac               Gen:Variant.Zusy.556634
APEX                Malicious
AVG                 Win32:KeyloggerX-gen [Trj]
AhnLab-V3           Trojan/Win.Generic.R647582
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Arcabit             Trojan.Zusy.D87E5A
Avast               Win32:KeyloggerX-gen [Trj]
Avira               HEUR/AGEN.1374848
BitDefender         Gen:Variant.Zusy.556634
Bkav                W32.AIDetectMalware
CTX                 exe.unknown.zusy
ClamAV              Win.Packed.C2xk-10031869-0
CrowdStrike         win/malicious_confidence_100% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.BC suspicious
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Zusy.556634 (B)
F-Secure            Heuristic.HEUR/AGEN.1374848
FireEye             Generic.mg.1c85972b9aa48c66
Fortinet            W32/Kryptik.HRTC!tr
GData               Win32.Trojan.PSE.1V4QVRM
Google              Detected
Gridinsoft          Trojan.Heur!.022120A1
Ikarus              PUA.VMProtect
Jiangmin            Trojan.Agent.ewwu
K7AntiVirus         Trojan ( 0059f91f1 )
K7GW                Trojan ( 0059f91f1 )
Kaspersky           Trojan.Win32.Agent2.mxh
Kingsoft            malware.kb.b.808
Malwarebytes        Malware.AI.1010088143
MaxSecure           Trojan.Malware.273686129.susgen
McAfeeD             Real Protect-LS!1C85972B9AA4
MicroWorld-eScan    Gen:Variant.Zusy.556634
Microsoft           Trojan:Win32/KeyLogger.ASL!MTB
NANO-Antivirus      Trojan.Win32.Redcap.koeegm
Panda               Trj/Genetic.gen
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.tc
Sophos              Generic ML PUA (PUA)
Symantec            ML.Attribute.HighConfidence
TACHYON             Trojan/W32.Agent.1589760.V
Tencent             Trojan.Win32.Agent.cby
Trapmine            malicious.high.ml.score
TrendMicro          TROJ_GEN.R03BC0DKG24
TrendMicro-HouseCallTROJ_GEN.R03BC0DKG24
VBA32               BScope.TrojanSpy.LClipper
VIPRE               Gen:Variant.Zusy.556634
Varist              W32/VMProtect.EC.gen!Eldorado
VirIT               Trojan.Win32.Genus.WDT
Webroot             W32.Trojan.Gen
Zillya              Trojan.VMProtect.Win32.93512
huorong             Trojan/Agent.bss



firstSeen: 2024-11-29 04:32:22
ssz: 6 Mb
fname: 1cb9c7b1b0f2a54cc08e3b44f1b2900c
vt: Scan finished
hash: 1cb9c7b1b0f2a54cc08e3b44f1b2900c
date: 2024-11-29 04:32:22
compiled: Fri, Dec 11 2009, 21:31:37 - 32 Bit EXE
epSectIndex: 7
sects: .text, .rdata, .data, .CbOb, .`o$, .Y<i, .VCF
die: PE: linker: Microsoft Linker(6.0)[EXE32]
imphash: 4f2901c0f26912f101d33992f03f2ab2
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 3AD86F
epSect: .VCF
details:
ALYac               Gen:Variant.Zusy.540547
APEX                Malicious
AhnLab-V3           Trojan/Win.Generic.R640388
Antiy-AVL           GrayWare/Win32.Wacapew
Arcabit             Trojan.Zusy.D83F83
BitDefender         Gen:Variant.Zusy.540547
Bkav                W32.AIDetectMalware
CTX                 exe.unknown.zusy
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.AU suspicious
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Zusy.540547 (B)
FireEye             Generic.mg.1cb9c7b1b0f2a54c
Fortinet            Riskware/Application
GData               Gen:Variant.Zusy.540547
Google              Detected
Gridinsoft          Trojan.Heur!.022120A1
Ikarus              PUA.VMProtect
Jiangmin            TrojanClicker.Cycler.bxn
K7AntiVirus         Trojan ( 0059f3ce1 )
K7GW                Trojan ( 0059f3ce1 )
Kingsoft            malware.kb.b.989
Malwarebytes        Malware.AI.221908809
McAfeeD             Real Protect-LS!1CB9C7B1B0F2
MicroWorld-eScan    Gen:Variant.Zusy.540547
Microsoft           Trojan:Win32/PrivateLoader.RC!MTB
NANO-Antivirus      Trojan.Win32.TrjGen.kktpho
Panda               Trj/Genetic.gen
Rising              Trojan.Clicker!8.1972 (TFE:3:hexVX6EEAWG)
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.tc
Sophos              Generic ML PUA (PUA)
Symantec            ML.Attribute.HighConfidence
Tencent             Malware.Win32.Gencirc.10bfc6e1
Trapmine            malicious.high.ml.score
VBA32               BScope.TrojanPSW.Coins
VIPRE               Gen:Variant.Zusy.540547
Varist              W32/Unruy.N.gen!Eldorado
Yandex              Riskware.VMProtect!fYDaETDRrmU
Zillya              Trojan.Cycler.Win32.2464
Zoner               Probably Heur.ExeHeaderL



firstSeen: 2024-11-29 04:47:57
ssz: 6 Mb
fname: 1dbd77a370a131bb5134bc9b51a2d13f
vt: Scan finished
hash: 1dbd77a370a131bb5134bc9b51a2d13f
date: 2024-11-29 04:47:57
compiled: Fri, Dec 11 2009, 21:31:37 - 32 Bit EXE
epSectIndex: 6
sects: .text, .rdata, .data, .7]D, .K<', .TEs
die: PE: linker: Microsoft Linker(6.0)[EXE32]
imphash: 4f2901c0f26912f101d33992f03f2ab2
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 46EDA1
epSect: .TEs
details:
APEX                Malicious
AVG                 Win32:TrojanX-gen [Trj]
AhnLab-V3           Trojan/Win.Generic.R651028
Antiy-AVL           Trojan/Win32.Agent
Arcabit             Trojan.Kelios.1
Avast               Win32:TrojanX-gen [Trj]
Avira               TR/Crypt.XPACK.Gen
BitDefender         Gen:Heur.Kelios.1
Bkav                W32.AIDetectMalware
CTX                 exe.unknown.kelios
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Trojan.MulDrop28.45647
ESET-NOD32          a variant of Win32/Packed.VMProtect.AU suspicious
Elastic             malicious (high confidence)
Emsisoft            Gen:Heur.Kelios.1 (B)
F-Secure            Trojan.TR/Crypt.XPACK.Gen
FireEye             Generic.mg.1dbd77a370a131bb
Fortinet            Riskware/Application
GData               Win32.Trojan.PSE.17WGX8P
Google              Detected
Gridinsoft          Trojan.Heur!.022120A1
Ikarus              PUA.VMProtect
Jiangmin            TrojanClicker.Cycler.bxl
K7AntiVirus         Trojan ( 0059f3ce1 )
K7GW                Trojan ( 0059f3ce1 )
Kaspersky           Trojan-Clicker.Win32.Cycler.beny
Kingsoft            Win32.HeurC.KVMH008.a
Malwarebytes        Malware.AI.4246046164
MaxSecure           Trojan.Malware.300983.susgen
McAfee              GenericRXWP-FP!1DBD77A370A1
McAfeeD             Real Protect-LS!1DBD77A370A1
MicroWorld-eScan    Gen:Heur.Kelios.1
Microsoft           Trojan:Win32/PrivateLoader.RC!MTB
NANO-Antivirus      Trojan.Win32.Kelios.kktppb
Panda               Trj/Genetic.gen
Rising              Trojan.Kryptik@AI.96 (RDML:+zWbD0gC0yKi4tKacb8oYg)
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.vc
Sophos              Generic ML PUA (PUA)
Symantec            ML.Attribute.HighConfidence
Tencent             Malware.Win32.Gencirc.10bfc551
Trapmine            malicious.high.ml.score
VBA32               BScope.TrojanPSW.Coins
VIPRE               Gen:Heur.Kelios.1
Varist              W32/Unruy.N.gen!Eldorado
Yandex              Riskware.VMProtect!OCZ3pd+HDXY
Zillya              Trojan.Cycler.Win32.2459
Zoner               Probably Heur.ExeHeaderL
tehtris             Generic.Malware



firstSeen: 2024-11-29 04:38:43
ssz: 4 Mb
fname: 204ac99c88965a893bf953f8e1e6aeca
vt: Scan finished
hash: 204ac99c88965a893bf953f8e1e6aeca
date: 2024-11-29 04:38:43
compiled: Sun, Nov 13 2011, 2:54:02 - 32 Bit EXE
epSectIndex: 1
sects: .text, .rdata, .data, .rsrc
die: PE: compiler: Microsoft Visual C/C++(6.0)[libcmt] PE: linker: Microsoft Linker(6.0)[EXE32]
imphash: 3c2815c82be1e401e611741af831ecb9
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 29FFD
epSect: .text
details:
ALYac               Gen:Variant.Doina.69145
APEX                Malicious
AVG                 Win32:Evo-gen [Trj]
AhnLab-V3           Unwanted/Win32.HackTool.R30464
Antiy-AVL           Trojan/Win32.Qhost
Arcabit             Trojan.Doina.D10E19
Avast               Win32:Evo-gen [Trj]
Avira               TR/ATRAPS.Gen
BitDefender         Gen:Variant.Doina.69145
Bkav                W32.AIDetectMalware
CAT-QuickHeal       Trojan.QhostPMF.S34341769
CTX                 exe.unknown.doina
ClamAV              Win.Packed.Vmprotect-9976168-0
CrowdStrike         win/malicious_confidence_90% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Trojan.Siggen4.15899
ESET-NOD32          multiple detections
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Doina.69145 (B)
F-Secure            Trojan.TR/ATRAPS.Gen
FireEye             Generic.mg.204ac99c88965a89
Fortinet            W32/Qhost.OAG!tr
GData               Gen:Variant.Doina.69145
Google              Detected
Gridinsoft          Ransom.Win32.Sabsik.oa!s1
Ikarus              Trojan.Win32.Spy2
Jiangmin            Trojan/Qhost.eid
K7AntiVirus         Trojan ( 005850dc1 )
K7GW                Trojan ( 005850dc1 )
Kaspersky           Trojan.Win32.Qhost.abnr
Malwarebytes        Generic.Malware.AI.DDS
McAfee              GenericRXTH-JG!204AC99C8896
McAfeeD             ti!A6D30CA6E9F6
MicroWorld-eScan    Gen:Variant.Doina.69145
Microsoft           Trojan:Win32/Sabsik.RD.A!ml
NANO-Antivirus      Trojan.Win32.Qhost.ccdhix
Panda               Generic Malware
Rising              Trojan.Undefined!8.1327C (RDMK:cmRtazqStipisDhXa/QPCUy12N4v)
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.rm
Sophos              Troj/Qhost-ER
Symantec            ML.Attribute.HighConfidence
Tencent             Trojan.Win32.Qhost.wa
Trapmine            malicious.moderate.ml.score
TrendMicro          TROJ_AGENT_014687.TOMB
TrendMicro-HouseCallTROJ_AGENT_014687.TOMB
VBA32               Trojan.Qhost
VIPRE               Gen:Variant.Doina.69145
Varist              W32/A-16388b05!Eldorado
ViRobot             Trojan.Win32.A.Qhost.4235264
Webroot             W32.Trojan.Gen
Xcitium             TrojWare.Win32.QHost.ABNR@4na2b4
Yandex              Trojan.GenAsa!VubRXkFIJ1k
Zillya              Trojan.Qhost.Win32.9034
huorong             TrojanDownloader/Agent.wf
tehtris             Generic.Malware


resNames:
308     \CURSOR\2\2052
2220    \CURSOR\3\2052
748     \CURSOR\4\2052
54506   \BITMAP\174\2052
2730    \BITMAP\191\2052
2730    \BITMAP\192\2052
744     \ICON\1\2052
576     \DIALOG\129\2052
20      \GROUP_CURSOR\193\2052
34      \GROUP_CURSOR\194\2052
20      \GROUP_ICON\176\2052
628     \VERSION\1\2052

fileProps:
CompanyName      CompanyName
FileDescription  FileDescription
FileVersion      FileVersion
InternalName     InternalName
LegalCopyright   LegalCopyright
OriginalFilename OriginalFileName
ProductName      ProductName
ProductVersion   ProductVersion

rich:
offset DanS:128
offset Rich:224
Size: 96
checkSum: 0xD2FC1406 Matches!

clearData: DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00{\x1C\x0C\x00\x02\x00\x00\x006&\x0B\x00\x0A\x00\x00\x00\x83\x1C\x0E\x00\x16\x00\x00\x006&\x0A\x00e\x00\x00\x00o\x1F\x0B\x00\x02\x00\x00\x00\x00\x00\x00\x00\x0D\x00\x00\x00b\x1F\x13\x00\x13\x00\x00\x00\x00\x00\x01\x00\xE7\x00\x00\x00\xE8\x1F\x0B\x00\x01\x00\x00\x00\xC7\x06\x06\x00\x01\x00\x00\x00

10 entries
--------------------------------------------------
Compiler: 7291
toolID: 12
Count: 2
toolName: AliasObj60
vsVer: Visual Studio 6 (06.00)

Compiler: 9782
toolID: 11
Count: 10
toolName: Utc12_CPP
vsVer: Visual Studio 6 (06.00)

Compiler: 7299
toolID: 14
Count: 22
toolName: Masm613
vsVer: Visual Studio 6 (06.00)

Compiler: 9782
toolID: 10
Count: 101
toolName: Utc12_C
vsVer: Visual Studio 6 (06.00)

Compiler: 8047
toolID: 11
Count: 2
toolName: Utc12_CPP
vsVer: Visual Studio 6 (06.00)

Compiler: 0
toolID: 0
Count: 13
toolName: 
vsVer: <unknown> (00.00)

Compiler: 8034
toolID: 19
Count: 19
toolName: Linker512
vsVer: <unknown> (00.00)

Compiler: 0
toolID: 1
Count: 231
toolName: Import0
vsVer: Visual Studio (00.00)

Compiler: 8168
toolID: 11
Count: 1
toolName: Utc12_CPP
vsVer: Visual Studio 6 (06.00)

Compiler: 1735
toolID: 6
Count: 1
toolName: Cvtres500
vsVer: Visual Studio 6 (06.00)


firstSeen: 2024-11-29 05:28:05
ssz: 2 Mb
fname: 20e6fbcaeaa84f6f645c68b29999da14
vt: Scan finished
hash: 20e6fbcaeaa84f6f645c68b29999da14
date: 2024-11-29 05:28:05
compiled: Sun, Sep 12 2021, 7:32:25 - 32 Bit EXE
epSectIndex: 6
sects: OsfjR, svy6ZM, iI1Ne, fG5gu, fG5g, fG5gu, 2wWmn
die: PE: compiler: Microsoft Visual C/C++(6.0)[-] PE: linker: Microsoft Linker(6.0)[EXE32]
resNames: 604 \VERSION\1\2052
imphash: 56701e66a09015019e446765d657c56d
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 103E98
epSect: fG5gu
details:
ALYac               Gen:Variant.Lazy.624471
APEX                Malicious
AVG                 Win32:MalwareX-gen [Trj]
AhnLab-V3           Trojan/Win.Generic.R665143
Antiy-AVL           Trojan[Packed]/Win32.Vemply
Arcabit             Trojan.Lazy.D98757
Avast               Win32:MalwareX-gen [Trj]
Avira               TR/Crypt.ZPACK.Gen
Baidu               Win32.Packed.VMProtect.a
BitDefender         Gen:Variant.Lazy.624471
Bkav                W32.AIDetectMalware
CAT-QuickHeal       Trojan.GenericRI.S23452157
CTX                 exe.unknown.lazy
ClamAV              Win.Dropper.Tiggre-9845940-0
CrowdStrike         win/malicious_confidence_100% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.ABD
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Lazy.624471 (B)
F-Secure            Trojan.TR/Crypt.ZPACK.Gen
FireEye             Generic.mg.20e6fbcaeaa84f6f
Fortinet            W32/VMProtect.ABD!tr
GData               Win32.Trojan-Stealer.BlackMoon.D
Google              Detected
Gridinsoft          Trojan.Heur!.032920A1
Ikarus              Trojan.Win32.VMProtect
Jiangmin            Packed.Vemply.jjn
K7AntiVirus         Trojan ( 7000001c1 )
K7GW                Trojan ( 7000001c1 )
Kaspersky           UDS:Packed.Win32.Vemply.gen
Malwarebytes        Generic.Malware.AI.DDS
MaxSecure           Trojan.Malware.300983.susgen
McAfeeD             Real Protect-LS!20E6FBCAEAA8
MicroWorld-eScan    Gen:Variant.Lazy.624471
Microsoft           Trojan:Win32/Zusy.EM!MTB
NANO-Antivirus      Trojan.Win32.Vemply.ktsjbp
Panda               Trj/Genetic.gen
Sangfor             Trojan.Win32.Save.BlackMoon
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.tc
Sophos              Mal/VMProtBad-A
Symantec            ML.Attribute.HighConfidence
Tencent             Packed.Win32.Vemply.he
Trapmine            malicious.high.ml.score
VBA32               BScope.Trojan.Dynamer
VIPRE               Gen:Variant.Lazy.624471
Varist              W32/Agent.JKA.gen!Eldorado
Zillya              Trojan.VMProtect.Win32.99252
huorong             Trojan/FakeAPP.s


fileProps:
FileDescription  ????????
FileVersion      1.0.2107.6
LegalCopyright   Tencent Limited.All Rights Reserved.
ProductName      ????????
ProductVersion   1.0.2107.6

rich:
offset DanS:128
offset Rich:216
Size: 88
checkSum: 0xCB928CDE Matches!

clearData: DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00{\x1C\x0C\x00\x01\x00\x00\x00\x83\x1C\x0E\x00\x18\x00\x00\x006&\x0A\x00\x89\x00\x00\x00\xE8\x1F\x0A\x00\x02\x00\x00\x00\x00\x00\x01\x00\x8B\x00\x00\x00\xC3\x0F]\x00\x0D\x00\x00\x006&\x0B\x00E\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\xE8\x1F\x0B\x00\x03\x00\x00\x00

9 entries
--------------------------------------------------
Compiler: 7291
toolID: 12
Count: 1
toolName: AliasObj60
vsVer: Visual Studio 6 (06.00)

Compiler: 7299
toolID: 14
Count: 24
toolName: Masm613
vsVer: Visual Studio 6 (06.00)

Compiler: 9782
toolID: 10
Count: 137
toolName: Utc12_C
vsVer: Visual Studio 6 (06.00)

Compiler: 8168
toolID: 10
Count: 2
toolName: Utc12_C
vsVer: Visual Studio 6 (06.00)

Compiler: 0
toolID: 1
Count: 139
toolName: Import0
vsVer: Visual Studio (00.00)

Compiler: 4035
toolID: 93
Count: 13
toolName: Implib710
vsVer: Visual Studio 2003 (07.10)

Compiler: 9782
toolID: 11
Count: 69
toolName: Utc12_CPP
vsVer: Visual Studio 6 (06.00)

Compiler: 0
toolID: 0
Count: 1
toolName: 
vsVer: <unknown> (00.00)

Compiler: 8168
toolID: 11
Count: 3
toolName: Utc12_CPP
vsVer: Visual Studio 6 (06.00)


firstSeen: 2024-10-10 08:37:32
ssz: 10 Mb
fname: 21f26636a39c0e60ab5053fbf82df5a9
vt: Scan finished
hash: 21f26636a39c0e60ab5053fbf82df5a9
date: 2024-11-10 23:15:15
compiled: Thu, Oct 10 2024, 8:26:38 - 32 Bit EXE
epSectIndex: 6
sects: .text, .rdata, .data, .+I2, .:c[, .^pb, .reloc, .rsrc
die: PE: protector: VMProtect(2.X)[-] PE: linker: Microsoft Linker(14.40)[EXE32,console,admin]
resNames: 270376 \ICON\1\1049 20 \GROUP_ICON\101\1049 392 \24\1\1033
imphash: 667e60fadf72a558c7f54b6a70617a89
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: D4DBB7
epSect: .^pb
details:
ALYac               Gen:Trojan.Heur.GM.0800520080
APEX                Malicious
AVG                 Win32:MalwareX-gen [Trj]
Alibaba             Packed:Win32/VMProtect.ec6762d2
Antiy-AVL           GrayWare/Win32.Wacapew
Arcabit             Trojan.Heur.GM.D2FB6F790
Avast               Win32:MalwareX-gen [Trj]
BitDefender         Gen:Trojan.Heur.GM.0800520080
Bkav                W32.Common.7A77DF67
CTX                 exe.trojan.vmprotect
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.BC suspicious
Elastic             malicious (high confidence)
Emsisoft            Gen:Trojan.Heur.GM.0800520080 (B)
FireEye             Generic.mg.21f26636a39c0e60
Fortinet            Riskware/Application
GData               Gen:Trojan.Heur.GM.0800520080
Google              Detected
Gridinsoft          Trojan.Heur!.022120A1
Ikarus              PUA.VMProtect
K7AntiVirus         Trojan ( 0059f2081 )
K7GW                Trojan ( 0059f2081 )
Kingsoft            Win32.HeurC.KVMH008.a
Lionic              Trojan.Win32.VMProtect.4!c
Malwarebytes        Malware.AI.4283781507
MaxSecure           Trojan.Malware.155205894.susgen
McAfee              Artemis!21F26636A39C
McAfeeD             Real Protect-LS!21F26636A39C
MicroWorld-eScan    Gen:Trojan.Heur.GM.0800520080
Microsoft           Program:Win32/Wacapew.C!ml
Paloalto            generic.ml
Rising              Trojan.Kryptik@AI.80 (RDML:hs1XkmrU3Ys5Y3wV8Y/nBw)
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.tc
Sophos              Mal/Generic-S
Symantec            ML.Attribute.HighConfidence
Trapmine            malicious.moderate.ml.score
TrendMicro-HouseCallTROJ_GEN.R002H09JA24
VIPRE               Gen:Trojan.Heur.GM.0800520080
Varist              W32/ABTrojan.XRRE-0864
Zillya              Trojan.VMProtect.Win32.99846
tehtris             Generic.Malware



firstSeen: 2024-11-29 05:02:28
ssz: 5 Mb
fname: 220f5c8d783b3d80000d373a9e1a9db0
vt: Scan finished
hash: 220f5c8d783b3d80000d373a9e1a9db0
date: 2024-11-29 05:02:28
compiled: Sun, Nov 13 2011, 3:05:27 - 32 Bit EXE
epSectIndex: 1
sects: .text, .rdata, .data, .text0, .text1, .rsrc
imphash: 3c2815c82be1e401e611741af831ecb9
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 29FFD
epSect: .text
details:
ALYac               Gen:Variant.Zusy.321922
APEX                Malicious
AVG                 Win32:Evo-gen [Trj]
Acronis             suspicious
AhnLab-V3           Unwanted/Win32.HackTool.R30464
Antiy-AVL           Trojan/Win32.Qhost
Arcabit             Trojan.Zusy.D4E982
Avast               Win32:Evo-gen [Trj]
Avira               TR/ATRAPS.Gen
BitDefender         Gen:Variant.Zusy.321922
Bkav                W32.AIDetectMalware
CAT-QuickHeal       Trojan.Qhost.7777
CTX                 exe.unknown.zusy
ClamAV              Win.Packed.Vmprotect-9976168-0
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Trojan.Siggen4.15899
ESET-NOD32          a variant of Win32/Packed.VMProtect.AAH
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Zusy.321922 (B)
F-Secure            Trojan.TR/ATRAPS.Gen
FireEye             Generic.mg.220f5c8d783b3d80
Fortinet            W32/Qhost.OAG!tr
GData               Gen:Variant.Zusy.321922
Google              Detected
Gridinsoft          Ransom.Win32.Wacatac.oa!s1
Ikarus              Trojan.Win32.Genome
Jiangmin            Trojan/Genome.bxbo
K7AntiVirus         Trojan ( 7000001c1 )
K7GW                Trojan ( 7000001c1 )
Kaspersky           Trojan.Win32.Qhost.abnk
Kingsoft            malware.kb.b.816
Malwarebytes        Generic.Malware.AI.DDS
McAfee              Trojan-FDXA!220F5C8D783B
McAfeeD             ti!D39EEEE97367
MicroWorld-eScan    Gen:Variant.Zusy.321922
Microsoft           VirTool:Win32/Obfuscator.XZ
NANO-Antivirus      Trojan.Win32.Qhost.cvdfkd
Rising              Trojan.Kryptik@AI.80 (RDML:2dfSX8kurNcRZwtiKhncjw)
Sangfor             Trojan.Win32.Save.a
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.th
Sophos              Troj/AutoG-EY
Symantec            ML.Attribute.HighConfidence
Tencent             Trojan-Packed.Win32.Vmprotect.ya
Trapmine            malicious.moderate.ml.score
TrendMicro          TROJ_AGENT_017657.TOMB
TrendMicro-HouseCallTROJ_AGENT_017657.TOMB
VBA32               TScope.Malware-Cryptor.SB
VIPRE               Gen:Variant.Zusy.321922
Varist              W32/S-2a66a243!Eldorado
ViRobot             Trojan.Win32.A.Qhost.5304320
Webroot             W32.Trojan.Gen
Yandex              Trojan.GenAsa!VubRXkFIJ1k
Zillya              Trojan.Qhost.Win32.9013
alibabacloud        Trojan:Win/Vmprotect.e19e3c28
huorong             TrojanDownloader/Agent.wf
tehtris             Generic.Malware


die:
PE: protector: VMProtect(-)[-]
	    PE: compiler: Microsoft Visual C/C++(6.0)[libcmt]
	    PE: linker: Microsoft Linker(6.0)[EXE32]

resNames:
308     \CURSOR\2\2052
2220    \CURSOR\3\2052
748     \CURSOR\4\2052
54506   \BITMAP\174\2052
2730    \BITMAP\191\2052
2730    \BITMAP\192\2052
744     \ICON\1\2052
576     \DIALOG\129\2052
20      \GROUP_CURSOR\193\2052
34      \GROUP_CURSOR\194\2052
20      \GROUP_ICON\176\2052
628     \VERSION\1\2052

fileProps:
CompanyName      CompanyName
FileDescription  FileDescription
FileVersion      FileVersion
InternalName     InternalName
LegalCopyright   LegalCopyright
OriginalFilename OriginalFileName
ProductName      ProductName
ProductVersion   ProductVersion

rich:
offset DanS:128
offset Rich:224
Size: 96
checkSum: 0xD2FC1406 Matches!

clearData: DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00{\x1C\x0C\x00\x02\x00\x00\x006&\x0B\x00\x0A\x00\x00\x00\x83\x1C\x0E\x00\x16\x00\x00\x006&\x0A\x00e\x00\x00\x00o\x1F\x0B\x00\x02\x00\x00\x00\x00\x00\x00\x00\x0D\x00\x00\x00b\x1F\x13\x00\x13\x00\x00\x00\x00\x00\x01\x00\xE7\x00\x00\x00\xE8\x1F\x0B\x00\x01\x00\x00\x00\xC7\x06\x06\x00\x01\x00\x00\x00

10 entries
--------------------------------------------------
Compiler: 7291
toolID: 12
Count: 2
toolName: AliasObj60
vsVer: Visual Studio 6 (06.00)

Compiler: 9782
toolID: 11
Count: 10
toolName: Utc12_CPP
vsVer: Visual Studio 6 (06.00)

Compiler: 7299
toolID: 14
Count: 22
toolName: Masm613
vsVer: Visual Studio 6 (06.00)

Compiler: 9782
toolID: 10
Count: 101
toolName: Utc12_C
vsVer: Visual Studio 6 (06.00)

Compiler: 8047
toolID: 11
Count: 2
toolName: Utc12_CPP
vsVer: Visual Studio 6 (06.00)

Compiler: 0
toolID: 0
Count: 13
toolName: 
vsVer: <unknown> (00.00)

Compiler: 8034
toolID: 19
Count: 19
toolName: Linker512
vsVer: <unknown> (00.00)

Compiler: 0
toolID: 1
Count: 231
toolName: Import0
vsVer: Visual Studio (00.00)

Compiler: 8168
toolID: 11
Count: 1
toolName: Utc12_CPP
vsVer: Visual Studio 6 (06.00)

Compiler: 1735
toolID: 6
Count: 1
toolName: Cvtres500
vsVer: Visual Studio 6 (06.00)


firstSeen: 2024-11-29 05:05:15
ssz: 5 Mb
fname: 24f575bdcbb8380a6c1aa951e549ada3
vt: Scan finished
hash: 24f575bdcbb8380a6c1aa951e549ada3
date: 2024-11-29 05:05:15
compiled: Sun, Nov 13 2011, 3:05:27 - 32 Bit EXE
epSectIndex: 1
sects: .text, .rdata, .data, .text0, .text1, .rsrc
imphash: 3c2815c82be1e401e611741af831ecb9
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 29FFD
epSect: .text
details:
ALYac               Gen:Variant.Zusy.321922
APEX                Malicious
AVG                 Win32:Evo-gen [Trj]
Acronis             suspicious
AhnLab-V3           Unwanted/Win32.HackTool.R30464
Antiy-AVL           Trojan/Win32.Qhost
Arcabit             Trojan.Zusy.D4E982
Avast               Win32:Evo-gen [Trj]
Avira               TR/ATRAPS.Gen
BitDefender         Gen:Variant.Zusy.321922
Bkav                W32.AIDetectMalware
CAT-QuickHeal       Trojan.Qhost.7777
CTX                 exe.unknown.zusy
ClamAV              Win.Packed.Vmprotect-9976168-0
CrowdStrike         win/malicious_confidence_100% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Trojan.Siggen4.15899
ESET-NOD32          a variant of Win32/Packed.VMProtect.AAH
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Zusy.321922 (B)
F-Secure            Trojan.TR/ATRAPS.Gen
FireEye             Generic.mg.24f575bdcbb8380a
Fortinet            W32/Qhost.OAG!tr
GData               Gen:Variant.Zusy.321922
Google              Detected
Gridinsoft          Ransom.Win32.Wacatac.oa!s1
Ikarus              Trojan.Win32.Genome
Jiangmin            Trojan/Genome.bxbo
K7AntiVirus         Trojan ( 7000001c1 )
K7GW                Trojan ( 7000001c1 )
Kaspersky           Trojan.Win32.Qhost.abnk
Kingsoft            malware.kb.b.816
Malwarebytes        Generic.Malware.AI.DDS
McAfee              Trojan-FDXA!24F575BDCBB8
McAfeeD             ti!0DE1B61E65C8
MicroWorld-eScan    Gen:Variant.Zusy.321922
Microsoft           VirTool:Win32/Obfuscator.XZ
NANO-Antivirus      Trojan.Win32.Qhost.cvdfkd
Rising              Trojan.Kryptik@AI.80 (RDML:2dfSX8kurNcRZwtiKhncjw)
Sangfor             Trojan.Win32.Save.a
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.th
Sophos              Troj/AutoG-EY
Symantec            ML.Attribute.HighConfidence
Tencent             Trojan-Packed.Win32.Vmprotect.ya
Trapmine            malicious.moderate.ml.score
TrendMicro          TROJ_AGENT_017657.TOMB
TrendMicro-HouseCallTROJ_AGENT_017657.TOMB
VBA32               TScope.Malware-Cryptor.SB
VIPRE               Gen:Variant.Zusy.321922
Varist              W32/S-2a66a243!Eldorado
ViRobot             Trojan.Win32.A.Qhost.5304320
Webroot             W32.Trojan.Gen
Yandex              Trojan.GenAsa!VubRXkFIJ1k
Zillya              Trojan.Qhost.Win32.9013
alibabacloud        Trojan:Win/Vmprotect.e19e3c28
huorong             TrojanDownloader/Agent.wf
tehtris             Generic.Malware


die:
PE: protector: VMProtect(-)[-]
	    PE: compiler: Microsoft Visual C/C++(6.0)[libcmt]
	    PE: linker: Microsoft Linker(6.0)[EXE32]

resNames:
308     \CURSOR\2\2052
2220    \CURSOR\3\2052
748     \CURSOR\4\2052
54506   \BITMAP\174\2052
2730    \BITMAP\191\2052
2730    \BITMAP\192\2052
744     \ICON\1\2052
576     \DIALOG\129\2052
20      \GROUP_CURSOR\193\2052
34      \GROUP_CURSOR\194\2052
20      \GROUP_ICON\176\2052
628     \VERSION\1\2052

fileProps:
CompanyName      CompanyName
FileDescription  FileDescription
FileVersion      FileVersion
InternalName     InternalName
LegalCopyright   LegalCopyright
OriginalFilename OriginalFileName
ProductName      ProductName
ProductVersion   ProductVersion

rich:
offset DanS:128
offset Rich:224
Size: 96
checkSum: 0xD2FC1406 Matches!

clearData: DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00{\x1C\x0C\x00\x02\x00\x00\x006&\x0B\x00\x0A\x00\x00\x00\x83\x1C\x0E\x00\x16\x00\x00\x006&\x0A\x00e\x00\x00\x00o\x1F\x0B\x00\x02\x00\x00\x00\x00\x00\x00\x00\x0D\x00\x00\x00b\x1F\x13\x00\x13\x00\x00\x00\x00\x00\x01\x00\xE7\x00\x00\x00\xE8\x1F\x0B\x00\x01\x00\x00\x00\xC7\x06\x06\x00\x01\x00\x00\x00

10 entries
--------------------------------------------------
Compiler: 7291
toolID: 12
Count: 2
toolName: AliasObj60
vsVer: Visual Studio 6 (06.00)

Compiler: 9782
toolID: 11
Count: 10
toolName: Utc12_CPP
vsVer: Visual Studio 6 (06.00)

Compiler: 7299
toolID: 14
Count: 22
toolName: Masm613
vsVer: Visual Studio 6 (06.00)

Compiler: 9782
toolID: 10
Count: 101
toolName: Utc12_C
vsVer: Visual Studio 6 (06.00)

Compiler: 8047
toolID: 11
Count: 2
toolName: Utc12_CPP
vsVer: Visual Studio 6 (06.00)

Compiler: 0
toolID: 0
Count: 13
toolName: 
vsVer: <unknown> (00.00)

Compiler: 8034
toolID: 19
Count: 19
toolName: Linker512
vsVer: <unknown> (00.00)

Compiler: 0
toolID: 1
Count: 231
toolName: Import0
vsVer: Visual Studio (00.00)

Compiler: 8168
toolID: 11
Count: 1
toolName: Utc12_CPP
vsVer: Visual Studio 6 (06.00)

Compiler: 1735
toolID: 6
Count: 1
toolName: Cvtres500
vsVer: Visual Studio 6 (06.00)


firstSeen: 2024-11-29 05:12:12
ssz: 6 Mb
fname: 255672b3a77857dd0c588d3082f3052c
vt: Scan finished
hash: 255672b3a77857dd0c588d3082f3052c
date: 2024-11-29 05:12:12
compiled: Fri, Dec 11 2009, 21:31:37 - 32 Bit EXE
epSectIndex: 6
sects: .text, .rdata, .data, .7]D, .K<', .TEs
die: PE: linker: Microsoft Linker(6.0)[EXE32]
imphash: 4f2901c0f26912f101d33992f03f2ab2
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 46EDA1
epSect: .TEs
details:
APEX                Malicious
AVG                 Win32:TrojanX-gen [Trj]
AhnLab-V3           Trojan/Win.Generic.R651028
Antiy-AVL           Trojan/Win32.Agent
Arcabit             Trojan.Kelios.1
Avast               Win32:TrojanX-gen [Trj]
Avira               TR/Crypt.XPACK.Gen
BitDefender         Gen:Heur.Kelios.1
Bkav                W32.AIDetectMalware
CTX                 exe.unknown.kelios
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Trojan.Siggen30.11109
ESET-NOD32          a variant of Win32/Packed.VMProtect.AU suspicious
Elastic             malicious (high confidence)
Emsisoft            Gen:Heur.Kelios.1 (B)
F-Secure            Trojan.TR/Crypt.XPACK.Gen
FireEye             Generic.mg.255672b3a77857dd
Fortinet            Riskware/Application
GData               Win32.Trojan.PSE.17WGX8P
Google              Detected
Gridinsoft          Trojan.Heur!.022120A1
Ikarus              PUA.VMProtect
Jiangmin            TrojanClicker.Cycler.bxl
K7AntiVirus         Trojan ( 0059f3ce1 )
K7GW                Trojan ( 0059f3ce1 )
Kaspersky           Trojan-Clicker.Win32.Cycler.benz
Kingsoft            Win32.HeurC.KVMH008.a
Malwarebytes        Malware.AI.4246046164
MaxSecure           Trojan.Malware.300983.susgen
McAfee              GenericRXWP-FP!255672B3A778
McAfeeD             Real Protect-LS!255672B3A778
MicroWorld-eScan    Gen:Heur.Kelios.1
Microsoft           Trojan:Win32/PrivateLoader.RC!MTB
NANO-Antivirus      Trojan.Win32.Kelios.kktppb
Panda               Trj/Genetic.gen
Rising              Trojan.Kryptik@AI.96 (RDML:+zWbD0gC0yKi4tKacb8oYg)
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.vc
Sophos              Generic ML PUA (PUA)
Symantec            ML.Attribute.HighConfidence
Tencent             Malware.Win32.Gencirc.10bfc551
Trapmine            malicious.high.ml.score
VBA32               BScope.TrojanPSW.Coins
VIPRE               Gen:Heur.Kelios.1
Varist              W32/Unruy.N.gen!Eldorado
Yandex              Riskware.VMProtect!OCZ3pd+HDXY
Zillya              Trojan.Cycler.Win32.2459
Zoner               Probably Heur.ExeHeaderL
tehtris             Generic.Malware



firstSeen: 2024-11-29 05:52:49
ssz: 3 Mb
fname: 25eac045cd790c7ec1ed37eed6735f30
vt: Scan finished
hash: 25eac045cd790c7ec1ed37eed6735f30
date: 2024-11-29 05:52:49
compiled: Tue, Oct 8 2024, 14:35:59 - 32 Bit EXE
epSectIndex: 6
sects: .text, .rdata, .data, .SHa, .-4`, .=q,, .rsrc
die: PE: linker: Microsoft Linker(14.24)[EXE32]
resNames: 381 \24\1\1033
imphash: c4150a1c2692f1546ad7236624824920
pever: DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 292670
epSect: .=q,
details:
ALYac               Trojan.GenericKD.74913835
APEX                Malicious
Arcabit             Trojan.Generic.D477182B
Avira               TR/Dldr.Deyma.zbxfz
BitDefender         Trojan.GenericKD.74913835
Bkav                W32.AIDetectMalware
CTX                 exe.trojan.generic
CrowdStrike         win/malicious_confidence_100% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Trojan.MulDrop28.46791
ESET-NOD32          a variant of Win32/Packed.VMProtect.BC suspicious
Elastic             malicious (high confidence)
Emsisoft            Trojan.GenericKD.74913835 (B)
F-Secure            Trojan.TR/Dldr.Deyma.zbxfz
FireEye             Generic.mg.25eac045cd790c7e
Fortinet            Riskware/Application
GData               Trojan.GenericKD.74913835
Gridinsoft          Trojan.Heur!.022120A1
K7GW                Hacktool ( 700007861 )
Kaspersky           Trojan-Downloader.Win32.Deyma.irx
Kingsoft            malware.kb.b.979
Malwarebytes        Trojan.MalPack.VMP
MaxSecure           Trojan.Malware.300983.susgen
McAfeeD             Real Protect-LS!25EAC045CD79
MicroWorld-eScan    Trojan.GenericKD.74913835
NANO-Antivirus      Trojan.Win32.Deyma.ktspci
Rising              Downloader.Deyma!8.1093B (TFE:5:KHbaYS5mriP)
SentinelOne         Static AI - Malicious PE
Sophos              Generic ML PUA (PUA)
Symantec            ML.Attribute.HighConfidence
Trapmine            malicious.high.ml.score
VBA32               Malware-Cryptor.Inject.gen
VIPRE               Trojan.GenericKD.74913835
tehtris             Generic.Malware



firstSeen: 2024-11-29 05:23:07
ssz: 6 Mb
fname: 29e4b6c5d4629044e236002e749cb5ca
vt: Scan finished
hash: 29e4b6c5d4629044e236002e749cb5ca
date: 2024-11-29 05:23:07
compiled: Sat, May 6 2017, 16:04:14 - 32 Bit EXE
epSectIndex: 8
sects: .text, .rdata, .data, .8 ,, .htext, .yeJ, .G{L, .J=T, .rsrc
die: PE: library: MFC(4.2)[-] PE: linker: Microsoft Linker(6.0)[EXE32]
imphash: 7e87a01ac42028a7dfe4775bb51d9c2e
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 537848
epSect: .J=T
details:
ALYac               Gen:Variant.Lazy.494320
APEX                Malicious
AVG                 Win32:Evo-gen [Trj]
AhnLab-V3           Trojan/Win.Nitol.R638630
Antiy-AVL           Trojan[Packed]/Win32.VMProtect.au
Arcabit             Trojan.Lazy.D78AF0
Avast               Win32:Evo-gen [Trj]
Avira               TR/Crypt.XPACK.Gen
BitDefender         Gen:Variant.Lazy.494320
CTX                 exe.unknown.lazy
ClamAV              Win.Packed.Vmprotect-10023863-0
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Trojan.Siggen30.11365
ESET-NOD32          a variant of Win32/Packed.VMProtect.AU suspicious
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Lazy.494320 (B)
F-Secure            Trojan.TR/Crypt.XPACK.Gen
FireEye             Generic.mg.29e4b6c5d4629044
Fortinet            Riskware/Application
GData               Gen:Variant.Lazy.494320
Google              Detected
Gridinsoft          Malware.Win32.Nitol.st!n
Ikarus              PUA.VMProtect
Jiangmin            Backdoor.Farfli.hoq
K7AntiVirus         Trojan ( 0059f3ce1 )
K7GW                Trojan ( 0059f3ce1 )
Kaspersky           Backdoor.Win32.Farfli.cvzf
Kingsoft            Win32.HeurC.KVMH008.a
Malwarebytes        Generic.Malware.AI.DDS
McAfeeD             Real Protect-LS!29E4B6C5D462
MicroWorld-eScan    Gen:Variant.Lazy.494320
Microsoft           DDoS:Win32/Nitol!pz
NANO-Antivirus      Trojan.Win32.TrjGen.kkoomr
Panda               Trj/Genetic.gen
Rising              Trojan.Nitol!8.14C6 (TFE:4:CVryPQRwE0E)
Sangfor             Trojan.Win32.Save.a
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.tc
Sophos              Generic ML PUA (PUA)
Symantec            ML.Attribute.HighConfidence
TACHYON             Trojan/W32.Agent.6182714
Tencent             Malware.Win32.Gencirc.10bfc093
Trapmine            malicious.high.ml.score
VBA32               BScope.TrojanPSW.Coins
VIPRE               Gen:Variant.Lazy.494320
Varist              W32/VMProtBad.BC.gen!Eldorado
Webroot             W32.Malware.gen
Yandex              Riskware.VMProtect!+YH7Wl4kKzo
Zillya              Backdoor.Farfli.Win32.15999
tehtris             Generic.Malware


resNames:
744     \ICON\1\2052
296     \ICON\2\2052
6156    \ICON\3\2052
744     \ICON\4\2052
296     \ICON\5\2052
3752    \ICON\6\2052
48      \GROUP_ICON\108\2052
48      \GROUP_ICON\128\2052
960     \VERSION\1\1033

fileProps:
CompanyName      Hello World
FileDescription  Clien Local RunProcess
FileVersion      10.0.14393.0 (rs1_release.160715-1616)
InternalName     hello.exe
LegalCopyright   All rights reserved.
OriginalFilename Hello World
ProductName      Hello World® Operating System
ProductVersion   17.000.14393.08


firstSeen: 2020-10-29 20:15:14
ssz: 7 Mb
fname: 3306c8ffe15fea29a0a59fac9805daf4
vt: Scan finished
hash: 3306c8ffe15fea29a0a59fac9805daf4
date: 2024-11-28 05:06:35
compiled: Thu, Jul 12 1962, 3:40:43 - 32 Bit .NET v4.0 EXE
epSectIndex: 3
sects: .text, .of0, .of1, .rsrc, .reloc
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 17B6483
epSect: .of1
sig: Error 800B010A
sigDetails: Subject: OnlineFix Issuer: Ascertia Public CA 1
details:
AhnLab-V3           Malware/Win32.RL_Generic.C4218953
Antiy-AVL           Trojan[Packed]/MSIL.VMProtect
CrowdStrike         win/grayware_confidence_100% (W)
Fortinet            PossibleThreat
Google              Detected
K7AntiVirus         Trojan ( 00574e2d1 )
K7GW                Trojan ( 00574e2d1 )
McAfee              GenericRXAA-AA!3306C8FFE15F
McAfeeD             ti!2AD12BF130D6
Varist              W32/ABTrojan.VIVV-1732
Zillya              Trojan.VMProtect.Win32.61320


die:
PE: protector: VMProtect(-)[-]
	    PE: library: .NET(v4.0.30319)[-]
	    PE: linker: Microsoft Linker(48.0*)[EXE32,signed]

resNames:
27464   \ICON\1\0
67624   \ICON\2\0
16936   \ICON\3\0
9640    \ICON\4\0
4264    \ICON\5\0
1128    \ICON\6\0
90      \GROUP_ICON\32512\0
912     \VERSION\1\0

fileProps:
CompanyName      Online-Fix
FileDescription  Photon Launcher
FileVersion      1.0.1.0
InternalName     Launcher.exe
LegalCopyright   Copyright ©  2020, 0xdeadc0de
OriginalFilename Launcher.exe
ProductName      Photon Launcher
ProductVersion   1.0.1.0


firstSeen: 2024-11-29 05:10:03
ssz: 6 Mb
fname: 33119a88a96ffebe6af2b3a62b782b2c
vt: Scan finished
hash: 33119a88a96ffebe6af2b3a62b782b2c
date: 2024-11-29 05:10:03
compiled: Fri, Dec 11 2009, 21:31:37 - 32 Bit EXE
epSectIndex: 7
sects: .text, .rdata, .data, .CbOb, .`o$, .Y<i, .VCF
die: PE: linker: Microsoft Linker(6.0)[EXE32]
imphash: 4f2901c0f26912f101d33992f03f2ab2
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 3AD86F
epSect: .VCF
details:
ALYac               Gen:Variant.Zusy.540547
APEX                Malicious
AVG                 Win32:Evo-gen [Trj]
AhnLab-V3           Trojan/Win.Generic.R640388
Antiy-AVL           GrayWare/Win32.Wacapew
Arcabit             Trojan.Zusy.D83F83
Avast               Win32:Evo-gen [Trj]
BitDefender         Gen:Variant.Zusy.540547
CTX                 exe.unknown.zusy
ClamAV              Win.Packed.Kelios-10023944-0
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.AU suspicious
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Zusy.540547 (B)
FireEye             Generic.mg.33119a88a96ffebe
Fortinet            Riskware/Application
GData               Gen:Variant.Zusy.540547
Google              Detected
Gridinsoft          Trojan.Heur!.022120A1
Ikarus              PUA.VMProtect
Jiangmin            TrojanClicker.Cycler.bxn
K7AntiVirus         Trojan ( 0059f3ce1 )
K7GW                Trojan ( 0059f3ce1 )
Kingsoft            malware.kb.b.991
Malwarebytes        Malware.AI.221908809
McAfee              Artemis!33119A88A96F
McAfeeD             Real Protect-LS!33119A88A96F
MicroWorld-eScan    Gen:Variant.Zusy.540547
Microsoft           Trojan:Win32/PrivateLoader.RC!MTB
NANO-Antivirus      Trojan.Win32.TrjGen.kktpho
Panda               Trj/Genetic.gen
Rising              Trojan.Clicker!8.1972 (TFE:3:hexVX6EEAWG)
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.tc
Sophos              Mal/Generic-S
Symantec            ML.Attribute.HighConfidence
Tencent             Malware.Win32.Gencirc.10bfc6e1
Trapmine            malicious.high.ml.score
VBA32               BScope.TrojanPSW.Coins
VIPRE               Gen:Variant.Zusy.540547
Varist              W32/Unruy.N.gen!Eldorado
Yandex              Riskware.VMProtect!fYDaETDRrmU
Zillya              Trojan.Cycler.Win32.2464
Zoner               Probably Heur.ExeHeaderL



firstSeen: 2024-11-29 05:40:15
ssz: 2 Mb
fname: 37d9aac725a5d51cc83012a1055e9779
vt: Scan finished
hash: 37d9aac725a5d51cc83012a1055e9779
date: 2024-11-29 05:40:15
compiled: Sun, Sep 12 2021, 7:32:25 - 32 Bit EXE
epSectIndex: 6
sects: NRXYP, 7NIEr2, A2u8O, 4LM8b, 4LM8, R7DeA, HO6VP
die: PE: compiler: Microsoft Visual C/C++(6.0)[-] PE: linker: Microsoft Linker(6.0)[EXE32]
resNames: 604 \VERSION\1\2052
imphash: 56701e66a09015019e446765d657c56d
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 103E98
epSect: R7DeA
details:
APEX                Malicious
AVG                 Win32:MalwareX-gen [Trj]
AhnLab-V3           Trojan/Win.Generic.R665143
Antiy-AVL           Trojan[Packed]/Win32.Vemply
Arcabit             Trojan.Lazy.D98757
Avast               Win32:MalwareX-gen [Trj]
Avira               TR/Crypt.ZPACK.Gen
Baidu               Win32.Packed.VMProtect.a
BitDefender         Gen:Variant.Lazy.624471
Bkav                W32.AIDetectMalware
CAT-QuickHeal       Trojan.GenericRI.S23452157
CTX                 exe.unknown.lazy
ClamAV              Win.Dropper.Tiggre-9845940-0
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.ABD
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Lazy.624471 (B)
F-Secure            Trojan.TR/Crypt.ZPACK.Gen
FireEye             Generic.mg.37d9aac725a5d51c
Fortinet            W32/VMProtect.ABD!tr
GData               Win32.Trojan-Stealer.BlackMoon.D
Google              Detected
Gridinsoft          Trojan.Heur!.032920A1
Ikarus              Trojan.Win32.VMProtect
Jiangmin            Packed.Vemply.jjn
K7AntiVirus         Trojan ( 7000001c1 )
K7GW                Trojan ( 7000001c1 )
Kaspersky           VHO:Packed.Win32.Vemply.gen
Malwarebytes        Generic.Malware.AI.DDS
MaxSecure           Trojan.Malware.300983.susgen
McAfeeD             Real Protect-LS!37D9AAC725A5
MicroWorld-eScan    Gen:Variant.Lazy.624471
Microsoft           Trojan:Win32/Zusy.EM!MTB
Panda               Trj/Genetic.gen
Sangfor             Trojan.Win32.Save.BlackMoon
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.tc
Sophos              Mal/VMProtBad-A
Symantec            ML.Attribute.HighConfidence
Tencent             Packed.Win32.Vemply.he
Trapmine            malicious.high.ml.score
VBA32               BScope.Trojan.Dynamer
VIPRE               Gen:Variant.Lazy.624471
Varist              W32/Agent.JKA.gen!Eldorado
Zillya              Trojan.VMProtect.Win32.99252
huorong             Trojan/FakeAPP.s


fileProps:
FileDescription  ????????
FileVersion      1.0.2107.6
LegalCopyright   Tencent Limited.All Rights Reserved.
ProductName      ????????
ProductVersion   1.0.2107.6

rich:
offset DanS:128
offset Rich:216
Size: 88
checkSum: 0xCB928CDE Matches!

clearData: DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00{\x1C\x0C\x00\x01\x00\x00\x00\x83\x1C\x0E\x00\x18\x00\x00\x006&\x0A\x00\x89\x00\x00\x00\xE8\x1F\x0A\x00\x02\x00\x00\x00\x00\x00\x01\x00\x8B\x00\x00\x00\xC3\x0F]\x00\x0D\x00\x00\x006&\x0B\x00E\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\xE8\x1F\x0B\x00\x03\x00\x00\x00

9 entries
--------------------------------------------------
Compiler: 7291
toolID: 12
Count: 1
toolName: AliasObj60
vsVer: Visual Studio 6 (06.00)

Compiler: 7299
toolID: 14
Count: 24
toolName: Masm613
vsVer: Visual Studio 6 (06.00)

Compiler: 9782
toolID: 10
Count: 137
toolName: Utc12_C
vsVer: Visual Studio 6 (06.00)

Compiler: 8168
toolID: 10
Count: 2
toolName: Utc12_C
vsVer: Visual Studio 6 (06.00)

Compiler: 0
toolID: 1
Count: 139
toolName: Import0
vsVer: Visual Studio (00.00)

Compiler: 4035
toolID: 93
Count: 13
toolName: Implib710
vsVer: Visual Studio 2003 (07.10)

Compiler: 9782
toolID: 11
Count: 69
toolName: Utc12_CPP
vsVer: Visual Studio 6 (06.00)

Compiler: 0
toolID: 0
Count: 1
toolName: 
vsVer: <unknown> (00.00)

Compiler: 8168
toolID: 11
Count: 3
toolName: Utc12_CPP
vsVer: Visual Studio 6 (06.00)


firstSeen: 2024-11-29 04:41:11
ssz: 6 Mb
fname: 39a51d3371b5bf56a90ee51ff1beea76
vt: Scan finished
hash: 39a51d3371b5bf56a90ee51ff1beea76
date: 2024-11-29 04:41:11
compiled: Fri, Dec 11 2009, 21:31:37 - 32 Bit EXE
epSectIndex: 7
sects: .text, .rdata, .data, .CbOb, .`o$, .Y<i, .VCF
die: PE: linker: Microsoft Linker(6.0)[EXE32]
imphash: 4f2901c0f26912f101d33992f03f2ab2
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 3AD86F
epSect: .VCF
details:
ALYac               Gen:Variant.Zusy.540547
APEX                Malicious
AVG                 Win32:Evo-gen [Trj]
AhnLab-V3           Trojan/Win.Generic.R640388
Antiy-AVL           GrayWare/Win32.Wacapew
Arcabit             Trojan.Zusy.D83F83
Avast               Win32:Evo-gen [Trj]
Avira               TR/AVI.Evo.dryfg
BitDefender         Gen:Variant.Zusy.540547
Bkav                W32.AIDetectMalware
CTX                 exe.unknown.zusy
ClamAV              Win.Packed.Kelios-10023944-0
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Trojan.Siggen30.9776
ESET-NOD32          a variant of Win32/Packed.VMProtect.AU suspicious
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Zusy.540547 (B)
F-Secure            Trojan.TR/AVI.Evo.dryfg
FireEye             Generic.mg.39a51d3371b5bf56
Fortinet            Riskware/Application
GData               Gen:Variant.Zusy.540547
Google              Detected
Gridinsoft          Trojan.Heur!.022120A1
Ikarus              PUA.VMProtect
Jiangmin            TrojanClicker.Cycler.bxn
K7AntiVirus         Trojan ( 0059f3ce1 )
K7GW                Trojan ( 0059f3ce1 )
Kaspersky           Trojan-Clicker.Win32.Cycler.benm
Kingsoft            Win32.HeurC.KVMH008.a
Malwarebytes        Malware.AI.221908809
McAfeeD             Real Protect-LS!39A51D3371B5
MicroWorld-eScan    Gen:Variant.Zusy.540547
Microsoft           Trojan:Win32/PrivateLoader.RC!MTB
NANO-Antivirus      Trojan.Win32.TrjGen.kktpho
Panda               Trj/Genetic.gen
Rising              Trojan.Clicker!8.1972 (TFE:3:hexVX6EEAWG)
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.tc
Sophos              Mal/Generic-S
Symantec            ML.Attribute.HighConfidence
Tencent             Malware.Win32.Gencirc.10bfc6e1
Trapmine            malicious.high.ml.score
VBA32               BScope.TrojanPSW.Coins
VIPRE               Gen:Variant.Zusy.540547
Varist              W32/Unruy.N.gen!Eldorado
Yandex              Riskware.VMProtect!fYDaETDRrmU
Zillya              Trojan.Cycler.Win32.2464
Zoner               Probably Heur.ExeHeaderL



firstSeen: 2024-11-29 04:35:34
ssz: 4 Mb
fname: 3a2ff7caf9e31c0642475b5945be7c01
vt: Scan finished
hash: 3a2ff7caf9e31c0642475b5945be7c01
date: 2024-11-29 04:35:34
compiled: Sun, Nov 13 2011, 2:54:02 - 32 Bit EXE
epSectIndex: 1
sects: .text, .rdata, .data, .rsrc
die: PE: compiler: Microsoft Visual C/C++(6.0)[libcmt] PE: linker: Microsoft Linker(6.0)[EXE32]
imphash: 3c2815c82be1e401e611741af831ecb9
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 29FFD
epSect: .text
details:
ALYac               Gen:Variant.Doina.69145
APEX                Malicious
AVG                 Win32:Evo-gen [Trj]
AhnLab-V3           Unwanted/Win32.HackTool.R30464
Antiy-AVL           Trojan/Win32.Qhost
Arcabit             Trojan.Doina.D10E19
Avast               Win32:Evo-gen [Trj]
Avira               TR/ATRAPS.Gen
BitDefender         Gen:Variant.Doina.69145
Bkav                W32.AIDetectMalware
CAT-QuickHeal       Trojan.QhostPMF.S34341769
CTX                 exe.unknown.doina
ClamAV              Win.Packed.Vmprotect-9976168-0
CrowdStrike         win/malicious_confidence_100% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Trojan.Siggen4.15899
ESET-NOD32          multiple detections
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Doina.69145 (B)
F-Secure            Trojan.TR/ATRAPS.Gen
FireEye             Generic.mg.3a2ff7caf9e31c06
Fortinet            W32/Qhost.OAG!tr
GData               Gen:Variant.Doina.69145
Google              Detected
Gridinsoft          Ransom.Win32.Sabsik.oa!s1
Ikarus              Trojan.Win32.Spy2
Jiangmin            Trojan/Qhost.eid
K7AntiVirus         Trojan ( 005850dc1 )
K7GW                Trojan ( 005850dc1 )
Kaspersky           Trojan.Win32.Qhost.abnr
Malwarebytes        Generic.Malware.AI.DDS
McAfeeD             ti!29B2D4DA5C76
MicroWorld-eScan    Gen:Variant.Doina.69145
Microsoft           Trojan:Win32/Phonzy.B!ml
NANO-Antivirus      Trojan.Win32.Qhost.ccdhix
Panda               Generic Malware
Rising              Trojan.Undefined!8.1327C (RDMK:cmRtazqStipisDhXa/QPCUy12N4v)
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.rm
Sophos              Troj/Qhost-ER
Symantec            ML.Attribute.HighConfidence
Tencent             Trojan.Win32.Qhost.wa
Trapmine            malicious.moderate.ml.score
TrendMicro          TROJ_AGENT_014687.TOMB
TrendMicro-HouseCallTROJ_AGENT_014687.TOMB
VBA32               Trojan.Qhost
VIPRE               Gen:Variant.Doina.69145
Varist              W32/A-16388b05!Eldorado
ViRobot             Trojan.Win32.A.Qhost.4235264
Webroot             W32.Trojan.Gen
Xcitium             TrojWare.Win32.QHost.ABNR@4na2b4
Yandex              Trojan.GenAsa!VubRXkFIJ1k
Zillya              Trojan.Qhost.Win32.9034
huorong             TrojanDownloader/Agent.wf
tehtris             Generic.Malware



firstSeen: 2024-11-29 04:44:39
ssz: 4 Mb
fname: 3cd1022ef614686f2dafaa942fcb2162
vt: Scan finished
hash: 3cd1022ef614686f2dafaa942fcb2162
date: 2024-11-29 04:44:39
compiled: Sun, Nov 13 2011, 2:54:02 - 32 Bit EXE
epSectIndex: 1
sects: .text, .rdata, .data, .rsrc
die: PE: compiler: Microsoft Visual C/C++(6.0)[libcmt] PE: linker: Microsoft Linker(6.0)[EXE32]
imphash: 3c2815c82be1e401e611741af831ecb9
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 29FFD
epSect: .text
details:
ALYac               Gen:Variant.Doina.69145
APEX                Malicious
AVG                 Win32:Evo-gen [Trj]
AhnLab-V3           Unwanted/Win32.HackTool.R30464
Antiy-AVL           Trojan/Win32.Qhost
Arcabit             Trojan.Doina.D10E19
Avast               Win32:Evo-gen [Trj]
Avira               TR/ATRAPS.Gen
BitDefender         Gen:Variant.Doina.69145
Bkav                W32.AIDetectMalware
CAT-QuickHeal       Trojan.QhostPMF.S34341769
CTX                 exe.unknown.doina
ClamAV              Win.Packed.Vmprotect-9976168-0
CrowdStrike         win/malicious_confidence_90% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Trojan.Siggen4.15899
ESET-NOD32          multiple detections
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Doina.69145 (B)
F-Secure            Trojan.TR/ATRAPS.Gen
FireEye             Generic.mg.3cd1022ef614686f
Fortinet            W32/Qhost.OAG!tr
GData               Gen:Variant.Doina.69145
Google              Detected
Gridinsoft          Ransom.Win32.Sabsik.oa!s1
Ikarus              Trojan.Win32.Spy2
Jiangmin            Trojan/Qhost.eid
K7AntiVirus         Trojan ( 005850dc1 )
K7GW                Trojan ( 005850dc1 )
Kaspersky           Trojan.Win32.Qhost.abnr
Malwarebytes        Generic.Malware.AI.DDS
McAfee              GenericRXTH-JG!3CD1022EF614
McAfeeD             ti!30EFBE8665E6
MicroWorld-eScan    Gen:Variant.Doina.69145
Microsoft           Trojan:Win32/Phonzy.B!ml
NANO-Antivirus      Trojan.Win32.Qhost.ccdhix
Panda               Generic Malware
Rising              Trojan.Undefined!8.1327C (RDMK:cmRtazqStipisDhXa/QPCUy12N4v)
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.rm
Sophos              Troj/Qhost-ER
Symantec            ML.Attribute.HighConfidence
Tencent             Trojan.Win32.Qhost.wa
Trapmine            malicious.moderate.ml.score
TrendMicro          TROJ_AGENT_014687.TOMB
TrendMicro-HouseCallTROJ_AGENT_014687.TOMB
VBA32               Trojan.Qhost
VIPRE               Gen:Variant.Doina.69145
Varist              W32/A-16388b05!Eldorado
ViRobot             Trojan.Win32.A.Qhost.4235264
Webroot             W32.Trojan.Gen
Xcitium             TrojWare.Win32.QHost.ABNR@4na2b4
Yandex              Trojan.GenAsa!VubRXkFIJ1k
Zillya              Trojan.Qhost.Win32.9034
huorong             TrojanDownloader/Agent.wf
tehtris             Generic.Malware



firstSeen: 2024-11-29 12:26:27
ssz: 5 Mb
fname: 3dcb48b4a0e5183bc0b17bf334a15ef0
vt: Scan finished
hash: 3dcb48b4a0e5183bc0b17bf334a15ef0
date: 2024-11-29 12:26:37
compiled: Thu, Sep 12 2024, 9:08:14 - 32 Bit DLL
epSectIndex: 6
sects: .text, .rdata, .data, .%?., .%-[, .mo:, .reloc, .rsrc
die: PE: protector: VMProtect(2.X)[-] PE: linker: Microsoft Linker(14.39)[DLL32,signed]
exports: @1 MyUnregisterServer
resNames: 381 \24\2\1033
imphash: c60ea44c29fb9958cdca44c6933240cf
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 442944
epSect: .mo:
details:
APEX                Malicious
AVG                 Win32:MalwareX-gen [Trj]
AhnLab-V3           Trojan/Win.Redcap.R672916
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Avast               Win32:MalwareX-gen [Trj]
Avira               TR/Redcap.vdzex
Bkav                W32.AIDetectMalware
CrowdStrike         win/malicious_confidence_100% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.BB suspicious
Elastic             malicious (high confidence)
F-Secure            Trojan.TR/Redcap.vdzex
FireEye             Generic.mg.3dcb48b4a0e5183b
Fortinet            Riskware/Application
GData               Win32.Trojan.Agent.PJH0KY
Google              Detected
Gridinsoft          Trojan.Heur!.022120A0
Ikarus              PUA.VMProtect
K7AntiVirus         Trojan ( 0059f0351 )
K7GW                Trojan ( 0059f0351 )
Kaspersky           HEUR:Trojan.Win32.TbMA.gen
Malwarebytes        Trojan.MalPack.PES
MaxSecure           Trojan.Malware.300983.susgen
McAfeeD             Real Protect-LS!3DCB48B4A0E5
Microsoft           Trojan:Win32/Redcap.GNZ!MTB
Panda               Trj/Genetic.gen
Rising              Trojan.TbMA!8.E459 (RDMK:cmRtazr/US+AhfL+Fb3vVxQNlPWS)
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.BumbleBee.rc
Symantec            ML.Attribute.HighConfidence
TACHYON             Trojan/W32.Agent.4858192
Tencent             Backdoor.Win64.Runshell_l.16001403
TrendMicro-HouseCallTROJ_GEN.R03BH01KS24
VBA32               BScope.TrojanPSW.Stealer
Varist              W32/Trojan.CZEC-4507
Webroot             Win.Trojan.Gen
Yandex              Riskware.VMProtect!U0btQzBGNZ8
Zillya              Trojan.VMProtect.Win32.100032



firstSeen: 2024-11-17 02:15:28
ssz: 2 Mb
fname: 3fbced51c06417895622ded156a0a860
vt: Scan finished
hash: 3fbced51c06417895622ded156a0a860
date: 2024-11-29 05:05:50
compiled: Mon, Aug 8 2022, 12:35:23 - 32 Bit EXE
epSectIndex: 1
sects: .text, .rdata, .data, flag_dat, .rsrc, .reloc
imphash: 60affa2c1c2a995a256c370e06e92714
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: AD0E6
epSect: .text
details:
ALYac               Gen:Variant.Midie.126803
AVG                 Win32:Malware-gen
AhnLab-V3           Trojan/Win.OP.R574387
Alibaba             TrojanDownloader:Win32/Upatre.c768ce4c
Antiy-AVL           GrayWare/Win32.Wacapew
Arcabit             Trojan.Midie.D1EF53
Avast               Win32:Malware-gen
Avira               TR/Dldr.Upatre.hfysc
BitDefender         Gen:Variant.Midie.126803
Bkav                W32.AIDetectMalware
CTX                 exe.trojan.upatre
ClamAV              Win.Malware.Bulz-10016535-0
CrowdStrike         win/malicious_confidence_70% (W)
Cylance             Unsafe
Cynet               Malicious (score: 99)
DeepInstinct        MALICIOUS
DrWeb               Trojan.Siggen19.17623
ESET-NOD32          a variant of Generik.BAOLRRY
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Midie.126803 (B)
F-Secure            Trojan.TR/Dldr.Upatre.hfysc
FireEye             Generic.mg.3fbced51c0641789
Fortinet            W32/PossibleThreat
GData               Gen:Variant.Midie.126803
Google              Detected
Gridinsoft          Trojan.Heur!.02056421
Ikarus              Trojan-Downloader.Upatre
Jiangmin            TrojanDownloader.Upatre.aokz
Kaspersky           HEUR:Trojan-Downloader.Win32.Upatre.gen
Kingsoft            Win32.Trojan-Downloader.Upatre.gen
Lionic              Trojan.Win32.Upatre.1j!c
Malwarebytes        Generic.Malware.AI.DDS
McAfee              GenericRXTO-OP!3FBCED51C064
McAfeeD             ti!2FD03DF71E67
MicroWorld-eScan    Gen:Variant.Midie.126803
Microsoft           Trojan:Win32/Wacatac.B!ml
Paloalto            generic.ml
Sangfor             Trojan.Win32.Agent.V4w3
SentinelOne         Static AI - Suspicious PE
Skyhigh             BehavesLike.Win32.Dropper.vc
Sophos              Mal/Generic-S
Symantec            ML.Attribute.HighConfidence
Tencent             Trojan-Ransom.Win32.Agent.kg
VBA32               TrojanDownloader.Upatre
VIPRE               Gen:Variant.Midie.126803
Varist              W32/ABTrojan.EMGF-7361
ViRobot             Trojan.Win.Z.Upatre.2432678
Yandex              Trojan.VMProtect!O7oTog8ofAg
Zillya              Trojan.Fsysna.Win32.53341
alibabacloud        Trojan[downloader]:Win/Upatre.gyf
tehtris             Generic.Malware


die:
PE: compiler: Microsoft Visual C/C++(2003)[libcmt,wWinMain]
	    PE: linker: Microsoft Linker(7.10)[EXE32,admin]

exports:
@1 LoadEnvi
@2 MemoryCompare
@3 MemoryCopy
@4 MemorySet
@5 WndProc1
@6 WndProc1_
@7 WndProc2
@8 WndProc2_
@9 WndProc3
@10 WndProc3_
@11 _dllMain_Name@12
@12 main
@13 main1
@14 main5
@15 mainB
@16 _mainB_@8
@17 _mainW@16
@18 _main_@4

resNames:
3816    \SCRIPT\101\2052
493885  \SCRIPT\103\2052
296     \ICON\50\0
1384    \ICON\51\0
1128    \ICON\52\0
488     \ICON\53\0
1736    \ICON\54\0
2440    \ICON\55\0
744     \ICON\56\0
2216    \ICON\57\0
4264    \ICON\58\0
1640    \ICON\59\0
3752    \ICON\60\0
9640    \ICON\61\0
2664    \ICON\62\0
5672    \ICON\63\0
16936   \ICON\64\0
4264    \ICON\65\0
8424    \ICON\66\0
26600   \ICON\67\0
5864    \ICON\68\0
11432   \ICON\69\0
38056   \ICON\70\0
10344   \ICON\71\0
19496   \ICON\72\0
67624   \ICON\73\0
12648   \ICON\74\0
108     \DIALOG\10011\2052
108     \DIALOG\10012\2052
86      \DIALOG\10013\2052
108     \DIALOG\10014\2052
456     \DIALOG\10016\2052
86      \DIALOG\10019\2052
356     \GROUP_ICON\1\0
720     \VERSION\1\1041
1528    \24\1\2052

fileProps:
CompanyName      Moo0
FileDescription  Image Sizer
FileVersion      1.0.0.1
InternalName     ImageSizer.exe
LegalCopyright   (c) Moo0.  All rights reserved.
OriginalFilename ImageSizer.exe
ProductName      Image Sizer
ProductVersion   1.0.0.1

rich:
offset DanS:128
offset Rich:240
Size: 112
checkSum: 0xE5343DFB Matches!

clearData: DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8E\x17\x0F\x005\x00\x00\x00\x8E\x17_\x00\x98\x00\x00\x00\x83\x08_\x00\x08\x00\x00\x00\xDA#\x1C\x00\x01\x00\x00\x00\x13\x08]\x00\x02\x00\x00\x00\x83\x08]\x00\x0A\x00\x00\x00\xFA#\x19\x00\x05\x00\x00\x00\x00\x00\x01\x005\x02\x00\x00\x8E\x17`\x00#\x00\x00\x00\x8E\x17\\x00\x01\x00\x00\x00\xEC\x0B^\x00\x01\x00\x00\x00\x8E\x17Z\x00\x01\x00\x00\x00

12 entries
--------------------------------------------------
Compiler: 6030
toolID: 15
Count: 53
toolName: Masm710
vsVer: <unknown> (00.00)

Compiler: 6030
toolID: 95
Count: 152
toolName: Utc1310_C
vsVer: Visual Studio 2003 (07.10)

Compiler: 2179
toolID: 95
Count: 8
toolName: Utc1310_C
vsVer: Visual Studio 2003 (07.10)

Compiler: 9178
toolID: 28
Count: 1
toolName: Utc13_C
vsVer: <unknown> (00.00)

Compiler: 2067
toolID: 93
Count: 2
toolName: Implib710
vsVer: Visual Studio 2003 (07.10)

Compiler: 2179
toolID: 93
Count: 10
toolName: Implib710
vsVer: Visual Studio 2003 (07.10)

Compiler: 9210
toolID: 25
Count: 5
toolName: Implib700
vsVer: <unknown> (00.00)

Compiler: 0
toolID: 1
Count: 565
toolName: Import0
vsVer: Visual Studio (00.00)

Compiler: 6030
toolID: 96
Count: 35
toolName: Utc1310_CPP
vsVer: Visual Studio 2003 (07.10)

Compiler: 6030
toolID: 92
Count: 1
toolName: Export710
vsVer: Visual Studio 2003 (07.10)

Compiler: 3052
toolID: 94
Count: 1
toolName: Cvtres710
vsVer: Visual Studio 2003 (07.10)

Compiler: 6030
toolID: 90
Count: 1
toolName: Linker710
vsVer: Visual Studio 2003 (07.10)


firstSeen: 2024-11-29 05:58:51
ssz: 5 Mb
fname: 3fcd8dcaa02da070a8c12ae43770c64d
vt: Scan finished
hash: 3fcd8dcaa02da070a8c12ae43770c64d
date: 2024-11-29 05:58:51
compiled: Thu, Sep 12 2024, 9:08:14 - 32 Bit DLL
epSectIndex: 6
sects: .text, .rdata, .data, .%?., .%-[, .mo:, .reloc, .rsrc
die: PE: protector: VMProtect(2.X)[-] PE: linker: Microsoft Linker(14.39)[DLL32,signed]
exports: @1 MyUnregisterServer
resNames: 381 \24\2\1033
imphash: c60ea44c29fb9958cdca44c6933240cf
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 442944
epSect: .mo:
details:
APEX                Malicious
AVG                 Win32:MalwareX-gen [Trj]
AhnLab-V3           Trojan/Win.Redcap.R672916
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Avast               Win32:MalwareX-gen [Trj]
Avira               TR/Redcap.vdzex
Bkav                W32.AIDetectMalware
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.BB suspicious
Elastic             malicious (high confidence)
F-Secure            Trojan.TR/Redcap.vdzex
FireEye             Generic.mg.3fcd8dcaa02da070
Fortinet            Riskware/Application
Google              Detected
Gridinsoft          Trojan.Heur!.022120A0
K7AntiVirus         Trojan ( 0059f0351 )
K7GW                Trojan ( 0059f0351 )
Kaspersky           HEUR:Trojan.Win32.TbMA.gen
Malwarebytes        Trojan.MalPack.PES
McAfeeD             Real Protect-LS!3FCD8DCAA02D
Microsoft           Trojan:Win32/Redcap.GNZ!MTB
Panda               Trj/Genetic.gen
Rising              Trojan.TbMA!8.E459 (RDMK:cmRtazr/US+AhfL+Fb3vVxQNlPWS)
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.BumbleBee.rc
Symantec            ML.Attribute.HighConfidence
TACHYON             Trojan/W32.Agent.4858192
Tencent             Backdoor.Win64.Runshell_l.16001403
VBA32               BScope.TrojanPSW.Stealer
Varist              W32/Trojan.CZEC-4507
Webroot             Win.Trojan.Gen
Yandex              Riskware.VMProtect!U0btQzBGNZ8
Zillya              Trojan.VMProtect.Win32.100032



firstSeen: 2024-03-09 18:02:00
ssz: 7 Mb
fname: 407d137590461141a1e80b4c7ed48070
vt: Scan finished
hash: 407d137590461141a1e80b4c7ed48070
date: 2024-07-17 15:42:03
compiled: Thu, Jan 1 1970, 0:00:00 - 32 Bit DLL
epSectIndex: 10
sects: .text, .data, .rdata, .bss, .CRT, .idata, .edata, .u0q0, .u0q1, .u0q2, .reloc, .rsrc
die: PE: linker: Microsoft Linker(3.22)[DLL32,console]
resNames: 668 \VERSION\1\0
imphash: 06ff5ae01c1850a456bbe374ba631f48
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 4CB4DA
epSect: .u0q2
details:
ALYac               Gen:Variant.Lazy.493748
AVG                 Win32:MalwareX-gen [Trj]
Alibaba             Packed:Win32/VMProtect.f2e68843
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Arcabit             Trojan.Lazy.D788B4
Avast               Win32:MalwareX-gen [Trj]
BitDefender         Gen:Variant.Lazy.493748
BitDefenderTheta    Gen:NN.ZedlaF.36808.@Z8@aaCXu0
Bkav                W32.AIDetectMalware
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.AU suspicious
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Lazy.493748 (B)
FireEye             Generic.mg.407d137590461141
Fortinet            Riskware/Application
GData               Gen:Variant.Lazy.493748
Google              Detected
Gridinsoft          Trojan.Heur!.02292120
Ikarus              PUA.VMProtect
K7AntiVirus         Trojan ( 0059f3ca1 )
K7GW                Trojan ( 0059f3ca1 )
Lionic              Trojan.Win32.VMProtect.4!c
MAX                 malware (ai score=89)
Malwarebytes        Malware.AI.2037375221
MaxSecure           Trojan.Malware.236899225.susgen
McAfeeD             ti!60CCD6A4BB2C
MicroWorld-eScan    Gen:Variant.Lazy.493748
Microsoft           PUA:Win32/Packunwan
Paloalto            generic.ml
Sangfor             Trojan.Win32.Packed.V8tx
SentinelOne         Static AI - Suspicious PE
Skyhigh             BehavesLike.Win32.Generic.vc
Sophos              Mal/Generic-S
Symantec            ML.Attribute.HighConfidence
TrendMicro-HouseCallTROJ_GEN.R023H09CG24
VIPRE               Gen:Variant.Lazy.493748
Varist              W32/ABRisk.LKCP-9377
Yandex              Riskware.VMProtect!ZfB6jCZyFZw
Zillya              Trojan.VMProtect.Win32.92083
alibabacloud        Trojan:Win/Packed.VMProtect.AU


exports:
@1 NetpsPathType
@2 NetpsPathCompare
@3 NetpsPathCanonicalize
@4 NetpsNameValidate
@5 NetpsNameCompare
@6 NetpsNameCanonicalize
@7 NetShareSetInfo
@8 NetShareGetInfo
@9 NetShareEnumSticky
@10 NetShareEnum
@11 NetShareDelSticky
@12 NetShareDelEx
@13 NetShareDel
@14 NetShareCheck
@15 NetShareAdd
@16 NetSessionGetInfo
@17 NetSessionEnum
@18 NetSessionDel
@19 NetServerTransportEnum
@20 NetServerTransportDel
@21 NetServerTransportAddEx
@22 NetServerTransportAdd
@23 NetServerStatisticsGet
@24 NetServerSetInfo
@25 NetServerGetInfo
@26 NetServerDiskEnum
@27 NetServerComputerNameDel
@28 NetServerComputerNameAdd
@29 NetServerAliasEnum
@30 NetServerAliasDel
@31 NetServerAliasAdd
@32 NetRemoteTOD
@33 NetFileGetInfo
@34 NetFileEnum
@35 NetFileClose
@36 NetConnectionEnum
@37 LocalShareSetInfo
@38 LocalShareGetInfoEx
@39 LocalShareGetInfo
@40 LocalShareEnumEx
@41 LocalShareEnum
@42 LocalShareDelEx
@43 LocalShareAdd
@44 LocalSessionGetInfoEx
@45 LocalSessionGetInfo
@46 LocalSessionEnumEx
@47 LocalSessionEnum
@48 LocalSessionDel
@49 LocalServerCertificateMappingRemove
@50 LocalServerCertificateMappingGet
@51 LocalServerCertificateMappingEnum
@52 LocalServerCertificateMappingAdd
@53 LocalFileGetInfoEx
@54 LocalFileGetInfo
@55 LocalFileEnumEx
@56 LocalFileEnum
@57 LocalFileClose
@58 LocalAliasGet
@59 I_NetServerSetServiceBitsEx
@60 I_NetServerSetServiceBits
@61 I_NetDfsGetVersion
@62 Intercept

fileProps:
CompanyName      CompanyName
FileDescription  cloud+update library
FileVersion      1.0.0.0
InternalName     InternalName
LegalCopyright   @ebfe90
OriginalFilename OriginalFileName
ProductName      ProductName
ProductVersion   ProductVersion


firstSeen: 2024-11-29 05:16:52
ssz: 2 Mb
fname: 42964fbbd7c8689b11c00f7baf932566
vt: Scan finished
hash: 42964fbbd7c8689b11c00f7baf932566
date: 2024-11-29 05:16:52
compiled: Tue, May 7 2024, 12:27:29 - 32 Bit EXE
epSectIndex: 6
sects: .text, .rdata, .data, .1Q[, .),E, .sc=, .reloc
die: PE: linker: Microsoft Linker(14.29)[EXE32]
imphash: 847bf44a6099ee7a9c215a232e218aab
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 1A9119
epSect: .sc=
details:
ALYac               Gen:Variant.Zusy.556634
APEX                Malicious
AVG                 Win32:KeyloggerX-gen [Trj]
AhnLab-V3           Trojan/Win.Generic.R647582
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Arcabit             Trojan.Zusy.D87E5A
Avast               Win32:KeyloggerX-gen [Trj]
Avira               HEUR/AGEN.1374848
BitDefender         Gen:Variant.Zusy.556634
Bkav                W32.AIDetectMalware
CTX                 exe.unknown.zusy
ClamAV              Win.Packed.C2xk-10031869-0
CrowdStrike         win/malicious_confidence_100% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.BC suspicious
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Zusy.556634 (B)
F-Secure            Heuristic.HEUR/AGEN.1374848
FireEye             Generic.mg.42964fbbd7c8689b
Fortinet            W32/Kryptik.HRTC!tr
GData               Win32.Trojan.PSE.1V4QVRM
Google              Detected
Gridinsoft          Trojan.Heur!.022120A1
Ikarus              PUA.VMProtect
Jiangmin            Trojan.Agent.ewwu
K7AntiVirus         Trojan ( 0059f91f1 )
K7GW                Trojan ( 0059f91f1 )
Kaspersky           Trojan.Win32.Agent2.mxh
Kingsoft            malware.kb.b.808
Malwarebytes        Malware.AI.1010088143
MaxSecure           Trojan.Malware.273686129.susgen
McAfeeD             Real Protect-LS!42964FBBD7C8
MicroWorld-eScan    Gen:Variant.Zusy.556634
Microsoft           Trojan:Win32/KeyLogger.ASL!MTB
NANO-Antivirus      Trojan.Win32.Redcap.koeegm
Panda               Trj/Genetic.gen
Rising              Trojan.Agent!8.B1E (RDMK:cmRtazq5NcToROS7mwuY9xUJu9Y+)
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.tc
Sophos              Generic ML PUA (PUA)
Symantec            ML.Attribute.HighConfidence
TACHYON             Trojan/W32.Agent.1589760.V
Tencent             Trojan.Win32.Agent.cby
Trapmine            malicious.high.ml.score
VBA32               BScope.TrojanSpy.LClipper
VIPRE               Gen:Variant.Zusy.556634
Varist              W32/VMProtect.EC.gen!Eldorado
VirIT               Trojan.Win32.Genus.WDT
Webroot             W32.Trojan.Gen
Zillya              Trojan.VMProtect.Win32.93512
huorong             Trojan/Agent.bss



firstSeen: 2024-11-29 05:59:37
ssz: 6 Mb
fname: 42a74c12c5fdb7a67bb2d9e36764214c
vt: Scan finished
hash: 42a74c12c5fdb7a67bb2d9e36764214c
date: 2024-11-29 05:59:37
compiled: Fri, Dec 11 2009, 21:31:37 - 32 Bit EXE
epSectIndex: 6
sects: .text, .rdata, .data, .7]D, .K<', .TEs
die: PE: linker: Microsoft Linker(6.0)[EXE32]
imphash: 4f2901c0f26912f101d33992f03f2ab2
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 46EDA1
epSect: .TEs
details:
APEX                Malicious
AVG                 Win32:TrojanX-gen [Trj]
AhnLab-V3           Trojan/Win.Generic.R651028
Antiy-AVL           Trojan/Win32.Agent
Arcabit             Trojan.Kelios.1
Avast               Win32:TrojanX-gen [Trj]
Avira               TR/Crypt.XPACK.Gen
BitDefender         Gen:Heur.Kelios.1
Bkav                W32.AIDetectMalware
CTX                 exe.unknown.kelios
CrowdStrike         win/malicious_confidence_100% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Trojan.Siggen30.10311
ESET-NOD32          a variant of Win32/Packed.VMProtect.AU suspicious
Elastic             malicious (high confidence)
Emsisoft            Gen:Heur.Kelios.1 (B)
F-Secure            Trojan.TR/Crypt.XPACK.Gen
FireEye             Generic.mg.42a74c12c5fdb7a6
Fortinet            Riskware/Application
GData               Win32.Trojan.PSE.17WGX8P
Google              Detected
Gridinsoft          Trojan.Heur!.022120A1
Ikarus              PUA.VMProtect
Jiangmin            TrojanClicker.Cycler.bxl
K7AntiVirus         Trojan ( 0059f3ce1 )
K7GW                Trojan ( 0059f3ce1 )
Kaspersky           Trojan-Clicker.Win32.Cycler.bent
Kingsoft            Win32.HeurC.KVMH008.a
Malwarebytes        Malware.AI.4246046164
MaxSecure           Trojan.Malware.300983.susgen
McAfee              GenericRXWP-FP!42A74C12C5FD
McAfeeD             Real Protect-LS!42A74C12C5FD
MicroWorld-eScan    Gen:Heur.Kelios.1
Microsoft           Trojan:Win32/PrivateLoader.RC!MTB
NANO-Antivirus      Trojan.Win32.Kelios.kktppb
Panda               Trj/Genetic.gen
Rising              Trojan.Kryptik@AI.96 (RDML:+zWbD0gC0yKi4tKacb8oYg)
Skyhigh             BehavesLike.Win32.Generic.vc
Sophos              Mal/Generic-S
Symantec            ML.Attribute.HighConfidence
Tencent             Malware.Win32.Gencirc.10bfc551
Trapmine            malicious.high.ml.score
VBA32               BScope.TrojanPSW.Coins
Varist              W32/Unruy.N.gen!Eldorado
Yandex              Riskware.VMProtect!OCZ3pd+HDXY
Zillya              Trojan.Cycler.Win32.2459
Zoner               Probably Heur.ExeHeaderL
tehtris             Generic.Malware



firstSeen: 2023-09-20 10:52:03
ssz: 6 Mb
fname: 44fb92185d2428c31a29a5819651d2cf
vt: Scan finished
hash: 44fb92185d2428c31a29a5819651d2cf
date: 2024-01-02 19:30:02
compiled: Tue, Sep 19 2023, 2:47:19 - 32 Bit EXE
epSectIndex: 6
sects: .text, .rdata, .data, .R4D, .&kg, .Vx1, .reloc, .rsrc
imphash: 2b4ac1d55288e311136b04b263ff8571
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 9F9FBB
epSect: .Vx1
details:
ALYac               Gen:Heur.Zygug.3
AVG                 Win32:MalwareX-gen [Trj]
AhnLab-V3           Trojan/Win.Generic.C5506420
Alibaba             Packed:Win32/VMProtect.7df5e15c
Antiy-AVL           GrayWare/Win32.Wacapew
Arcabit             Trojan.Zygug.3
Avast               Win32:MalwareX-gen [Trj]
BitDefender         Gen:Heur.Zygug.3
Bkav                W32.AIDetectMalware
CrowdStrike         win/malicious_confidence_100% (W)
Cylance             unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.AU suspicious
Emsisoft            Gen:Heur.Zygug.3 (B)
FireEye             Gen:Heur.Zygug.3
Fortinet            PossibleThreat.PALLAS.M
GData               Gen:Heur.Zygug.3
Lionic              Trojan.Win32.Generic.4!c
MAX                 malware (ai score=85)
Malwarebytes        Trojan.MalPack.PES
MaxSecure           Trojan.Malware.9266833.susgen
McAfee              Artemis!44FB92185D24
MicroWorld-eScan    Gen:Heur.Zygug.3
Rising              Trojan.Generic@AI.90 (RDML:0axkrD3TQinrVDbHovFKVg)
Sangfor             Trojan.Win32.Packed.Vky0
Skyhigh             BehavesLike.Win32.Generic.tc
Sophos              Generic Reputation PUA (PUA)
Symantec            ML.Attribute.HighConfidence
TrendMicro-HouseCallTROJ_GEN.R002H09IK23
VIPRE               Gen:Heur.Zygug.3


die:
PE: protector: VMProtect(2.X)[-]
	    PE: library: Qt(5.X)[-]
	    PE: linker: Microsoft Linker(14.29)[EXE32]

resNames:
67624   \ICON\1\1033
20      \GROUP_ICON\IDI_ICON1\1033
560     \VERSION\1\1033
638     \24\1\1033

fileProps:
CompanyName      CompanyName
FileDescription  iTubeGo
FileVersion      0.0.0.0
LegalCopyright   LegalCopyright
OriginalFilename itubegow.exe
ProductName      iTubeGo
ProductVersion   0.0.0.0


firstSeen: 2024-11-21 14:48:25
ssz: 9 Mb
fname: 528865813ccd9f4993ebfaa940ffb508
vt: Scan finished
hash: 528865813ccd9f4993ebfaa940ffb508
date: 2024-11-23 14:05:46
compiled: Fri, Aug 29 1941, 1:35:32 - 32 Bit .NET v4.0 EXE
epSectIndex: 4
sects: .text, .JC[, .r4M, .vTI, .rsrc, .reloc
die: PE: library: .NET(v4.0.30319)[-] PE: linker: Microsoft Linker(48.0*)[EXE32,console,admin]
resNames: 51473 \ICON\1\0 20 \GROUP_ICON\32512\0 860 \VERSION\1\0 4394 \24\1\0
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 10B36A2
epSect: .vTI
details:
ALYac               Gen:Variant.Barys.477683
APEX                Malicious
AVG                 Win32:MalwareX-gen [Trj]
AhnLab-V3           Trojan/Win.MalwareX-gen.C5660200
Alibaba             Packed:MSIL/VMProtect.17944143
Arcabit             Trojan.Barys.D749F3
Avast               Win32:MalwareX-gen [Trj]
Avira               HEUR/AGEN.1308572
BitDefender         Gen:Variant.Barys.477683
Bkav                W32.AIDetectMalware.CS
CTX                 exe.trojan.msil
CrowdStrike         win/malicious_confidence_100% (W)
Cylance             Unsafe
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of MSIL/Packed.VMProtect.D suspicious
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Barys.477683 (B)
F-Secure            Heuristic.HEUR/AGEN.1308572
FireEye             Generic.mg.528865813ccd9f49
Fortinet            Riskware/Application
GData               Gen:Variant.Barys.477683
Google              Detected
Gridinsoft          Trojan.Heur!.022134A1
Ikarus              PUA.MSIL.Vmprotect
K7AntiVirus         Trojan ( 005a54d91 )
K7GW                Trojan ( 005a54d91 )
Lionic              Trojan.Win32.Generic.4!c
Malwarebytes        Trojan.Injector
McAfee              Artemis!528865813CCD
McAfeeD             Real Protect-LS!528865813CCD
MicroWorld-eScan    Gen:Variant.Barys.477683
Microsoft           Program:Win32/Wacapew.C!ml
Paloalto            generic.ml
Panda               Trj/Chgt.AD
Rising              Malware.Obfus/MSIL@AI.84 (RDM.MSIL2:9jIhQNSw2e/UqRoCeGrIDg)
Sangfor             Trojan.Win32.Save.a
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.tc
Sophos              Generic Reputation PUA (PUA)
Symantec            ML.Attribute.HighConfidence
Trapmine            malicious.moderate.ml.score
VIPRE               Gen:Variant.Barys.477683
alibabacloud        VirTool:MSIL/Wacapew.C9nj


fileProps:
CompanyName      CompanyName
FileDescription  NerestPCInJector
FileVersion      1.0.0.0
InternalName     NerestPCInJector.exe
LegalCopyright   Copyright ©  2024
OriginalFilename NerestPCInJector.exe
ProductName      NerestPCInJector
ProductVersion   1.0.0.0


firstSeen: 2024-11-29 05:38:05
ssz: 6 Mb
fname: 546d968873517b99e87ad44c9404b294
vt: Scan finished
hash: 546d968873517b99e87ad44c9404b294
date: 2024-11-29 05:38:05
compiled: Sat, May 6 2017, 16:04:14 - 32 Bit EXE
epSectIndex: 8
sects: .text, .rdata, .data, .8 ,, .htext, .yeJ, .G{L, .J=T, .rsrc
die: PE: library: MFC(4.2)[-] PE: linker: Microsoft Linker(6.0)[EXE32]
imphash: 7e87a01ac42028a7dfe4775bb51d9c2e
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 537848
epSect: .J=T
details:
ALYac               Gen:Variant.Lazy.494320
APEX                Malicious
AVG                 Win32:Evo-gen [Trj]
AhnLab-V3           Trojan/Win.Nitol.R638630
Antiy-AVL           Trojan[Packed]/Win32.VMProtect.au
Arcabit             Trojan.Lazy.D78AF0
Avast               Win32:Evo-gen [Trj]
Avira               TR/Crypt.XPACK.Gen
BitDefender         Gen:Variant.Lazy.494320
Bkav                W32.AIDetectMalware
CTX                 exe.unknown.lazy
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.AU suspicious
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Lazy.494320 (B)
F-Secure            Trojan.TR/Crypt.XPACK.Gen
FireEye             Generic.mg.546d968873517b99
Fortinet            Riskware/Application
GData               Gen:Variant.Lazy.494320
Google              Detected
Gridinsoft          Malware.Win32.Nitol.st!n
Ikarus              PUA.VMProtect
Jiangmin            Backdoor.Farfli.hoq
K7AntiVirus         Trojan ( 0059f3ce1 )
K7GW                Trojan ( 0059f3ce1 )
Kingsoft            malware.kb.b.963
Malwarebytes        Generic.Malware.AI.DDS
McAfeeD             Real Protect-LS!546D96887351
MicroWorld-eScan    Gen:Variant.Lazy.494320
Microsoft           DDoS:Win32/Nitol!pz
NANO-Antivirus      Trojan.Win32.TrjGen.kkoomr
Panda               Trj/Genetic.gen
Sangfor             Trojan.Win32.Save.a
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.tc
Sophos              Generic ML PUA (PUA)
Symantec            ML.Attribute.HighConfidence
Tencent             Malware.Win32.Gencirc.10bfc093
Trapmine            malicious.high.ml.score
VBA32               BScope.TrojanPSW.Coins
VIPRE               Gen:Variant.Lazy.494320
Varist              W32/VMProtBad.BC.gen!Eldorado
Webroot             W32.Malware.gen
Yandex              Riskware.VMProtect!+YH7Wl4kKzo
Zillya              Backdoor.Farfli.Win32.15999
tehtris             Generic.Malware


resNames:
744     \ICON\1\2052
296     \ICON\2\2052
6156    \ICON\3\2052
744     \ICON\4\2052
296     \ICON\5\2052
3752    \ICON\6\2052
48      \GROUP_ICON\108\2052
48      \GROUP_ICON\128\2052
960     \VERSION\1\1033

fileProps:
CompanyName      Hello World
FileDescription  Clien Local RunProcess
FileVersion      10.0.14393.0 (rs1_release.160715-1616)
InternalName     hello.exe
LegalCopyright   All rights reserved.
OriginalFilename Hello World
ProductName      Hello World® Operating System
ProductVersion   17.000.14393.08


firstSeen: 2024-11-26 04:38:24
ssz: 6 Mb
fname: 54ae8aaae2d9d8fdd3190b59ca109560
vt: Scan finished
hash: 54ae8aaae2d9d8fdd3190b59ca109560
date: 2024-11-29 06:30:11
compiled: Fri, Dec 11 2009, 21:31:37 - 32 Bit EXE
epSectIndex: 7
sects: .text, .rdata, .data, .CbOb, .`o$, .Y<i, .VCF
die: PE: linker: Microsoft Linker(6.0)[EXE32]
imphash: 4f2901c0f26912f101d33992f03f2ab2
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 3AD86F
epSect: .VCF
details:
ALYac               Gen:Variant.Zusy.540547
APEX                Malicious
AVG                 Win32:Evo-gen [Trj]
AhnLab-V3           Trojan/Win.Generic.R640388
Antiy-AVL           GrayWare/Win32.Wacapew
Arcabit             Trojan.Zusy.D83F83
Avast               Win32:Evo-gen [Trj]
Avira               TR/AVI.Evo.orcvr
BitDefender         Gen:Variant.Zusy.540547
Bkav                W32.AIDetectMalware
CTX                 exe.trojan.generic
ClamAV              Win.Packed.Kelios-10023944-0
CrowdStrike         win/malicious_confidence_100% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Trojan.MulDrop28.44708
ESET-NOD32          a variant of Win32/Packed.VMProtect.AU suspicious
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Zusy.540547 (B)
F-Secure            Trojan.TR/AVI.Evo.orcvr
FireEye             Generic.mg.54ae8aaae2d9d8fd
Fortinet            Riskware/Application
GData               Gen:Variant.Zusy.540547
Google              Detected
Gridinsoft          Trojan.Heur!.022120A1
Ikarus              PUA.VMProtect
Jiangmin            TrojanClicker.Cycler.bxn
K7AntiVirus         Trojan ( 0059f3ce1 )
K7GW                Trojan ( 0059f3ce1 )
Kaspersky           Trojan-Clicker.Win32.Cycler.beng
Kingsoft            Win32.HeurC.KVMH008.a
Lionic              Trojan.Win32.Cycler.8!c
Malwarebytes        Malware.AI.221908809
MaxSecure           Trojan.Malware.300983.susgen
McAfee              Artemis!54AE8AAAE2D9
McAfeeD             Real Protect-LS!54AE8AAAE2D9
MicroWorld-eScan    Gen:Variant.Zusy.540547
Microsoft           Trojan:Win32/PrivateLoader.RC!MTB
NANO-Antivirus      Trojan.Win32.TrjGen.kktpho
Paloalto            generic.ml
Panda               Trj/Genetic.gen
Rising              Trojan.Clicker!8.1972 (TFE:3:hexVX6EEAWG)
SentinelOne         Static AI - Malicious PE
Sophos              Mal/Generic-S
Symantec            ML.Attribute.HighConfidence
Tencent             Malware.Win32.Gencirc.10bfc6e1
Trapmine            malicious.high.ml.score
TrendMicro          TROJ_GEN.R002C0DKQ24
TrendMicro-HouseCallTROJ_GEN.R002C0DKQ24
VBA32               BScope.TrojanPSW.Coins
VIPRE               Gen:Variant.Zusy.540547
Varist              W32/Unruy.N.gen!Eldorado
ViRobot             Trojan.Win.Z.Zusy.6144856
Yandex              Riskware.VMProtect!fYDaETDRrmU
Zillya              Trojan.Cycler.Win32.2464
Zoner               Probably Heur.ExeHeaderL
alibabacloud        Trojan[stealer]:Win/PrivateLoader.RW8PHU



firstSeen: 2024-11-29 05:12:06
ssz: 6 Mb
fname: 5645593b731acb8d709e8dba000dd38e
vt: Scan finished
hash: 5645593b731acb8d709e8dba000dd38e
date: 2024-11-29 05:12:06
compiled: Fri, Dec 11 2009, 21:31:37 - 32 Bit EXE
epSectIndex: 6
sects: .text, .rdata, .data, .7]D, .K<', .TEs
die: PE: linker: Microsoft Linker(6.0)[EXE32]
imphash: 4f2901c0f26912f101d33992f03f2ab2
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 46EDA1
epSect: .TEs
details:
APEX                Malicious
AVG                 Win32:TrojanX-gen [Trj]
AhnLab-V3           Trojan/Win.Generic.R651028
Antiy-AVL           Trojan/Win32.Agent
Arcabit             Trojan.Kelios.1
Avast               Win32:TrojanX-gen [Trj]
Avira               TR/Crypt.XPACK.Gen
BitDefender         Gen:Heur.Kelios.1
Bkav                W32.AIDetectMalware
CTX                 exe.unknown.kelios
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.AU suspicious
Elastic             malicious (high confidence)
Emsisoft            Gen:Heur.Kelios.1 (B)
F-Secure            Trojan.TR/Crypt.XPACK.Gen
FireEye             Generic.mg.5645593b731acb8d
Fortinet            Riskware/Application
GData               Win32.Trojan.PSE.17WGX8P
Google              Detected
Gridinsoft          Trojan.Heur!.022120A1
Ikarus              PUA.VMProtect
Jiangmin            TrojanClicker.Cycler.bxl
K7AntiVirus         Trojan ( 0059f3ce1 )
K7GW                Trojan ( 0059f3ce1 )
Kingsoft            malware.kb.b.988
Malwarebytes        Malware.AI.4246046164
MaxSecure           Trojan.Malware.300983.susgen
McAfee              GenericRXWP-FP!5645593B731A
McAfeeD             Real Protect-LS!5645593B731A
MicroWorld-eScan    Gen:Heur.Kelios.1
Microsoft           Trojan:Win32/PrivateLoader.RC!MTB
NANO-Antivirus      Trojan.Win32.Kelios.kktppb
Panda               Trj/Genetic.gen
Rising              Trojan.Kryptik@AI.96 (RDML:+zWbD0gC0yKi4tKacb8oYg)
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.vc
Sophos              Mal/Generic-S
Symantec            ML.Attribute.HighConfidence
Tencent             Malware.Win32.Gencirc.10bfc551
Trapmine            malicious.high.ml.score
VBA32               BScope.TrojanPSW.Coins
VIPRE               Gen:Heur.Kelios.1
Varist              W32/Unruy.N.gen!Eldorado
Yandex              Riskware.VMProtect!OCZ3pd+HDXY
Zillya              Trojan.Cycler.Win32.2459
Zoner               Probably Heur.ExeHeaderL
tehtris             Generic.Malware



firstSeen: 2024-07-16 15:34:58
ssz: 7 Mb
fname: 58d6dd7f014106317372469de062b882
vt: Scan finished
hash: 58d6dd7f014106317372469de062b882
date: 2024-11-21 12:56:09
compiled: Sun, Jan 27 1963, 5:15:36 - 32 Bit .NET v4.0 EXE
epSectIndex: 1
sects: .text, .reloc
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 70536E
epSect: .text
details:
ALYac               Gen:Variant.MSILHeracles.171679
APEX                Malicious
AVG                 Win32:MalwareX-gen [Trj]
Arcabit             Trojan.MSILHeracles.D29E9F
Avast               Win32:MalwareX-gen [Trj]
BitDefender         Gen:Variant.MSILHeracles.171679
CTX                 exe.trojan.msil
ClamAV              Win.Trojan.Bladbindi-1
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
DeepInstinct        MALICIOUS
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.MSILHeracles.171679 (B)
FireEye             Generic.mg.58d6dd7f01410631
Fortinet            PossibleThreat
GData               MSIL.Malware.MultiFakeObfus.A
Google              Detected
Ikarus              Trojan.MSIL.Vmprotect
Kaspersky           UDS:DangerousObject.Multi.Generic
Kingsoft            Win32.Riskware.Loader.fn
Lionic              Trojan.Win32.Generic.4!c
Malwarebytes        Malware.AI.1925467529
McAfee              Artemis!58D6DD7F0141
McAfeeD             Real Protect-LS!58D6DD7F0141
MicroWorld-eScan    Gen:Variant.MSILHeracles.171679
Microsoft           Trojan:Win32/AgentTesla!ml
Paloalto            generic.ml
Panda               Trj/Chgt.AD
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Trojan.wm
Sophos              Mal/Generic-S
Symantec            ML.Attribute.HighConfidence
Trapmine            suspicious.low.ml.score
TrendMicro-HouseCallTROJ_GEN.R002H07GG24
VBA32               OScope.Trojan.MSIL.Crypt.s1
VIPRE               Gen:Variant.MSILHeracles.171679
Varist              W32/ABTrojan.TOBK-3671
alibabacloud        Software:Multi/Wacatac.B9nj


die:
PE: protector: Agile .NET(-)[-]
	    PE: protector: Babel .NET(1.0-2.X)[-]
	    PE: protector: CliSecure(4.0-5.X)[-]
	    PE: protector: CodeVeil(4.X)[-]
	    PE: protector: CodeWall(4.X)[Evaluation]
	    PE: protector: Confuser(1.X)[-]
	    PE: protector: Crypto Obfuscator For .Net(5.X)[-]
	    PE: protector: DNGuard(-)[-]
	    PE: protector: Dotfuscator(-)[-]
	    PE: protector: Goliath(-)[-]
	    PE: packer: NsPacK(3.X)[-]
	    PE: protector: Obfuscator.NET 2009(-)[-]
	    PE: protector: Sixxpack(2.X)[-]
	    PE: protector: Yano(1.X)[-]
	    PE: library: .NET(v4.0.30319)[-]
	    PE: compiler: Borland Delphi(8)[-]
	    PE: compiler: VB.NET(-)[-]
	    PE: linker: Microsoft Linker(48.0*)[EXE32]


firstSeen: 2024-11-29 04:34:37
ssz: 6 Mb
fname: 59fadd5a091f7eb0b83aa3f92b139b66
vt: Scan finished
hash: 59fadd5a091f7eb0b83aa3f92b139b66
date: 2024-11-29 04:34:37
compiled: Fri, Dec 11 2009, 21:31:37 - 32 Bit EXE
epSectIndex: 6
sects: .text, .rdata, .data, .7]D, .K<', .TEs
die: PE: linker: Microsoft Linker(6.0)[EXE32]
imphash: 4f2901c0f26912f101d33992f03f2ab2
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 46EDA1
epSect: .TEs
details:
APEX                Malicious
AVG                 Win32:TrojanX-gen [Trj]
AhnLab-V3           Trojan/Win.Generic.R651028
Antiy-AVL           Trojan/Win32.Agent
Arcabit             Trojan.Kelios.1
Avast               Win32:TrojanX-gen [Trj]
Avira               TR/Crypt.XPACK.Gen
BitDefender         Gen:Heur.Kelios.1
Bkav                W32.AIDetectMalware
CTX                 exe.unknown.kelios
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Trojan.Siggen30.10310
ESET-NOD32          a variant of Win32/Packed.VMProtect.AU suspicious
Elastic             malicious (high confidence)
Emsisoft            Gen:Heur.Kelios.1 (B)
F-Secure            Trojan.TR/Crypt.XPACK.Gen
FireEye             Generic.mg.59fadd5a091f7eb0
Fortinet            Riskware/Application
GData               Win32.Trojan.PSE.17WGX8P
Google              Detected
Gridinsoft          Trojan.Heur!.022120A1
Ikarus              PUA.VMProtect
Jiangmin            TrojanClicker.Cycler.bxl
K7AntiVirus         Trojan ( 0059f3ce1 )
K7GW                Trojan ( 0059f3ce1 )
Kaspersky           Trojan-Clicker.Win32.Cycler.benj
Kingsoft            Win32.HeurC.KVMH008.a
Malwarebytes        Malware.AI.4246046164
MaxSecure           Trojan.Malware.300983.susgen
McAfee              GenericRXWP-FP!59FADD5A091F
McAfeeD             Real Protect-LS!59FADD5A091F
MicroWorld-eScan    Gen:Heur.Kelios.1
Microsoft           Trojan:Win32/PrivateLoader.RC!MTB
NANO-Antivirus      Trojan.Win32.Kelios.kktppb
Panda               Trj/Genetic.gen
Rising              Trojan.Kryptik@AI.96 (RDML:+zWbD0gC0yKi4tKacb8oYg)
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.vc
Sophos              Mal/Generic-S
Symantec            ML.Attribute.HighConfidence
Tencent             Malware.Win32.Gencirc.10bfc551
Trapmine            malicious.high.ml.score
VBA32               BScope.TrojanPSW.Coins
VIPRE               Gen:Heur.Kelios.1
Varist              W32/Unruy.N.gen!Eldorado
Yandex              Riskware.VMProtect!OCZ3pd+HDXY
Zillya              Trojan.Cycler.Win32.2459
Zoner               Probably Heur.ExeHeaderL
tehtris             Generic.Malware



firstSeen: 2024-11-29 04:59:28
ssz: 2 Mb
fname: 5b0b409d45a264369fadb60468541eed
vt: Scan finished
hash: 5b0b409d45a264369fadb60468541eed
date: 2024-11-29 04:59:28
compiled: Tue, May 7 2024, 12:27:29 - 32 Bit EXE
epSectIndex: 6
sects: .text, .rdata, .data, .1Q[, .),E, .sc=, .reloc
die: PE: linker: Microsoft Linker(14.29)[EXE32]
imphash: 847bf44a6099ee7a9c215a232e218aab
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 1A9119
epSect: .sc=
details:
ALYac               Gen:Variant.Zusy.556634
APEX                Malicious
AVG                 Win32:KeyloggerX-gen [Trj]
AhnLab-V3           Trojan/Win.Generic.R647582
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Arcabit             Trojan.Zusy.D87E5A
Avast               Win32:KeyloggerX-gen [Trj]
Avira               HEUR/AGEN.1374848
BitDefender         Gen:Variant.Zusy.556634
Bkav                W32.AIDetectMalware
CTX                 exe.unknown.zusy
ClamAV              Win.Packed.C2xk-10031869-0
CrowdStrike         win/malicious_confidence_100% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.BC suspicious
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Zusy.556634 (B)
F-Secure            Heuristic.HEUR/AGEN.1374848
FireEye             Generic.mg.5b0b409d45a26436
Fortinet            W32/Kryptik.HRTC!tr
GData               Win32.Trojan.PSE.1V4QVRM
Google              Detected
Gridinsoft          Trojan.Heur!.022120A1
Ikarus              PUA.VMProtect
Jiangmin            Trojan.Agent.ewwu
K7AntiVirus         Trojan ( 0059f91f1 )
K7GW                Trojan ( 0059f91f1 )
Kaspersky           Trojan.Win32.Agent2.mxh
Kingsoft            Win32.HeurC.KVMH008.a
Malwarebytes        Malware.AI.1010088143
MaxSecure           Trojan.Malware.273686129.susgen
McAfeeD             Real Protect-LS!5B0B409D45A2
MicroWorld-eScan    Gen:Variant.Zusy.556634
Microsoft           Trojan:Win32/KeyLogger.ASL!MTB
NANO-Antivirus      Trojan.Win32.Redcap.koeegm
Panda               Trj/Genetic.gen
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.tc
Sophos              Generic ML PUA (PUA)
Symantec            ML.Attribute.HighConfidence
TACHYON             Trojan/W32.Agent.1589760.V
Tencent             Trojan.Win32.Agent.cby
Trapmine            malicious.high.ml.score
VBA32               BScope.TrojanSpy.LClipper
VIPRE               Gen:Variant.Zusy.556634
Varist              W32/VMProtect.EC.gen!Eldorado
VirIT               Trojan.Win32.Genus.WDT
Webroot             W32.Trojan.Gen
Zillya              Trojan.VMProtect.Win32.93512
huorong             Trojan/Agent.bss



firstSeen: 2024-11-29 13:43:40
ssz: 2 Mb
fname: 5b7b292035b103cbb6a68a6831652497
vt: Scan finished
hash: 5b7b292035b103cbb6a68a6831652497
date: 2024-11-29 13:43:40
compiled: Sun, Sep 12 2021, 7:32:25 - 32 Bit EXE
epSectIndex: 6
sects: cH3Dj, cH3Djd, 3Twky, 3Twky, 3Twk, 3Twky, 3Twky
die: PE: compiler: Microsoft Visual C/C++(6.0)[-] PE: linker: Microsoft Linker(6.0)[EXE32]
resNames: 604 \VERSION\1\2052
imphash: 56701e66a09015019e446765d657c56d
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 103E98
epSect: 3Twky
details:
ALYac               Gen:Variant.Lazy.624471
APEX                Malicious
AVG                 Win32:MalwareX-gen [Trj]
AhnLab-V3           Trojan/Win.Generic.R665143
Antiy-AVL           Trojan[Packed]/Win32.Vemply
Arcabit             Trojan.Lazy.D98757
Avast               Win32:MalwareX-gen [Trj]
Avira               TR/Crypt.ZPACK.Gen
Baidu               Win32.Packed.VMProtect.a
BitDefender         Gen:Variant.Lazy.624471
Bkav                W32.AIDetectMalware
CAT-QuickHeal       Trojan.GenericRI.S23452157
CTX                 exe.unknown.lazy
ClamAV              Win.Dropper.Tiggre-9845940-0
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.ABD
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Lazy.624471 (B)
F-Secure            Trojan.TR/Crypt.ZPACK.Gen
FireEye             Generic.mg.5b7b292035b103cb
Fortinet            W32/VMProtect.ABD!tr
GData               Win32.Trojan-Stealer.BlackMoon.D
Google              Detected
Gridinsoft          Trojan.Heur!.032920A1
Ikarus              Trojan.Win32.VMProtect
Jiangmin            Packed.Vemply.jjn
K7AntiVirus         Trojan ( 7000001c1 )
K7GW                Trojan ( 7000001c1 )
Kaspersky           VHO:Packed.Win32.Vemply.gen
Malwarebytes        Generic.Malware.AI.DDS
McAfeeD             Real Protect-LS!5B7B292035B1
MicroWorld-eScan    Gen:Variant.Lazy.624471
Microsoft           Trojan:Win32/Zusy.EM!MTB
Panda               Trj/Genetic.gen
Sangfor             Trojan.Win32.Save.BlackMoon
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.tc
Sophos              Mal/VMProtBad-A
Symantec            ML.Attribute.HighConfidence
Tencent             Packed.Win32.Vemply.he
Trapmine            malicious.high.ml.score
VBA32               BScope.Trojan.Dynamer
VIPRE               Gen:Variant.Lazy.624471
Varist              W32/Agent.JKA.gen!Eldorado
Zillya              Trojan.VMProtect.Win32.99252
huorong             Trojan/FakeAPP.s


fileProps:
FileDescription  ????????
FileVersion      1.0.2107.6
LegalCopyright   Tencent Limited.All Rights Reserved.
ProductName      ????????
ProductVersion   1.0.2107.6

rich:
offset DanS:128
offset Rich:216
Size: 88
checkSum: 0xCB928CDE Matches!

clearData: DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00{\x1C\x0C\x00\x01\x00\x00\x00\x83\x1C\x0E\x00\x18\x00\x00\x006&\x0A\x00\x89\x00\x00\x00\xE8\x1F\x0A\x00\x02\x00\x00\x00\x00\x00\x01\x00\x8B\x00\x00\x00\xC3\x0F]\x00\x0D\x00\x00\x006&\x0B\x00E\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\xE8\x1F\x0B\x00\x03\x00\x00\x00

9 entries
--------------------------------------------------
Compiler: 7291
toolID: 12
Count: 1
toolName: AliasObj60
vsVer: Visual Studio 6 (06.00)

Compiler: 7299
toolID: 14
Count: 24
toolName: Masm613
vsVer: Visual Studio 6 (06.00)

Compiler: 9782
toolID: 10
Count: 137
toolName: Utc12_C
vsVer: Visual Studio 6 (06.00)

Compiler: 8168
toolID: 10
Count: 2
toolName: Utc12_C
vsVer: Visual Studio 6 (06.00)

Compiler: 0
toolID: 1
Count: 139
toolName: Import0
vsVer: Visual Studio (00.00)

Compiler: 4035
toolID: 93
Count: 13
toolName: Implib710
vsVer: Visual Studio 2003 (07.10)

Compiler: 9782
toolID: 11
Count: 69
toolName: Utc12_CPP
vsVer: Visual Studio 6 (06.00)

Compiler: 0
toolID: 0
Count: 1
toolName: 
vsVer: <unknown> (00.00)

Compiler: 8168
toolID: 11
Count: 3
toolName: Utc12_CPP
vsVer: Visual Studio 6 (06.00)


firstSeen: 2024-08-01 11:10:31
ssz: 5 Mb
fname: 5d04da31238ff20998723b09affd65d3
vt: Scan finished
hash: 5d04da31238ff20998723b09affd65d3
date: 2024-11-29 09:14:19
compiled: Thu, Aug 1 2024, 9:46:35 - 32 Bit EXE
epSectIndex: 5
sects: .text, .rdata, .data, .inx0, .inx1, .rsrc
die: PE: protector: VMProtect(-)[-] PE: linker: Microsoft Linker(14.16)[EXE32,admin,signed]
pdb: D:\Jenkins\.jenkins\workspace\master_lu\inst_ui\inst_ui\Release\å•è¯é£Žæš´_b015226917.pdb
imphash: 71ad6cbfc67b4da8fcef13151713f4d5
pever: DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 94515F
epSect: .inx1
sig: Valid
sigDetails: Subject: ?????????? Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
details:
ALYac               Gen:Variant.Babar.544568
AVG                 Win32:MalwareX-gen [Trj]
AhnLab-V3           PUP/Win.Generic.C5660685
Alibaba             Downloader:Win32/MalwareX.2047b2bb
Arcabit             Trojan.Babar.D84F38
Avast               Win32:MalwareX-gen [Trj]
BitDefender         Gen:Variant.Babar.544568
Bkav                W32.Common.A116FAED
CTX                 exe.trojan.generic
Cylance             Unsafe
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Generik.ESWJTPW potentially unwanted
Emsisoft            Gen:Variant.Babar.544568 (B)
FireEye             Gen:Variant.Babar.544568
Fortinet            Riskware/Application
GData               Gen:Variant.Babar.544568
Gridinsoft          Trojan.Heur!.00254021
Jiangmin            Trojan.Agentb.pit
K7AntiVirus         Adware ( 005ba59d1 )
K7GW                Adware ( 005ba59d1 )
Kaspersky           not-a-virus:Downloader.Win32.Agent.nswp
Lionic              Riskware.Win32.Agent.1!c
Malwarebytes        Generic.Malware.AI.DDS
MaxSecure           Trojan.Malware.276057441.susgen
McAfee              Artemis!5D04DA31238F
McAfeeD             ti!F1EA3DD89B90
MicroWorld-eScan    Gen:Variant.Babar.544568
Microsoft           PUA:Win32/Packunwan
Paloalto            generic.ml
Panda               PUP/Generic
Rising              PUA.Undefined!8.132FE (C64:YzY0Oos5GrIJ9D+C)
Skyhigh             Artemis!Trojan
Sophos              Generic Reputation PUA (PUA)
VIPRE               Gen:Variant.Babar.544568
Varist              W32/ABApplication.DUMT-2730
ViRobot             Trojan.Win.S.Agent.5702624
Xcitium             ApplicUnwnt@#1d8w9aplsrdtz
alibabacloud        Trojan[downloader]:Win/Packunwan.Gen


exports:
@1 TitanSDK_AddHttpHeaderBypassKey
@2 TitanSDK_AsyncOpenSession
@3 TitanSDK_CloseSession
@4 TitanSDK_CloseSwarm
@5 TitanSDK_GetDownloadUrl
@6 TitanSDK_GetFlow
@7 TitanSDK_GetFlowDone
@8 TitanSDK_GetVodUrl
@9 TitanSDK_OnNetworkChanged
@10 TitanSDK_OpenSwarm
@11 TitanSDK_PlayQuality
@12 TitanSDK_PlayStatistics
@13 TitanSDK_SetListenPort
@14 TitanSDK_SetPauseTimeout
@15 TitanSDK_SetSleepTimeout
@16 TitanSDK_SetStartCallback
@17 TitanSDK_SetToken
@18 TitanSDK_SetWorkspace
@19 TitanSDK_Start
@20 TitanSDK_Stop
@21 pthreadCancelableTimedWait
@22 pthreadCancelableWait
@23 pthread_attr_destroy
@24 pthread_attr_getdetachstate
@25 pthread_attr_getinheritsched
@26 pthread_attr_getschedparam
@27 pthread_attr_getschedpolicy
@28 pthread_attr_getscope
@29 pthread_attr_getstackaddr
@30 pthread_attr_getstacksize
@31 pthread_attr_init
@32 pthread_attr_setdetachstate
@33 pthread_attr_setinheritsched
@34 pthread_attr_setschedparam
@35 pthread_attr_setschedpolicy
@36 pthread_attr_setscope
@37 pthread_attr_setstackaddr
@38 pthread_attr_setstacksize
@39 pthread_barrier_destroy
@40 pthread_barrier_init
@41 pthread_barrier_wait
@42 pthread_barrierattr_destroy
@43 pthread_barrierattr_getpshared
@44 pthread_barrierattr_init
@45 pthread_barrierattr_setpshared
@46 pthread_cancel
@47 pthread_cond_broadcast
@48 pthread_cond_destroy
@49 pthread_cond_init
@50 pthread_cond_signal
@51 pthread_cond_timedwait
@52 pthread_cond_wait
@53 pthread_condattr_destroy
@54 pthread_condattr_getpshared
@55 pthread_condattr_init
@56 pthread_condattr_setpshared
@57 pthread_create
@58 pthread_delay_np
@59 pthread_detach
@60 pthread_equal
@61 pthread_exit
@62 pthread_getconcurrency
@63 pthread_getschedparam
@64 pthread_getspecific
@65 pthread_getunique_np
@66 pthread_getw32threadhandle_np
@67 pthread_getw32threadid_np
@68 pthread_join
@69 pthread_key_create
@70 pthread_key_delete
@71 pthread_kill
@72 pthread_mutex_consistent
@73 pthread_mutex_destroy
@74 pthread_mutex_init
@75 pthread_mutex_lock
@76 pthread_mutex_timedlock
@77 pthread_mutex_trylock
@78 pthread_mutex_unlock
@79 pthread_mutexattr_destroy
@80 pthread_mutexattr_getkind_np
@81 pthread_mutexattr_getpshared
@82 pthread_mutexattr_getrobust
@83 pthread_mutexattr_gettype
@84 pthread_mutexattr_init
@85 pthread_mutexattr_setkind_np
@86 pthread_mutexattr_setpshared
@87 pthread_mutexattr_setrobust
@88 pthread_mutexattr_settype
@89 pthread_num_processors_np
@90 pthread_once
@91 pthread_rwlock_destroy
@92 pthread_rwlock_init
@93 pthread_rwlock_rdlock
@94 pthread_rwlock_timedrdlock
@95 pthread_rwlock_timedwrlock
@96 pthread_rwlock_tryrdlock
@97 pthread_rwlock_trywrlock
@98 pthread_rwlock_unlock
@99 pthread_rwlock_wrlock
@100 pthread_rwlockattr_destroy
@101 pthread_rwlockattr_getpshared
@102 pthread_rwlockattr_init
@103 pthread_rwlockattr_setpshared
@104 pthread_self
@105 pthread_setcancelstate
@106 pthread_setcanceltype
@107 pthread_setconcurrency
@108 pthread_setschedparam
@109 pthread_setspecific
@110 pthread_spin_destroy
@111 pthread_spin_init
@112 pthread_spin_lock
@113 pthread_spin_trylock
@114 pthread_spin_unlock
@115 pthread_testcancel
@116 pthread_timechange_handler_np
@117 pthread_win32_process_attach_np
@118 pthread_win32_process_detach_np
@119 pthread_win32_test_features_np
@120 pthread_win32_thread_attach_np
@121 pthread_win32_thread_detach_np
@122 ptw32_get_exception_services_code
@123 ptw32_pop_cleanup
@124 ptw32_push_cleanup
@125 sched_get_priority_max
@126 sched_get_priority_min
@127 sched_getscheduler
@128 sched_setscheduler
@129 sched_yield
@130 sem_close
@131 sem_destroy
@132 sem_getvalue
@133 sem_init
@134 sem_open
@135 sem_post
@136 sem_post_multiple
@137 sem_timedwait
@138 sem_trywait
@139 sem_unlink
@140 sem_wait

resNames:
3752    \ICON\1\2052
2216    \ICON\2\2052
1384    \ICON\3\2052
9640    \ICON\4\2052
4264    \ICON\5\2052
1128    \ICON\6\2052
90      \GROUP_ICON\128\2052
576     \VERSION\1\2052
4249    \24\1\1033

fileProps:
FileDescription  ????
FileVersion      6.1024.1225.801
InternalName     inst.exe
LegalCopyright   Copyright (C) 2024
ProductName      ????
ProductVersion   6.1024.1225.801

rich:
offset DanS:128
offset Rich:328
Size: 200
checkSum: 0x18B9E67B Matches!

clearData: DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x09x\x93\x00\x18\x00\x00\x00Rh\x01\x01\x02\x00\x00\x00Rh\x03\x01\x0D\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\xA1i\x04\x01\xDE\x01\x00\x00\xA8i\x04\x01J\x00\x00\x00Ag\x05\x01\x04\x00\x00\x00\x97i\x04\x01\x03\x00\x00\x00\x98i\x05\x01\x06\x00\x00\x00\x9E\xA0\xC7\x00\x0A\x00\x00\x00\x97i\x05\x01\x06\x00\x00\x00Rh\x04\x01\x1D\x00\x00\x00\xABi\x05\x01\x0F\x00\x00\x00Rh\x05\x01<\x00\x00\x00\xDD\xFF\xCE\x00\x01\x00\x00\x00\xDD\xFF\xCB\x00\x0D\x00\x00\x00\xDD\xFF\xD0\x00\x02\x00\x00\x00\x00\x00\x01\x00\x95\x02\x00\x00\xABi\x09\x01\x90\x00\x00\x00\xABi\x00\x01\x01\x00\x00\x00\xABi\xFF\x00\x01\x00\x00\x00\x00\x00\x97\x00\x01\x00\x00\x00\xABi\x02\x01\x01\x00\x00\x00

23 entries
--------------------------------------------------
Compiler: 30729
toolID: 147
Count: 24
toolName: Implib900
vsVer: Visual Studio 2008 (09.00)

Compiler: 26706
toolID: 257
Count: 2
toolName: Implib1400
vsVer: Visual Studio 2015 (14.00)

Compiler: 26706
toolID: 259
Count: 13
toolName: Masm1400
vsVer: Visual Studio 2015 (14.00)

Compiler: 0
toolID: 0
Count: 20
toolName: 
vsVer: <unknown> (00.00)

Compiler: 27041
toolID: 260
Count: 478
toolName: Utc1900_C
vsVer: Visual Studio 2015 (14.00)

Compiler: 27048
toolID: 260
Count: 74
toolName: Utc1900_C
vsVer: Visual Studio 2015 (14.00)

Compiler: 26433
toolID: 261
Count: 4
toolName: Utc1900_CPP
vsVer: Visual Studio 2015 (14.00)

Compiler: 27031
toolID: 260
Count: 3
toolName: Utc1900_C
vsVer: Visual Studio 2015 (14.00)

Compiler: 27032
toolID: 261
Count: 6
toolName: Utc1900_CPP
vsVer: Visual Studio 2015 (14.00)

Compiler: -24418
toolID: 199
Count: 10
toolName: AliasObj1100
vsVer: Visual Studio 2012 (11.00)

Compiler: 27031
toolID: 261
Count: 6
toolName: Utc1900_CPP
vsVer: Visual Studio 2015 (14.00)

Compiler: 26706
toolID: 260
Count: 29
toolName: Utc1900_C
vsVer: Visual Studio 2015 (14.00)

Compiler: 27051
toolID: 261
Count: 15
toolName: Utc1900_CPP
vsVer: Visual Studio 2015 (14.00)

Compiler: 26706
toolID: 261
Count: 60
toolName: Utc1900_CPP
vsVer: Visual Studio 2015 (14.00)

Compiler: -35
toolID: 206
Count: 1
toolName: Utc1700_C
vsVer: Visual Studio 2012 (11.00)

Compiler: -35
toolID: 203
Count: 13
toolName: Implib1100
vsVer: Visual Studio 2012 (11.00)

Compiler: -35
toolID: 208
Count: 2
toolName: Utc1700_CVTCIL_C
vsVer: Visual Studio 2012 (11.00)

Compiler: 0
toolID: 1
Count: 661
toolName: Import0
vsVer: Visual Studio (00.00)

Compiler: 27051
toolID: 265
Count: 144
toolName: Utc1900_LTCG_CPP
vsVer: Visual Studio 2015 (14.00)

Compiler: 27051
toolID: 256
Count: 1
toolName: Export1400
vsVer: Visual Studio 2015 (14.00)

Compiler: 27051
toolID: 255
Count: 1
toolName: Cvtres1400
vsVer: Visual Studio 2015 (14.00)

Compiler: 0
toolID: 151
Count: 1
toolName: Resource
vsVer: Visual Studio 2008 (09.00)

Compiler: 27051
toolID: 258
Count: 1
toolName: Linker1400
vsVer: Visual Studio 2015 (14.00)


firstSeen: 2024-11-29 04:35:47
ssz: 6 Mb
fname: 5eba3c6a033e9e273c90f1d88bfb116d
vt: Scan finished
hash: 5eba3c6a033e9e273c90f1d88bfb116d
date: 2024-11-29 04:35:47
compiled: Fri, Dec 11 2009, 21:31:37 - 32 Bit EXE
epSectIndex: 6
sects: .text, .rdata, .data, .7]D, .K<', .TEs
die: PE: linker: Microsoft Linker(6.0)[EXE32]
imphash: 4f2901c0f26912f101d33992f03f2ab2
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 46EDA1
epSect: .TEs
details:
APEX                Malicious
AVG                 Win32:TrojanX-gen [Trj]
AhnLab-V3           Trojan/Win.Generic.R651028
Antiy-AVL           Trojan/Win32.Agent
Arcabit             Trojan.Kelios.1
Avast               Win32:TrojanX-gen [Trj]
Avira               TR/Crypt.XPACK.Gen
BitDefender         Gen:Heur.Kelios.1
Bkav                W32.AIDetectMalware
CTX                 exe.unknown.kelios
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Trojan.Siggen30.10309
ESET-NOD32          a variant of Win32/Packed.VMProtect.AU suspicious
Elastic             malicious (high confidence)
Emsisoft            Gen:Heur.Kelios.1 (B)
F-Secure            Trojan.TR/Crypt.XPACK.Gen
FireEye             Generic.mg.5eba3c6a033e9e27
Fortinet            Riskware/Application
GData               Win32.Trojan.PSE.17WGX8P
Google              Detected
Gridinsoft          Trojan.Heur!.022120A1
Ikarus              PUA.VMProtect
Jiangmin            TrojanClicker.Cycler.bxl
K7AntiVirus         Trojan ( 0059f3ce1 )
K7GW                Trojan ( 0059f3ce1 )
Kaspersky           Trojan-Clicker.Win32.Cycler.benk
Kingsoft            Win32.HeurC.KVMH008.a
Malwarebytes        Malware.AI.4246046164
McAfee              GenericRXWP-FP!5EBA3C6A033E
McAfeeD             Real Protect-LS!5EBA3C6A033E
MicroWorld-eScan    Gen:Heur.Kelios.1
Microsoft           Trojan:Win32/PrivateLoader.RC!MTB
NANO-Antivirus      Trojan.Win32.Kelios.kktppb
Panda               Trj/Genetic.gen
Rising              Trojan.Kryptik@AI.96 (RDML:+zWbD0gC0yKi4tKacb8oYg)
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.vc
Sophos              Mal/Generic-S
Symantec            ML.Attribute.HighConfidence
Tencent             Malware.Win32.Gencirc.10bfc551
Trapmine            malicious.high.ml.score
VBA32               BScope.TrojanPSW.Coins
VIPRE               Gen:Heur.Kelios.1
Varist              W32/Unruy.N.gen!Eldorado
Yandex              Riskware.VMProtect!OCZ3pd+HDXY
Zillya              Trojan.Cycler.Win32.2459
Zoner               Probably Heur.ExeHeaderL
tehtris             Generic.Malware



firstSeen: 2024-11-29 14:55:18
ssz: 3 Mb
fname: 62ce2eca8a59866973dc90116ee567a7
vt: Scan finished
hash: 62ce2eca8a59866973dc90116ee567a7
date: 2024-11-29 14:55:18
compiled: Tue, Jun 13 2023, 7:17:19 - 32 Bit EXE
epSectIndex: 6
sects: .text, .rdata, .data, .5q#, .l`X, .o/j, .reloc, .rsrc
die: PE: linker: Microsoft Linker(9.0)[EXE32]
imphash: d41d8cd98f00b204e9800998ecf8427e
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 7DA21E
epSect: .o/j
details:
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Bkav                W32.AIDetectMalware
CrowdStrike         win/malicious_confidence_60% (D)
Gridinsoft          Trojan.Heur!.023920A1
Malwarebytes        Trojan.MalPack.PES
SentinelOne         Static AI - Suspicious PE
Skyhigh             BehavesLike.Win32.Generic.wc
Trapmine            malicious.moderate.ml.score



firstSeen: 2024-11-29 00:58:17
ssz: 9 Mb
fname: 64e899b6ba4330a8963914e48221e5a7
vt: Scan finished
hash: 64e899b6ba4330a8963914e48221e5a7
date: 2024-11-29 00:58:17
compiled: Sun, Aug 1 2010, 10:32:37 - 32 Bit EXE
epSectIndex: 4
sects: ., ., .lol 0, .lol 1, .
die: PE: packer: MPRESS(-)[-] PE: linker: unknown(2.50)[EXE32]
resNames: 611 \24\1\1033
imphash: 65b6862e9898b195f4ef7a1685fd82dd
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 15CB7
epSect: .lol 1
details:
ALYac               GenPack:Trojan.Agent.EXMP
APEX                Malicious
AVG                 Win32:MalwareX-gen [Trj]
Acronis             suspicious
Antiy-AVL           GrayWare/Win32.Ausiv.a
Arcabit             GenPack:Trojan.Agent.EXMP
Avast               Win32:MalwareX-gen [Trj]
Avira               TR/Black.Gen2
BitDefender         GenPack:Trojan.Agent.EXMP
Bkav                W32.AIDetectMalware
CAT-QuickHeal       W32.Sivis.V5
CTX                 exe.trojan.exmp
ClamAV              Win.Malware.Ausiv-9940816-0
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Win32.HLLP.Siggen.53
ESET-NOD32          a variant of Win32/Ausiv.A
Elastic             malicious (high confidence)
Emsisoft            GenPack:Trojan.Agent.EXMP (B)
F-Secure            Trojan.TR/Black.Gen2
FireEye             Generic.mg.64e899b6ba4330a8
Fortinet            W32/VMProtect.ACO!tr
GData               GenPack:Trojan.Agent.EXMP
Google              Detected
Gridinsoft          Trojan.Win32.Gen.bot!s4
Ikarus              wormWin32.AutoRun.Delf
Jiangmin            Trojan.Generic.bvcco
K7AntiVirus         Trojan ( 7000001c1 )
K7GW                Trojan ( 7000001c1 )
Kaspersky           HEUR:Trojan.Win32.Generic
Kingsoft            malware.kb.b.920
Malwarebytes        Generic.Malware.AI.DDS
MaxSecure           Trojan.WIN32.generickd.45914965
McAfee              GenericRXDR-HK!64E899B6BA43
McAfeeD             Real Protect-LS!64E899B6BA43
MicroWorld-eScan    GenPack:Trojan.Agent.EXMP
Microsoft           Trojan:Win32/Ausiv
Panda               Trj/Genetic.gen
Rising              Trojan.Ausiv!1.A52C (CLASSIC)
Sangfor             Worm.Win32.Save.a
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.rh
Sophos              Mal/VMProtBad-A
Symantec            W32.Suviapen
Tencent             Trojan.Win32.Ausiv.abc
Trapmine            malicious.high.ml.score
VBA32               Trojan.Ausiv
VIPRE               GenPack:Trojan.Agent.EXMP
Varist              W32/Ausiv.F.gen!Eldorado
VirIT               Trojan.Win32.Ausiv.A
Webroot             W32.Trojan.Gen
Xcitium             TrojWare.Win32.Ausiv.A@7gzgk5
Yandex              Trojan.GenAsa!wNuUW5HMkU4
Zillya              Trojan.Heur.Win32.10174
huorong             Trojan/Obfuscated.dm
tehtris             Generic.Malware



firstSeen: 2022-11-30 07:49:24
ssz: 3 Mb
fname: 66f23aaf3c99870f806d753134fa7032
vt: Scan finished
hash: 66f23aaf3c99870f806d753134fa7032
date: 2024-02-16 00:43:34
compiled: Sun, Mar 20 2022, 15:49:33 - 32 Bit EXE
epSectIndex: 6
sects: .text, .rdata, .data, .gfids, .ado0, .ado1, .reloc, .rsrc
die: PE: protector: VMProtect(1.X)[-] PE: linker: Microsoft Linker(14.0)[EXE32]
imphash: 8d68e8c7ea8b5da43e199de7a4b922da
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 2A57F2
epSect: .ado1
details:
ALYac               Gen:Variant.Fragtor.172083
APEX                Malicious
AVG                 Win32:TrojanX-gen [Trj]
Alibaba             Trojan:Win32/VMProtBad.1c025e25
Antiy-AVL           Trojan/Win32.Generic
Arcabit             Trojan.Fragtor.D2A033
Avast               Win32:TrojanX-gen [Trj]
BitDefender         Gen:Variant.Fragtor.172083
BitDefenderTheta    Gen:NN.ZexaF.36744.II0@aGy5yJej
Bkav                W32.AIDetectMalware
CrowdStrike         win/malicious_confidence_100% (W)
Cybereason          malicious.34e28b
Cylance             unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Generik.FBLACBA
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Fragtor.172083 (B)
FireEye             Generic.mg.66f23aaf3c99870f
Fortinet            W32/PossibleThreat
GData               Gen:Variant.Fragtor.172083
Google              Detected
Gridinsoft          Trojan.Heur!.02296021
Ikarus              Trojan.Win32.VMProtect
K7AntiVirus         Trojan ( 7000001c1 )
K7GW                Trojan ( 7000001c1 )
Kaspersky           UDS:Trojan.Win32.Generic
Lionic              Trojan.Win32.Generic.4!c
MAX                 malware (ai score=80)
Malwarebytes        MachineLearning/Anomalous.100%
MaxSecure           Trojan.Malware.7164915.susgen
McAfee              Artemis!66F23AAF3C99
MicroWorld-eScan    Gen:Variant.Fragtor.172083
Microsoft           Trojan:Win32/Phonzy.A!ml
NANO-Antivirus      Virus.Win32.Gen.ccmw
Panda               Trj/Chgt.AC
Rising              Trojan.Generic@AI.99 (RDML:lrBonRt4H2lyXiW2hyElWw)
Sangfor             Suspicious.Win32.Save.a
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.vc
Sophos              Mal/VMProtBad-A
Symantec            ML.Attribute.HighConfidence
Tencent             Malware.Win32.Gencirc.13b92d73
Trapmine            malicious.moderate.ml.score
TrendMicro          TROJ_GEN.R002C0RB124
TrendMicro-HouseCallTROJ_GEN.R002C0RB124
VIPRE               Gen:Variant.Fragtor.172083
Varist              W32/ABTrojan.MPMP-2121
Zillya              Trojan.Generic.Win32.1679247
ZoneAlarm           UDS:Trojan.Win32.Generic
tehtris             Generic.Malware


resNames:
68695   \ICON\1\2052
4264    \ICON\2\2052
20      \GROUP_ICON\105\2052
20      \GROUP_ICON\106\2052
672     \VERSION\1\2052
638     \24\1\1033

fileProps:
CompanyName      Ado
FileDescription  AVA ??/?? ??
FileVersion      1.4.0.8
InternalName     Ado1408.exe
LegalCopyright   Copyright (C) 2022
OriginalFilename Ado1408.exe
ProductName      Ado1408
ProductVersion   1.4.0.8

rich:
offset DanS:128
offset Rich:248
Size: 120
checkSum: 0x706C609B Matches!

clearData: DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xB4\x9C\xF1\x00\x09\x00\x00\x00\xB4\x9C\xF3\x00z\x00\x00\x00\xB4\x9C\xF2\x00\x18\x00\x00\x00;^\x03\x01\x14\x00\x00\x00;^\x04\x01\x12\x00\x00\x00\x09x\x93\x00\x02\x00\x00\x00;^\x05\x01'\x00\x00\x00\xDD\xFF\xCB\x00\x09\x00\x00\x00\x00\x00\x01\x00\x81\x00\x00\x00\x97^\x09\x01\x01\x00\x00\x00\x92^\xFF\x00\x01\x00\x00\x00\x00\x00\x97\x00\x01\x00\x00\x00\x97^\x02\x01\x01\x00\x00\x00

13 entries
--------------------------------------------------
Compiler: -25420
toolID: 241
Count: 9
toolName: Masm1210
vsVer: Visual Studio 2013 (12.10)

Compiler: -25420
toolID: 243
Count: 122
toolName: Utc1810_CPP
vsVer: Visual Studio 2013 (12.10)

Compiler: -25420
toolID: 242
Count: 24
toolName: Utc1810_C
vsVer: Visual Studio 2013 (12.10)

Compiler: 24123
toolID: 259
Count: 20
toolName: Masm1400
vsVer: Visual Studio 2015 (14.00)

Compiler: 24123
toolID: 260
Count: 18
toolName: Utc1900_C
vsVer: Visual Studio 2015 (14.00)

Compiler: 30729
toolID: 147
Count: 2
toolName: Implib900
vsVer: Visual Studio 2008 (09.00)

Compiler: 24123
toolID: 261
Count: 39
toolName: Utc1900_CPP
vsVer: Visual Studio 2015 (14.00)

Compiler: -35
toolID: 203
Count: 9
toolName: Implib1100
vsVer: Visual Studio 2012 (11.00)

Compiler: 0
toolID: 1
Count: 129
toolName: Import0
vsVer: Visual Studio (00.00)

Compiler: 24215
toolID: 265
Count: 1
toolName: Utc1900_LTCG_CPP
vsVer: Visual Studio 2015 (14.00)

Compiler: 24210
toolID: 255
Count: 1
toolName: Cvtres1400
vsVer: Visual Studio 2015 (14.00)

Compiler: 0
toolID: 151
Count: 1
toolName: Resource
vsVer: Visual Studio 2008 (09.00)

Compiler: 24215
toolID: 258
Count: 1
toolName: Linker1400
vsVer: Visual Studio 2015 (14.00)


firstSeen: 2024-11-29 05:46:00
ssz: 6 Mb
fname: 678987b11e5c7336930c5670fd302748
vt: Scan finished
hash: 678987b11e5c7336930c5670fd302748
date: 2024-11-29 05:46:00
compiled: Fri, Dec 11 2009, 21:31:37 - 32 Bit EXE
epSectIndex: 7
sects: .text, .rdata, .data, .CbOb, .`o$, .Y<i, .VCF
die: PE: linker: Microsoft Linker(6.0)[EXE32]
imphash: 4f2901c0f26912f101d33992f03f2ab2
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 3AD86F
epSect: .VCF
details:
ALYac               Gen:Variant.Zusy.540547
APEX                Malicious
AVG                 Win32:Evo-gen [Trj]
AhnLab-V3           Trojan/Win.Generic.R640388
Antiy-AVL           GrayWare/Win32.Wacapew
Arcabit             Trojan.Zusy.D83F83
Avast               Win32:Evo-gen [Trj]
Avira               TR/AVI.Evo.owqds
BitDefender         Gen:Variant.Zusy.540547
Bkav                W32.AIDetectMalware
CTX                 exe.unknown.zusy
ClamAV              Win.Packed.Kelios-10023944-0
CrowdStrike         win/malicious_confidence_100% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Trojan.Siggen30.9772
ESET-NOD32          a variant of Win32/Packed.VMProtect.AU suspicious
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Zusy.540547 (B)
F-Secure            Trojan.TR/AVI.Evo.owqds
FireEye             Generic.mg.678987b11e5c7336
Fortinet            Riskware/Application
GData               Gen:Variant.Zusy.540547
Google              Detected
Gridinsoft          Trojan.Heur!.022120A1
Ikarus              PUA.VMProtect
Jiangmin            TrojanClicker.Cycler.bxn
K7AntiVirus         Trojan ( 0059f3ce1 )
K7GW                Trojan ( 0059f3ce1 )
Kaspersky           Trojan-Clicker.Win32.Cycler.beno
Kingsoft            Win32.HeurC.KVMH008.a
Malwarebytes        Malware.AI.221908809
MaxSecure           Trojan.Malware.300983.susgen
McAfeeD             Real Protect-LS!678987B11E5C
MicroWorld-eScan    Gen:Variant.Zusy.540547
Microsoft           Trojan:Win32/PrivateLoader.RC!MTB
NANO-Antivirus      Trojan.Win32.TrjGen.kktpho
Panda               Trj/Genetic.gen
Rising              Trojan.Clicker!8.1972 (TFE:3:hexVX6EEAWG)
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.tc
Sophos              Mal/Generic-S
Symantec            ML.Attribute.HighConfidence
Tencent             Malware.Win32.Gencirc.10bfc6e1
Trapmine            malicious.high.ml.score
VBA32               BScope.TrojanPSW.Coins
VIPRE               Gen:Variant.Zusy.540547
Varist              W32/Unruy.N.gen!Eldorado
Yandex              Riskware.VMProtect!fYDaETDRrmU
Zillya              Trojan.Cycler.Win32.2464
Zoner               Probably Heur.ExeHeaderL



firstSeen: 2024-11-26 17:55:17
ssz: 5 Mb
fname: 6bf64ca200b998ad5db325a7bcd52698
vt: Scan finished
hash: 6bf64ca200b998ad5db325a7bcd52698
date: 2024-11-28 02:25:47
compiled: Mon, Nov 25 2024, 20:01:42 - 32 Bit EXE
epSectIndex: 5
sects: .text, .data, .g7^, .|n_, .f[=, .rsrc
die: PE: compiler: Microsoft Visual Basic(6.0)[-] PE: linker: Microsoft Linker(6.0)[EXE32]
imphash: a2ebb2d1157c08374a76e7e2c7089c90
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: A8A088
epSect: .f[=
details:
ALYac               Gen:Variant.Zusy.562079
APEX                Malicious
AVG                 Win32:Evo-gen [Trj]
AhnLab-V3           Worm/Win.WBNA.R683254
Antiy-AVL           Worm/Win32.WBNA
Arcabit             Trojan.Zusy.D8939F
Avast               Win32:Evo-gen [Trj]
Avira               WORM/Agent.cxigt
BitDefender         Gen:Variant.Zusy.562079
Bkav                W32.AIDetectMalware
CTX                 exe.worm.wbna
CrowdStrike         win/malicious_confidence_90% (W)
Cylance             Unsafe
Cynet               Malicious (score: 99)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.AU suspicious
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Zusy.562079 (B)
F-Secure            Worm.WORM/Agent.cxigt
FireEye             Generic.mg.6bf64ca200b998ad
Fortinet            Riskware/Application
GData               Gen:Variant.Zusy.562079
Google              Detected
Gridinsoft          Trojan.Win32.Packed.sa
Ikarus              PUA.VMProtect
K7AntiVirus         Trojan ( 0059f3ce1 )
K7GW                Trojan ( 0059f3ce1 )
Kaspersky           Worm.Win32.WBNA.roc
Kingsoft            Win32.Worm.WBNA.roc
Lionic              Worm.Win32.WBNA.o!c
McAfee              Artemis!6BF64CA200B9
McAfeeD             ti!077F8A640C29
MicroWorld-eScan    Gen:Variant.Zusy.562079
Microsoft           Trojan:Win32/Sabsik.FL.A!ml
Paloalto            generic.ml
Rising              Worm.WBNA!8.321 (CLOUD)
SentinelOne         Static AI - Suspicious PE
Skyhigh             BehavesLike.Win32.Generic.rc
Sophos              Mal/Generic-S
Symantec            ML.Attribute.HighConfidence
Tencent             Win32.Worm.Wbna.Rzfl
Trapmine            malicious.moderate.ml.score
TrendMicro-HouseCallTROJ_GEN.R002H09KQ24
VIPRE               Gen:Variant.Zusy.562079
Varist              W32/ABRisk.ZFEF-2002
alibabacloud        Worm:Win/Wacapew.C9nj


resNames:
2216    \ICON\30001\0
16936   \ICON\30002\0
14920   \ICON\30003\0
9640    \ICON\30004\0
6760    \ICON\30005\0
4264    \ICON\30006\0
2440    \ICON\30007\0
1720    \ICON\30008\0
1128    \ICON\30009\0
132     \GROUP_ICON\1\0
736     \VERSION\1\1033

fileProps:
CompanyName      Salty Brine Software
FileVersion      5.0.5.0
InternalName     FolderMatch
OriginalFilename FolderMatch.exe
ProductName      FolderMatch
ProductVersion   5.0.5.0


firstSeen: 2024-01-16 05:26:30
ssz: 2 Mb
fname: 6cfb1defba01a7f8d94b295d801e329f
vt: Scan finished
hash: 6cfb1defba01a7f8d94b295d801e329f
date: 2024-08-08 11:33:58
compiled: Sun, Jan 21 1906, 2:49:03 - 32 Bit .NET v2.0 AnyCPU EXE
epSectIndex: 3
sects: .text, .vmp0, .vmp1, .rsrc, .reloc
resNames: 9640 \ICON\1\0 20 \GROUP_ICON\32512\0 828 \VERSION\1\0 4009 \24\1\0
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: CF930
epSect: .vmp1
details:
ALYac               Gen:Variant.MSILPerseus.227754
APEX                Malicious
AVG                 Win32:MalwareX-gen [Trj]
AhnLab-V3           Malware/Win32.RL_Generic.C4239106
Alibaba             Packed:MSIL/VMProtect.138d8230
Antiy-AVL           Trojan[Packed]/MSIL.VMProtect
Arcabit             Trojan.MSILPerseus.D379AA
Avast               Win32:MalwareX-gen [Trj]
BitDefender         Gen:Variant.MSILPerseus.227754
BitDefenderTheta    Gen:NN.ZemsilF.36810.Nv0@aSGAgpl
Bkav                W32.AIDetectMalware.CS
CrowdStrike         win/malicious_confidence_100% (W)
Cybereason          malicious.fba01a
Cylance             Unsafe
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of MSIL/Packed.VMProtect.C suspicious
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.MSILPerseus.227754 (B)
FireEye             Generic.mg.6cfb1defba01a7f8
Fortinet            Riskware/Application
GData               Gen:Variant.MSILPerseus.227754
Ikarus              Trojan.MSIL.Vmprotect
K7AntiVirus         Trojan ( 7000001c1 )
K7GW                Trojan ( 7000001c1 )
Kingsoft            malware.kb.c.695
Lionic              Trojan.Win32.VMProtect.4!c
MAX                 malware (ai score=84)
Malwarebytes        Malware.AI.856079956
MaxSecure           Trojan.Malware.116733114.susgen
McAfee              Artemis!6CFB1DEFBA01
McAfeeD             Real Protect-LS!6CFB1DEFBA01
MicroWorld-eScan    Gen:Variant.MSILPerseus.227754
Microsoft           Program:Win32/Wacapew.C!ml
Paloalto            generic.ml
Panda               Trj/Chgt.AD
Rising              Malware.Obfus/MSIL@AI.88 (RDM.MSIL2:zBfgVampa9CXp51fPx0TFA)
Sangfor             Suspicious.Win32.Save.a
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.tc
Sophos              Mal/VMProtBad-A
Symantec            ML.Attribute.HighConfidence
TrendMicro          TROJ_GEN.R002C0RAR24
TrendMicro-HouseCallTROJ_GEN.R002C0RAR24
VIPRE               Gen:Variant.MSILPerseus.227754
Varist              W32/ABRisk.NWPJ-0189
Yandex              Riskware.VMProtect!arbKAukoN0M
Zillya              Trojan.VMProtect.Win32.90889
alibabacloud        VirTool:MSIL/Packed.VMProtect.C
tehtris             Generic.Malware


die:
PE: protector: VMProtect(-)[-]
	    PE: library: .NET(v2.0.50727)[-]
	    PE: compiler: VB.NET(-)[-]
	    PE: linker: Microsoft Linker(80.0*)[EXE32,admin]

fileProps:
CompanyName      CompanyName
FileDescription  Aplus_patcher
FileVersion      1.0.0.0
InternalName     Aplus_patcher.exe
LegalCopyright   Copyright ©  2020
OriginalFilename Aplus_patcher.exe
ProductName      Aplus_patcher
ProductVersion   1.0.0.0


firstSeen: 2024-11-20 14:03:29
ssz: 10 Mb
fname: 713998985d9253877d350df15b73960e
vt: Scan finished
hash: 713998985d9253877d350df15b73960e
date: 2024-11-28 18:47:29
compiled: Wed, Nov 20 2024, 7:59:30 - 32 Bit EXE
epSectIndex: 5
sects: .text, .rdata, .data, .vmp0, .vmp1, .reloc, .rsrc
die: PE: protector: VMProtect(1.60-2.05)[-] PE: linker: Microsoft Linker(14.16)[EXE32]
resNames: 13268 \ICON\1\2052 20 \GROUP_ICON\ICON_LOGO\2052 712 \VERSION\1\9 1567 \24\1\1033
imphash: 5c98742fecf695ecd58c9e0fcbd727b4
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: B285DF
epSect: .vmp1
details:
ALYac               Trojan.GenericKD.74895823
AVG                 Win32:MalwareX-gen [Trj]
AhnLab-V3           Trojan/Win.Trojan-gen.C5663572
Alibaba             Packed:Win32/VMProtect.02f83003
Antiy-AVL           GrayWare/Win32.Wacapew
Arcabit             Trojan.Generic.D476D1CF
Avast               Win32:MalwareX-gen [Trj]
BitDefender         Trojan.GenericKD.74895823
Bkav                W32.AIDetectMalware
CTX                 exe.trojan.vmprotect
CrowdStrike         win/malicious_confidence_70% (W)
Cylance             Unsafe
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.ACR
Elastic             malicious (high confidence)
Emsisoft            Trojan.GenericKD.74895823 (B)
FireEye             Generic.mg.713998985d925387
Fortinet            W32/PossibleThreat
GData               Trojan.GenericKD.74895823
Google              Detected
Ikarus              Trojan.Win32.VMProtect
Lionic              Trojan.Win32.VMProtect.4!c
Malwarebytes        Malware.AI.4060462019
MaxSecure           Trojan.Malware.305403726.susgen
McAfee              Artemis!713998985D92
McAfeeD             Real Protect-LS!713998985D92
MicroWorld-eScan    Trojan.GenericKD.74895823
Microsoft           Trojan:Win32/Wacatac.B!ml
Paloalto            generic.ml
Sangfor             Trojan.Win32.Packed.Vlkw
SentinelOne         Static AI - Suspicious PE
Skyhigh             BehavesLike.Win32.Generic.tc
Sophos              Generic Reputation PUA (PUA)
Symantec            ML.Attribute.HighConfidence
Trapmine            malicious.high.ml.score
TrendMicro-HouseCallTROJ_GEN.R002H09KQ24
VIPRE               Trojan.GenericKD.74895823
Varist              W32/ABTrojan.SGYP-7010
Webroot             W32.Trojan.Gen
alibabacloud        VirTool:Win/Wacapew.C9nj


fileProps:
CompanyName      https://care-eyes.com
FileDescription  CareUEyes
FileVersion      2.4.6.0
InternalName     CareUEyes
LegalCopyright   Copyright (C) 2017-2024
OriginalFilename CareUEyes.exe
ProductName      CareUEyes
ProductVersion   2.4.6.0


firstSeen: 2024-11-22 21:05:37
ssz: 11 Mb
fname: 71ab17e8e24d818510c17b23827f48c4
vt: Scan finished
hash: 71ab17e8e24d818510c17b23827f48c4
date: 2024-11-28 08:11:43
compiled: Fri, Nov 22 2024, 20:26:41 - 32 Bit EXE
epSectIndex: 6
sects: .text, .rdata, .data, .F/5, .ex6, .*b7, .rsrc
die: PE: linker: Microsoft Linker(14.42)[EXE32,console,admin]
resNames: 165140 \ICON\1\1033 20 \GROUP_ICON\101\1033 392 \24\1\1033
imphash: 0038e5aa48b68db6e567319f75d339e0
pever: DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: D632B1
epSect: .*b7
details:
APEX                Malicious
Alibaba             Packed:Win32/VMProtect.30904f62
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Bkav                W32.AIDetectMalware
CTX                 exe.trojan.vmprotect
CrowdStrike         win/malicious_confidence_90% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.BC suspicious
Elastic             malicious (high confidence)
FireEye             Generic.mg.71ab17e8e24d8185
Fortinet            Riskware/Application
Google              Detected
Gridinsoft          Trojan.Heur!.02212021
Ikarus              PUA.VMProtect
Lionic              Trojan.Win32.VMProtect.4!c
Malwarebytes        Malware.AI.4189927712
MaxSecure           Trojan.Malware.300983.susgen
McAfee              Artemis!71AB17E8E24D
McAfeeD             Real Protect-LS!71AB17E8E24D
Microsoft           PUA:Win32/Puwaders.C!ml
Paloalto            generic.ml
Sangfor             Trojan.Win32.Agent.V3zy
Skyhigh             BehavesLike.Win32.Generic.vc
Sophos              Generic Reputation PUA (PUA)
Symantec            ML.Attribute.HighConfidence
Trapmine            malicious.high.ml.score
alibabacloud        VirTool:Win/Packed.VMProtect.BW
tehtris             Generic.Malware



firstSeen: 2024-10-16 09:38:09
ssz: 11 Mb
fname: 73a6a2f1ffdc4a41ea56390ad9ad38f0
vt: Scan finished
hash: 73a6a2f1ffdc4a41ea56390ad9ad38f0
date: 2024-11-11 13:09:12
compiled: Mon, Oct 14 2024, 9:07:39 - 32 Bit DLL
epSectIndex: 7
sects: .text, .rdata, .data, .gfids, .UPX0, .UPX1, .UPX2, .reloc, .rsrc
die: PE: protector: VMProtect(2.X)[-] PE: linker: Microsoft Linker(14.0)[DLL32]
resNames: 828 \VERSION\1\1033 145 \24\2\1033
imphash: b6b5acf3e14600b32a7675ea84bbe9ed
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 786871
epSect: .UPX2
details:
APEX                Malicious
AVG                 Win32:MalwareX-gen [Trj]
Alibaba             Trojan:Win32/VMProtect.6e748d60
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Avast               Win32:MalwareX-gen [Trj]
Avira               TR/Injector.kybbq
Bkav                W32.AIDetectMalware
CTX                 dll.trojan.vmprotect
CrowdStrike         win/malicious_confidence_90% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.BC suspicious
Elastic             malicious (moderate confidence)
F-Secure            Trojan.TR/Injector.kybbq
FireEye             Generic.mg.73a6a2f1ffdc4a41
Fortinet            Riskware/Application
Google              Detected
Ikarus              PUA.VMProtect
Kaspersky           Trojan.Win32.Inject.aqetz
Lionic              Trojan.Win32.VMProtect.4!c
McAfee              Artemis!73A6A2F1FFDC
McAfeeD             ti!CF5547718F2F
Paloalto            generic.ml
Rising              Trojan.Inject!8.103 (CLOUD)
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Backdoor.wc
Sophos              Mal/Generic-S
Symantec            Trojan.Gen.MBT
Tencent             Malware.Win32.Gencirc.141e508d
Trapmine            malicious.moderate.ml.score
Varist              W32/ABTrojan.ZLUS-4425
Zillya              Trojan.Inject.Win32.349060
ZoneAlarm           UDS:Trojan.Win32.Inject.aqetz


fileProps:
CompanyName      Lien he mua facebook.com/alonescriptjx
FileDescription  AutoVLBS 1.9 theo server by Linh Em
FileVersion      1.0.0.1
InternalName     LEAutoCore.dll
LegalCopyright   Copyright (C) Linh Em 2024
OriginalFilename LEAutoCore.dll
ProductName      LEAutoCore
ProductVersion   1.0.0.1


firstSeen: 2023-06-20 07:34:50
ssz: 6 Mb
fname: 740523e55e784d2f946e5d58547bea9f
vt: Scan finished
hash: 740523e55e784d2f946e5d58547bea9f
date: 2024-11-29 08:19:40
compiled: Fri, Jul 11 2008, 11:52:46 - 32 Bit DLL
epSectIndex: 9
sects: .apssk, .gjxno, .2giq4, .j38c, .v8xw, .tm36, .gffs20, .t5nh9, .a96tz6, .094cg5
die: PE: packer: ASPack(2.12)[-] PE: linker: unknown(0.0)[DLL32]
resNames: 1016 \VERSION\1\0 768 \VERSION\1\1033 381 \24\2\1033
imphash: d41d8cd98f00b204e9800998ecf8427e
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: A52001
epSect: .a96tz6
details:
APEX                Malicious
AVG                 Win32:Malware-gen
Alibaba             Packed:Win32/VMProtect.aa543289
Avast               Win32:Malware-gen
Bkav                W32.AIDetectMalware
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.BB suspicious
Elastic             malicious (high confidence)
FireEye             Generic.mg.740523e55e784d2f
Fortinet            Riskware/Application
Gridinsoft          Trojan.Heur!.032120A0
Paloalto            generic.ml
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.vc
Trapmine            malicious.high.ml.score


fileProps:
CompanyName      Valve Corporation
FileDescription  vstdlib_ s.dll
FileVersion      08.13.34.93
InternalName     vstdlib_ s.dll (buildbot_steam-relclient-win32-builder_steam_rel_client_win32@steam-relclient-win32-builder)
LegalCopyright   Copyright (C) 2005 Valve Corporation
OriginalFilename vstdlib_ s.dll
ProductName      Steam
ProductVersion   03.00.00.01


firstSeen: 2024-11-29 00:58:17
ssz: 4 Mb
fname: 77e53444990c7f28d5c414995c53db16
vt: Scan finished
hash: 77e53444990c7f28d5c414995c53db16
date: 2024-11-29 00:58:17
compiled: Sun, Aug 1 2010, 10:32:37 - 32 Bit EXE
epSectIndex: 4
sects: ., ., .lol 0, .lol 1, .
die: PE: packer: MPRESS(-)[-] PE: linker: unknown(2.50)[EXE32]
resNames: 611 \24\1\1033
imphash: 65b6862e9898b195f4ef7a1685fd82dd
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 15CB7
epSect: .lol 1
details:
ALYac               GenPack:Trojan.Agent.EXMP
APEX                Malicious
AVG                 Win32:MalwareX-gen [Trj]
Antiy-AVL           GrayWare/Win32.Ausiv.a
Arcabit             GenPack:Trojan.Agent.EXMP
Avast               Win32:MalwareX-gen [Trj]
Avira               TR/Black.Gen2
BitDefender         GenPack:Trojan.Agent.EXMP
Bkav                W32.AIDetectMalware
CAT-QuickHeal       W32.Sivis.V5
CTX                 exe.trojan.exmp
ClamAV              Win.Trojan.Generic-9933070-0
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Win32.HLLP.Siggen.53
ESET-NOD32          a variant of Win32/Ausiv.A
Elastic             malicious (high confidence)
Emsisoft            GenPack:Trojan.Agent.EXMP (B)
F-Secure            Trojan.TR/Black.Gen2
FireEye             Generic.mg.77e53444990c7f28
Fortinet            W32/VMProtect.ACO!tr
GData               GenPack:Trojan.Agent.EXMP
Google              Detected
Gridinsoft          Trojan.Win32.Gen.bot!s4
Ikarus              wormWin32.AutoRun.Delf
Jiangmin            Trojan.Generic.bvcco
K7AntiVirus         Trojan ( 7000001c1 )
K7GW                Trojan ( 7000001c1 )
Kaspersky           HEUR:Trojan.Win32.Generic
Kingsoft            malware.kb.b.997
Malwarebytes        Generic.Malware.AI.DDS
MaxSecure           Trojan.WIN32.generickd.45914965
McAfee              GenericRXDR-HK!77E53444990C
McAfeeD             Real Protect-LS!77E53444990C
MicroWorld-eScan    GenPack:Trojan.Agent.EXMP
Microsoft           Trojan:Win32/Ausiv
Panda               Trj/Genetic.gen
Rising              Trojan.Ausiv!1.A52C (CLASSIC)
Sangfor             Worm.Win32.Save.a
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.rm
Sophos              Mal/VMProtBad-A
Symantec            W32.Suviapen
Tencent             Trojan.Win32.Ausiv.abc
Trapmine            malicious.high.ml.score
VBA32               Trojan.Ausiv
VIPRE               GenPack:Trojan.Agent.EXMP
Varist              W32/Ausiv.F.gen!Eldorado
VirIT               Trojan.Win32.Ausiv.A
Xcitium             TrojWare.Win32.Ausiv.A@7gzgk5
Yandex              Trojan.GenAsa!wNuUW5HMkU4
Zillya              Trojan.Heur.Win32.10174
alibabacloud        Trojan:Win/Stone.A
huorong             Trojan/Obfuscated.dm
tehtris             Generic.Malware



firstSeen: 2013-03-21 14:54:45
ssz: 2 Mb
fname: 79cc6904f48cad2b7b79dab71b3efc8a
vt: Scan finished
hash: 79cc6904f48cad2b7b79dab71b3efc8a
date: 2024-11-29 09:02:42
compiled: Thu, Mar 21 2013, 8:44:59 - 32 Bit EXE
epSectIndex: 6
sects: .text, .data, .rsrc, .VCrypt0, .tls, .VCrypt1
die: PE: compiler: Microsoft Visual Basic(6.0)[-] PE: linker: Microsoft Linker(6.0)[EXE32]
imphash: 1c254d992c208726746d14d52c633c9d
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 6635ED
epSect: .VCrypt1
details:
ALYac               Trojan.GenericKD.49022517
APEX                Malicious
AVG                 Win32:Malware-gen
Alibaba             VirTool:Win32/Obfuscator.90a6ec3f
Antiy-AVL           Trojan/Win32.Tgenic
Arcabit             Trojan.Generic.D2EC0635
Avast               Win32:Malware-gen
Avira               TR/Black.Gen2
BitDefender         Trojan.GenericKD.49022517
Bkav                W32.AIDetectMalware
CTX                 exe.trojan.generic
CrowdStrike         win/malicious_confidence_100% (W)
Cylance             Unsafe
Cynet               Malicious (score: 99)
DeepInstinct        MALICIOUS
DrWeb               Trojan.PWS.Siggen1.29068
ESET-NOD32          a variant of Win32/Packed.VMProtect.AAH
Elastic             malicious (high confidence)
Emsisoft            Trojan.GenericKD.49022517 (B)
F-Secure            Trojan.TR/Black.Gen2
FireEye             Generic.mg.79cc6904f48cad2b
GData               Trojan.GenericKD.49022517
Google              Detected
Gridinsoft          Trojan.Heur!.032900A1
Ikarus              Trojan.Win32.Spy
K7AntiVirus         Trojan ( 00006f8a1 )
K7GW                Trojan ( 00006f8a1 )
Kingsoft            Win32.HeurC.KVMH008.a
Lionic              Trojan.Win32.Generic.4!c
Malwarebytes        Generic.Malware.AI.DDS
MaxSecure           Trojan.Malware.11453901.susgen
McAfeeD             Real Protect-LS!79CC6904F48C
MicroWorld-eScan    Trojan.GenericKD.49022517
Microsoft           VirTool:Win32/Obfuscator.XZ
NANO-Antivirus      Riskware.Win32.Black.btumll
Paloalto            generic.ml
Panda               Trj/CI.A
SentinelOne         Static AI - Suspicious PE
Skyhigh             BehavesLike.Win32.Generic.vc
Sophos              Mal/VMProtBad-A
Symantec            Packed.Vmpbad!gen4
Trapmine            malicious.high.ml.score
VIPRE               Trojan.GenericKD.49022517
Varist              W32/A-7fdeb6c8!Eldorado
VirIT               Trojan.Win32.Generic.BNYL
Webroot             W32.Trojan.Gen
Xcitium             Malware@#oz3vnue6v8el
Yandex              Trojan.GenAsa!/AuZ6BrDiLM
Zillya              Trojan.Packed.Win32.32487
Zoner               Probably Heur.ExeHeaderL
tehtris             Generic.Malware


resNames:
34522   \CUSTOM\104\1053
4096    \CUSTOM\110\1053
147504  \WAVE\102\1053
143408  \WAVE\103\1053
262768  \WAVE\106\1053
65812   \WAVE\107\1053
191788  \WAVE\108\1053
68728   \WAVE\111\1053
296     \ICON\30001\0
1384    \ICON\30002\0
9640    \ICON\30003\0
4264    \ICON\30004\0
2440    \ICON\30005\0
1128    \ICON\30006\0
258288  \RCDATA\101\0
90      \GROUP_ICON\1\0
1032    \VERSION\1\1033

fileProps:
CompanyName      LinGon
FileDescription  A LinGon Trainer
FileVersion      1.02.0003
InternalName     TWD-SI+10Tr-LNG_21March_2013
LegalCopyright   LinGon
OriginalFilename TWD-SI+10Tr-LNG_21March_2013.exe
ProductName      Crysis 3 - 22 Feb 2013 - Update 8 March 2013 to  v1.2  - Trainer by LinGon
ProductVersion   1.02.0003

rich:
offset DanS:128
offset Rich:176
Size: 48
checkSum: 0x78864BB7 Matches!

clearData: DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x83\x1C\x0E\x00\x01\x00\x00\x00\x00\x00\x00\x00\x1B\x00\x00\x00O"\x09\x00\x1C\x00\x00\x006&\x0D\x00\x01\x00\x00\x00

4 entries
--------------------------------------------------
Compiler: 7299
toolID: 14
Count: 1
toolName: Masm613
vsVer: Visual Studio 6 (06.00)

Compiler: 0
toolID: 0
Count: 27
toolName: 
vsVer: <unknown> (00.00)

Compiler: 8783
toolID: 9
Count: 28
toolName: Utc12_Basic
vsVer: Visual Studio 6 (06.00)

Compiler: 9782
toolID: 13
Count: 1
toolName: VisualBasic60
vsVer: Visual Studio 6 (06.00)


firstSeen: 2014-12-19 05:24:51
ssz: 5 Mb
fname: 7a3faf967289e08d48de836f0e960efb
vt: Scan finished
hash: 7a3faf967289e08d48de836f0e960efb
date: 2024-07-17 02:14:01
compiled: Sat, Sep 21 2013, 7:06:32 - 32 Bit EXE
epSectIndex: 9
sects: .text, .itext, .data, .bss, .idata, .tls, .rdata, .UPX0, .UPX1, .rsrc
die: PE: protector: VMProtect(-)[-] PE: linker: Turbo Linker(2.25*,Delphi)[EXE32,console,signed]
imphash: 2738bf1b4023c21d313aae9387d3fd5c
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: A4D514
epSect: .UPX1
sig: Valid
sigDetails: Subject: Ivan Yurievich Permyakov IP Issuer: COMODO Code Signing CA 2
details:
APEX                Malicious
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Bkav                W32.Common.1D9325BD
Cylance             Unsafe
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.ABO
Fortinet            W32/PossibleThreat
Google              Detected
Gridinsoft          Trojan.Win32.Packed.oa!s9
Ikarus              Trojan.Win32.VMProtect
K7AntiVirus         Trojan ( 004b0a511 )
K7GW                Trojan ( 004b0a511 )
Lionic              Trojan.Win32.VMProtect.4!c
MaxSecure           Trojan.Malware.216104564.susgen
McAfee              Artemis!7A3FAF967289
McAfeeD             ti!667EE46E52D4
Skyhigh             Artemis!Trojan
Sophos              Mal/VMProtBad-A
Varist              W32/Risk.CSED-6995
Webroot             W32.Malware.Heur
Xcitium             Malware@#3djjta5cnxunl
Yandex              Trojan.VMProtect!NGvELlFCEzc
Zillya              Trojan.VMProtect.Win32.10891


resNames:
13814   \ICON\1\1049
9640    \ICON\2\1049
4264    \ICON\3\1049
1128    \ICON\4\1049
30365   \ICON\5\1033
9640    \ICON\6\1033
4264    \ICON\7\1033
1128    \ICON\8\1033
62      \GROUP_ICON\MAINICON\1049
62      \GROUP_ICON\VMP\1033
760     \VERSION\1\1033

fileProps:
CompanyName      VMProtect Software
FileDescription  FileDescription
FileVersion      2.1.3.6231
InternalName     InternalName
LegalCopyright   Copyright 2003-2013 VMProtect Software
OriginalFilename OriginalFileName
ProductName      VMProtect
ProductVersion   2.13


firstSeen: 2024-11-29 09:25:35
ssz: 5 Mb
fname: 82b0f0b83ba4b30bbaa27a0ae8129790
vt: Scan finished
hash: 82b0f0b83ba4b30bbaa27a0ae8129790
date: 2024-11-29 09:25:35
compiled: Thu, Sep 12 2024, 9:08:14 - 32 Bit DLL
epSectIndex: 6
sects: .text, .rdata, .data, .%?., .%-[, .mo:, .reloc, .rsrc
die: PE: protector: VMProtect(2.X)[-] PE: linker: Microsoft Linker(14.39)[DLL32,signed]
exports: @1 MyUnregisterServer
resNames: 381 \24\2\1033
imphash: c60ea44c29fb9958cdca44c6933240cf
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 442944
epSect: .mo:
details:
APEX                Malicious
AVG                 Win32:MalwareX-gen [Trj]
AhnLab-V3           Trojan/Win.Redcap.R672916
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Avast               Win32:MalwareX-gen [Trj]
Avira               TR/Redcap.vdzex
Bkav                W32.AIDetectMalware
CrowdStrike         win/malicious_confidence_100% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.BB suspicious
Elastic             malicious (high confidence)
F-Secure            Trojan.TR/Redcap.vdzex
FireEye             Generic.mg.82b0f0b83ba4b30b
Fortinet            Riskware/Application
GData               Win32.Trojan.Agent.AKLI22
Google              Detected
Gridinsoft          Trojan.Heur!.022120A0
Ikarus              PUA.VMProtect
K7AntiVirus         Trojan ( 0059f0351 )
K7GW                Trojan ( 0059f0351 )
Kaspersky           HEUR:Trojan.Win32.TbMA.gen
Malwarebytes        Trojan.MalPack.PES
McAfeeD             Real Protect-LS!82B0F0B83BA4
Microsoft           Trojan:Win32/Redcap.GNZ!MTB
Panda               Trj/Genetic.gen
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.BumbleBee.rc
Symantec            ML.Attribute.HighConfidence
TACHYON             Trojan/W32.Agent.4858192
Tencent             Backdoor.Win64.Runshell_l.16001403
TrendMicro-HouseCallTROJ_GEN.R03BH01KS24
VBA32               BScope.TrojanPSW.Stealer
Varist              W32/Trojan.CZEC-4507
Webroot             Win.Trojan.Gen
Yandex              Riskware.VMProtect!U0btQzBGNZ8
Zillya              Trojan.VMProtect.Win32.100032



firstSeen: 2024-11-29 00:47:04
ssz: 6 Mb
fname: 84dc77d1dbec49b3f260775c5e2c05f4
vt: Scan finished
hash: 84dc77d1dbec49b3f260775c5e2c05f4
date: 2024-11-29 00:47:04
compiled: Mon, Sep 20 2010, 20:12:34 - 32 Bit EXE
epSectIndex: 1
sects: .text, .rsrc
imphash: cdc00badc7162acde9bb032e793ac137
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 1000
epSect: .text
details:
ALYac               Gen:Variant.Genie.705
APEX                Malicious
AVG                 Win32:Evo-gen [Trj]
Acronis             suspicious
AhnLab-V3           Trojan/Win32.Agent.R3783
Antiy-AVL           Trojan/Win32.Agent
Arcabit             Trojan.Genie.705
Avast               Win32:Evo-gen [Trj]
Avira               TR/Crypt.PEPM.Gen2
BitDefender         Gen:Variant.Genie.705
Bkav                W32.AIDetectMalware
CTX                 exe.unknown.genie
ClamAV              Win.Malware.Vmprotect-9887724-0
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Trojan.Fakealert.19055
ESET-NOD32          Win32/TrojanClicker.Delf.NKG
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Genie.705 (B)
F-Secure            Trojan.TR/Crypt.PEPM.Gen2
FireEye             Generic.mg.84dc77d1dbec49b3
Fortinet            W32/Agent.NKG!tr
GData               Gen:Variant.Genie.705
Google              Detected
Gridinsoft          Ransom.Win32.Wacatac.oa!s1
Ikarus              Trojan.Rogue
Jiangmin            TrojanClicker.Agent.cyy
K7AntiVirus         Trojan ( 0059e2b51 )
K7GW                Trojan ( 0059e2b51 )
Kaspersky           HEUR:Trojan-Clicker.Win32.Agent.gen
Kingsoft            malware.kb.a.999
Malwarebytes        Generic.Malware.AI.DDS
MaxSecure           Trojan.Malware.121218.susgen
McAfee              GenericRXDK-WN!5C1ACF284C62
McAfeeD             ti!C4A2F4AE7146
MicroWorld-eScan    Gen:Variant.Genie.705
Microsoft           Trojan:Win32/Wacatac.B!ml
NANO-Antivirus      Trojan.Win32.Fakealert.bbwtgv
Rising              Trojan.Clicker-Delf!8.2E2 (TFE:5:uvegHgjRAeQ)
Sangfor             Suspicious.Win32.Save.a
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.vc
Sophos              ML/PE-A
Symantec            Trojan.Adclicker
Tencent             Trojan-Clicker.Win32.Delf.ka
Trapmine            suspicious.low.ml.score
TrendMicro          TROJ_CLICKR.SMIB
TrendMicro-HouseCallTROJ_CLICKR.SMIB
VBA32               Win32.Trojan.Dropper.Heur
VIPRE               Gen:Variant.Genie.705
Varist              W32/Risk.IQIT-8490
VirIT               Trojan.Win32.Generic.TSV
Webroot             W32.Trojan.Clicker
Yandex              Trojan.GenAsa!Ey7MwU+gHUA
Zillya              Trojan.FakeAV.Win32.51542
huorong             TrojanDownloader/Adload.ax


die:
PE: packer: PeCompact(2.20)[-]
	    PE: compiler: Borland Delphi(-)[-]
	    PE: linker: Turbo Linker(2.25*,Delphi)[EXE32]

resNames:
308     \CURSOR\1\1033
308     \CURSOR\2\1033
308     \CURSOR\3\1033
308     \CURSOR\4\1033
308     \CURSOR\5\1033
308     \CURSOR\6\1033
308     \CURSOR\7\1033
1176    \STRING\4083\0
420     \STRING\4084\0
200     \STRING\4085\0
672     \STRING\4086\0
1004    \STRING\4087\0
924     \STRING\4088\0
872     \STRING\4089\0
948     \STRING\4090\0
212     \STRING\4091\0
164     \STRING\4092\0
672     \STRING\4093\0
1024    \STRING\4094\0
784     \STRING\4095\0
756     \STRING\4096\0
16      \RCDATA\DVCLAL\0
736     \RCDATA\PACKAGEINFO\0
345     \RCDATA\TALLCLICKFORM\0
20      \GROUP_CURSOR\32761\1033
20      \GROUP_CURSOR\32762\1033
20      \GROUP_CURSOR\32763\1033
20      \GROUP_CURSOR\32764\1033
20      \GROUP_CURSOR\32765\1033
20      \GROUP_CURSOR\32766\1033
20      \GROUP_CURSOR\32767\1033


firstSeen: 2024-07-01 18:48:51
ssz: 3 Mb
fname: 869ad1a5ccceb6bf82108a1d407aade7
vt: Scan finished
hash: 869ad1a5ccceb6bf82108a1d407aade7
date: 2024-07-27 19:50:36
compiled: Sun, Jun 30 2024, 1:39:01 - 32 Bit EXE
epSectIndex: 6
sects: .text, .rdata, .data, , , , .reloc, .rsrc
die: PE: linker: Microsoft Linker(14.39)[EXE32]
exports: @1 AmdPowerXpressRequestHighPerformance @2 NvOptimusEnablement
resNames: 381 \24\1\1033
imphash: 85c616a4b83c5aa24fce28de64ee96df
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 371CC1
details:
ALYac               Trojan.Generic.36504867
APEX                Malicious
AVG                 Win32:Evo-gen [Trj]
Alibaba             Trojan:Win32/VMProtect.73f29e02
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Arcabit             Trojan.Generic.D22D0523
Avast               Win32:Evo-gen [Trj]
BitDefender         Trojan.Generic.36504867
Bkav                W32.AIDetectMalware
CrowdStrike         win/malicious_confidence_70% (W)
Cybereason          malicious.5ccceb
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.BC suspicious
Emsisoft            Trojan.Generic.36504867 (B)
FireEye             Generic.mg.869ad1a5ccceb6bf
Fortinet            Riskware/Application
GData               Trojan.Generic.36504867
Google              Detected
Gridinsoft          Trojan.Win32.Packed.sa
Ikarus              PUA.VMProtect
Lionic              Trojan.Win32.VMProtect.4!c
MAX                 malware (ai score=88)
Malwarebytes        Malware.AI.2830931446
MaxSecure           Trojan.Malware.300983.susgen
McAfee              Artemis!869AD1A5CCCE
McAfeeD             Real Protect-LS!869AD1A5CCCE
MicroWorld-eScan    Trojan.Generic.36504867
Microsoft           Program:Win32/Wacapew.C!ml
Paloalto            generic.ml
Sangfor             Trojan.Win32.VMProtect.Vh22
Skyhigh             BehavesLike.Win32.Generic.wc
Sophos              Generic Reputation PUA (PUA)
Symantec            ML.Attribute.HighConfidence
Trapmine            suspicious.low.ml.score
TrendMicro-HouseCallTROJ_GEN.R002H09G924
VBA32               SScope.TrojanDropper.Hider
VIPRE               Trojan.Generic.36504867
Varist              W32/ABApplication.AEVC-4530
Zillya              Trojan.VMProtect.Win32.96195
alibabacloud        Trojan:Win/Packed.VMProtect.BW
tehtris             Generic.Malware



firstSeen: 2024-11-19 13:57:16
ssz: 8 Mb
fname: 883ebcb44cd589f46852c904fe212f53
vt: Scan finished
hash: 883ebcb44cd589f46852c904fe212f53
date: 2024-11-28 07:13:45
compiled: Thu, Oct 10 2024, 23:08:55 - 32 Bit DLL
epSectIndex: 6
sects: .text, .rdata, .data, .of0, .of1, .of2, .rsrc, .reloc
die: PE: protector: VMProtect(2.X)[-] PE: linker: Microsoft Linker(14.41)[DLL32]
resNames: 576 \VERSION\1\1049
imphash: 4560ab5f3cb5d4e0fd636839940fb2ea
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 69E094
epSect: .of2
details:
Alibaba             Packed:Win32/VMProtect.111eed6b
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Bkav                W32.Common.C6555FC8
CTX                 dll.trojan.vmprotect
CrowdStrike         win/malicious_confidence_70% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.BC suspicious
Elastic             malicious (moderate confidence)
FireEye             Generic.mg.883ebcb44cd589f4
Fortinet            Riskware/Application
Google              Detected
Gridinsoft          Trojan.Heur!.022120A0
Ikarus              PUA.VMProtect
Lionic              Trojan.Win32.VMProtect.4!c
Malwarebytes        Malware.AI.4124156150
McAfee              Artemis!883EBCB44CD5
McAfeeD             ti!C1A70DCF4DA8
Microsoft           PUA:Win32/Puwaders.C!ml
Paloalto            generic.ml
Sangfor             PUP.Win32.Packed.V5d4
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.wc
Sophos              Generic Reputation PUA (PUA)
VBA32               Malware-Cryptor.Inject.gen
Webroot             W32.Hack.Tool
alibabacloud        VirTool:Win/Packed.VMProtect.BW


exports:
@1 Breakpad_SteamMiniDumpInit
@2 Breakpad_SteamSetAppID
@3 Breakpad_SteamSetSteamID
@4 Breakpad_SteamWriteMiniDumpSetComment
@5 Breakpad_SteamWriteMiniDumpUsingExceptionInfoWithBuildId
@6 CreateInterface
@7 OnlineFix
@8 ShellExecuteA
@9 ShellExecuteW
@10 Steam_BConnected
@11 Steam_BGetCallback
@12 Steam_BLoggedOn
@13 Steam_BReleaseSteamPipe
@14 Steam_ConnectToGlobalUser
@15 Steam_CreateGlobalUser
@16 Steam_CreateLocalUser
@17 Steam_CreateSteamPipe
@18 Steam_FreeLastCallback
@19 Steam_GSBLoggedOn
@20 Steam_GSBSecure
@21 Steam_GSGetSteam2GetEncryptionKeyToSendToNewClient
@22 Steam_GSGetSteamID
@23 Steam_GSLogOff
@24 Steam_GSLogOn
@25 Steam_GSRemoveUserConnect
@26 Steam_GSSendSteam2UserConnect
@27 Steam_GSSendSteam3UserConnect
@28 Steam_GSSendUserDisconnect
@29 Steam_GSSendUserStatusResponse
@30 Steam_GSSetServerType
@31 Steam_GSSetSpawnCount
@32 Steam_GSUpdateStatus
@33 Steam_GetAPICallResult
@34 Steam_GetGSHandle
@35 Steam_InitiateGameConnection
@36 Steam_LogOff
@37 Steam_LogOn
@38 Steam_ReleaseThreadLocalMemory
@39 Steam_ReleaseUser
@40 Steam_SetLocalIPBinding
@41 Steam_TerminateGameConnection
@42 hid_close
@43 hid_enumerate
@44 hid_error
@45 hid_exit
@46 hid_free_enumeration
@47 hid_get_feature_report
@48 hid_get_indexed_string
@49 hid_get_manufacturer_string
@50 hid_get_product_string
@51 hid_get_serial_number_string
@52 hid_init
@53 hid_open
@54 hid_open_path
@55 hid_read
@56 hid_read_timeout
@57 hid_send_feature_report
@58 hid_set_nonblocking
@59 hid_write
@60 hid_write_output_report

fileProps:
CompanyName      Online-Fix.Me
FileDescription  Online-Fix Steamclient
FileVersion      1.3.2.5
LegalCopyright   Copyright (C) 2021-2024, 0xdeadc0de
ProductVersion   1.3.2.5


firstSeen: 2024-11-29 00:58:17
ssz: 6 Mb
fname: 88c4d11a98e290d34940659b1d38bbd3
vt: Scan finished
hash: 88c4d11a98e290d34940659b1d38bbd3
date: 2024-11-29 00:58:17
compiled: Sun, Aug 1 2010, 10:32:37 - 32 Bit EXE
epSectIndex: 4
sects: ., ., .lol 0, .lol 1, .
die: PE: packer: MPRESS(-)[-] PE: linker: unknown(2.50)[EXE32]
resNames: 611 \24\1\1033
imphash: 65b6862e9898b195f4ef7a1685fd82dd
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 15CB7
epSect: .lol 1
details:
ALYac               GenPack:Trojan.Agent.EXMP
APEX                Malicious
AVG                 Win32:MalwareX-gen [Trj]
Acronis             suspicious
Antiy-AVL           GrayWare/Win32.Ausiv.a
Arcabit             GenPack:Trojan.Agent.EXMP
Avast               Win32:MalwareX-gen [Trj]
Avira               TR/Black.Gen2
BitDefender         GenPack:Trojan.Agent.EXMP
Bkav                W32.AIDetectMalware
CAT-QuickHeal       W32.Sivis.V5
CTX                 exe.trojan.exmp
ClamAV              Win.Malware.Ausiv-9940816-0
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Win32.HLLP.Siggen.53
ESET-NOD32          a variant of Win32/Ausiv.A
Elastic             malicious (high confidence)
Emsisoft            GenPack:Trojan.Agent.EXMP (B)
F-Secure            Trojan.TR/Black.Gen2
FireEye             Generic.mg.88c4d11a98e290d3
Fortinet            W32/VMProtect.ACO!tr
GData               GenPack:Trojan.Agent.EXMP
Google              Detected
Gridinsoft          Trojan.Win32.Gen.bot!s4
Ikarus              wormWin32.AutoRun.Delf
Jiangmin            Trojan.Generic.bvcco
K7AntiVirus         Trojan ( 7000001c1 )
K7GW                Trojan ( 7000001c1 )
Kaspersky           HEUR:Trojan.Win32.Generic
Kingsoft            malware.kb.b.979
Malwarebytes        Generic.Malware.AI.DDS
MaxSecure           Trojan.WIN32.generickd.45914965
McAfee              GenericRXDR-HK!88C4D11A98E2
McAfeeD             Real Protect-LS!88C4D11A98E2
MicroWorld-eScan    GenPack:Trojan.Agent.EXMP
Microsoft           Trojan:Win32/Ausiv
Panda               Trj/Genetic.gen
Rising              Trojan.Ausiv!1.A52C (CLASSIC)
Sangfor             Worm.Win32.Save.a
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.vh
Sophos              Mal/VMProtBad-A
Symantec            W32.Suviapen
Tencent             Trojan.Win32.Ausiv.abc
Trapmine            malicious.high.ml.score
VBA32               Trojan.Ausiv
VIPRE               GenPack:Trojan.Agent.EXMP
Varist              W32/Ausiv.F.gen!Eldorado
VirIT               Trojan.Win32.Ausiv.A
Webroot             W32.Trojan.Gen
Xcitium             TrojWare.Win32.Ausiv.A@7gzgk5
Yandex              Trojan.GenAsa!wNuUW5HMkU4
Zillya              Trojan.Heur.Win32.10174
alibabacloud        Trojan:Win/Stone.A
huorong             Trojan/Obfuscated.dm
tehtris             Generic.Malware



firstSeen: 2022-12-15 13:27:40
ssz: 2 Mb
fname: 89eb91459182e588ed4cd43f1727dddb
vt: Scan finished
hash: 89eb91459182e588ed4cd43f1727dddb
date: 2024-08-25 14:13:38
compiled: Thu, Apr 22 1909, 3:33:32 - 32 Bit .NET v4.0 EXE
epSectIndex: 1
sects: .text, .4UB9y@I, .rze.cbF, .rsrc, .reloc
die: PE: library: .NET(v4.0.30319)[-] PE: linker: Microsoft Linker(48.0*)[EXE32,admin]
resNames: 16936 \ICON\1\0 20 \GROUP_ICON\32512\0 980 \VERSION\1\0 3802 \24\1\0
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: CF68E
epSect: .text
details:
ALYac               Trojan.GenericKD.64923816
APEX                Malicious
AVG                 Win32:TrojanX-gen [Trj]
AhnLab-V3           Trojan/Win.Generic.R559137
Alibaba             Trojan:MSIL/Miner.c08c9bc7
Antiy-AVL           Trojan/MSIL.Miner
Arcabit             Trojan.Generic.D3DEA8A8
Avast               Win32:TrojanX-gen [Trj]
Avira               TR/CoinMiner.cckhi
BitDefender         Trojan.GenericKD.64923816
Bkav                W32.AIDetectMalware.CS
CAT-QuickHeal       Trojan.YakbeexMSIL.ZZ4
CrowdStrike         win/malicious_confidence_100% (W)
Cybereason          malicious.59182e
Cylance             Unsafe
DeepInstinct        MALICIOUS
DrWeb               Trojan.MulDrop22.18159
ESET-NOD32          a variant of MSIL/Packed.VMProtect.D suspicious
Elastic             malicious (high confidence)
Emsisoft            Trojan.GenericKD.64923816 (B)
F-Secure            Trojan.TR/CoinMiner.cckhi
FireEye             Generic.mg.89eb91459182e588
Fortinet            PossibleThreat
GData               Trojan.GenericKD.64923816
Google              Detected
Gridinsoft          Trojan.Heur!.020134A1
Ikarus              Trojan.Win32.Generic
K7AntiVirus         Trojan ( 0059eee21 )
K7GW                Trojan ( 0059eee21 )
Kaspersky           HEUR:Trojan.MSIL.Miner.gen
Kingsoft            MSIL.Trojan.Miner.gen
Lionic              Trojan.Win32.Miner.4!c
MAX                 malware (ai score=86)
Malwarebytes        Generic.Malware.Agent.DDS
MaxSecure           Trojan.Malware.73691317.susgen
McAfee              GenericRXVQ-PD!89EB91459182
McAfeeD             Real Protect-LS!89EB91459182
MicroWorld-eScan    Trojan.GenericKD.64923816
Microsoft           Trojan:Win32/CryptInject!MSR
NANO-Antivirus      Trojan.Win32.Miner.jxfrkz
Paloalto            generic.ml
Panda               Trj/Chgt.AB
Rising              Trojan.Miner!8.EA1 (CLOUD)
Sangfor             CoinMiner.Msil.Agent.Vo4m
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.vc
Sophos              Mal/Generic-S
Symantec            ML.Attribute.HighConfidence
Tencent             Malware.Win32.Gencirc.11777268
VBA32               TScope.Trojan.MSIL
VIPRE               Trojan.GenericKD.64923816
Webroot             W32.Trojan.Gen
Xcitium             Malware@#1fs3frqru3hih
Yandex              Trojan.Agent!ji19Wcufj/c
Zillya              Trojan.Miner.Win32.16082
ZoneAlarm           HEUR:Trojan.MSIL.Miner.gen
alibabacloud        Miner


fileProps:
CompanyName      Reality Cheats
FileDescription  RealUI Installer
FileVersion      3.0.0.0
InternalName     RealUI-Installer.exe
LegalCopyright   Copyright ©  Reality Cheats INC. 2022
OriginalFilename RealUI-Installer.exe
ProductName      RealUI Loader
ProductVersion   3.0.0.0


firstSeen: 2024-11-29 00:46:10
ssz: 3 Mb
fname: 932ecc108b66048cf486e4063d648e77
vt: Scan finished
hash: 932ecc108b66048cf486e4063d648e77
date: 2024-11-29 00:46:10
compiled: Sun, Aug 1 2010, 10:32:37 - 32 Bit EXE
epSectIndex: 4
sects: ., ., .lol 0, .lol 1, .
die: PE: packer: MPRESS(-)[-] PE: linker: unknown(2.50)[EXE32]
resNames: 611 \24\1\1033
imphash: 65b6862e9898b195f4ef7a1685fd82dd
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 15CB7
epSect: .lol 1
details:
ALYac               GenPack:Trojan.Agent.EXMP
APEX                Malicious
AVG                 Win32:MalwareX-gen [Trj]
Acronis             suspicious
Antiy-AVL           GrayWare/Win32.Ausiv.a
Arcabit             GenPack:Trojan.Agent.EXMP
Avast               Win32:MalwareX-gen [Trj]
Avira               TR/Black.Gen2
BitDefender         GenPack:Trojan.Agent.EXMP
Bkav                W32.AIDetectMalware
CAT-QuickHeal       W32.Sivis.V5
CTX                 exe.trojan.exmp
ClamAV              Win.Malware.Ausiv-9940816-0
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Win32.HLLP.Siggen.53
ESET-NOD32          a variant of Win32/Ausiv.A
Elastic             malicious (high confidence)
Emsisoft            GenPack:Trojan.Agent.EXMP (B)
F-Secure            Trojan.TR/Black.Gen2
FireEye             Generic.mg.932ecc108b66048c
Fortinet            W32/VMProtect.ACO!tr
GData               GenPack:Trojan.Agent.EXMP
Google              Detected
Gridinsoft          Trojan.Win32.Gen.bot!s4
Ikarus              wormWin32.AutoRun.Delf
Jiangmin            Trojan.Generic.bvcco
K7AntiVirus         Trojan ( 7000001c1 )
K7GW                Trojan ( 7000001c1 )
Kaspersky           HEUR:Trojan.Win32.Generic
Kingsoft            malware.kb.b.999
Malwarebytes        Generic.Malware.AI.DDS
McAfee              GenericRXDR-HK!932ECC108B66
McAfeeD             Real Protect-LS!932ECC108B66
MicroWorld-eScan    GenPack:Trojan.Agent.EXMP
Microsoft           Trojan:Win32/Ausiv
Panda               Trj/Genetic.gen
Rising              Trojan.Ausiv!1.A52C (CLASSIC)
Sangfor             Worm.Win32.Save.a
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.wh
Sophos              Mal/VMProtBad-A
Symantec            W32.Suviapen
Tencent             Trojan.Win32.Ausiv.abc
Trapmine            malicious.high.ml.score
VBA32               Trojan.Ausiv
VIPRE               GenPack:Trojan.Agent.EXMP
Varist              W32/Ausiv.F.gen!Eldorado
VirIT               Trojan.Win32.Ausiv.A
Webroot             W32.Trojan.Gen
Xcitium             TrojWare.Win32.Ausiv.A@7gzgk5
Yandex              Trojan.GenAsa!wNuUW5HMkU4
Zillya              Trojan.Heur.Win32.10174
alibabacloud        Trojan:Win/Stone.A
huorong             Trojan/Obfuscated.dm
tehtris             Generic.Malware



firstSeen: 2024-11-29 10:16:34
ssz: 5 Mb
fname: 94eaf0651632a80af85eeb17e4797d60
vt: Scan finished
hash: 94eaf0651632a80af85eeb17e4797d60
date: 2024-11-29 10:16:34
compiled: Thu, Sep 12 2024, 9:08:14 - 32 Bit DLL
epSectIndex: 6
sects: .text, .rdata, .data, .%?., .%-[, .mo:, .reloc, .rsrc
die: PE: protector: VMProtect(2.X)[-] PE: linker: Microsoft Linker(14.39)[DLL32,signed]
exports: @1 MyUnregisterServer
resNames: 381 \24\2\1033
imphash: c60ea44c29fb9958cdca44c6933240cf
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 442944
epSect: .mo:
details:
APEX                Malicious
AVG                 Win32:MalwareX-gen [Trj]
AhnLab-V3           Trojan/Win.Redcap.R672916
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Avast               Win32:MalwareX-gen [Trj]
Avira               TR/Redcap.vdzex
Bkav                W32.AIDetectMalware
CrowdStrike         win/malicious_confidence_100% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.BB suspicious
Elastic             malicious (high confidence)
F-Secure            Trojan.TR/Redcap.vdzex
FireEye             Generic.mg.94eaf0651632a80a
Fortinet            Riskware/Application
GData               Win32.Trojan.Agent.4VTU3Q
Google              Detected
Gridinsoft          Trojan.Heur!.022120A0
Ikarus              PUA.VMProtect
K7AntiVirus         Trojan ( 0059f0351 )
K7GW                Trojan ( 0059f0351 )
Kaspersky           HEUR:Trojan.Win32.TbMA.gen
Malwarebytes        Trojan.MalPack.PES
McAfeeD             Real Protect-LS!94EAF0651632
Microsoft           Trojan:Win32/Redcap.GNZ!MTB
NANO-Antivirus      Trojan.Win32.TbMA.ktspbr
Panda               Trj/Genetic.gen
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.BumbleBee.rc
Symantec            ML.Attribute.HighConfidence
TACHYON             Trojan/W32.Agent.4858192
Tencent             Backdoor.Win64.Runshell_l.16001403
TrendMicro-HouseCallTROJ_GEN.R03BH01KT24
VBA32               BScope.TrojanPSW.Stealer
Varist              W32/Trojan.CZEC-4507
Webroot             Win.Trojan.Gen
Yandex              Riskware.VMProtect!U0btQzBGNZ8
Zillya              Trojan.VMProtect.Win32.100032



firstSeen: 2024-11-29 16:15:15
ssz: 5 Mb
fname: 970b5cd1e57f0c206ded3523633c7580
vt: Scan finished
hash: 970b5cd1e57f0c206ded3523633c7580
date: 2024-11-29 16:15:23
compiled: Thu, Sep 12 2024, 9:08:14 - 32 Bit DLL
epSectIndex: 6
sects: .text, .rdata, .data, .%?., .%-[, .mo:, .reloc, .rsrc
die: PE: protector: VMProtect(2.X)[-] PE: linker: Microsoft Linker(14.39)[DLL32,signed]
exports: @1 MyUnregisterServer
resNames: 381 \24\2\1033
imphash: c60ea44c29fb9958cdca44c6933240cf
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 442944
epSect: .mo:
details:
APEX                Malicious
AVG                 Win32:MalwareX-gen [Trj]
AhnLab-V3           Trojan/Win.Redcap.R672916
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Avast               Win32:MalwareX-gen [Trj]
Avira               TR/Redcap.vdzex
CrowdStrike         win/malicious_confidence_100% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.BB suspicious
Elastic             malicious (high confidence)
F-Secure            Trojan.TR/Redcap.vdzex
FireEye             Generic.mg.970b5cd1e57f0c20
Fortinet            Riskware/Application
GData               Win32.Trojan.Agent.UEAR73
Google              Detected
Gridinsoft          Trojan.Heur!.022120A0
Ikarus              PUA.VMProtect
K7AntiVirus         Trojan ( 0059f0351 )
K7GW                Trojan ( 0059f0351 )
Kaspersky           HEUR:Trojan.Win32.TbMA.gen
Malwarebytes        Trojan.MalPack.PES
McAfeeD             Real Protect-LS!970B5CD1E57F
Microsoft           Trojan:Win32/Redcap.GNZ!MTB
Panda               Trj/Genetic.gen
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.BumbleBee.rc
Symantec            ML.Attribute.HighConfidence
TACHYON             Trojan/W32.Agent.4858192
Tencent             Backdoor.Win64.Runshell_l.16001403
TrendMicro-HouseCallTROJ_GEN.R03BH01KS24
VBA32               BScope.TrojanPSW.Stealer
Varist              W32/Trojan.CZEC-4507
Webroot             Win.Trojan.Gen
Yandex              Riskware.VMProtect!U0btQzBGNZ8
Zillya              Trojan.VMProtect.Win32.100032



firstSeen: 2024-11-29 03:41:38
ssz: 8 Mb
fname: 987df25308de13c798c9f125ea8e58f3
vt: Scan finished
hash: 987df25308de13c798c9f125ea8e58f3
date: 2024-11-29 03:41:38
compiled: Thu, Jun 9 1932, 1:46:34 - 32 Bit EXE
epSectIndex: 8
sects: .text, exelent, .reloc, .imports, .themida, .taggant, .enigma1, .enigma2, .reloc, .rsrc
resNames: 796 \VERSION\1\0 490 \24\1\0
imphash: 86cd3e5a91af725b7ae55e612129849d
pever: ASLR PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 1321C5B
epSect: .enigma2
details:
APEX                Malicious
AVG                 Win32:Evo-gen [Trj]
AhnLab-V3           Trojan/Win.Evo-gen.R650662
Antiy-AVL           Trojan/Win32.Wacatac
Avast               Win32:Evo-gen [Trj]
Avira               HEUR/AGEN.1313495
Bkav                W32.AIDetectMalware
CrowdStrike         win/malicious_confidence_70% (W)
Cylance             Unsafe
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.XO
Elastic             malicious (high confidence)
F-Secure            Heuristic.HEUR/AGEN.1313495
FireEye             Generic.mg.987df25308de13c7
Google              Detected
Gridinsoft          Trojan.Heur!.03212021
K7AntiVirus         Trojan ( 7000001c1 )
K7GW                Trojan ( 7000001c1 )
McAfee              Artemis!987DF25308DE
McAfeeD             ti!16DFB998D47B
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.rc
Sophos              Mal/VMProtBad-A
Trapmine            malicious.high.ml.score
VBA32               Worm.Bundpil
Webroot             W32.Malware.Gen


die:
PE: protector: Enigma Virtual Box(-)[-]
	    PE: protector: VMProtect(2.X)[-]
	    PE: linker: Microsoft Linker(48.0*)[EXE32,console]

fileProps:
CompanyName      CompanyName
FileDescription  exelent v2
FileVersion      2.0.0.0
InternalName     exelent.exe
LegalCopyright   Copyright ©  2021
OriginalFilename exelent.exe
ProductName      exelent v2
ProductVersion   2.0.0.0


firstSeen: 2012-07-14 07:52:01
ssz: 3 Mb
fname: 992c6749fe830e9c54375ef1199cfb30
vt: Scan finished
hash: 992c6749fe830e9c54375ef1199cfb30
date: 2024-11-29 11:39:25
compiled: Sat, Jun 18 2011, 8:25:49 - 32 Bit EXE
epSectIndex: 1
sects: .text, .rdata, .data, .text0, .text1, .rsrc
die: PE: compiler: Microsoft Visual C/C++(6.0)[libcmt] PE: linker: Microsoft Linker(6.0)[EXE32]
imphash: 671bf282a1220dd40b726d0900e97b4a
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: CC8C
epSect: .text
details:
ALYac               Gen:Variant.Zusy.2597
APEX                Malicious
AVG                 Win32:Trojan-gen
Acronis             suspicious
AhnLab-V3           Unwanted/Win32.HackTool.R30464
Alibaba             Packed:Win32/Rename.1d1ca634
Antiy-AVL           Trojan/Win32.Genome
Arcabit             Trojan.Zusy.DA25
Avast               Win32:Trojan-gen
Avira               TR/ATRAPS.Gen
BitDefender         Gen:Variant.Zusy.2597
Bkav                W32.AIDetectMalware
CTX                 exe.unknown.zusy
ClamAV              Win.Packed.Vmprotect-9976168-0
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Trojan.DownLoader3.34874
ESET-NOD32          a variant of Win32/Packed.VMProtect.AAH
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Zusy.2597 (B)
F-Secure            Trojan.TR/ATRAPS.Gen
FireEye             Generic.mg.992c6749fe830e9c
Fortinet            W32/Genome.VFAE!tr
GData               Gen:Variant.Zusy.2597
Google              Detected
Gridinsoft          Rogue.Win32.Gen.bot!i
Ikarus              Trojan.Win32.Genome
Jiangmin            Trojan/Genome.brqi
K7AntiVirus         Trojan ( 0030861b1 )
K7GW                Trojan ( 0030861b1 )
Kaspersky           HEUR:Trojan.Win32.Generic
Kingsoft            Win32.Trojan.Generic.a
Lionic              Trojan.Win32.Genome.4!c
Malwarebytes        Generic.Malware.AI.DDS
MaxSecure           Trojan.Malware.7164915.susgen
McAfee              Generic PWS.zs
McAfeeD             ti!E946F603252B
MicroWorld-eScan    Gen:Variant.Zusy.2597
Microsoft           Trojan:Win32/Sisproc
NANO-Antivirus      Trojan.Win32.TrjGen.cukojh
Paloalto            generic.ml
Panda               Trj/Genetic.gen
Rising              HackTool.Obfuscator!8.236 (TFE:1:E6LjCSyx0qQ)
Sangfor             Trojan.Win32.Save.a
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.vh
Sophos              Mal/Generic-S
Symantec            ML.Attribute.HighConfidence
Tencent             Malware.Win32.Gencirc.10b6919f
Trapmine            malicious.high.ml.score
TrendMicro          TROJ_AGENT_015219.TOMB
TrendMicro-HouseCallTROJ_AGENT_015219.TOMB
VBA32               BScope.Trojan.Downloader
VIPRE               Gen:Variant.Zusy.2597
Varist              W32/Downloader.EF.gen!Eldorado
Xcitium             Malware@#2a39rj0zu8ks7
Yandex              Trojan.Genome!c5Oh+uzq7R4
Zillya              Trojan.Genome.Win32.156378
alibabacloud        Trojan:Win/Obfuscator.XO


resNames:
308     \CURSOR\2\2052
2220    \CURSOR\3\2052
748     \CURSOR\4\2052
54506   \BITMAP\174\2052
2730    \BITMAP\191\2052
2730    \BITMAP\192\2052
744     \ICON\1\2052
450     \DIALOG\129\2052
20      \GROUP_CURSOR\193\2052
34      \GROUP_CURSOR\194\2052
20      \GROUP_ICON\176\2052
628     \VERSION\1\2052

rich:
offset DanS:128
offset Rich:224
Size: 96
checkSum: 0x1575773F Matches!

clearData: DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00{\x1C\x0C\x00\x01\x00\x00\x006&\x0B\x00\x0A\x00\x00\x00\x83\x1C\x0E\x00\x16\x00\x00\x006&\x0A\x00d\x00\x00\x00o\x1F\x0B\x00\x02\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00b\x1F\x13\x00\x11\x00\x00\x00\x00\x00\x01\x00\xD0\x00\x00\x00\xE8\x1F\x0B\x00\x01\x00\x00\x00\xC7\x06\x06\x00\x01\x00\x00\x00

10 entries
--------------------------------------------------
Compiler: 7291
toolID: 12
Count: 1
toolName: AliasObj60
vsVer: Visual Studio 6 (06.00)

Compiler: 9782
toolID: 11
Count: 10
toolName: Utc12_CPP
vsVer: Visual Studio 6 (06.00)

Compiler: 7299
toolID: 14
Count: 22
toolName: Masm613
vsVer: Visual Studio 6 (06.00)

Compiler: 9782
toolID: 10
Count: 100
toolName: Utc12_C
vsVer: Visual Studio 6 (06.00)

Compiler: 8047
toolID: 11
Count: 2
toolName: Utc12_CPP
vsVer: Visual Studio 6 (06.00)

Compiler: 0
toolID: 0
Count: 19
toolName: 
vsVer: <unknown> (00.00)

Compiler: 8034
toolID: 19
Count: 17
toolName: Linker512
vsVer: <unknown> (00.00)

Compiler: 0
toolID: 1
Count: 208
toolName: Import0
vsVer: Visual Studio (00.00)

Compiler: 8168
toolID: 11
Count: 1
toolName: Utc12_CPP
vsVer: Visual Studio 6 (06.00)

Compiler: 1735
toolID: 6
Count: 1
toolName: Cvtres500
vsVer: Visual Studio 6 (06.00)


firstSeen: 2024-11-28 00:56:12
ssz: 10 Mb
fname: a5606b2c602d8c2f215793f10e6b4c54
vt: Scan finished
hash: a5606b2c602d8c2f215793f10e6b4c54
date: 2024-11-28 00:56:12
compiled: Wed, Nov 27 2024, 7:57:21 - 32 Bit EXE
epSectIndex: 6
sects: .text, .rdata, .data, .n[1, .ENm, .f~Q, .reloc, .rsrc
imphash: ab85b3f75d8f2dee0859c80e053544cd
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 1519C4F
epSect: .f~Q
details:
Bkav                W32.AIDetectMalware
CrowdStrike         win/malicious_confidence_60% (D)
Cylance             Unsafe
ESET-NOD32          a variant of Win32/Packed.VMProtect.AU suspicious
Elastic             malicious (high confidence)
Microsoft           Program:Win32/Wacapew.C!ml
Skyhigh             BehavesLike.Win32.Generic.tc
Symantec            ML.Attribute.HighConfidence


die:
PE: protector: VMProtect(2.X)[-]
	    PE: library: Qt(5.X)[-]
	    PE: linker: Microsoft Linker(14.29)[EXE32]

resNames:
4148    \ICON\1\1033
3752    \ICON\2\1033
2216    \ICON\3\1033
1736    \ICON\4\1033
1384    \ICON\5\1033
7336    \ICON\6\1033
3240    \ICON\7\1033
1864    \ICON\8\1033
872     \ICON\9\1033
4541    \ICON\10\1033
67624   \ICON\11\1033
9640    \ICON\12\1033
4264    \ICON\13\1033
2440    \ICON\14\1033
1128    \ICON\15\1033
216     \GROUP_ICON\101\1033
800     \VERSION\1\1033
638     \24\1\1033

fileProps:
CompanyName      Digital Wave Ltd
FileDescription  Free YouTube Download
FileVersion      4,4,17,1126
InternalName     FreeYTVDownloader.exe
LegalCopyright   © 2006-2024 Digital Wave Ltd
OriginalFilename FreeYTVDownloader.exe
ProductName      Free Studio
ProductVersion   4,4,17,1126


firstSeen: 2024-11-29 16:27:40
ssz: 2 Mb
fname: a8b8021bdabca3a920b2fcd5368e6812
vt: Scan finished
hash: a8b8021bdabca3a920b2fcd5368e6812
date: 2024-11-29 16:27:40
compiled: Tue, May 7 2024, 12:27:29 - 32 Bit EXE
epSectIndex: 6
sects: .text, .rdata, .data, .1Q[, .),E, .sc=, .reloc
die: PE: linker: Microsoft Linker(14.29)[EXE32]
imphash: 847bf44a6099ee7a9c215a232e218aab
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 1A9119
epSect: .sc=
details:
ALYac               Gen:Variant.Zusy.556634
APEX                Malicious
AVG                 Win32:KeyloggerX-gen [Trj]
AhnLab-V3           Trojan/Win.Generic.R647582
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Arcabit             Trojan.Zusy.D87E5A
Avast               Win32:KeyloggerX-gen [Trj]
Avira               HEUR/AGEN.1374848
BitDefender         Gen:Variant.Zusy.556634
Bkav                W32.AIDetectMalware
CTX                 exe.unknown.zusy
ClamAV              Win.Packed.C2xk-10031869-0
CrowdStrike         win/malicious_confidence_100% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.BC suspicious
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Zusy.556634 (B)
F-Secure            Heuristic.HEUR/AGEN.1374848
FireEye             Generic.mg.a8b8021bdabca3a9
Fortinet            W32/Kryptik.HRTC!tr
GData               Win32.Trojan.PSE.1V4QVRM
Google              Detected
Gridinsoft          Trojan.Heur!.022120A1
Ikarus              PUA.VMProtect
Jiangmin            Trojan.Agent.ewwu
K7AntiVirus         Trojan ( 0059f91f1 )
K7GW                Trojan ( 0059f91f1 )
Kaspersky           Trojan.Win32.Agent2.mxh
Kingsoft            malware.kb.b.808
Malwarebytes        Malware.AI.1010088143
MaxSecure           Trojan.Malware.273686129.susgen
McAfeeD             Real Protect-LS!A8B8021BDABC
MicroWorld-eScan    Gen:Variant.Zusy.556634
Microsoft           Trojan:Win32/KeyLogger.ASL!MTB
NANO-Antivirus      Trojan.Win32.Redcap.koeegm
Panda               Trj/Genetic.gen
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.tc
Sophos              Generic ML PUA (PUA)
Symantec            ML.Attribute.HighConfidence
TACHYON             Trojan/W32.Agent.1589760.V
Tencent             Trojan.Win32.Agent.cby
Trapmine            malicious.high.ml.score
VBA32               BScope.TrojanSpy.LClipper
VIPRE               Gen:Variant.Zusy.556634
Varist              W32/VMProtect.EC.gen!Eldorado
VirIT               Trojan.Win32.Genus.WDT
Webroot             W32.Trojan.Gen
Zillya              Trojan.VMProtect.Win32.93512
huorong             Trojan/Agent.bss



firstSeen: 2024-11-29 00:44:21
ssz: 3 Mb
fname: aa4dfec2153ac2d2d9c5cd27efd579ae
vt: Scan finished
hash: aa4dfec2153ac2d2d9c5cd27efd579ae
date: 2024-11-29 00:44:21
compiled: Sun, Aug 1 2010, 10:32:37 - 32 Bit EXE
epSectIndex: 4
sects: ., ., .lol 0, .lol 1, .
die: PE: packer: MPRESS(-)[-] PE: linker: unknown(2.50)[EXE32]
resNames: 611 \24\1\1033
imphash: 65b6862e9898b195f4ef7a1685fd82dd
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 15CB7
epSect: .lol 1
details:
APEX                Malicious
AVG                 Win32:MalwareX-gen [Trj]
Acronis             suspicious
Antiy-AVL           GrayWare/Win32.Ausiv.a
Arcabit             GenPack:Trojan.Agent.EXMP
Avast               Win32:MalwareX-gen [Trj]
Avira               TR/Black.Gen2
BitDefender         GenPack:Trojan.Agent.EXMP
Bkav                W32.AIDetectMalware
CAT-QuickHeal       W32.Sivis.V5
CTX                 exe.trojan.exmp
ClamAV              Win.Malware.Ausiv-9940816-0
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Win32.HLLP.Siggen.53
ESET-NOD32          a variant of Win32/Ausiv.A
Elastic             malicious (high confidence)
Emsisoft            GenPack:Trojan.Agent.EXMP (B)
F-Secure            Trojan.TR/Black.Gen2
FireEye             Generic.mg.aa4dfec2153ac2d2
Fortinet            W32/VMProtect.ACO!tr
GData               GenPack:Trojan.Agent.EXMP
Google              Detected
Gridinsoft          Trojan.Win32.Gen.bot!s4
Ikarus              wormWin32.AutoRun.Delf
Jiangmin            Trojan.Generic.bvcco
K7AntiVirus         Trojan ( 7000001c1 )
K7GW                Trojan ( 7000001c1 )
Kaspersky           HEUR:Trojan.Win32.Generic
Kingsoft            malware.kb.b.999
Malwarebytes        Generic.Malware.AI.DDS
MaxSecure           Trojan.WIN32.generickd.45914965
McAfee              GenericRXDR-HK!AA4DFEC2153A
McAfeeD             Real Protect-LS!AA4DFEC2153A
MicroWorld-eScan    GenPack:Trojan.Agent.EXMP
Microsoft           Trojan:Win32/Ausiv
Panda               Trj/Genetic.gen
Rising              Trojan.Ausiv!1.A52C (CLASSIC)
Sangfor             Worm.Win32.Save.a
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.wh
Sophos              Mal/VMProtBad-A
Symantec            W32.Suviapen
Tencent             Trojan.Win32.Ausiv.abc
Trapmine            malicious.high.ml.score
VBA32               Trojan.Ausiv
VIPRE               GenPack:Trojan.Agent.EXMP
Varist              W32/Ausiv.F.gen!Eldorado
VirIT               Trojan.Win32.Ausiv.A
Webroot             W32.Trojan.Gen
Xcitium             TrojWare.Win32.Ausiv.A@7gzgk5
Yandex              Trojan.GenAsa!wNuUW5HMkU4
Zillya              Trojan.Heur.Win32.10174
alibabacloud        Trojan:Win/Stone.A
huorong             Trojan/Obfuscated.dm
tehtris             Generic.Malware



firstSeen: 2024-11-29 03:53:09
ssz: 5 Mb
fname: abcfa043f93f89103a59fdd1ab7eb76b
vt: Scan finished
hash: abcfa043f93f89103a59fdd1ab7eb76b
date: 2024-11-29 03:53:09
compiled: Thu, Sep 12 2024, 9:08:14 - 32 Bit DLL
epSectIndex: 6
sects: .text, .rdata, .data, .%?., .%-[, .mo:, .reloc, .rsrc
die: PE: protector: VMProtect(2.X)[-] PE: linker: Microsoft Linker(14.39)[DLL32,signed]
exports: @1 MyUnregisterServer
resNames: 381 \24\2\1033
imphash: c60ea44c29fb9958cdca44c6933240cf
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 442944
epSect: .mo:
details:
APEX                Malicious
AVG                 Win32:MalwareX-gen [Trj]
AhnLab-V3           Trojan/Win.Redcap.R672916
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Avast               Win32:MalwareX-gen [Trj]
Avira               TR/Redcap.vdzex
Bkav                W32.AIDetectMalware
CrowdStrike         win/malicious_confidence_100% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.BB suspicious
Elastic             malicious (high confidence)
F-Secure            Trojan.TR/Redcap.vdzex
FireEye             Generic.mg.abcfa043f93f8910
Fortinet            Riskware/Application
GData               Win32.Trojan.Agent.DCQXGV
Google              Detected
Gridinsoft          Trojan.Heur!.022120A0
Ikarus              PUA.VMProtect
K7AntiVirus         Trojan ( 0059f0351 )
K7GW                Trojan ( 0059f0351 )
Kaspersky           HEUR:Trojan.Win32.TbMA.gen
Malwarebytes        Trojan.MalPack.PES
MaxSecure           Trojan.Malware.300983.susgen
McAfeeD             Real Protect-LS!ABCFA043F93F
Microsoft           Trojan:Win32/Redcap.GNZ!MTB
Panda               Trj/Genetic.gen
Rising              Trojan.TbMA!8.E459 (RDMK:cmRtazr/US+AhfL+Fb3vVxQNlPWS)
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.BumbleBee.rc
Symantec            ML.Attribute.HighConfidence
TACHYON             Trojan/W32.Agent.4858192
Tencent             Backdoor.Win64.Runshell_l.16001403
VBA32               BScope.TrojanPSW.Stealer
Varist              W32/Trojan.CZEC-4507
Webroot             Win.Trojan.Gen
Yandex              Riskware.VMProtect!U0btQzBGNZ8
Zillya              Trojan.VMProtect.Win32.100032



firstSeen: 2024-05-02 17:28:49
ssz: 9 Mb
fname: ae7730ee51ef3f6d50c9116975fd0b2d
vt: Scan finished
hash: ae7730ee51ef3f6d50c9116975fd0b2d
date: 2024-11-08 13:09:20
compiled: Sat, Jul 8 2023, 5:26:03 - 32 Bit EXE
epSectIndex: 6
sects: .text, .rdata, .data, .C:+, .9];, .;5`, .rsrc
die: PE: linker: Microsoft Linker(10.0)[EXE32]
imphash: a8c2ec335c97f11dfa89b338634a1b95
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: E9D20B
epSect: .;5`
details:
ALYac               Trojan.GenericKD.72617446
APEX                Malicious
AVG                 Win32:Evo-gen [Trj]
Alibaba             Packed:Win32/VMProtect.d425d7c9
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Arcabit             Trojan.Generic.D4540DE6
Avast               Win32:Evo-gen [Trj]
Avira               TR/AVI.Agent.hgnbc
BitDefender         Trojan.GenericKD.72617446
Bkav                W32.AIDetectMalware
CTX                 exe.trojan.vmprotect
CrowdStrike         win/malicious_confidence_90% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.AU suspicious
Elastic             malicious (high confidence)
Emsisoft            Trojan.GenericKD.72617446 (B)
F-Secure            Trojan.TR/AVI.Agent.hgnbc
FireEye             Generic.mg.ae7730ee51ef3f6d
Fortinet            Riskware/Application
GData               Trojan.GenericKD.72617446
Google              Detected
Gridinsoft          Trojan.Heur!.02292021
Ikarus              PUA.VMProtect
K7AntiVirus         Trojan ( 0059f3ca1 )
K7GW                Trojan ( 0059f3ca1 )
Lionic              Trojan.Win32.VMProtect.4!c
Malwarebytes        Generic.Malware.AI.DDS
MaxSecure           Trojan.Malware.244470848.susgen
McAfeeD             Real Protect-LS!AE7730EE51EF
MicroWorld-eScan    Trojan.GenericKD.72617446
Microsoft           PUA:Win32/Packunwan
Paloalto            generic.ml
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.rc
Sophos              Mal/Generic-S
Symantec            ML.Attribute.HighConfidence
Trapmine            malicious.moderate.ml.score
TrendMicro          TROJ_FRS.VSNTHQ24
TrendMicro-HouseCallTROJ_FRS.VSNTHQ24
VIPRE               Trojan.GenericKD.72617446
Varist              W32/ABTrojan.SONI-4445
Zillya              Trojan.VMProtect.Win32.93584
tehtris             Generic.Malware


resNames:
67624   \ICON\1\1033
1128    \ICON\4\1033
1128    \ICON\5\1033
1128    \ICON\6\1033
296     \ICON\7\1033
20      \GROUP_ICON\159\1033
20      \GROUP_ICON\160\1033
20      \GROUP_ICON\206\1033
20      \GROUP_ICON\207\1033
20      \GROUP_ICON\208\1033
540     \VERSION\1\1033
1268    \24\1\1033

fileProps:
CompanyName      CompanyName
FileDescription  FileDescription
FileVersion      1.1.37.01
InternalName     InternalName
LegalCopyright   LegalCopyright
OriginalFilename OriginalFileName
ProductName      ProductName
ProductVersion   1.1.37.01


firstSeen: 2017-01-05 00:21:42
ssz: 3 Mb
fname: af85546028cf5bec2c7d501998c0b78b
details: Ikarus Trojan.Win32.VMProtect
vt: Scan finished
hash: af85546028cf5bec2c7d501998c0b78b
date: 2024-11-18 10:00:53
compiled: Wed, Jul 9 2014, 7:58:13 - 32 Bit EXE
epSectIndex: 2
sects: .text, .itext, .data, .bss, .idata, .tls, .rdata, .rsrc
imphash: 9accc748a9d89a334d2fc419ec39655a
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 113BC
epSect: .itext
die:
PE: installer: Inno Setup Module(5.5.0)[unicode]
	    PE: compiler: Embarcadero Delphi(2009-2010)[-]
	    PE: linker: Turbo Linker(2.25*,Delphi)[EXE32]
	    PE: overlay: Inno Setup Installer data(-)[-]

resNames:
270376  \ICON\1\1033
296     \ICON\1\1043
67624   \ICON\2\1033
1384    \ICON\2\1043
16936   \ICON\3\1033
744     \ICON\3\1043
9640    \ICON\4\1033
2216    \ICON\4\1043
4264    \ICON\5\1033
1128    \ICON\6\1033
104     \STRING\4091\0
212     \STRING\4092\0
164     \STRING\4093\0
684     \STRING\4094\0
844     \STRING\4095\0
660     \STRING\4096\0
33512   \RCDATA\CHARTABLE\1033
16      \RCDATA\DVCLAL\0
336     \RCDATA\PACKAGEINFO\0
44      \RCDATA\11111\0
90      \GROUP_ICON\MAINICON\1033
1268    \VERSION\1\1033
1512    \24\1\1033

fileProps:
CompanyName      Capcom
FileDescription  Resident Evil 4 Ultimate HD Edition Setup
ProductName      Resident Evil 4 Ultimate HD Edition
ProductVersion   1.0.6


firstSeen: 2024-11-29 02:58:10
ssz: 2 Mb
fname: b22d4d93ec89c50d201e20fd953fbaf4
vt: Scan finished
hash: b22d4d93ec89c50d201e20fd953fbaf4
date: 2024-11-29 02:58:10
compiled: Wed, Jan 26 2022, 9:27:36 - 32 Bit EXE
epSectIndex: 1
sects: .text, .rdata, .data, .rsrc, .reloc
die: PE: linker: Microsoft Linker(14.16)[EXE32]
pdb: D:\Workspace\01_Source\Develop\102_git\02_LogView\LogView\binrelease\DownloadConfig.pdb
imphash: 6b792b2abba0e5db3eabb94ff78d7d54
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 1474E8
epSect: .text
details:
APEX                Malicious
AVG                 Win32:SaliCode [Inf]
AhnLab-V3           Win32/Kashu.E
Antiy-AVL           Virus/Win32.Sality.gen
Arcabit             Win32.Sality.3
Avast               Win32:SaliCode [Inf]
Avira               W32/Sality.AT
Baidu               Win32.Virus.Sality.gen
BitDefender         Win32.Sality.3
Bkav                W32.Sality.PE
CAT-QuickHeal       W32.Sality.U
CTX                 exe.unknown.sality
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 99)
DrWeb               Win32.Sector.30
ESET-NOD32          Win32/Sality.NBA
Elastic             malicious (high confidence)
Emsisoft            Win32.Sality.3 (B)
F-Secure            Malware.W32/Sality.AT
FireEye             Generic.mg.b22d4d93ec89c50d
Fortinet            W32/CoinMiner.BH
GData               Win32.Sality.3
Google              Detected
Ikarus              Trojan.Win32.VMProtect
Jiangmin            Win32/HLLP.Kuku.poly2
K7AntiVirus         Virus ( f10001071 )
K7GW                Virus ( f10001071 )
Kaspersky           Virus.Win32.Sality.sil
MaxSecure           Virus.Sality.BH
McAfee              W32/Sality.gen.z
McAfeeD             Real Protect-LS!B22D4D93EC89
MicroWorld-eScan    Win32.Sality.3
Microsoft           Virus:Win32/Sality.AT
NANO-Antivirus      Virus.Win32.Sality.bzkem
Panda               W32/Sality.AA
Rising              Virus.Sality!1.A5BD (CLASSIC)
Sangfor             Virus_Suspicious.Win32.Sality.bh
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Sality.vh
Sophos              Mal/Sality-D
Symantec            W32.Sality.AE
Tencent             Virus.Win32.TuTu.Gen.200004
Trapmine            malicious.high.ml.score
TrendMicro          PE_SALITY.ER
TrendMicro-HouseCallPE_SALITY.ER
VBA32               Virus.Win32.Sality.bakb
VIPRE               Win32.Sality.3
Varist              W32/Sality.gen2
ViRobot             Win32.Sality.Gen.A
VirIT               Win32.Sality.BI
Yandex              Win32.Sality.FA.Gen
Zillya              Virus.Sality.Win32.25
alibabacloud        Virus:Win/Sality.NBA(dyn)
huorong             Virus/Sality.c


resNames:
2       \AFX_DIALOG_LAYOUT\102\2052
308     \CURSOR\14\2052
180     \CURSOR\15\2052
308     \CURSOR\16\2052
308     \CURSOR\17\2052
308     \CURSOR\18\2052
308     \CURSOR\19\2052
308     \CURSOR\20\2052
308     \CURSOR\21\2052
308     \CURSOR\22\2052
308     \CURSOR\23\2052
308     \CURSOR\24\2052
308     \CURSOR\25\2052
308     \CURSOR\26\2052
308     \CURSOR\27\2052
308     \CURSOR\28\2052
308     \CURSOR\29\2052
184     \BITMAP\30994\2052
324     \BITMAP\30996\2052
1640    \ICON\1\2052
744     \ICON\2\2052
488     \ICON\3\2052
296     \ICON\4\2052
3752    \ICON\5\2052
2216    \ICON\6\2052
1736    \ICON\7\2052
1384    \ICON\8\2052
37835   \ICON\9\2052
9640    \ICON\10\2052
4264    \ICON\11\2052
2440    \ICON\12\2052
1128    \ICON\13\2052
312     \DIALOG\100\2052
1288    \DIALOG\102\2052
226     \DIALOG\30721\2052
52      \DIALOG\30734\2052
80      \STRING\7\2052
78      \STRING\3841\2052
44      \STRING\3842\2052
132     \STRING\3843\2052
460     \STRING\3857\2052
334     \STRING\3858\2052
270     \STRING\3859\2052
80      \STRING\3860\2052
68      \STRING\3865\2052
104     \STRING\3866\2052
434     \STRING\3867\2052
244     \STRING\3868\2052
36      \STRING\3869\2052
424     \STRING\3887\2052
34      \GROUP_CURSOR\30977\2052
20      \GROUP_CURSOR\30998\2052
20      \GROUP_CURSOR\30999\2052
20      \GROUP_CURSOR\31000\2052
20      \GROUP_CURSOR\31001\2052
20      \GROUP_CURSOR\31002\2052
20      \GROUP_CURSOR\31003\2052
20      \GROUP_CURSOR\31004\2052
20      \GROUP_CURSOR\31005\2052
20      \GROUP_CURSOR\31006\2052
20      \GROUP_CURSOR\31007\2052
20      \GROUP_CURSOR\31008\2052
20      \GROUP_CURSOR\31009\2052
20      \GROUP_CURSOR\31010\2052
20      \GROUP_CURSOR\31011\2052
188     \GROUP_ICON\128\2052
876     \VERSION\1\2052
796     \24\1\1033

fileProps:
CompanyName      XINYI Information Technology Ltd
FileDescription  XIYI Download Configuration
FileVersion      1.3.1.6
InternalName     DownloadConfig.exe
LegalCopyright   Copyright © XINYI Technology Ltd. All rights reserved
OriginalFilename DownloadConfig.exe
ProductName      DownloadConfig
ProductVersion   1.3.1.6

rich:
offset DanS:128
offset Rich:248
Size: 120
checkSum: 0xF85D45E7 Matches!

clearData: DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00ef\x03\x01\x1A\x00\x00\x00ef\x04\x01"\x00\x00\x00ef\x05\x01\xBC\x00\x00\x00ef\x06\x01\x03\x00\x00\x00ef\x01\x01#\x00\x00\x00\x00\x00\x01\x00\xFF\x02\x00\x00Rh\x04\x01\x13\x00\x00\x00Rh\x03\x01\x16\x00\x00\x00Rh\x05\x01i\x01\x00\x00\xA5i\x09\x01\x04\x00\x00\x00\xA5i\xFF\x00\x01\x00\x00\x00\x00\x00\x97\x00\x01\x00\x00\x00\xA5i\x02\x01\x01\x00\x00\x00

13 entries
--------------------------------------------------
Compiler: 26213
toolID: 259
Count: 26
toolName: Masm1400
vsVer: Visual Studio 2015 (14.00)

Compiler: 26213
toolID: 260
Count: 34
toolName: Utc1900_C
vsVer: Visual Studio 2015 (14.00)

Compiler: 26213
toolID: 261
Count: 188
toolName: Utc1900_CPP
vsVer: Visual Studio 2015 (14.00)

Compiler: 26213
toolID: 262
Count: 3
toolName: Utc1900_CVTCIL_C
vsVer: Visual Studio 2015 (14.00)

Compiler: 26213
toolID: 257
Count: 35
toolName: Implib1400
vsVer: Visual Studio 2015 (14.00)

Compiler: 0
toolID: 1
Count: 767
toolName: Import0
vsVer: Visual Studio (00.00)

Compiler: 26706
toolID: 260
Count: 19
toolName: Utc1900_C
vsVer: Visual Studio 2015 (14.00)

Compiler: 26706
toolID: 259
Count: 22
toolName: Masm1400
vsVer: Visual Studio 2015 (14.00)

Compiler: 26706
toolID: 261
Count: 361
toolName: Utc1900_CPP
vsVer: Visual Studio 2015 (14.00)

Compiler: 27045
toolID: 265
Count: 4
toolName: Utc1900_LTCG_CPP
vsVer: Visual Studio 2015 (14.00)

Compiler: 27045
toolID: 255
Count: 1
toolName: Cvtres1400
vsVer: Visual Studio 2015 (14.00)

Compiler: 0
toolID: 151
Count: 1
toolName: Resource
vsVer: Visual Studio 2008 (09.00)

Compiler: 27045
toolID: 258
Count: 1
toolName: Linker1400
vsVer: Visual Studio 2015 (14.00)


firstSeen: 2024-06-06 13:09:42
ssz: 7 Mb
fname: b713bf00893690f8f7d62710a03384ae
vt: Scan finished
hash: b713bf00893690f8f7d62710a03384ae
date: 2024-11-24 04:11:42
compiled: Wed, Jan 31 2024, 18:44:30 - 32 Bit DLL
epSectIndex: 7
sects: .text, .rdata, .data, _RDATA, .&:`, .yN9, .EAY, .reloc, .rsrc
die: PE: protector: VMProtect(2.X)[-] PE: linker: Microsoft Linker(14.38)[DLL32]
resNames: 381 \24\2\1033
imphash: 101f7eedcfeb5cecc5f8f18ce68d6ee9
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: B4AAA4
epSect: .EAY
details:
APEX                Malicious
Alibaba             Packed:Win32/VMProtect.b684dc7a
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Bkav                W32.AIDetectMalware
CTX                 dll.trojan.vmprotect
CrowdStrike         win/malicious_confidence_90% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.AU suspicious
Elastic             malicious (high confidence)
FireEye             Generic.mg.b713bf00893690f8
Fortinet            Riskware/Application
Google              Detected
Gridinsoft          Trojan.Heur!.02212020
Ikarus              PUA.VMProtect
Lionic              Trojan.Win32.VMProtect.4!c
Malwarebytes        Malware.AI.930923382
MaxSecure           Trojan.Malware.300983.susgen
McAfee              Artemis!B713BF008936
McAfeeD             Real Protect-LS!B713BF008936
Paloalto            generic.ml
Sangfor             Trojan.Win32.Save.a
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.wc
Sophos              Generic ML PUA (PUA)
alibabacloud        VirTool:Win/Packed.VMProtect.AC



firstSeen: 2016-01-04 10:19:03
ssz: 3 Mb
fname: b9ff75315515d7e04c3d763ce415b596
vt: Scan finished
hash: b9ff75315515d7e04c3d763ce415b596
date: 2024-11-29 14:43:03
compiled: Wed, Jul 9 2014, 7:58:13 - 32 Bit EXE
epSectIndex: 2
sects: .text, .itext, .data, .bss, .idata, .tls, .rdata, .rsrc
imphash: 9accc748a9d89a334d2fc419ec39655a
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 113BC
epSect: .itext
details:
Bkav                W32.AIDetectMalware
CrowdStrike         win/grayware_confidence_60% (D)
Ikarus              Trojan.Win32.VMProtect


die:
PE: installer: Inno Setup Module(5.5.0)[unicode]
	    PE: compiler: Embarcadero Delphi(2009-2010)[-]
	    PE: linker: Turbo Linker(2.25*,Delphi)[EXE32]
	    PE: overlay: Inno Setup Installer data(-)[-]

resNames:
1128    \ICON\1\1033
296     \ICON\1\1043
2440    \ICON\2\1033
1384    \ICON\2\1043
4264    \ICON\3\1033
744     \ICON\3\1043
9640    \ICON\4\1033
2216    \ICON\4\1043
16936   \ICON\5\1033
38056   \ICON\6\1033
67624   \ICON\7\1033
152104  \ICON\8\1033
270376  \ICON\9\1033
104     \STRING\4091\0
212     \STRING\4092\0
164     \STRING\4093\0
684     \STRING\4094\0
844     \STRING\4095\0
660     \STRING\4096\0
33512   \RCDATA\CHARTABLE\1033
16      \RCDATA\DVCLAL\0
336     \RCDATA\PACKAGEINFO\0
44      \RCDATA\11111\0
132     \GROUP_ICON\MAINICON\1033
1268    \VERSION\1\1033
1512    \24\1\1033

fileProps:
CompanyName      UBISoft
FileDescription  Assassins Creed Unity Setup
ProductName      Assassins Creed Unity
ProductVersion   1.5.0


firstSeen: 2021-03-24 12:41:55
ssz: 6 Mb
fname: ba232821ff88e7cc01bc215f8cde74d7
vt: Scan finished
hash: ba232821ff88e7cc01bc215f8cde74d7
date: 2022-11-21 07:04:28
compiled: Mon, Mar 22 2021, 18:51:07 - 32 Bit EXE
epSectIndex: 6
sects: .text, .rdata, .data, .gfids, .lav0, .lav1, .reloc
die: PE: protector: VMProtect(1.X)[-] PE: linker: Microsoft Linker(14.0)[EXE32,console]
imphash: e6a31ee0183bf0f4f4860d87efb31a2a
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 92E32D
epSect: .lav1
details:
APEX                Malicious
AVG                 Win32:Malware-gen
Acronis             suspicious
Ad-Aware            Gen:Variant.Babar.97769
Alibaba             Trojan:Win32/Generic.eb2aa0e4
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Arcabit             Trojan.Babar.D17DE9
Avast               Win32:Malware-gen
Avira               TR/Agent.aazk
BitDefender         Gen:Variant.Babar.97769
BitDefenderTheta    Gen:NN.ZexaF.34796.@FW@aik8g6j
Bkav                W32.AIDetect.malware1
Comodo              Malware@#3nwp9hvd97iqj
CrowdStrike         win/malicious_confidence_100% (W)
Cybereason          malicious.1ff88e
Cylance             Unsafe
Cynet               Malicious (score: 100)
ESET-NOD32          a variant of Win32/Packed.VMProtect.ACR
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Babar.97769 (B)
F-Secure            Trojan.TR/Agent.aazk
FireEye             Generic.mg.ba232821ff88e7cc
Fortinet            PossibleThreat.PALLAS.H
GData               Gen:Variant.Babar.97769
Google              Detected
Gridinsoft          Trojan.Win32.Packed.ns
Ikarus              Trojan.Crypt
Lionic              Trojan.Win32.Malicious.4!c
MAX                 malware (ai score=88)
Malwarebytes        Malware.Heuristic.1003
MaxSecure           Trojan.Malware.116072815.susgen
McAfee              Artemis!BA232821FF88
McAfee-GW-Edition   BehavesLike.Win32.Generic.vc
MicroWorld-eScan    Gen:Variant.Babar.97769
Microsoft           Trojan:Win32/Ymacco.AAF9
Panda               Trj/RnkBend.A
Rising              Trojan.Generic@AI.96 (RDML:H2wvLqs1enEa4FQmovqVcw)
Sangfor             Trojan.Win32.Save.a
SentinelOne         Static AI - Malicious PE
Sophos              Mal/Generic-S
Symantec            ML.Attribute.HighConfidence
Trapmine            malicious.high.ml.score
TrendMicro-HouseCallTROJ_GEN.R002H0CCB22
VIPRE               Gen:Variant.Babar.97769
Webroot             W32.Trojan.Gen
Zillya              Trojan.VMProtect.Win32.59778
tehtris             Generic.Malware



firstSeen: 2024-11-29 00:58:17
ssz: 3 Mb
fname: c4f08a83383c374d62ac98c57bc5451e
vt: Scan finished
hash: c4f08a83383c374d62ac98c57bc5451e
date: 2024-11-29 00:58:17
compiled: Sun, Aug 1 2010, 10:32:37 - 32 Bit EXE
epSectIndex: 4
sects: ., ., .lol 0, .lol 1, .
die: PE: packer: MPRESS(-)[-] PE: linker: unknown(2.50)[EXE32]
resNames: 611 \24\1\1033
imphash: 65b6862e9898b195f4ef7a1685fd82dd
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 15CB7
epSect: .lol 1
details:
ALYac               GenPack:Trojan.Agent.EXMP
APEX                Malicious
AVG                 Win32:MalwareX-gen [Trj]
Acronis             suspicious
Antiy-AVL           GrayWare/Win32.Ausiv.a
Arcabit             GenPack:Trojan.Agent.EXMP
Avast               Win32:MalwareX-gen [Trj]
Avira               TR/Black.Gen2
BitDefender         GenPack:Trojan.Agent.EXMP
Bkav                W32.AIDetectMalware
CAT-QuickHeal       W32.Sivis.V5
CTX                 exe.trojan.exmp
ClamAV              Win.Malware.Ausiv-9940816-0
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Win32.HLLP.Siggen.53
ESET-NOD32          a variant of Win32/Ausiv.A
Elastic             malicious (high confidence)
Emsisoft            GenPack:Trojan.Agent.EXMP (B)
F-Secure            Trojan.TR/Black.Gen2
FireEye             Generic.mg.c4f08a83383c374d
Fortinet            W32/VMProtect.ACO!tr
GData               GenPack:Trojan.Agent.EXMP
Google              Detected
Gridinsoft          Trojan.Win32.Gen.bot!s4
Ikarus              wormWin32.AutoRun.Delf
Jiangmin            Trojan.Generic.bvcco
K7AntiVirus         Trojan ( 7000001c1 )
K7GW                Trojan ( 7000001c1 )
Kaspersky           HEUR:Trojan.Win32.Generic
Kingsoft            malware.kb.b.999
Malwarebytes        Generic.Malware.AI.DDS
MaxSecure           Trojan.WIN32.generickd.45914965
McAfee              GenericRXDR-HK!C4F08A83383C
McAfeeD             Real Protect-LS!C4F08A83383C
MicroWorld-eScan    GenPack:Trojan.Agent.EXMP
Microsoft           Trojan:Win32/Ausiv
Panda               Trj/Genetic.gen
Rising              Trojan.Ausiv!1.A52C (CLASSIC)
Sangfor             Worm.Win32.Save.a
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.wh
Sophos              Mal/VMProtBad-A
Symantec            W32.Suviapen
Tencent             Trojan.Win32.Ausiv.abc
Trapmine            malicious.high.ml.score
VBA32               Trojan.Ausiv
VIPRE               GenPack:Trojan.Agent.EXMP
Varist              W32/Ausiv.F.gen!Eldorado
VirIT               Trojan.Win32.Ausiv.A
Webroot             W32.Trojan.Gen
Xcitium             TrojWare.Win32.Ausiv.A@7gzgk5
Yandex              Trojan.GenAsa!wNuUW5HMkU4
alibabacloud        Trojan:Win/Stone.A
huorong             Trojan/Obfuscated.dm
tehtris             Generic.Malware



firstSeen: 2013-03-11 18:49:32
ssz: 11 Mb
fname: d18c7bf976268f79bdc216b4ec36ddc6
vt: Scan finished
hash: d18c7bf976268f79bdc216b4ec36ddc6
date: 2024-08-26 17:01:25
compiled: Tue, Dec 11 2012, 16:01:49 - 32 Bit EXE
epSectIndex: 10
sects: , .vmp0, .idata , zaiolyfh, wdijtpjy, wdijtpjy, .data, .mackt, .vmp1, .vmp2, .rsrc
imphash: 7b87ada9fae01af53406bf060f67ed57
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
fileProps: FileVersion 1.0.0.0 ProductVersion 1.0.0.0
ep: 157DD23
epSect: .vmp2
details:
Alibaba             Packed:Win32/VMProtect.88e0fe7c
Avira               TR/Black.Gen2
Baidu               Win32.Packed.VMProtect.a
BitDefenderTheta    Gen:NN.ZelphiF.36812.@V0@aG5wikci
Bkav                W32.AIDetectMalware
CrowdStrike         win/malicious_confidence_100% (W)
Cylance             Unsafe
Cynet               Malicious (score: 99)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.ABD
Elastic             malicious (high confidence)
F-Secure            Trojan.TR/Black.Gen2
FireEye             Generic.mg.d18c7bf976268f79
Fortinet            W32/Generic
Google              Detected
Gridinsoft          Trojan.Win32.Packed.ns
Ikarus              Backdoor.Win32.Hupigon
K7AntiVirus         Trojan ( 7000001c1 )
K7GW                Trojan ( 7000001c1 )
Lionic              Trojan.Win32.Black.4!c
MAX                 malware (ai score=100)
Malwarebytes        Generic.Trojan.Malpack.DDS
MaxSecure           Trojan.Malware.7164915.susgen
McAfee              GenericRXAA-FA!D18C7BF97626
McAfeeD             ti!18E620037510
Microsoft           Trojan:Win32/Skeeyah
NANO-Antivirus      Trojan.Win32.Black.bkwqyj
Paloalto            generic.ml
Panda               Trj/Agent.ABC
Rising              Trojan.Mploit/Android!8.11B3A (CLOUD)
Sangfor             Trojan.Win32.Packed.Vpkq
SentinelOne         Static AI - Suspicious PE
Skyhigh             BehavesLike.Win32.Sality.wc
Sophos              Mal/VMProtBad-A
Symantec            ML.Attribute.HighConfidence
Tencent             Malware.Win32.Gencirc.13c47afc
VBA32               Trojan.Generic
Webroot             W32.Malware.Heur.Dkvt
Xcitium             Malware@#36vx41olnsq3z
Yandex              Trojan.Packed!QScZ2cqJnuc
Zillya              Trojan.Packed.Win32.83734
alibabacloud        VirTool:Win/Skeeyah


die:
PE: protector: VMProtect(-)[-]
	    PE: compiler: Embarcadero Delphi(XE2-XE4)[-]
	    PE: linker: Turbo Linker(2.25*,Delphi)[EXE32]

resNames:
1384    \ICON\1\1033
1128    \ICON\2\1033
1736    \ICON\3\1033
2440    \ICON\4\1033
2216    \ICON\5\1033
4264    \ICON\6\1033
3752    \ICON\7\1033
9640    \ICON\8\1033
118     \GROUP_ICON\MAINICON\1033
320     \VERSION\1\1033
714     \24\1\1033


firstSeen: 2024-11-23 17:50:24
ssz: 5 Mb
fname: d469ebc147593d8f719c7ea4301c4800
vt: Scan finished
hash: d469ebc147593d8f719c7ea4301c4800
date: 2024-11-29 14:54:19
compiled: Thu, Sep 12 2024, 9:08:14 - 32 Bit DLL
epSectIndex: 6
sects: .text, .rdata, .data, .%?., .%-[, .mo:, .reloc, .rsrc
die: PE: protector: VMProtect(2.X)[-] PE: linker: Microsoft Linker(14.39)[DLL32,signed]
exports: @1 MyUnregisterServer
resNames: 381 \24\2\1033
imphash: c60ea44c29fb9958cdca44c6933240cf
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 442944
epSect: .mo:
details:
ALYac               Trojan.Generic.37106884
APEX                Malicious
AVG                 Win32:MalwareX-gen [Trj]
AhnLab-V3           Trojan/Win.Redcap.R672916
Alibaba             Trojan:Win32/Redcap.98735fd4
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Arcabit             Trojan.Generic.D23634C4
Avast               Win32:MalwareX-gen [Trj]
Avira               TR/Redcap.vdzex
BitDefender         Trojan.Generic.37106884
CAT-QuickHeal       Trojan.Tbma
CTX                 dll.trojan.redcap
CrowdStrike         win/malicious_confidence_100% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.BB suspicious
Elastic             malicious (high confidence)
Emsisoft            Trojan.Generic.37106884 (B)
F-Secure            Trojan.TR/Redcap.vdzex
FireEye             Generic.mg.d469ebc147593d8f
Fortinet            Riskware/Application
GData               Trojan.Generic.37106884
Google              Detected
Gridinsoft          Trojan.Heur!.022120A0
Ikarus              PUA.VMProtect
K7AntiVirus         Trojan ( 0059f0351 )
K7GW                Trojan ( 0059f0351 )
Kaspersky           HEUR:Trojan.Win32.TbMA.gen
Lionic              Trojan.Win32.Redcap.4!c
Malwarebytes        Trojan.MalPack.PES
MaxSecure           Trojan.Malware.300983.susgen
McAfee              Artemis!D469EBC14759
McAfeeD             Real Protect-LS!D469EBC14759
MicroWorld-eScan    Trojan.Generic.37106884
Microsoft           Trojan:Win32/Redcap.GNZ!MTB
NANO-Antivirus      Trojan.Win32.TbMA.ktqoez
Paloalto            generic.ml
Panda               Trj/Genetic.gen
Rising              Trojan.TbMA!8.E459 (CLOUD)
Sangfor             Trojan.Win32.Redcap.Vg5i
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.BumbleBee.rc
Sophos              Mal/Generic-S
Symantec            ML.Attribute.HighConfidence
TACHYON             Trojan/W32.Agent.4858192
Tencent             Backdoor.Win64.Runshell_l.16001403
TrendMicro          TROJ_GEN.R03BC0DKT24
TrendMicro-HouseCallTROJ_GEN.R03BC0DKT24
VBA32               BScope.TrojanPSW.Stealer
VIPRE               Trojan.Generic.37106884
Varist              W32/Trojan.CZEC-4507
ViRobot             Trojan.Win.Z.Vmprotect.4858192.BFM
Webroot             Win.Trojan.Gen
Zillya              Trojan.VMProtect.Win32.100032
alibabacloud        Trojan:Win/Redcap.GTP2XJC



firstSeen: 2024-11-29 04:37:56
ssz: 6 Mb
fname: d5496c252bcfac4ddbfffd7f48a6f76c
vt: Scan finished
hash: d5496c252bcfac4ddbfffd7f48a6f76c
date: 2024-11-29 04:37:56
compiled: Fri, Dec 11 2009, 21:31:37 - 32 Bit EXE
epSectIndex: 6
sects: .text, .rdata, .data, .7]D, .K<', .TEs
die: PE: linker: Microsoft Linker(6.0)[EXE32]
imphash: 4f2901c0f26912f101d33992f03f2ab2
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 46EDA1
epSect: .TEs
details:
APEX                Malicious
AVG                 Win32:TrojanX-gen [Trj]
AhnLab-V3           Trojan/Win.Generic.R651028
Antiy-AVL           Trojan/Win32.Agent
Arcabit             Trojan.Kelios.1
Avast               Win32:TrojanX-gen [Trj]
Avira               TR/Crypt.XPACK.Gen
BitDefender         Gen:Heur.Kelios.1
Bkav                W32.AIDetectMalware
CTX                 exe.unknown.kelios
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.AU suspicious
Elastic             malicious (high confidence)
Emsisoft            Gen:Heur.Kelios.1 (B)
F-Secure            Trojan.TR/Crypt.XPACK.Gen
FireEye             Generic.mg.d5496c252bcfac4d
Fortinet            Riskware/Application
GData               Win32.Trojan.PSE.17WGX8P
Google              Detected
Gridinsoft          Trojan.Heur!.022120A1
Ikarus              PUA.VMProtect
Jiangmin            TrojanClicker.Cycler.bxl
K7AntiVirus         Trojan ( 0059f3ce1 )
K7GW                Trojan ( 0059f3ce1 )
Kingsoft            malware.kb.b.988
Malwarebytes        Malware.AI.4246046164
MaxSecure           Trojan.Malware.300983.susgen
McAfee              GenericRXWP-FP!D5496C252BCF
McAfeeD             Real Protect-LS!D5496C252BCF
MicroWorld-eScan    Gen:Heur.Kelios.1
Microsoft           Trojan:Win32/PrivateLoader.RC!MTB
NANO-Antivirus      Trojan.Win32.Kelios.kktppb
Panda               Trj/Genetic.gen
Rising              Trojan.Kryptik@AI.96 (RDML:+zWbD0gC0yKi4tKacb8oYg)
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.vc
Sophos              Generic ML PUA (PUA)
Symantec            ML.Attribute.HighConfidence
Tencent             Malware.Win32.Gencirc.10bfc551
Trapmine            malicious.high.ml.score
VBA32               BScope.TrojanPSW.Coins
VIPRE               Gen:Heur.Kelios.1
Varist              W32/Unruy.N.gen!Eldorado
Yandex              Riskware.VMProtect!OCZ3pd+HDXY
Zillya              Trojan.Cycler.Win32.2459
Zoner               Probably Heur.ExeHeaderL
tehtris             Generic.Malware



firstSeen: 2024-11-29 05:49:21
ssz: 6 Mb
fname: d5f9518beb09efde2a2d64e2cf10069d
vt: Scan finished
hash: d5f9518beb09efde2a2d64e2cf10069d
date: 2024-11-29 05:49:21
compiled: Fri, Dec 11 2009, 21:31:37 - 32 Bit EXE
epSectIndex: 7
sects: .text, .rdata, .data, .CbOb, .`o$, .Y<i, .VCF
die: PE: linker: Microsoft Linker(6.0)[EXE32]
imphash: 4f2901c0f26912f101d33992f03f2ab2
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 3AD86F
epSect: .VCF
details:
ALYac               Gen:Variant.Zusy.540547
APEX                Malicious
AVG                 Win32:Evo-gen [Trj]
AhnLab-V3           Trojan/Win.Generic.R640388
Antiy-AVL           GrayWare/Win32.Wacapew
Arcabit             Trojan.Zusy.D83F83
Avast               Win32:Evo-gen [Trj]
BitDefender         Gen:Variant.Zusy.540547
Bkav                W32.AIDetectMalware
CTX                 exe.unknown.zusy
ClamAV              Win.Packed.Kelios-10023944-0
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.AU suspicious
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Zusy.540547 (B)
FireEye             Generic.mg.d5f9518beb09efde
Fortinet            Riskware/Application
GData               Gen:Variant.Zusy.540547
Google              Detected
Gridinsoft          Trojan.Heur!.022120A1
Ikarus              PUA.VMProtect
Jiangmin            TrojanClicker.Cycler.bxn
K7AntiVirus         Trojan ( 0059f3ce1 )
K7GW                Trojan ( 0059f3ce1 )
Kingsoft            malware.kb.b.989
Malwarebytes        Malware.AI.221908809
MaxSecure           Trojan.Malware.300983.susgen
McAfeeD             Real Protect-LS!D5F9518BEB09
MicroWorld-eScan    Gen:Variant.Zusy.540547
Microsoft           Trojan:Win32/PrivateLoader.RC!MTB
NANO-Antivirus      Trojan.Win32.TrjGen.kktpho
Panda               Trj/Genetic.gen
Rising              Trojan.Clicker!8.1972 (TFE:3:hexVX6EEAWG)
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.tc
Sophos              Generic ML PUA (PUA)
Symantec            ML.Attribute.HighConfidence
Tencent             Malware.Win32.Gencirc.10bfc6e1
Trapmine            malicious.high.ml.score
VBA32               BScope.TrojanPSW.Coins
VIPRE               Gen:Variant.Zusy.540547
Varist              W32/Unruy.N.gen!Eldorado
Yandex              Riskware.VMProtect!fYDaETDRrmU
Zillya              Trojan.Cycler.Win32.2464
Zoner               Probably Heur.ExeHeaderL



firstSeen: 2021-12-14 17:38:06
ssz: 6 Mb
fname: d862aabcea74c3b7aad486cde4e3e8a8
vt: Scan finished
hash: d862aabcea74c3b7aad486cde4e3e8a8
date: 2024-11-25 09:53:55
compiled: Fri, Oct 15 2021, 15:23:30 - 32 Bit EXE
epSectIndex: 11
sects: .text, .itext, .data, .bss, .idata, .didata, .edata, .tls, .rdata, .vmp0, .vmp1, .rsrc
die: PE: protector: VMProtect(1.60-2.05)[-] PE: linker: Turbo Linker(2.25*,Delphi)[EXE32,admin]
exports: @1 dbkFCallWrapperAddr @2 __dbk_fcall_wrapper @3 TMethodImplementationIntercept
imphash: 3b33e3320c740643ca06c9476a9d4d2b
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 67CDC4
epSect: .vmp1
details:
ALYac               Trojan.Generic.35310385
AVG                 Win32:Malware-gen
Alibaba             Packed:Win32/VMProtect.9dccb82c
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Arcabit             Trojan.Generic.D21ACB31
Avast               Win32:Malware-gen
BitDefender         Trojan.Generic.35310385
Bkav                W32.AIDetectMalware
CTX                 exe.trojan.vmprotect
CrowdStrike         win/malicious_confidence_100% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Trojan.Hosts.51677
ESET-NOD32          a variant of Win32/Packed.VMProtect.ACR
Elastic             malicious (high confidence)
Emsisoft            Trojan.Generic.35310385 (B)
FireEye             Generic.mg.d862aabcea74c3b7
Fortinet            PossibleThreat.PALLAS.H
GData               Trojan.Generic.35310385
Google              Detected
Ikarus              Trojan.Win32.VMProtect
Lionic              Trojan.Win32.VMProtect.4!c
Malwarebytes        Malware.AI.4022904120
MaxSecure           Trojan.Malware.9901767.susgen
McAfee              Artemis!D862AABCEA74
McAfeeD             ti!6942FC3AFDDA
MicroWorld-eScan    Trojan.Generic.35310385
Microsoft           Trojan:Win32/Malgent
Paloalto            generic.ml
Panda               Trj/CI.A
Rising              Trojan.Malgent!8.10C33 (CLOUD)
Sangfor             Trojan.Win32.VMProtect.V50j
SentinelOne         Static AI - Suspicious PE
Skyhigh             BehavesLike.Win32.Softcnapp.tc
Sophos              Mal/Generic-S
Symantec            ML.Attribute.HighConfidence
Trapmine            malicious.moderate.ml.score
TrendMicro          Trojan.Win32.VMPROTECT.USBLBT24
TrendMicro-HouseCallTrojan.Win32.VMPROTECT.USBLBT24
VBA32               Trojan.Hosts
VIPRE               Trojan.Generic.35310385
Varist              W32/ABApplication.USCI-7189
Yandex              Trojan.Igent.bXOPLC.1
Zillya              Trojan.VMProtect.Win32.63106
alibabacloud        Trojan:Win/Malgent.Gen
tehtris             Generic.Malware


resNames:
5672    \ICON\1\1033
3752    \ICON\2\1033
2216    \ICON\3\1033
1736    \ICON\4\1033
1384    \ICON\5\1033
60113   \ICON\6\1033
16936   \ICON\7\1033
9640    \ICON\8\1033
4264    \ICON\9\1033
2440    \ICON\10\1033
1128    \ICON\11\1033
160     \GROUP_ICON\MAINICON\1033
580     \VERSION\1\1033
1516    \24\1\1033

fileProps:
FileDescription  TmsAuth
FileVersion      1.0.0.6
ProductName      TmsAuth
ProductVersion   1.0.0.0


firstSeen: 2024-11-27 02:04:58
ssz: 4 Mb
fname: da1c2a25d4b6b085bd11dae9097f0770
vt: Scan finished
hash: da1c2a25d4b6b085bd11dae9097f0770
date: 2024-11-29 07:11:28
compiled: Tue, Nov 12 2024, 6:23:04 - 32 Bit EXE
epSectIndex: 5
sects: .text, .rdata, .data, .vmp0, .vmp1, .reloc, .rsrc
resNames: 134656 \VMP\129\2052 352 \VERSION\1\2052 346 \24\1\1033
imphash: 59db90d4ddf7a01f819fe6d08c4cc138
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
fileProps: FileVersion 24, 1, 12, 946 ProductVersion 24, 1, 12, 946
ep: EBD56
epSect: .vmp1
details:
APEX                Malicious
AVG                 Win32:Evo-gen [Trj]
AhnLab-V3           Trojan/Win.Gulpix.R683257
Alibaba             Trojan:Win64/Gulpix.aa9ea865
Antiy-AVL           Trojan[Backdoor]/Win32.Gulpix
Arcabit             Trojan.Tedy.D9FABA
Avast               Win32:Evo-gen [Trj]
Avira               TR/Black.Gen2
Baidu               Win32.Packed.VMProtect.a
BitDefender         Gen:Variant.Tedy.654010
Bkav                W32.AIDetectMalware
CAT-QuickHeal       Backdoor.Agent
CTX                 exe.trojan.generic
ClamAV              Win.Malware.Doina-10022852-0
CrowdStrike         win/malicious_confidence_100% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Trojan.MulDrop28.36539
ESET-NOD32          a variant of Win32/Packed.VMProtect.ABD
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Tedy.654010 (B)
F-Secure            Trojan.TR/Black.Gen2
FireEye             Generic.mg.da1c2a25d4b6b085
Fortinet            W32/Sfuzuan.AB!tr
GData               Gen:Variant.Tedy.654010
Google              Detected
Gridinsoft          Trojan.Win32.Packed.sa
Ikarus              Trojan.Crypt
K7AntiVirus         Trojan ( 7000001c1 )
K7GW                Trojan ( 7000001c1 )
Kaspersky           UDS:Backdoor.Win32.Gulpix.gen
Lionic              Trojan.Win32.VMProtect.m!c
Malwarebytes        Generic.Malware.AI.DDS
MaxSecure           Trojan.Malware.73952795.susgen
McAfee              Artemis!DA1C2A25D4B6
McAfeeD             Real Protect-LS!DA1C2A25D4B6
MicroWorld-eScan    Gen:Variant.Tedy.654010
Microsoft           Trojan:Win64/Gulpix.RPX!MTB
NANO-Antivirus      Trojan.Win32.Black.ktsjpm
Paloalto            generic.ml
Panda               Trj/CI.A
Rising              Trojan.Sfuzuan!1.F143 (CLASSIC)
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.rh
Sophos              Mal/VMProtBad-A
Symantec            ML.Attribute.HighConfidence
Tencent             Malware.Win32.Gencirc.10c07586
Trapmine            malicious.high.ml.score
VBA32               BScope.Trojan.Zenpak
VIPRE               Gen:Variant.Tedy.654010
Varist              W32/Trojan.YHWO-7076
Zillya              Trojan.VMProtect.Win32.100744
alibabacloud        Trojan:Win/Gulpix.RXF2XJC


die:
PE: protector: VMProtect(-)[-]
	    PE: compiler: Microsoft Visual C/C++(2008)[-]
	    PE: linker: Microsoft Linker(9.0)[EXE32]

rich:
offset DanS:128
offset Rich:232
Size: 104
checkSum: 0xDC116682 Failed!
calculatedCheckSum: 0xE3696682

clearData: DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'\xC6m\x00\x01\x00\x00\x00\x1ER\x84\x00\x05\x00\x00\x00\xBDO\x96\x00\x01\x00\x00\x00\x09x\x95\x00\x1A\x00\x00\x00\x09x\x83\x00\xAA\x00\x00\x00'\xC6{\x00\x1D\x00\x00\x00\x00\x00\x01\x00\x12\x01\x00\x00\x09x\x84\x00I\x00\x00\x00\x09x\x8A\x00:\x00\x00\x00\x1ER\x94\x00\x01\x00\x00\x00\x09x\x91\x00\x01\x00\x00\x00

11 entries
--------------------------------------------------
Compiler: -14809
toolID: 109
Count: 1
toolName: Utc1400_C
vsVer: Visual Studio 2005 (08.00)

Compiler: 21022
toolID: 132
Count: 5
toolName: Utc1500_CPP
vsVer: Visual Studio 2008 (09.00)

Compiler: 20413
toolID: 150
Count: 1
toolName: AliasObj900
vsVer: Visual Studio 2008 (09.00)

Compiler: 30729
toolID: 149
Count: 26
toolName: Masm900
vsVer: Visual Studio 2008 (09.00)

Compiler: 30729
toolID: 131
Count: 170
toolName: Utc1500_C
vsVer: Visual Studio 2008 (09.00)

Compiler: -14809
toolID: 123
Count: 29
toolName: Implib800
vsVer: Visual Studio 2005 (08.00)

Compiler: 0
toolID: 1
Count: 274
toolName: Import0
vsVer: Visual Studio (00.00)

Compiler: 30729
toolID: 132
Count: 73
toolName: Utc1500_CPP
vsVer: Visual Studio 2008 (09.00)

Compiler: 30729
toolID: 138
Count: 58
toolName: Utc1500_LTCG_CPP
vsVer: Visual Studio 2008 (09.00)

Compiler: 21022
toolID: 148
Count: 1
toolName: Cvtres900
vsVer: Visual Studio 2008 (09.00)

Compiler: 30729
toolID: 145
Count: 1
toolName: Linker900
vsVer: Visual Studio 2008 (09.00)


firstSeen: 2024-11-29 05:05:38
ssz: 5 Mb
fname: de12b8d6ccc7843f8beeb4224b67a7ef
vt: Scan finished
hash: de12b8d6ccc7843f8beeb4224b67a7ef
date: 2024-11-29 05:05:38
compiled: Sun, Nov 13 2011, 3:05:27 - 32 Bit EXE
epSectIndex: 1
sects: .text, .rdata, .data, .text0, .text1, .rsrc
imphash: 3c2815c82be1e401e611741af831ecb9
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 29FFD
epSect: .text
details:
ALYac               Gen:Variant.Zusy.321922
APEX                Malicious
AVG                 Win32:Evo-gen [Trj]
Acronis             suspicious
AhnLab-V3           Unwanted/Win32.HackTool.R30464
Antiy-AVL           Trojan/Win32.Qhost
Arcabit             Trojan.Zusy.D4E982
Avast               Win32:Evo-gen [Trj]
Avira               TR/ATRAPS.Gen
BitDefender         Gen:Variant.Zusy.321922
Bkav                W32.AIDetectMalware
CAT-QuickHeal       Trojan.Qhost.7777
CTX                 exe.unknown.zusy
ClamAV              Win.Packed.Vmprotect-9976168-0
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
DrWeb               Trojan.Siggen4.15899
ESET-NOD32          a variant of Win32/Packed.VMProtect.AAH
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Zusy.321922 (B)
F-Secure            Trojan.TR/ATRAPS.Gen
FireEye             Generic.mg.de12b8d6ccc7843f
Fortinet            W32/Qhost.OAG!tr
GData               Gen:Variant.Zusy.321922
Google              Detected
Gridinsoft          Ransom.Win32.Wacatac.oa!s1
Ikarus              Trojan.Win32.Genome
Jiangmin            Trojan/Genome.bxbo
K7AntiVirus         Trojan ( 7000001c1 )
K7GW                Trojan ( 7000001c1 )
Kaspersky           Trojan.Win32.Qhost.abnk
Kingsoft            malware.kb.b.816
Malwarebytes        Generic.Malware.AI.DDS
McAfee              Trojan-FDXA!DE12B8D6CCC7
McAfeeD             ti!9A8611E9F7BE
MicroWorld-eScan    Gen:Variant.Zusy.321922
Microsoft           VirTool:Win32/Obfuscator.XZ
NANO-Antivirus      Trojan.Win32.Qhost.cvdfkd
Rising              Trojan.Kryptik@AI.80 (RDML:2dfSX8kurNcRZwtiKhncjw)
Sangfor             Trojan.Win32.Save.a
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.th
Sophos              Troj/AutoG-EY
Symantec            ML.Attribute.HighConfidence
Tencent             Trojan-Packed.Win32.Vmprotect.ya
Trapmine            malicious.moderate.ml.score
TrendMicro          TROJ_AGENT_017657.TOMB
TrendMicro-HouseCallTROJ_AGENT_017657.TOMB
VBA32               TScope.Malware-Cryptor.SB
VIPRE               Gen:Variant.Zusy.321922
Varist              W32/S-2a66a243!Eldorado
ViRobot             Trojan.Win32.A.Qhost.5304320
Webroot             W32.Trojan.Gen
Yandex              Trojan.GenAsa!VubRXkFIJ1k
Zillya              Trojan.Qhost.Win32.9013
alibabacloud        Trojan:Win/Vmprotect.e19e3c28
huorong             TrojanDownloader/Agent.wf
tehtris             Generic.Malware


die:
PE: protector: VMProtect(-)[-]
	    PE: compiler: Microsoft Visual C/C++(6.0)[libcmt]
	    PE: linker: Microsoft Linker(6.0)[EXE32]


firstSeen: 2024-11-29 15:34:00
ssz: 7 Mb
fname: df82e72da69f8d37bca71d6c23a301c2
vt: Scan finished
hash: df82e72da69f8d37bca71d6c23a301c2
date: 2024-11-29 15:34:00
compiled: Sat, Jun 16 2018, 9:45:42 - 32 Bit DLL
epSectIndex: 6
sects: .text, .rdata, .data, .tls, .vmp0, .vmp1, .reloc, .rsrc
die: PE: protector: VMProtect(-)[-] PE: linker: Microsoft Linker(14.0)[DLL32]
exports: @1 _AttachPlugin@4
imphash: 71786f26858ff8734b69aae1364c18ce
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 10E8EC0
epSect: .vmp1
details:
Bkav                W32.AIDetectMalware
CrowdStrike         win/malicious_confidence_70% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
Elastic             malicious (moderate confidence)
FireEye             Generic.mg.df82e72da69f8d37
Kingsoft            malware.kb.b.878
MaxSecure           Trojan.Malware.300983.susgen
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.vc
Trapmine            malicious.high.ml.score
VBA32               TScope.Malware-Cryptor.SB


resNames:
2       \AFX_DIALOG_LAYOUT\1027\2052
2       \AFX_DIALOG_LAYOUT\4011\2052
2       \AFX_DIALOG_LAYOUT\4029\2052
2       \AFX_DIALOG_LAYOUT\4042\2052
2       \AFX_DIALOG_LAYOUT\4044\2052
2       \AFX_DIALOG_LAYOUT\4048\2052
2       \AFX_DIALOG_LAYOUT\4051\2052
2       \AFX_DIALOG_LAYOUT\4054\2052
2       \AFX_DIALOG_LAYOUT\4060\2052
2       \AFX_DIALOG_LAYOUT\4063\2052
2       \AFX_DIALOG_LAYOUT\4074\2052
2       \AFX_DIALOG_LAYOUT\4076\2052
2       \AFX_DIALOG_LAYOUT\4078\2052
2       \AFX_DIALOG_LAYOUT\4093\2052
2       \AFX_DIALOG_LAYOUT\4095\2052
2       \AFX_DIALOG_LAYOUT\4097\2052
2       \AFX_DIALOG_LAYOUT\4103\2052
2       \AFX_DIALOG_LAYOUT\4105\2052
2       \AFX_DIALOG_LAYOUT\4121\2052
2       \AFX_DIALOG_LAYOUT\4125\2052
2       \AFX_DIALOG_LAYOUT\4130\2052
2       \AFX_DIALOG_LAYOUT\4132\2052
2       \AFX_DIALOG_LAYOUT\4138\2052
2       \AFX_DIALOG_LAYOUT\4150\2052
2       \AFX_DIALOG_LAYOUT\4173\2052
2       \AFX_DIALOG_LAYOUT\4180\2052
2       \AFX_DIALOG_LAYOUT\4182\2052
2       \AFX_DIALOG_LAYOUT\4184\2052
2       \AFX_DIALOG_LAYOUT\4187\2052
2       \AFX_DIALOG_LAYOUT\4189\2052
2       \AFX_DIALOG_LAYOUT\4192\2052
2       \AFX_DIALOG_LAYOUT\4194\2052
2       \AFX_DIALOG_LAYOUT\4196\2052
2       \AFX_DIALOG_LAYOUT\4198\2052
2       \AFX_DIALOG_LAYOUT\4200\2052
2       \AFX_DIALOG_LAYOUT\4202\2052
2       \AFX_DIALOG_LAYOUT\4204\2052
2       \AFX_DIALOG_LAYOUT\4207\2052
2       \AFX_DIALOG_LAYOUT\4210\2052
2       \AFX_DIALOG_LAYOUT\4213\2052
2       \AFX_DIALOG_LAYOUT\4215\2052
2       \AFX_DIALOG_LAYOUT\4218\2052
2       \AFX_DIALOG_LAYOUT\4224\2052
2       \AFX_DIALOG_LAYOUT\4231\2052
2       \AFX_DIALOG_LAYOUT\4238\2052
2       \AFX_DIALOG_LAYOUT\5000\2052
2       \AFX_DIALOG_LAYOUT\5128\2052
2       \AFX_DIALOG_LAYOUT\5148\2052
2       \AFX_DIALOG_LAYOUT\5263\2052
2       \AFX_DIALOG_LAYOUT\5367\2052
2       \AFX_DIALOG_LAYOUT\5409\2052
2       \AFX_DIALOG_LAYOUT\5510\2052
2       \AFX_DIALOG_LAYOUT\6001\2052
2       \AFX_DIALOG_LAYOUT\6104\2052
308     \CURSOR\15\2052
180     \CURSOR\16\2052
308     \CURSOR\17\2052
308     \CURSOR\18\2052
308     \CURSOR\19\2052
308     \CURSOR\20\2052
308     \CURSOR\21\2052
308     \CURSOR\22\2052
308     \CURSOR\23\2052
308     \CURSOR\24\2052
308     \CURSOR\25\2052
308     \CURSOR\26\2052
308     \CURSOR\27\2052
308     \CURSOR\28\2052
308     \CURSOR\29\2052
308     \CURSOR\30\2052
22950   \BITMAP\4020\2052
1770    \BITMAP\4022\2052
1770    \BITMAP\4023\2052
1770    \BITMAP\4024\2052
1698    \BITMAP\4025\2052
1698    \BITMAP\4026\2052
1698    \BITMAP\4027\2052
1866    \BITMAP\4031\2052
1714    \BITMAP\4032\2052
1790    \BITMAP\4033\2052
1638    \BITMAP\4034\2052
1866    \BITMAP\4035\2052
1638    \BITMAP\4036\2052
1790    \BITMAP\4037\2052
1562    \BITMAP\4038\2052
1714    \BITMAP\4039\2052
1562    \BITMAP\4040\2052
1790    \BITMAP\4041\2052
1790    \BITMAP\4047\2052
6762    \BITMAP\4056\2052
7930    \BITMAP\4057\2052
8682    \BITMAP\4058\2052
2250    \BITMAP\4083\2052
2154    \BITMAP\4084\2052
1064    \BITMAP\4101\2052
1064    \BITMAP\4102\2052
2344    \BITMAP\4107\2052
2344    \BITMAP\4108\2052
2344    \BITMAP\4109\2052
2346    \BITMAP\4110\2052
2344    \BITMAP\4111\2052
2344    \BITMAP\4112\2052
2344    \BITMAP\4113\2052
2344    \BITMAP\4114\2052
2344    \BITMAP\4115\2052
2344    \BITMAP\4116\2052
2344    \BITMAP\4117\2052
2344    \BITMAP\4118\2052
2344    \BITMAP\4119\2052
2344    \BITMAP\4120\2052
2346    \BITMAP\4123\2052
2344    \BITMAP\4124\2052
4136    \BITMAP\4127\2052
4136    \BITMAP\4128\2052
4136    \BITMAP\4129\2052
2344    \BITMAP\4134\2052
2344    \BITMAP\4135\2052
2344    \BITMAP\4136\2052
2346    \BITMAP\4140\2052
2346    \BITMAP\4141\2052
2346    \BITMAP\4142\2052
2346    \BITMAP\4143\2052
2346    \BITMAP\4144\2052
2346    \BITMAP\4145\2052
2346    \BITMAP\4146\2052
2346    \BITMAP\4147\2052
15378   \BITMAP\4148\2052
15378   \BITMAP\4149\2052
63658   \BITMAP\4154\2052
63658   \BITMAP\4155\2052
63658   \BITMAP\4156\2052
63658   \BITMAP\4157\2052
63658   \BITMAP\4158\2052
63658   \BITMAP\4159\2052
63658   \BITMAP\4160\2052
63658   \BITMAP\4161\2052
63658   \BITMAP\4162\2052
63658   \BITMAP\4163\2052
63658   \BITMAP\4164\2052
63658   \BITMAP\4165\2052
63658   \BITMAP\4166\2052
63658   \BITMAP\4167\2052
63658   \BITMAP\4168\2052
63658   \BITMAP\4169\2052
63658   \BITMAP\4170\2052
63658   \BITMAP\4171\2052
63658   \BITMAP\4172\2052
4572    \BITMAP\4176\2052
4592    \BITMAP\4177\2052
3232    \BITMAP\4178\2052
3232    \BITMAP\4179\2052
98602   \BITMAP\4186\2052
98602   \BITMAP\4191\2052
2346    \BITMAP\4206\2052
1242    \BITMAP\4209\2052
4594    \BITMAP\4212\2052
474     \BITMAP\4222\2052
618     \BITMAP\4223\2052
98602   \BITMAP\4227\2052
98602   \BITMAP\4228\2052
184     \BITMAP\30994\2052
324     \BITMAP\30996\2052
2180    \ICON\1\2052
2180    \ICON\2\2052
1928    \ICON\3\2052
1384    \ICON\4\2052
1384    \ICON\5\2052
1384    \ICON\6\2052
1384    \ICON\7\2052
1384    \ICON\8\2052
1384    \ICON\9\2052
1384    \ICON\10\2052
2216    \ICON\11\2052
2216    \ICON\12\2052
1128    \ICON\13\2052
1928    \ICON\14\2052
1048    \DIALOG\1000\2052
308     \DIALOG\1027\2052
804     \DIALOG\4011\2052
892     \DIALOG\4029\2052
1260    \DIALOG\4042\2052
1608    \DIALOG\4044\2052
870     \DIALOG\4048\2052
800     \DIALOG\4051\2052
1108    \DIALOG\4054\2052
624     \DIALOG\4060\2052
1982    \DIALOG\4063\2052
972     \DIALOG\4074\2052
940     \DIALOG\4076\2052
872     \DIALOG\4078\2052
3820    \DIALOG\4093\2052
1026    \DIALOG\4095\2052
1210    \DIALOG\4097\2052
1774    \DIALOG\4103\2052
994     \DIALOG\4105\2052
388     \DIALOG\4121\2052
628     \DIALOG\4125\2052
1956    \DIALOG\4130\2052
1050    \DIALOG\4132\2052
2918    \DIALOG\4138\2052
2610    \DIALOG\4150\2052
1266    \DIALOG\4173\2052
550     \DIALOG\4180\2052
1284    \DIALOG\4182\2052
248     \DIALOG\4184\2052
1232    \DIALOG\4187\2052
920     \DIALOG\4189\2052
1440    \DIALOG\4192\2052
1092    \DIALOG\4194\2052
810     \DIALOG\4196\2052
482     \DIALOG\4198\2052
376     \DIALOG\4200\2052
368     \DIALOG\4202\2052
216     \DIALOG\4204\2052
420     \DIALOG\4207\2052
180     \DIALOG\4210\2052
82      \DIALOG\4213\2052
1172    \DIALOG\4215\2052
216     \DIALOG\4218\2052
3320    \DIALOG\4224\2052
556     \DIALOG\4231\2052
228     \DIALOG\4238\2052
926     \DIALOG\5000\2052
3204    \DIALOG\5128\2052
1450    \DIALOG\5148\2052
914     \DIALOG\5263\2052
2848    \DIALOG\5367\2052
524     \DIALOG\5409\2052
758     \DIALOG\5510\2052
310     \DIALOG\6001\2052
2716    \DIALOG\6104\2052
226     \DIALOG\30721\2052
52      \DIALOG\30734\2052
78      \STRING\3841\2052
44      \STRING\3842\2052
132     \STRING\3843\2052
460     \STRING\3857\2052
334     \STRING\3858\2052
270     \STRING\3859\2052
80      \STRING\3860\2052
68      \STRING\3865\2052
104     \STRING\3866\2052
434     \STRING\3867\2052
244     \STRING\3868\2052
36      \STRING\3869\2052
424     \STRING\3887\2052
34      \GROUP_CURSOR\30977\2052
20      \GROUP_CURSOR\30998\2052
20      \GROUP_CURSOR\30999\2052
20      \GROUP_CURSOR\31000\2052
20      \GROUP_CURSOR\31001\2052
20      \GROUP_CURSOR\31002\2052
20      \GROUP_CURSOR\31003\2052
20      \GROUP_CURSOR\31004\2052
20      \GROUP_CURSOR\31005\2052
20      \GROUP_CURSOR\31006\2052
20      \GROUP_CURSOR\31007\2052
20      \GROUP_CURSOR\31008\2052
20      \GROUP_CURSOR\31009\2052
20      \GROUP_CURSOR\31010\2052
20      \GROUP_CURSOR\31011\2052
20      \GROUP_ICON\4012\2052
20      \GROUP_ICON\4018\2052
20      \GROUP_ICON\4021\2052
20      \GROUP_ICON\4086\2052
20      \GROUP_ICON\4087\2052
20      \GROUP_ICON\4088\2052
20      \GROUP_ICON\4089\2052
20      \GROUP_ICON\4090\2052
20      \GROUP_ICON\4091\2052
20      \GROUP_ICON\4092\2052
20      \GROUP_ICON\4099\2052
20      \GROUP_ICON\4100\2052
20      \GROUP_ICON\4230\2052
20      \GROUP_ICON\4237\2052
548     \24\2\1033
170     \240\4231\2052
170     \240\4238\2052

rich:
offset DanS:128
offset Rich:288
Size: 160
checkSum: 0x16CCB879 Matches!

clearData: DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xB4\x9C\xF1\x00!\x00\x00\x00\xB4\x9C\xF3\x00\xC3\x00\x00\x00\xB4\x9C\xF2\x00#\x00\x00\x00\x9E\xA0\xC7\x00\x03\x00\x00\x00\x09x\x93\x00\x02\x00\x00\x00\xDD\xFF\xCE\x00\x10\x00\x00\x00\xDD\xFF\xCF\x00\x01\x00\x00\x00\xDD\xFF\xD0\x00\x05\x00\x00\x00\xDD\xFF\xCB\x00+\x00\x00\x00\x00\x00\x01\x00Q\x03\x00\x00\xE5Y\x03\x01\x18\x00\x00\x00\xE5Y\x04\x01@\x00\x00\x00\xE5Y\x05\x01{\x01\x00\x00\xF2Y\x09\x01\x19\x00\x00\x00\xF2Y\x00\x01\x01\x00\x00\x00\xF2Y\xFF\x00\x01\x00\x00\x00\x00\x00\x97\x00\x01\x00\x00\x00\xF2Y\x02\x01\x01\x00\x00\x00

18 entries
--------------------------------------------------
Compiler: -25420
toolID: 241
Count: 33
toolName: Masm1210
vsVer: Visual Studio 2013 (12.10)

Compiler: -25420
toolID: 243
Count: 195
toolName: Utc1810_CPP
vsVer: Visual Studio 2013 (12.10)

Compiler: -25420
toolID: 242
Count: 35
toolName: Utc1810_C
vsVer: Visual Studio 2013 (12.10)

Compiler: -24418
toolID: 199
Count: 3
toolName: AliasObj1100
vsVer: Visual Studio 2012 (11.00)

Compiler: 30729
toolID: 147
Count: 2
toolName: Implib900
vsVer: Visual Studio 2008 (09.00)

Compiler: -35
toolID: 206
Count: 16
toolName: Utc1700_C
vsVer: Visual Studio 2012 (11.00)

Compiler: -35
toolID: 207
Count: 1
toolName: Utc1700_CPP
vsVer: Visual Studio 2012 (11.00)

Compiler: -35
toolID: 208
Count: 5
toolName: Utc1700_CVTCIL_C
vsVer: Visual Studio 2012 (11.00)

Compiler: -35
toolID: 203
Count: 43
toolName: Implib1100
vsVer: Visual Studio 2012 (11.00)

Compiler: 0
toolID: 1
Count: 849
toolName: Import0
vsVer: Visual Studio (00.00)

Compiler: 23013
toolID: 259
Count: 24
toolName: Masm1400
vsVer: Visual Studio 2015 (14.00)

Compiler: 23013
toolID: 260
Count: 64
toolName: Utc1900_C
vsVer: Visual Studio 2015 (14.00)

Compiler: 23013
toolID: 261
Count: 379
toolName: Utc1900_CPP
vsVer: Visual Studio 2015 (14.00)

Compiler: 23026
toolID: 265
Count: 25
toolName: Utc1900_LTCG_CPP
vsVer: Visual Studio 2015 (14.00)

Compiler: 23026
toolID: 256
Count: 1
toolName: Export1400
vsVer: Visual Studio 2015 (14.00)

Compiler: 23026
toolID: 255
Count: 1
toolName: Cvtres1400
vsVer: Visual Studio 2015 (14.00)

Compiler: 0
toolID: 151
Count: 1
toolName: Resource
vsVer: Visual Studio 2008 (09.00)

Compiler: 23026
toolID: 258
Count: 1
toolName: Linker1400
vsVer: Visual Studio 2015 (14.00)


firstSeen: 2024-11-29 15:45:25
ssz: 5 Mb
fname: e21e8ae822a1a0d41a97d1741e1c8ccf
vt: Scan finished
hash: e21e8ae822a1a0d41a97d1741e1c8ccf
date: 2024-11-29 15:45:25
compiled: Thu, Sep 12 2024, 9:08:14 - 32 Bit DLL
epSectIndex: 6
sects: .text, .rdata, .data, .%?., .%-[, .mo:, .reloc, .rsrc
die: PE: protector: VMProtect(2.X)[-] PE: linker: Microsoft Linker(14.39)[DLL32,signed]
exports: @1 MyUnregisterServer
resNames: 381 \24\2\1033
imphash: c60ea44c29fb9958cdca44c6933240cf
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 442944
epSect: .mo:
details:
APEX                Malicious
AVG                 Win32:MalwareX-gen [Trj]
AhnLab-V3           Trojan/Win.Redcap.R672916
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Avast               Win32:MalwareX-gen [Trj]
Avira               TR/Redcap.vdzex
Bkav                W32.AIDetectMalware
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.BB suspicious
Elastic             malicious (high confidence)
F-Secure            Trojan.TR/Redcap.vdzex
FireEye             Generic.mg.e21e8ae822a1a0d4
Fortinet            Riskware/Application
Google              Detected
Gridinsoft          Trojan.Heur!.022120A0
K7AntiVirus         Trojan ( 0059f0351 )
K7GW                Trojan ( 0059f0351 )
Kaspersky           HEUR:Trojan.Win32.TbMA.gen
Malwarebytes        Trojan.MalPack.PES
McAfeeD             Real Protect-LS!E21E8AE822A1
Microsoft           Trojan:Win32/Redcap.GNZ!MTB
Panda               Trj/Genetic.gen
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.BumbleBee.rc
Symantec            ML.Attribute.HighConfidence
TACHYON             Trojan/W32.Agent.4858192
Tencent             Backdoor.Win64.Runshell_l.16001403
VBA32               BScope.TrojanPSW.Stealer
Varist              W32/Trojan.CZEC-4507
Webroot             Win.Trojan.Gen
Yandex              Riskware.VMProtect!U0btQzBGNZ8
Zillya              Trojan.VMProtect.Win32.100032



firstSeen: 2018-05-26 08:20:23
ssz: 5 Mb
fname: e21fcb14a85f535281182d0d1863f5c5
details: APEX Malicious
vt: Scan finished
hash: e21fcb14a85f535281182d0d1863f5c5
date: 2024-09-30 08:22:56
compiled: Fri, May 25 2018, 1:55:28 - 32 Bit EXE
epSectIndex: 6
sects: .text, .rdata, .data, .tls, .vmp0, .vmp1, .reloc, .rsrc
die: PE: protector: VMProtect(-)[-] PE: linker: Microsoft Linker(12.0)[EXE32,signed]
exports: @1 OPENSSL_Applink
imphash: b1e9945e2f5d6d1c3fde8802e4be4559
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 411505
epSect: .vmp1
sig: Valid
sigDetails: Subject: Xiaomi Technology Inc Issuer: Symantec Class 3 SHA256 Code Signing CA
resNames:
28840   \ICON\1\1033
7336    \ICON\2\1033
3240    \ICON\3\1033
48      \GROUP_ICON\108\1033
760     \VERSION\1\2052
640     \24\1\1033

fileProps:
CompanyName      Xiaomi.Inc
FileDescription  MIPhone unlock tool
FileVersion      3.3.525.23
InternalName     miflash_unlock.exe
LegalCopyright   Copyright (C) 2017
OriginalFilename miflash_unlock.exe
ProductName      MiFlashUnlock
ProductVersion   3.3.525.23


firstSeen: 2024-11-24 12:37:55
ssz: 10 Mb
fname: e5f218d693a1ec7362a520eb86f3c140
vt: Scan finished
hash: e5f218d693a1ec7362a520eb86f3c140
date: 2024-11-24 12:37:55
compiled: Thu, Oct 10 2024, 22:17:15 - 32 Bit EXE
epSectIndex: 10
sects: .text, .rdata, .data, .gfids, .giats, .tls, .shared, .P#L, .uH", .h{', .rsrc
die: PE: linker: Microsoft Linker(14.0)[EXE32,admin,signed]
imphash: 699039067d2cbfcfa511d79f54fb5227
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: BC6050
epSect: .h{'
sig: Corrupt
sigDetails: Subject: VALOFE Co.,Ltd. Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
details:
Bkav                W32.AIDetectMalware
Cylance             Unsafe
ESET-NOD32          a variant of Win32/Packed.VMProtect.BC suspicious
FireEye             Generic.mg.e5f218d693a1ec73
Gridinsoft          Trojan.Heur!.00212431
MaxSecure           Trojan.Malware.300983.susgen
McAfeeD             Real Protect-LS!E5F218D693A1
Symantec            ML.Attribute.HighConfidence
Trapmine            malicious.high.ml.score
VBA32               Malware-Cryptor.Inject.gen


resNames:
270376  \ICON\1\1042
67624   \ICON\2\1042
16936   \ICON\3\1042
4264    \ICON\4\1042
1128    \ICON\5\1042
76      \GROUP_ICON\128\1042
636     \VERSION\1\1042
736     \HTML\103\1042
739     \HTML\104\1042
736     \HTML\105\1042
742     \HTML\106\1042
559     \24\1\1033

fileProps:
FileDescription  Sailor Online Launcher
FileVersion      1.0.0.4
InternalName     InternalName
LegalCopyright   Copyright (C) 2022
OriginalFilename OriginalFileName
ProductName      Sailor Online Launcher
ProductVersion   1.0.0.4


firstSeen: 2024-11-29 05:32:08
ssz: 2 Mb
fname: e6330570dbe5144f97cd351432df4671
vt: Scan finished
hash: e6330570dbe5144f97cd351432df4671
date: 2024-11-29 05:32:08
compiled: Sun, Sep 12 2021, 7:32:25 - 32 Bit EXE
epSectIndex: 6
sects: 8p6If, PixCKg, fbHug, IqtuD, c9fY, wB0FC, MaDeo
die: PE: compiler: Microsoft Visual C/C++(6.0)[-] PE: linker: Microsoft Linker(6.0)[EXE32]
resNames: 604 \VERSION\1\2052
imphash: 56701e66a09015019e446765d657c56d
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 103E98
epSect: wB0FC
details:
ALYac               Gen:Variant.Lazy.624471
APEX                Malicious
AVG                 Win32:MalwareX-gen [Trj]
AhnLab-V3           Trojan/Win.Generic.R665143
Antiy-AVL           Trojan[Packed]/Win32.Vemply
Arcabit             Trojan.Lazy.D98757
Avast               Win32:MalwareX-gen [Trj]
Avira               TR/Crypt.ZPACK.Gen
Baidu               Win32.Packed.VMProtect.a
BitDefender         Gen:Variant.Lazy.624471
Bkav                W32.AIDetectMalware
CAT-QuickHeal       Trojan.GenericRI.S23452157
CTX                 exe.unknown.lazy
ClamAV              Win.Dropper.Tiggre-9845940-0
CrowdStrike         win/malicious_confidence_100% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.ABD
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Lazy.624471 (B)
F-Secure            Trojan.TR/Crypt.ZPACK.Gen
FireEye             Generic.mg.e6330570dbe5144f
Fortinet            W32/VMProtect.ABD!tr
GData               Win32.Trojan-Stealer.BlackMoon.D
Google              Detected
Gridinsoft          Trojan.Heur!.032920A1
Ikarus              Trojan.Win32.VMProtect
Jiangmin            Packed.Vemply.jjn
K7AntiVirus         Trojan ( 7000001c1 )
K7GW                Trojan ( 7000001c1 )
Kaspersky           VHO:Packed.Win32.Vemply.gen
Malwarebytes        Generic.Malware.AI.DDS
MaxSecure           Trojan.Malware.300983.susgen
McAfeeD             Real Protect-LS!E6330570DBE5
MicroWorld-eScan    Gen:Variant.Lazy.624471
Microsoft           Trojan:Win32/Zusy.EM!MTB
Panda               Trj/Genetic.gen
Sangfor             Trojan.Win32.Save.BlackMoon
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.tc
Sophos              Mal/VMProtBad-A
Symantec            ML.Attribute.HighConfidence
Tencent             Packed.Win32.Vemply.he
Trapmine            malicious.high.ml.score
VBA32               BScope.Trojan.Dynamer
VIPRE               Gen:Variant.Lazy.624471
Varist              W32/Agent.JKA.gen!Eldorado
Zillya              Trojan.VMProtect.Win32.99252
huorong             Trojan/FakeAPP.s



firstSeen: 2023-06-15 12:11:21
ssz: 7 Mb
fname: ebe2c582d1a647f8b269c3a34f67ebc3
vt: Scan finished
hash: ebe2c582d1a647f8b269c3a34f67ebc3
date: 2024-11-13 15:04:51
compiled: Mon, Jun 5 2023, 10:35:37 - 32 Bit DLL
epSectIndex: 6
sects: .text, .rdata, .data, .of0, .of1, .of2, .reloc, .rsrc
die: PE: linker: Microsoft Linker(14.36)[DLL32]
resNames: 576 \VERSION\1\1049
imphash: df5aef3999de44d338f573d7bf24d811
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 968159
epSect: .of2
details:
ALYac               Trojan.GenericKD.71742260
APEX                Malicious
AVG                 Win32:Evo-gen [Trj]
Alibaba             Packed:Win32/VMProtect.c81741f9
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Arcabit             Trojan.Generic.D446B334
Avast               Win32:Evo-gen [Trj]
BitDefender         Trojan.GenericKD.71742260
Bkav                W32.AIDetectMalware
CTX                 dll.trojan.vmprotect
CrowdStrike         win/malicious_confidence_100% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.BC suspicious
Elastic             malicious (high confidence)
Emsisoft            Trojan.GenericKD.71742260 (B)
FireEye             Generic.mg.ebe2c582d1a647f8
Fortinet            Riskware/Application
GData               Trojan.GenericKD.71742260
Google              Detected
Gridinsoft          Trojan.Heur!.022120A0
K7AntiVirus         Trojan ( 0059f2081 )
K7GW                Trojan ( 0059f2081 )
Lionic              Trojan.Win32.VMProtect.4!c
Malwarebytes        Malware.AI.4290126172
MaxSecure           Trojan.Malware.133898145.susgen
McAfee              Artemis!EBE2C582D1A6
McAfeeD             ti!719BDB6FC10C
MicroWorld-eScan    Trojan.GenericKD.71742260
Microsoft           PUA:Win32/Packunwan
Paloalto            generic.ml
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.wc
Sophos              Mal/Generic-S
Symantec            Trojan Horse
TrendMicro-HouseCallTROJ_GEN.R002H09BS24
VIPRE               Trojan.GenericKD.71742260
Varist              W32/ABRisk.YITJ-5241
Zillya              Tool.CrackAGen.Win64.16


exports:
@1 Breakpad_SteamMiniDumpInit
@2 Breakpad_SteamSetAppID
@3 Breakpad_SteamSetSteamID
@4 Breakpad_SteamWriteMiniDumpSetComment
@5 Breakpad_SteamWriteMiniDumpUsingExceptionInfoWithBuildId
@6 CreateInterface
@7 OnlineFix
@8 ShellExecuteA
@9 ShellExecuteW
@10 Steam_BConnected
@11 Steam_BGetCallback
@12 Steam_BLoggedOn
@13 Steam_BReleaseSteamPipe
@14 Steam_ConnectToGlobalUser
@15 Steam_CreateGlobalUser
@16 Steam_CreateLocalUser
@17 Steam_CreateSteamPipe
@18 Steam_FreeLastCallback
@19 Steam_GSBLoggedOn
@20 Steam_GSBSecure
@21 Steam_GSGetSteam2GetEncryptionKeyToSendToNewClient
@22 Steam_GSGetSteamID
@23 Steam_GSLogOff
@24 Steam_GSLogOn
@25 Steam_GSRemoveUserConnect
@26 Steam_GSSendSteam2UserConnect
@27 Steam_GSSendSteam3UserConnect
@28 Steam_GSSendUserDisconnect
@29 Steam_GSSendUserStatusResponse
@30 Steam_GSSetServerType
@31 Steam_GSSetSpawnCount
@32 Steam_GSUpdateStatus
@33 Steam_GetAPICallResult
@34 Steam_GetGSHandle
@35 Steam_InitiateGameConnection
@36 Steam_LogOff
@37 Steam_LogOn
@38 Steam_ReleaseThreadLocalMemory
@39 Steam_ReleaseUser
@40 Steam_SetLocalIPBinding
@41 Steam_TerminateGameConnection
@42 hid_close
@43 hid_enumerate
@44 hid_error
@45 hid_exit
@46 hid_free_enumeration
@47 hid_get_feature_report
@48 hid_get_indexed_string
@49 hid_get_manufacturer_string
@50 hid_get_product_string
@51 hid_get_serial_number_string
@52 hid_init
@53 hid_open
@54 hid_open_path
@55 hid_read
@56 hid_read_timeout
@57 hid_send_feature_report
@58 hid_set_nonblocking
@59 hid_write
@60 hid_write_output_report

fileProps:
CompanyName      Online-Fix.Me
FileDescription  Online-Fix Steamclient
FileVersion      1.3.1.0
LegalCopyright   Copyright (C) 2021-2023, 0xdeadc0de
ProductVersion   1.3.1.0


firstSeen: 2024-11-29 13:40:39
ssz: 2 Mb
fname: f6b9000c7a5b4ad9026cf6e9bfeea014
vt: Scan finished
hash: f6b9000c7a5b4ad9026cf6e9bfeea014
date: 2024-11-29 13:40:39
compiled: Sun, Sep 12 2021, 7:32:25 - 32 Bit EXE
epSectIndex: 6
sects: Kpzc1, Kpzc13, A62Tg, 4lkT9, RbaY, HoDFh, ueuL9
die: PE: compiler: Microsoft Visual C/C++(6.0)[-] PE: linker: Microsoft Linker(6.0)[EXE32]
resNames: 604 \VERSION\1\2052
imphash: 56701e66a09015019e446765d657c56d
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 103E98
epSect: HoDFh
details:
ALYac               Gen:Variant.Lazy.624471
APEX                Malicious
AVG                 Win32:MalwareX-gen [Trj]
AhnLab-V3           Trojan/Win.Generic.R665143
Antiy-AVL           Trojan[Packed]/Win32.Vemply
Arcabit             Trojan.Lazy.D98757
Avast               Win32:MalwareX-gen [Trj]
Avira               TR/Crypt.ZPACK.Gen
Baidu               Win32.Packed.VMProtect.a
BitDefender         Gen:Variant.Lazy.624471
Bkav                W32.AIDetectMalware
CAT-QuickHeal       Trojan.GenericRI.S23452157
CTX                 exe.unknown.lazy
ClamAV              Win.Dropper.Tiggre-9845940-0
CrowdStrike         win/malicious_confidence_100% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.ABD
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Lazy.624471 (B)
F-Secure            Trojan.TR/Crypt.ZPACK.Gen
FireEye             Generic.mg.f6b9000c7a5b4ad9
Fortinet            W32/VMProtect.ABD!tr
GData               Win32.Trojan-Stealer.BlackMoon.D
Google              Detected
Gridinsoft          Trojan.Heur!.032920A1
Ikarus              Trojan.Win32.VMProtect
Jiangmin            Packed.Vemply.jjn
K7AntiVirus         Trojan ( 7000001c1 )
K7GW                Trojan ( 7000001c1 )
Kaspersky           UDS:Packed.Win32.Vemply.gen
MaxSecure           Trojan.Malware.300983.susgen
McAfeeD             Real Protect-LS!F6B9000C7A5B
MicroWorld-eScan    Gen:Variant.Lazy.624471
Microsoft           Trojan:Win32/Zusy.EM!MTB
NANO-Antivirus      Trojan.Win32.Vemply.ktmajy
Panda               Trj/Genetic.gen
Sangfor             Trojan.Win32.Save.BlackMoon
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.tc
Sophos              Mal/VMProtBad-A
Symantec            ML.Attribute.HighConfidence
Tencent             Packed.Win32.Vemply.he
Trapmine            malicious.high.ml.score
TrendMicro          TROJ_GEN.R03BC0DKH24
TrendMicro-HouseCallTROJ_GEN.R03BC0DKH24
VBA32               BScope.Trojan.Dynamer
VIPRE               Gen:Variant.Lazy.624471
Varist              W32/Agent.JKA.gen!Eldorado
Zillya              Trojan.VMProtect.Win32.99252
huorong             Trojan/FakeAPP.s



firstSeen: 2024-11-29 13:03:52
ssz: 3 Mb
fname: f6c549d7be7f73ce65d6891670470f7f
vt: Scan finished
hash: f6c549d7be7f73ce65d6891670470f7f
date: 2024-11-29 13:03:52
compiled: Tue, Jun 13 2023, 7:17:19 - 32 Bit EXE
epSectIndex: 6
sects: .text, .rdata, .data, .5q#, .l`X, .o/j, .reloc, .rsrc
die: PE: linker: Microsoft Linker(9.0)[EXE32]
imphash: d41d8cd98f00b204e9800998ecf8427e
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 7DA21E
epSect: .o/j
details:
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Bkav                W32.AIDetectMalware
CrowdStrike         win/malicious_confidence_60% (D)
Gridinsoft          Trojan.Heur!.023920A1
Malwarebytes        Trojan.MalPack.PES
Microsoft           PUA:Win32/Puwaders.C!ml
SentinelOne         Static AI - Suspicious PE
Skyhigh             BehavesLike.Win32.Generic.wc
Trapmine            malicious.moderate.ml.score



firstSeen: 2024-11-29 12:19:53
ssz: 9 Mb
fname: f8ccfed4a716ba6f5157a17d137382ff
vt: Scan finished
hash: f8ccfed4a716ba6f5157a17d137382ff
date: 2024-11-29 12:19:53
compiled: Fri, Nov 29 2024, 10:18:16 - 32 Bit DLL
epSectIndex: 6
sects: .text, .rdata, .data, .UPX0, .UPX1, .UPX2, .rsrc, .reloc
die: PE: protector: VMProtect(2.X)[-] PE: linker: Microsoft Linker(14.16)[DLL32]
exports: @1 ZyXELAnchor
resNames: 540 \VERSION\1\1049 381 \24\2\1033
imphash: 3717d6e9e984360bcf933abe419bc6e2
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 65D2D0
epSect: .UPX2
details:
APEX                Malicious
Bkav                W32.AIDetectMalware
CrowdStrike         win/malicious_confidence_60% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.BC suspicious
Elastic             malicious (high confidence)
FireEye             Generic.mg.f8ccfed4a716ba6f
McAfeeD             ti!E3BB32AA8910
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.rc
Trapmine            malicious.high.ml.score


fileProps:
CompanyName      Spoken Dev
FileDescription  Lineage II Ext
FileVersion      1.0.0.0
LegalCopyright   Multiproff-Multimperia.com
ProductVersion   1.0.0.0


firstSeen: 2024-11-29 12:07:19
ssz: 7 Mb
fname: f9316e9bffe7ec0e7b8a7d8ab084a0ef
details: Gridinsoft Trojan.Heur!.00214020
vt: Scan finished
hash: f9316e9bffe7ec0e7b8a7d8ab084a0ef
date: 2024-11-29 12:07:19
compiled: Fri, Oct 18 2019, 12:53:13 - 32 Bit DLL
epSectIndex: 5
sects: .text, .rdata, .data, .dat0, .dat1, .reloc, .rsrc
die: PE: protector: VMProtect(-)[-] PE: linker: Microsoft Linker(12.0)[DLL32,signed]
resNames: 744 \ICON\1\2057 20 \GROUP_ICON\104\2057 976 \VERSION\1\2057
imphash: b7eb9bb95847c5aa10cfedb1ea7713f0
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 781FBC
epSect: .dat1
sig: Valid
sigDetails: Subject: Data Encryption Systems Ltd Issuer: Symantec Class 3 SHA256 Code Signing CA
exports:
@1 DK2AllowChangeInterrupts
@2 DK2DecrementDownCounter
@3 DK2DetectSpeed
@4 DK2DriverInstalled
@5 DK2FindLPTPort
@6 DK2GetDelayTime
@7 DK2GetFlags
@8 DK2ReadDUSN
@9 DK2ReadDownCounter
@10 DK2ReadMemory
@11 DK2ReadRandomNumbers
@12 DK2RestartDownCounter
@13 DK2SendAlgorithmString
@14 DK2SetDelayTime
@15 DK2SetFlags
@16 DK2SubDetectSpeed
@17 DK2Success
@18 DK2ThroughEncryption
@19 DK2WriteMemory
@20 FindDK2
@22 DK2Encode
@23 DK2Decode
@24 DK2GetLastError
@25 DK2FormatError
@26 FindDK2Ex
@27 DK2LogoutFromServer
@28 DK2GetServerName
@29 DK2SetAccessFlags
@30 DK2RegisterModule
@31 DK2UnregisterModule
@32 FindDK2ExP
@33
@34
@35
@36 DK2SendAlgorithmBuffer
@37 DK2GetFlagsEx
@38 DK2WriteMemoryAndVerify
@39 GetPlatformInfo
@40 FindFirstDK2
@41 FindNextDK2
@42 DK2LoginToServer
@54 DK2SendAndReceive
@55 DK2GetSystemTime
@56
@57
@58
@59
@60 DK2GetLicenceCount
@61 DK2RequestLicences
@62 DK2UpdateLicences
@63 DK2RemoteUpdate
@64 DK2RemoteUpdateFromFile
@65 EnumDK2
@66 EnumDK2VectorFree
@67 DK2GetLicenceCountEx
@68 DK2GetInstallVersionList
@69 DK2GetLocalInstallVersion
@70
@71
@72
@73
@74
@75
@76 DK2RemoteUpdateFromFileUnicode
@100 DK2IsTerminalServerSession
@101 DK2GetPortType
@102
@103
@104
@105 DK2StopThread
@110
@111
@112
@113
@114
@115
@116
@117
@118
@119
@120
@121
@122
@123
@124
@125
@126
@127
@128
@129
@130
@131
@132
@150
@151
@152
@153
@154
@155
@156
@157
@158
@159
@160
@161
@162
@163
@164
@165
@166
@167
@168
@169
@170
@171
@210
@211
@212
@213
@214
@215
@216
@217
@218
@219
@220
@221
@222
@223
@224
@226
@227
@228
@229
@230
@231
@232
@233
@240
@241
@242
@243
@244
@245
@246
@247
@248
@249
@250
@251
@252
@253
@254
@255
@256
@257

fileProps:
CompanyName      Data Encryption Systems Limited
FileDescription  32bit DK2 API DLL
FileVersion      6.58.0.189
InternalName     Magic Bus
LegalCopyright   Copyright ©2004 Data Encryption Systems Limited
OriginalFilename DK2Win32.dll
ProductName      DESkey DK2
ProductVersion   7.03.0.3


firstSeen: 2023-12-25 18:56:57
ssz: 2 Mb
fname: f9fd85ebb29992a1b1a1fe0cbeaaf827
vt: Scan finished
hash: f9fd85ebb29992a1b1a1fe0cbeaaf827
date: 2024-11-20 11:20:09
compiled: Tue, Oct 2 2012, 5:04:04 - 32 Bit EXE
epSectIndex: 2
sects: .text, .itext, .data, .bss, .idata, .tls, .rdata, .rsrc
imphash: 9accc748a9d89a334d2fc419ec39655a
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 16478
epSect: .itext
details:
AhnLab-V3           Unwanted/Win.Generic.R557998
Antiy-AVL           GrayWare/Win32.Packunwan
CAT-QuickHeal       Trojan.Fragtor
CTX                 exe.trojan.fragtor
CrowdStrike         win/grayware_confidence_60% (D)
Cylance             Unsafe
DeepInstinct        MALICIOUS
Google              Detected
Lionic              Trojan.Win32.Generic.4!c
Malwarebytes        Generic.Malware/Suspicious
MaxSecure           Trojan.Malware.276111561.susgen
McAfee              Artemis!F9FD85EBB299
VBA32               BScope.TrojanDropper.Dapato
Varist              W32/VMProtect.FD.gen!Eldorado


die:
PE: installer: Inno Setup Module(5.5.0)[unicode]
	    PE: compiler: Embarcadero Delphi(2009-2010)[-]
	    PE: linker: Turbo Linker(2.25*,Delphi)[EXE32,admin]
	    PE: overlay: Inno Setup Installer data(-)[-]

resNames:
1128    \ICON\1\1033
4392    \ICON\2\1033
9832    \ICON\3\1033
196     \STRING\4091\0
204     \STRING\4092\0
372     \STRING\4093\0
924     \STRING\4094\0
844     \STRING\4095\0
660     \STRING\4096\0
33512   \RCDATA\CHARTABLE\1033
16      \RCDATA\DVCLAL\0
432     \RCDATA\PACKAGEINFO\0
44      \RCDATA\11111\0
48      \GROUP_ICON\MAINICON\1033
1208    \VERSION\1\1033
1582    \24\1\1033

fileProps:
CompanyName      FreeTP.Org - Craft The World Multiplayer Fix
FileDescription  Craft The World
ProductName      Craft The World
ProductVersion   1-1


firstSeen: 2024-11-29 05:15:16
ssz: 2 Mb
fname: fdad4aeffb521cd67a9ce85845e5e34a
vt: Scan finished
hash: fdad4aeffb521cd67a9ce85845e5e34a
date: 2024-11-29 05:15:16
compiled: Fri, Dec 11 2009, 21:31:37 - 32 Bit EXE
epSectIndex: 6
sects: .text, .rdata, .data, .7]D, .K<', .TEs
die: PE: linker: Microsoft Linker(6.0)[EXE32]
imphash: 0cf907e6bea47190f4f36d3d8706fa34
pever: PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 46EDA1
epSect: .TEs
details:
APEX                Malicious
Antiy-AVL           Trojan/Win32.Agent
Bkav                W32.AIDetectMalware
CrowdStrike         win/malicious_confidence_90% (D)
Cylance             Unsafe
Cynet               Malicious (score: 100)
Elastic             malicious (high confidence)
FireEye             Generic.mg.fdad4aeffb521cd6
Google              Detected
Gridinsoft          Trojan.Heur!.022120A1
Ikarus              PUA.VMProtect
Jiangmin            TrojanClicker.Cycler.bxl
Kingsoft            malware.kb.b.908
Malwarebytes        Malware.AI.4246046164
Microsoft           Program:Win32/Wacapew.C!ml
NANO-Antivirus      Trojan.Win32.Kelios.kktppb
Rising              Trojan.Kryptik@AI.92 (RDML:AWG6oPmrh3X6OIx09aEoGA)
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.vc
Sophos              Generic ML PUA (PUA)
Trapmine            malicious.high.ml.score
Varist              W32/Unruy.N.gen!Eldorado
Zillya              Trojan.Cycler.Win32.2459
Zoner               Probably Heur.ExeHeaderL



firstSeen: 2024-11-29 09:20:52
ssz: 2 Mb
fname: ff7bfa107e0198fbc39719cd58aedd30
vt: Scan finished
hash: ff7bfa107e0198fbc39719cd58aedd30
date: 2024-11-29 09:20:52
compiled: Tue, May 7 2024, 12:27:29 - 32 Bit EXE
epSectIndex: 6
sects: .text, .rdata, .data, .1Q[, .),E, .sc=, .reloc
die: PE: linker: Microsoft Linker(14.29)[EXE32]
imphash: 847bf44a6099ee7a9c215a232e218aab
pever: ASLR DEP PEVersion:OS:6.0 Link:14.29 Img:0.0 SubSys:6.0
ep: 1A9119
epSect: .sc=
details:
ALYac               Gen:Variant.Zusy.556634
APEX                Malicious
AVG                 Win32:KeyloggerX-gen [Trj]
AhnLab-V3           Trojan/Win.Generic.R647582
Antiy-AVL           Trojan[Packed]/Win32.VMProtect
Arcabit             Trojan.Zusy.D87E5A
Avast               Win32:KeyloggerX-gen [Trj]
Avira               HEUR/AGEN.1374848
BitDefender         Gen:Variant.Zusy.556634
Bkav                W32.AIDetectMalware
CAT-QuickHeal       Trojan.Keylogger
CTX                 exe.unknown.zusy
ClamAV              Win.Packed.C2xk-10031869-0
CrowdStrike         win/malicious_confidence_100% (W)
Cylance             Unsafe
Cynet               Malicious (score: 100)
DeepInstinct        MALICIOUS
ESET-NOD32          a variant of Win32/Packed.VMProtect.BC suspicious
Elastic             malicious (high confidence)
Emsisoft            Gen:Variant.Zusy.556634 (B)
F-Secure            Heuristic.HEUR/AGEN.1374848
FireEye             Generic.mg.ff7bfa107e0198fb
Fortinet            W32/Kryptik.HRTC!tr
GData               Win32.Trojan.PSE.1V4QVRM
Google              Detected
Gridinsoft          Trojan.Heur!.022120A1
Ikarus              PUA.VMProtect
Jiangmin            Trojan.Agent.ewwu
K7AntiVirus         Trojan ( 0059f91f1 )
K7GW                Trojan ( 0059f91f1 )
Kaspersky           Trojan.Win32.Agent2.mxh
Kingsoft            malware.kb.b.808
Malwarebytes        Malware.AI.1010088143
MaxSecure           Trojan.Malware.273686129.susgen
McAfeeD             Real Protect-LS!FF7BFA107E01
MicroWorld-eScan    Gen:Variant.Zusy.556634
Microsoft           Trojan:Win32/KeyLogger.ASL!MTB
NANO-Antivirus      Trojan.Win32.Redcap.koeegm
Panda               Trj/Genetic.gen
SentinelOne         Static AI - Malicious PE
Skyhigh             BehavesLike.Win32.Generic.tc
Sophos              Generic ML PUA (PUA)
Symantec            ML.Attribute.HighConfidence
TACHYON             Trojan/W32.Agent.1589760.V
Tencent             Trojan.Win32.Agent.cby
Trapmine            malicious.high.ml.score
VBA32               BScope.TrojanSpy.LClipper
VIPRE               Gen:Variant.Zusy.556634
Varist              W32/Trojan.FBXE-5513
VirIT               Trojan.Win32.Genus.WDT
Webroot             W32.Trojan.Gen
Zillya              Trojan.VMProtect.Win32.93512
huorong             Trojan/Agent.bss



