龟包 240315 15X

biue

UNknownOoo

火绒（没开高级启发
扫描：10x

1. 扫描文件：15
   
2. 发现风险：10
   
3. 已处理风险：0
   
4. 病毒详情：
   
5. 风险路径：C:\Users\Serendipity\Desktop\TurtleSUSP-240315\TS-240315-14-Gozi-78be7f.exe, 病毒名：Trojan/MSIL.Heracles.a, 病毒ID：6e7428e33b8f70d2, 处理结果：暂不处理
   
6. 风险路径：C:\Users\Serendipity\Desktop\TurtleSUSP-240315\TS-240315-02-Lumma-356264.exe, 病毒名：Trojan/MSIL.Agent.gq, 病毒ID：480de0f93d03ca55, 处理结果：暂不处理
   
7. 风险路径：C:\Users\Serendipity\Desktop\TurtleSUSP-240315\TS-240315-13-DiscordRAT-8a718e.exe, 病毒名：HEUR:Trojan/Distool.a, 病毒ID：46ad91b2a9c808c8, 处理结果：暂不处理
   
8. 风险路径：C:\Users\Serendipity\Desktop\TurtleSUSP-240315\TS-240315-05-AgentTesla-ed181a.exe, 病毒名：HEUR:VirTool/MSIL.Obfuscator.gen!A, 病毒ID：3fda44dcb57a42be, 处理结果：暂不处理
   
9. 风险路径：C:\Users\Serendipity\Desktop\TurtleSUSP-240315\TS-240315-12-FormBook-219f9b.exe, 病毒名：HEUR:VirTool/MSIL.Obfuscator.gen!A, 病毒ID：3fda44dcb57a42be, 处理结果：暂不处理
   
10. 风险路径：C:\Users\Serendipity\Desktop\TurtleSUSP-240315\TS-240315-09-AgentTesla-d987a5.exe, 病毒名：TrojanSpy/MSIL.SnakeLogger.t, 病毒ID：1310f08f81b47d29, 处理结果：暂不处理
    
11. 风险路径：C:\Users\Serendipity\Desktop\TurtleSUSP-240315\TS-240315-10-Creal-01849c.exe, 病毒名：Ransom/LockFile.fl, 病毒ID：9b97d9df1e35b64c, 处理结果：暂不处理
    
12. 风险路径：C:\Users\Serendipity\Desktop\TurtleSUSP-240315\TS-240315-11-Creal-4562ee.exe, 病毒名：TrojanSpy/Python.PwStealer.h, 病毒ID：8f764abd607816c0, 处理结果：暂不处理
    
13. 风险路径：C:\Users\Serendipity\Desktop\TurtleSUSP-240315\TS-240315-06-AgentTesla-582139.exe, 病毒名：HVM:VirTool/Obfuscator.gen!A, 病毒ID：b27d4294cde6a1ec, 处理结果：暂不处理
    
14. 风险路径：C:\Users\Serendipity\Desktop\TurtleSUSP-240315\TS-240315-03-RisePro-c9da51.exe, 病毒名：Trojan/Agent.bms, 病毒ID：440206c4c770f392, 处理结果：暂不处理

复制代码

761773275

MD KILL ALL

1094947421

UNknownOoo 发表于 2024-3-15 22:55
火绒（高级启发
扫描：10x

你这高启发没开成功呀！
火绒监控9x+高启发6x=全杀。

1. 【1】2024-03-15 23:31:13,病毒防护,病毒查杀,自定义扫描, 发现6个风险项目
   
2. 
   
3. 病毒库时间：2024-03-15 17:32
   
4. 开始时间：2024-03-15 23:30
   
5. 总计用时：00:00:01
   
6. 扫描对象：18
   
7. 扫描文件：6
   
8. 发现风险：6
   
9. 已处理风险：6
   
10. 病毒详情：
    
11. 风险路径：D:\下载\Compressed\TurtleSUSP-240315\TS-240315-08-AgentTesla-2649b1.exe, 病毒名：ADV:TrojanSpy/MSIL.Stealer!meteor, 病毒ID：4a7ffd6cc7dd1ce4, 处理结果：已处理，删除文件
    
12. 风险路径：D:\下载\Compressed\TurtleSUSP-240315\TS-240315-07-AgentTesla-776cbd.exe, 病毒名：ADV:TrojanSpy/MSIL.Stealer!meteor, 病毒ID：4a7ffd6cc7dd1ce4, 处理结果：已处理，删除文件
    
13. 风险路径：D:\下载\Compressed\TurtleSUSP-240315\TS-240315-04-AgentTesla-bb5bbf.exe, 病毒名：ADV:VirTool/MSIL.Obfuscator!meteor, 病毒ID：9b3fa4092c57ea79, 处理结果：已处理，删除文件
    
14. 风险路径：D:\下载\Compressed\TurtleSUSP-240315\TS-240315-06-AgentTesla-582139.exe, 病毒名：ADV:VirTool/Obfuscator!meteor, 病毒ID：b6b4d4a297409986, 处理结果：已处理，删除文件
    
15. 风险路径：D:\下载\Compressed\TurtleSUSP-240315\TS-240315-15-Redline-4d2e57.exe, 病毒名：ADV:VirTool/Obfuscator!meteor, 病毒ID：b6b4d4a297409986, 处理结果：已处理，删除文件
    
16. 风险路径：D:\下载\Compressed\TurtleSUSP-240315\TS-240315-01-Lumma-c595df.exe, 病毒名：ADV:Backdoor/Generic!meteor, 病毒ID：1a0e0ea81e1fdbcd, 处理结果：已处理，删除文件
    
17. 
    
18. >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
    
19. 
    
20. 【2】2024-03-15 23:30:19,病毒防护,文件实时监控,发现病毒Trojan/MSIL.Heracles.a, 已处理
    
21. 
    
22. 病毒名称：Trojan/MSIL.Heracles.a
    
23. 病毒ID：6E7428E33B8F70D2
    
24. 病毒路径：D:\下载\Compressed\TurtleSUSP-240315\TS-240315-14-Gozi-78be7f.exe
    
25. 操作类型：修改
    
26. 操作结果：已处理，删除文件
    
27. 
    
28. 进程ID：4432
    
29. 操作进程：C:\Program Files\Bandizip\Bandizip.exe
    
30. 操作进程命令行："C:\Program Files\Bandizip\Bandizip.exe" "D:\下载\Compressed\TurtleSUSP-240315.zip"
    
31. 父进程ID：2272
    
32. 父进程：D:\Program Files\idm\IDM\IDMan.exe
    
33. >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
    
34. 
    
35. 【3】2024-03-15 23:30:19,病毒防护,文件实时监控,发现病毒HEUR:Trojan/Distool.a, 已处理
    
36. 
    
37. 病毒名称：HEUR:Trojan/Distool.a
    
38. 病毒ID：46AD91B2A9C808C8
    
39. 病毒路径：D:\下载\Compressed\TurtleSUSP-240315\TS-240315-13-DiscordRAT-8a718e.exe
    
40. 操作类型：修改
    
41. 操作结果：已处理，删除文件
    
42. 
    
43. 进程ID：4432
    
44. 操作进程：C:\Program Files\Bandizip\Bandizip.exe
    
45. 操作进程命令行："C:\Program Files\Bandizip\Bandizip.exe" "D:\下载\Compressed\TurtleSUSP-240315.zip"
    
46. 父进程ID：2272
    
47. 父进程：D:\Program Files\idm\IDM\IDMan.exe
    
48. >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
    
49. 
    
50. 【4】2024-03-15 23:30:19,病毒防护,文件实时监控,发现病毒HEUR:VirTool/MSIL.Obfuscator.gen!A, 已处理
    
51. 
    
52. 病毒名称：HEUR:VirTool/MSIL.Obfuscator.gen!A
    
53. 病毒ID：3FDA44DCB57A42BE
    
54. 病毒路径：D:\下载\Compressed\TurtleSUSP-240315\TS-240315-12-FormBook-219f9b.exe
    
55. 操作类型：修改
    
56. 操作结果：已处理，删除文件
    
57. 
    
58. 进程ID：4432
    
59. 操作进程：C:\Program Files\Bandizip\Bandizip.exe
    
60. 操作进程命令行："C:\Program Files\Bandizip\Bandizip.exe" "D:\下载\Compressed\TurtleSUSP-240315.zip"
    
61. 父进程ID：2272
    
62. 父进程：D:\Program Files\idm\IDM\IDMan.exe
    
63. >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
    
64. 
    
65. 【5】2024-03-15 23:30:19,病毒防护,文件实时监控,发现病毒TrojanSpy/Python.PwStealer.h, 已处理
    
66. 
    
67. 病毒名称：TrojanSpy/Python.PwStealer.h
    
68. 病毒ID：8F764ABD607816C0
    
69. 病毒路径：D:\下载\Compressed\TurtleSUSP-240315\TS-240315-11-Creal-4562ee.exe
    
70. 操作类型：修改
    
71. 操作结果：已处理，删除文件
    
72. 
    
73. 进程ID：4432
    
74. 操作进程：C:\Program Files\Bandizip\Bandizip.exe
    
75. 操作进程命令行："C:\Program Files\Bandizip\Bandizip.exe" "D:\下载\Compressed\TurtleSUSP-240315.zip"
    
76. 父进程ID：2272
    
77. 父进程：D:\Program Files\idm\IDM\IDMan.exe
    
78. >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
    
79. 
    
80. 【6】2024-03-15 23:30:19,病毒防护,文件实时监控,发现病毒Ransom/LockFile.fl, 已处理
    
81. 
    
82. 病毒名称：Ransom/LockFile.fl
    
83. 病毒ID：9B97D9DF1E35B64C
    
84. 病毒路径：D:\下载\Compressed\TurtleSUSP-240315\TS-240315-10-Creal-01849c.exe
    
85. 操作类型：修改
    
86. 操作结果：已处理，删除文件
    
87. 
    
88. 进程ID：4432
    
89. 操作进程：C:\Program Files\Bandizip\Bandizip.exe
    
90. 操作进程命令行："C:\Program Files\Bandizip\Bandizip.exe" "D:\下载\Compressed\TurtleSUSP-240315.zip"
    
91. 父进程ID：2272
    
92. 父进程：D:\Program Files\idm\IDM\IDMan.exe
    
93. >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
    
94. 
    
95. 【7】2024-03-15 23:30:18,病毒防护,文件实时监控,发现病毒TrojanSpy/MSIL.SnakeLogger.t, 已处理
    
96. 
    
97. 病毒名称：TrojanSpy/MSIL.SnakeLogger.t
    
98. 病毒ID：1310F08F81B47D29
    
99. 病毒路径：D:\下载\Compressed\TurtleSUSP-240315\TS-240315-09-AgentTesla-d987a5.exe
    
100. 操作类型：修改
     
101. 操作结果：已处理，删除文件
     
102. 
     
103. 进程ID：4432
     
104. 操作进程：C:\Program Files\Bandizip\Bandizip.exe
     
105. 操作进程命令行："C:\Program Files\Bandizip\Bandizip.exe" "D:\下载\Compressed\TurtleSUSP-240315.zip"
     
106. 父进程ID：2272
     
107. 父进程：D:\Program Files\idm\IDM\IDMan.exe
     
108. >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
     
109. 
     
110. 【8】2024-03-15 23:30:17,病毒防护,文件实时监控,发现病毒HEUR:VirTool/MSIL.Obfuscator.gen!A, 已处理
     
111. 
     
112. 病毒名称：HEUR:VirTool/MSIL.Obfuscator.gen!A
     
113. 病毒ID：3FDA44DCB57A42BE
     
114. 病毒路径：D:\下载\Compressed\TurtleSUSP-240315\TS-240315-05-AgentTesla-ed181a.exe
     
115. 操作类型：修改
     
116. 操作结果：已处理，删除文件
     
117. 
     
118. 进程ID：4432
     
119. 操作进程：C:\Program Files\Bandizip\Bandizip.exe
     
120. 操作进程命令行："C:\Program Files\Bandizip\Bandizip.exe" "D:\下载\Compressed\TurtleSUSP-240315.zip"
     
121. 父进程ID：2272
     
122. 父进程：D:\Program Files\idm\IDM\IDMan.exe
     
123. >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
     
124. 
     
125. 【9】2024-03-15 23:30:17,病毒防护,文件实时监控,发现病毒Trojan/Agent.bms, 已处理
     
126. 
     
127. 病毒名称：Trojan/Agent.bms
     
128. 病毒ID：440206C4C770F392
     
129. 病毒路径：D:\下载\Compressed\TurtleSUSP-240315\TS-240315-03-RisePro-c9da51.exe
     
130. 操作类型：修改
     
131. 操作结果：已处理，删除文件
     
132. 
     
133. 进程ID：4432
     
134. 操作进程：C:\Program Files\Bandizip\Bandizip.exe
     
135. 操作进程命令行："C:\Program Files\Bandizip\Bandizip.exe" "D:\下载\Compressed\TurtleSUSP-240315.zip"
     
136. 父进程ID：2272
     
137. 父进程：D:\Program Files\idm\IDM\IDMan.exe
     
138. >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
     
139. 
     
140. 【10】2024-03-15 23:30:16,病毒防护,文件实时监控,发现病毒Trojan/MSIL.Agent.gq, 已处理
     
141. 
     
142. 病毒名称：Trojan/MSIL.Agent.gq
     
143. 病毒ID：480DE0F93D03CA55
     
144. 病毒路径：D:\下载\Compressed\TurtleSUSP-240315\TS-240315-02-Lumma-356264.exe
     
145. 操作类型：修改
     
146. 操作结果：已处理，删除文件
     
147. 
     
148. 进程ID：4432
     
149. 操作进程：C:\Program Files\Bandizip\Bandizip.exe
     
150. 操作进程命令行："C:\Program Files\Bandizip\Bandizip.exe" "D:\下载\Compressed\TurtleSUSP-240315.zip"
     
151. 父进程ID：2272
     
152. 父进程：D:\Program Files\idm\IDM\IDMan.exe
     
153. >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

复制代码

UNknownOoo

1094947421 发表于 2024-3-15 23:37
你这高启发没开成功呀！
火绒监控9x+高启发6x=全杀。

抱歉...少打了两个字，已修正（

rfuujk8i

360 miss TS-240315-15-Redline-4d2e57
其余kill
双击不杀本体杀衍生物即拦截行为

神秘鬼

fsp      余1     双击后hmpa拦截
Mitigation   Kernel32Trap
Timestamp    2024-03-15T17:34:27

Platform     10.0.19045/x64 v979 06_4e%
PID          7768
WoW          x86
Feature      00FD2E70000001A2
Application  D:\TurtleSUSP-240315\TS-240315-03-RisePro-c9da51.exe
Created      2024-03-15T17:32:41
Description  TS-240315-03-RisePro-c9da51.exe

Callee Type  LoadLibrary

Caller info: TS-240315-03-RisePro-c9da51.exe+0x601D2
Root owner module name : TS-240315-03-RisePro-c9da51.exe
001A01D2  85c0                     TEST         EAX, EAX
001A01D4  7507                     JNZ          0x1a01dd
001A01D6  33f6                     XOR          ESI, ESI
001A01D8  e911280000               JMP          0x1a29ee
001A01DD  8d8d4ffeffff             LEA          ECX, [EBP-0x1b1]
001A01E3  c7854ffeffff061b1d1d     MOV          DWORD [EBP-0x1b1], 0x1d1d1b06
001A01ED  c78553feffff1b130376     MOV          DWORD [EBP-0x1ad], 0x7603131b
001A01F7  c78557feffff1d161700     MOV          DWORD [EBP-0x1a9], 0x17161d
001A0201  c6855bfeffff01           MOV          BYTE [EBP-0x1a5], 0x1
001A0208  e833d8faff               CALL         0x14da40
001A020D  50                       PUSH         EAX

Code thumbprint:055781ffb2bd0e3833c363bab218b233f13d7a312efdd163eab1e22564b1958f
Number of used instructions: 0x0000000e
OwnerModuleThumbprint: 2c3106dc3090610188ff048ed4b457aaba82c9c66aad9cb747d6568efa0c5a27

Stack Trace
#  Address  Module                   Location
-- -------- ------------------------ ----------------------------------------
1  726FBDCD hmpalert.dll             +0x4bdcd

2  001A01D2 TS-240315-03-RisePro-c9da51.exe
            85c0                     TEST         EAX, EAX
            7507                     JNZ          0x1a01dd
            33f6                     XOR          ESI, ESI
            e911280000               JMP          0x1a29ee

3  0021DB37 TS-240315-03-RisePro-c9da51.exe
4  761BFCC9 kernel32.dll             BaseThreadInitThunk +0x19
5  778A7C5E ntdll.dll                RtlGetAppContainerNamedObjectPath +0x11e
6  778A7C2E ntdll.dll                RtlGetAppContainerNamedObjectPath +0xee

Loaded Modules (28)
-----------------------------------------------------------------------------
00140000-00E4E000 TS-240315-03-RisePro-c9da51.exe (Microsoft Corporation),
                  version: 6,0,422,16404 @Commit: be98e88c760526452
77840000-779E4000 ntdll.dll (Microsoft Corporation),
                  version: 10.0.19041.3996 (WinBuild.160101.0800)
726B0000-727F4000 hmpalert.dll (Sophos B.V.),
                  version: 3.8.26.979
761A0000-76290000 KERNEL32.dll (Microsoft Corporation),
                  version: 10.0.19041.3636 (WinBuild.160101.0800)
758D0000-75B0A000 KERNELBASE.dll (Microsoft Corporation),
                  version: 10.0.19041.4170 (WinBuild.160101.0800)
72380000-7241F000 apphelp.dll (Microsoft Corporation),
                  version: 10.0.19041.3636 (WinBuild.160101.0800)
76E50000-76FEC000 USER32.dll (Microsoft Corporation),
                  version: 10.0.19041.4170 (WinBuild.160101.0800)
756E0000-756F8000 win32u.dll (Microsoft Corporation),
                  version: 10.0.19041.4123 (WinBuild.160101.0800)
776E0000-77703000 GDI32.dll (Microsoft Corporation),
                  version: 10.0.19041.3996 (WinBuild.160101.0800)
76A10000-76AF5000 gdi32full.dll (Microsoft Corporation),
                  version: 10.0.19041.4123 (WinBuild.160101.0800)
76B80000-76BFB000 msvcp_win.dll (Microsoft Corporation),
                  version: 10.0.19041.3636 (WinBuild.160101.0800)
775B0000-776D0000 ucrtbase.dll (Microsoft Corporation),
                  version: 10.0.19041.3636 (WinBuild.160101.0800)
76B00000-76B7D000 ADVAPI32.dll (Microsoft Corporation),
                  version: 10.0.19041.4170 (WinBuild.160101.0800)
75E00000-75EBF000 msvcrt.dll (Microsoft Corporation),
                  version: 7.0.19041.3636 (WinBuild.160101.0800)
76DD0000-76E48000 sechost.dll (Microsoft Corporation),
                  version: 10.0.19041.4170 (WinBuild.160101.0800)
75B10000-75BCE000 RPCRT4.dll (Microsoft Corporation),
                  version: 10.0.19041.4123 (WinBuild.160101.0800)
756C0000-756D9000 bcrypt.dll (Microsoft Corporation),
                  version: 10.0.19041.3636 (WinBuild.160101.0800)
763D0000-769A8000 SHELL32.dll (Microsoft Corporation),
                  version: 10.0.19041.4170 (WinBuild.160101.0800)
774C0000-775A3000 ole32.dll (Microsoft Corporation),
                  version: 10.0.19041.3636 (WinBuild.160101.0800)
75F20000-761A0000 combase.dll (Microsoft Corporation),
                  version: 10.0.19041.4123 (WinBuild.160101.0800)
76D60000-76DC3000 WS2_32.dll (Microsoft Corporation),
                  version: 10.0.19041.3636 (WinBuild.160101.0800)
76C00000-76CFF000 CRYPT32.dll (Microsoft Corporation),
                  version: 10.0.19041.3636 (WinBuild.160101.0800)
75710000-75755000 SHLWAPI.dll (Microsoft Corporation),
                  version: 10.0.19041.3636 (WinBuild.160101.0800)
77050000-77488000 SETUPAPI.dll (Microsoft Corporation),
                  version: 10.0.19041.3636 (WinBuild.160101.0800)
77710000-7774B000 cfgmgr32.dll (Microsoft Corporation),
                  version: 10.0.19041.3996 (WinBuild.160101.0800)
73220000-73388000 gdiplus.dll (Microsoft Corporation),
                  version: 10.0.19041.3996 (WinBuild.160101.0800)
77490000-774B6000 IMM32.DLL (Microsoft Corporation),
                  version: 10.0.19041.3996 (WinBuild.160101.0800)
72160000-721C9000 fshook32.dll (WithSecure Corporation),
                  version: 6.4.39.70

Process Trace
1  D:\TurtleSUSP-240315\TS-240315-03-RisePro-c9da51.exe [7768]
2  C:\Windows\explorer.exe [7920]

Dropped Files
1  C:\Users\ak\AppData\Roaming\Microsoft\Windows\Recent\infected.lnk
     Dropped by \Device\HarddiskVolume3\Windows\explorer.exe [7920]
2  C:\Users\ak\AppData\Roaming\Microsoft\Windows\Recent\软件 (D) (2).lnk
     Dropped by \Device\HarddiskVolume3\Windows\explorer.exe [7920]

Thumbprints
801bc2663e79a25be1140dd1f50888d413fdb4fe36bb691502f9af15544d91ef
055781ffb2bd0e3833c363bab218b233f13d7a312efdd163eab1e22564b1958f (code)
2c3106dc3090610188ff048ed4b457aaba82c9c66aad9cb747d6568efa0c5a27 (ownermodule)

chx818

BDTS mac版，一解压就看到在扫描
打开安全日志，就看到报毒记录一条接着一条出来，打开样本文件夹文件也是一个接着一个消失


最后剩下4个，手动扫也是安全


用关掉防护的红伞扫了下，剩下4个被干掉


感觉不太行，关掉bd防护重新解压，用红伞重新扫一次，全部清空


不知道bd怎么导出日志，就不一条一条截图给各位看报毒名了

zfc234

EES all
Log
Version of detection engine: 28902 (20240315)
Date: 15/03/2024  Time: 23:31:56
Scanned disks, folders and files: C:\Users\Noah\Downloads\TurtleSUSP-240315
User: DESKTOP-P561SGV\Noah
C:\Users\Noah\Downloads\TurtleSUSP-240315\TS-240315-01-Lumma-c595df.exe - a variant of Win32/Kryptik.HWPK trojan - cleaned by deleting [1]
C:\Users\Noah\Downloads\TurtleSUSP-240315\TS-240315-02-Lumma-356264.exe - a variant of MSIL/GenKryptik.GUYX trojan - cleaned by deleting [1]
C:\Users\Noah\Downloads\TurtleSUSP-240315\TS-240315-03-RisePro-c9da51.exe - a variant of Win32/Packed.VMProtect.AKX trojan - cleaned by deleting [1]
C:\Users\Noah\Downloads\TurtleSUSP-240315\TS-240315-04-AgentTesla-bb5bbf.exe - a variant of MSIL/Kryptik.ALED trojan - cleaned by deleting [1]
C:\Users\Noah\Downloads\TurtleSUSP-240315\TS-240315-05-AgentTesla-ed181a.exe - a variant of MSIL/GenKryptik.GUZL trojan - cleaned by deleting [1]
C:\Users\Noah\Downloads\TurtleSUSP-240315\TS-240315-06-AgentTesla-582139.exe » UPX v13_m8 » AUTOIT » script.bin - a variant of Win32/Injector.Autoit.FVS trojan - cleaned by deleting [1]
C:\Users\Noah\Downloads\TurtleSUSP-240315\TS-240315-07-AgentTesla-776cbd.exe - a variant of MSIL/Kryptik.ALEL trojan - cleaned by deleting [1]
C:\Users\Noah\Downloads\TurtleSUSP-240315\TS-240315-08-AgentTesla-2649b1.exe - a variant of MSIL/Kryptik.ALEL trojan - cleaned by deleting [1]
C:\Users\Noah\Downloads\TurtleSUSP-240315\TS-240315-09-AgentTesla-d987a5.exe - a variant of MSIL/Kryptik.ALBO trojan - cleaned by deleting [1]
C:\Users\Noah\Downloads\TurtleSUSP-240315\TS-240315-10-Creal-01849c.exe » PYINSTALLER » creal.pyc - Python/Spy.Agent.AAF trojan - cleaned by deleting [1]
C:\Users\Noah\Downloads\TurtleSUSP-240315\TS-240315-11-Creal-4562ee.exe » PYINSTALLER » Creal.pyc - Python/PSW.Agent.BHS trojan - cleaned by deleting [1]
C:\Users\Noah\Downloads\TurtleSUSP-240315\TS-240315-12-FormBook-219f9b.exe - a variant of MSIL/Kryptik.ALEJ trojan - cleaned by deleting [1]
C:\Users\Noah\Downloads\TurtleSUSP-240315\TS-240315-13-DiscordRAT-8a718e.exe - a variant of MSIL/Agent.DZT trojan - cleaned by deleting [1]
C:\Users\Noah\Downloads\TurtleSUSP-240315\TS-240315-14-Gozi-78be7f.exe - a variant of MSIL/Kryptik.AKRY trojan - cleaned by deleting [1]
C:\Users\Noah\Downloads\TurtleSUSP-240315\TS-240315-15-Redline-4d2e57.exe » NSIS » Tv - BAT/Runner.JL trojan - cleaned by deleting [1]

a1414007

AVG kill all