SmartHawk

11.2

0-day

58 个模型检测该样本为恶意！

重新分析

下载样本

fa28b1a6ff3b10c3fd15538fa05946b6864a49acead10738a0b6bdb44da64816

05d706b427d5bf71f40f80891ae615b1.exe

分析耗时

94s

最近分析

文件大小

1.1MB

静态报毒动态报毒 100% AGENTTESLA AI SCORE=89 AIDETECTVM ALI2000015 CLASSIC CONFIDENCE DELF DELFINJECT DELPHILESS EMOP EMOY FAREIT FAREITIH GENETIC GRPGP HIGH CONFIDENCE HNSACJ HPLOKI IHW@AMTXDCAI KRYPTIK MALWARE2 MALWARE@#1H9FUPXWL24I2 MALWAREX OEGP S15127631 SCORE SMBD SUSGEN SUSPICIOUS PE TSCOPE TSPY UNSAFE X2091 ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FVZ!05D706B427D5	20200831	6.0.6.653
Alibaba	Trojan:Win32/DelfInject.ali2000015	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Avast	Win32:MalwareX-gen [Trj]	20200831	18.4.3895.0
Tencent		20200831	1.0.0.1
Kingsoft		20200831	2013.8.14.323

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

None

One or more processes crashed (32 个事件)

Time & API	Arguments	Status
1619134514.128081 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 35389252 registers.edi: 0 registers.eax: 0 registers.ebp: 35389320 registers.edx: 53 registers.ebx: 0 registers.esi: 0 registers.ecx: 260 exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b exception.symbol: 05d706b427d5bf71f40f80891ae615b1+0x96338 exception.instruction: div eax exception.module: 05d706b427d5bf71f40f80891ae615b1.exe exception.exception_code: 0xc0000094 exception.offset: 615224 exception.address: 0x496338	success
1619150028.838876 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 35454788 registers.edi: 0 registers.eax: 0 registers.ebp: 35454856 registers.edx: 53 registers.ebx: 0 registers.esi: 0 registers.ecx: 838 exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b exception.symbol: hjiwws+0x96338 exception.instruction: div eax exception.module: hjiwws.exe exception.exception_code: 0xc0000094 exception.offset: 615224 exception.address: 0x496338	success
1619150030.869876 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7528d4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a hjiwws+0xa23f8 @ 0x4a23f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x750d4b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x750d5d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xff4a147d	success
1619150030.119876 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 49872708 registers.edi: 0 registers.eax: 0 registers.ebp: 49872776 registers.edx: 53 registers.ebx: 0 registers.esi: 0 registers.ecx: 88 exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b exception.symbol: hjiwws+0x96338 exception.instruction: div eax exception.module: hjiwws.exe exception.exception_code: 0xc0000094 exception.offset: 615224 exception.address: 0x496338	success
1619150038.885876 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 48627524 registers.edi: 0 registers.eax: 0 registers.ebp: 48627592 registers.edx: 53 registers.ebx: 0 registers.esi: 0 registers.ecx: 885 exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b exception.symbol: hjiwws+0x96338 exception.instruction: div eax exception.module: hjiwws.exe exception.exception_code: 0xc0000094 exception.offset: 615224 exception.address: 0x496338	success
1619150041.150249 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7528d4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a hjiwws+0xa23f8 @ 0x4a23f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75134b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75135d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xff72147d	success
1619150041.760626 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 50003780 registers.edi: 0 registers.eax: 0 registers.ebp: 50003848 registers.edx: 54 registers.ebx: 0 registers.esi: 0 registers.ecx: 744 exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b exception.symbol: hjiwws+0x96338 exception.instruction: div eax exception.module: hjiwws.exe exception.exception_code: 0xc0000094 exception.offset: 615224 exception.address: 0x496338	success
1619150045.666249 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 49479492 registers.edi: 0 registers.eax: 0 registers.ebp: 49479560 registers.edx: 54 registers.ebx: 0 registers.esi: 0 registers.ecx: 666 exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b exception.symbol: hjiwws+0x96338 exception.instruction: div eax exception.module: hjiwws.exe exception.exception_code: 0xc0000094 exception.offset: 615224 exception.address: 0x496338	success
1619150048.118999 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7528d4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a hjiwws+0xa23f8 @ 0x4a23f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75184b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75185d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xff5f147d	success
1619150048.603626 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34275140 registers.edi: 0 registers.eax: 0 registers.ebp: 34275208 registers.edx: 54 registers.ebx: 0 registers.esi: 0 registers.ecx: 603 exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b exception.symbol: hjiwws+0x96338 exception.instruction: div eax exception.module: hjiwws.exe exception.exception_code: 0xc0000094 exception.offset: 615224 exception.address: 0x496338	success
1619150052.619249 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 49020740 registers.edi: 0 registers.eax: 0 registers.ebp: 49020808 registers.edx: 54 registers.ebx: 0 registers.esi: 0 registers.ecx: 619 exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b exception.symbol: hjiwws+0x96338 exception.instruction: div eax exception.module: hjiwws.exe exception.exception_code: 0xc0000094 exception.offset: 615224 exception.address: 0x496338	success
1619150055.385374 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7528d4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a hjiwws+0xa23f8 @ 0x4a23f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x750e4b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x750e5d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfd88147d	success
1619150055.682626 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34930500 registers.edi: 0 registers.eax: 0 registers.ebp: 34930568 registers.edx: 54 registers.ebx: 0 registers.esi: 0 registers.ecx: 666 exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b exception.symbol: hjiwws+0x96338 exception.instruction: div eax exception.module: hjiwws.exe exception.exception_code: 0xc0000094 exception.offset: 615224 exception.address: 0x496338	success
1619150060.400626 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 35454788 registers.edi: 0 registers.eax: 0 registers.ebp: 35454856 registers.edx: 54 registers.ebx: 0 registers.esi: 0 registers.ecx: 400 exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b exception.symbol: hjiwws+0x96338 exception.instruction: div eax exception.module: hjiwws.exe exception.exception_code: 0xc0000094 exception.offset: 615224 exception.address: 0x496338	success
1619150063.213501 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7528d4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a hjiwws+0xa23f8 @ 0x4a23f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75184b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75185d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xff60147d	success
1619150063.010626 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34668356 registers.edi: 0 registers.eax: 0 registers.ebp: 34668424 registers.edx: 54 registers.ebx: 0 registers.esi: 0 registers.ecx: 10 exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b exception.symbol: hjiwws+0x96338 exception.instruction: div eax exception.module: hjiwws.exe exception.exception_code: 0xc0000094 exception.offset: 615224 exception.address: 0x496338	success
1619150069.274999 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 50265924 registers.edi: 0 registers.eax: 0 registers.ebp: 50265992 registers.edx: 54 registers.ebx: 0 registers.esi: 0 registers.ecx: 260 exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b exception.symbol: hjiwws+0x96338 exception.instruction: div eax exception.module: hjiwws.exe exception.exception_code: 0xc0000094 exception.offset: 615224 exception.address: 0x496338	success
1619150072.228249 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7528d4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a hjiwws+0xa23f8 @ 0x4a23f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75134b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75135d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xff3d147d	success
1619150072.572626 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 35585860 registers.edi: 0 registers.eax: 0 registers.ebp: 35585928 registers.edx: 54 registers.ebx: 0 registers.esi: 0 registers.ecx: 557 exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b exception.symbol: hjiwws+0x96338 exception.instruction: div eax exception.module: hjiwws.exe exception.exception_code: 0xc0000094 exception.offset: 615224 exception.address: 0x496338	success
1619150075.572249 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 49807172 registers.edi: 0 registers.eax: 0 registers.ebp: 49807240 registers.edx: 54 registers.ebx: 0 registers.esi: 0 registers.ecx: 572 exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b exception.symbol: hjiwws+0x96338 exception.instruction: div eax exception.module: hjiwws.exe exception.exception_code: 0xc0000094 exception.offset: 615224 exception.address: 0x496338	success
1619150076.852999 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7528d4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a hjiwws+0xa23f8 @ 0x4a23f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x750e4b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x750e5d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xff4f147d	success
1619150077.525374 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34209604 registers.edi: 0 registers.eax: 0 registers.ebp: 34209672 registers.edx: 54 registers.ebx: 0 registers.esi: 0 registers.ecx: 510 exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b exception.symbol: hjiwws+0x96338 exception.instruction: div eax exception.module: hjiwws.exe exception.exception_code: 0xc0000094 exception.offset: 615224 exception.address: 0x496338	success
1619150079.588374 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34799428 registers.edi: 0 registers.eax: 0 registers.ebp: 34799496 registers.edx: 54 registers.ebx: 0 registers.esi: 0 registers.ecx: 588 exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b exception.symbol: hjiwws+0x96338 exception.instruction: div eax exception.module: hjiwws.exe exception.exception_code: 0xc0000094 exception.offset: 615224 exception.address: 0x496338	success
1619150080.978626 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7528d4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a hjiwws+0xa23f8 @ 0x4a23f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75134b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75135d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xff46147d	success
1619150081.588124 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 35258180 registers.edi: 0 registers.eax: 0 registers.ebp: 35258248 registers.edx: 54 registers.ebx: 0 registers.esi: 0 registers.ecx: 557 exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b exception.symbol: hjiwws+0x96338 exception.instruction: div eax exception.module: hjiwws.exe exception.exception_code: 0xc0000094 exception.offset: 615224 exception.address: 0x496338	success
1619150083.524999 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 50003780 registers.edi: 0 registers.eax: 0 registers.ebp: 50003848 registers.edx: 54 registers.ebx: 0 registers.esi: 0 registers.ecx: 525 exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b exception.symbol: hjiwws+0x96338 exception.instruction: div eax exception.module: hjiwws.exe exception.exception_code: 0xc0000094 exception.offset: 615224 exception.address: 0x496338	success
1619150085.525374 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7528d4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a hjiwws+0xa23f8 @ 0x4a23f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x750e4b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x750e5d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfdbe147d	success
1619150085.713876 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 48693060 registers.edi: 0 registers.eax: 0 registers.ebp: 48693128 registers.edx: 54 registers.ebx: 0 registers.esi: 0 registers.ecx: 713 exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b exception.symbol: hjiwws+0x96338 exception.instruction: div eax exception.module: hjiwws.exe exception.exception_code: 0xc0000094 exception.offset: 615224 exception.address: 0x496338	success
1619150089.149999 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 49741636 registers.edi: 0 registers.eax: 0 registers.ebp: 49741704 registers.edx: 54 registers.ebx: 0 registers.esi: 0 registers.ecx: 103 exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b exception.symbol: hjiwws+0x96338 exception.instruction: div eax exception.module: hjiwws.exe exception.exception_code: 0xc0000094 exception.offset: 615224 exception.address: 0x496338	success
1619150090.493999 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7528d4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a hjiwws+0xa23f8 @ 0x4a23f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x750e4b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x750e5d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfdaf147d	success
1619150091.260626 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 50265924 registers.edi: 0 registers.eax: 0 registers.ebp: 50265992 registers.edx: 54 registers.ebx: 0 registers.esi: 0 registers.ecx: 260 exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b exception.symbol: hjiwws+0x96338 exception.instruction: div eax exception.module: hjiwws.exe exception.exception_code: 0xc0000094 exception.offset: 615224 exception.address: 0x496338	success
1619150095.182876 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 35520324 registers.edi: 0 registers.eax: 0 registers.ebp: 35520392 registers.edx: 54 registers.ebx: 0 registers.esi: 0 registers.ecx: 166 exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b exception.symbol: hjiwws+0x96338 exception.instruction: div eax exception.module: hjiwws.exe exception.exception_code: 0xc0000094 exception.offset: 615224 exception.address: 0x496338	success

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 316 个事件)

Time & API	Arguments	Status
1619134513.721081 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00600000	success
1619134514.128081 NtProtectVirtualMemory	process_identifier: 2248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 28672 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00496000	success
1619134514.143081 NtAllocateVirtualMemory	process_identifier: 2248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01df0000	success
1619150028.791876 NtAllocateVirtualMemory	process_identifier: 580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00370000	success
1619150028.838876 NtProtectVirtualMemory	process_identifier: 580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 28672 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00496000	success
1619150028.838876 NtAllocateVirtualMemory	process_identifier: 580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00900000	success
1619150029.807876 NtProtectVirtualMemory	process_identifier: 3156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1619150029.978876 NtAllocateVirtualMemory	process_identifier: 3156 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02050000	success
1619150029.978876 NtAllocateVirtualMemory	process_identifier: 3156 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02120000	success
1619150030.025876 NtAllocateVirtualMemory	process_identifier: 3156 region_size: 630784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01f70000	success
1619150030.025876 NtProtectVirtualMemory	process_identifier: 3156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 602112 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f72000	success
1619150030.822876 NtProtectVirtualMemory	process_identifier: 3156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f62000	success
1619150030.822876 NtProtectVirtualMemory	process_identifier: 3156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619150030.822876 NtProtectVirtualMemory	process_identifier: 3156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f62000	success
1619150030.822876 NtProtectVirtualMemory	process_identifier: 3156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619150030.822876 NtProtectVirtualMemory	process_identifier: 3156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f62000	success
1619150030.822876 NtProtectVirtualMemory	process_identifier: 3156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619150030.822876 NtProtectVirtualMemory	process_identifier: 3156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f62000	success
1619150030.822876 NtProtectVirtualMemory	process_identifier: 3156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619150030.822876 NtProtectVirtualMemory	process_identifier: 3156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f62000	success
1619150030.822876 NtProtectVirtualMemory	process_identifier: 3156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1619150030.822876 NtProtectVirtualMemory	process_identifier: 3156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f62000	success
1619150030.822876 NtProtectVirtualMemory	process_identifier: 3156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619150030.822876 NtProtectVirtualMemory	process_identifier: 3156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f62000	success
1619150030.822876 NtProtectVirtualMemory	process_identifier: 3156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619150030.822876 NtProtectVirtualMemory	process_identifier: 3156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f62000	success
1619150030.822876 NtProtectVirtualMemory	process_identifier: 3156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619150030.822876 NtProtectVirtualMemory	process_identifier: 3156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f62000	success
1619150030.822876 NtProtectVirtualMemory	process_identifier: 3156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619150030.822876 NtProtectVirtualMemory	process_identifier: 3156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f62000	success
1619150030.822876 NtProtectVirtualMemory	process_identifier: 3156 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619150030.057876 NtAllocateVirtualMemory	process_identifier: 3236 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00600000	success
1619150030.135876 NtProtectVirtualMemory	process_identifier: 3236 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 28672 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00496000	success
1619150030.135876 NtAllocateVirtualMemory	process_identifier: 3236 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01f00000	success
1619150038.791876 NtAllocateVirtualMemory	process_identifier: 3388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f0000	success
1619150038.885876 NtProtectVirtualMemory	process_identifier: 3388 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 28672 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00496000	success
1619150038.900876 NtAllocateVirtualMemory	process_identifier: 3388 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x02e90000	success
1619150040.635249 NtProtectVirtualMemory	process_identifier: 3464 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1619150040.666249 NtAllocateVirtualMemory	process_identifier: 3464 region_size: 1376256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x007b0000	success
1619150040.666249 NtAllocateVirtualMemory	process_identifier: 3464 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x008c0000	success
1619150040.666249 NtAllocateVirtualMemory	process_identifier: 3464 region_size: 630784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x007b0000	success
1619150040.666249 NtProtectVirtualMemory	process_identifier: 3464 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 602112 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x007b2000	success
1619150041.135249 NtProtectVirtualMemory	process_identifier: 3464 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x021e2000	success
1619150041.135249 NtProtectVirtualMemory	process_identifier: 3464 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619150041.135249 NtProtectVirtualMemory	process_identifier: 3464 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x021e2000	success
1619150041.135249 NtProtectVirtualMemory	process_identifier: 3464 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619150041.135249 NtProtectVirtualMemory	process_identifier: 3464 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x021e2000	success
1619150041.135249 NtProtectVirtualMemory	process_identifier: 3464 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619150041.135249 NtProtectVirtualMemory	process_identifier: 3464 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x021e2000	success
1619150041.135249 NtProtectVirtualMemory	process_identifier: 3464 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success

Creates executable files on the filesystem (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.vbs

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (35 个事件)

Time & API	Arguments	Status	Return
1619150028.838876 Process32NextW	process_name: conhost.exe snapshot_handle: 0x00000100 process_identifier: 392	success	1
1619150028.853876 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 3116	success	1
1619150030.244876 Process32NextW	process_name: hjiwws.exe snapshot_handle: 0x00000100 process_identifier: 3156	success	1
1619150030.260876 Process32NextW	process_name: hjiwws.exe snapshot_handle: 0x00000100 process_identifier: 3236	success	1
1619150038.916876 Process32NextW	process_name: hjiwws.exe snapshot_handle: 0x00000100 process_identifier: 3388	success	1
1619150038.916876 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 3448	success	1
1619150041.853626 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 3616	success	1
1619150045.682249 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 3704	success	1
1619150048.650626 Process32NextW	process_name: hjiwws.exe snapshot_handle: 0x00000104 process_identifier: 3788	success	1
1619150048.666626 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 3876	success	1
1619150052.791249 Process32NextW	process_name: hjiwws.exe snapshot_handle: 0x00000100 process_identifier: 3900	success	1
1619150055.697626 Process32NextW	process_name: hjiwws.exe snapshot_handle: 0x00000100 process_identifier: 3976	success	1
1619150055.697626 Process32NextW	process_name: hjiwws.exe snapshot_handle: 0x00000100 process_identifier: 4048	success	1
1619150055.697626 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 3088	success	1
1619150060.416626 Process32NextW	process_name: hjiwws.exe snapshot_handle: 0x00000100 process_identifier: 3224	success	1
1619150063.041626 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 3408	success	1
1619150069.509999 Process32NextW	process_name: hjiwws.exe snapshot_handle: 0x00000100 process_identifier: 1816	success	1
1619150069.509999 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 3392	success	1
1619150072.728626 Process32NextW	process_name: hjiwws.exe snapshot_handle: 0x00000100 process_identifier: 2960	success	1
1619150075.603249 Process32NextW	process_name: hjiwws.exe snapshot_handle: 0x00000100 process_identifier: 3784	success	1
1619150077.541374 Process32NextW	process_name: hjiwws.exe snapshot_handle: 0x00000100 process_identifier: 2496	success	1
1619150077.541374 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 4020	success	1
1619150079.650374 Process32NextW	process_name: hjiwws.exe snapshot_handle: 0x00000100 process_identifier: 4044	success	1
1619150081.588124 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 3160	success	1
1619150083.540999 Process32NextW	process_name: hjiwws.exe snapshot_handle: 0x00000100 process_identifier: 3420	success	1
1619150085.728876 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 708	success	1
1619150088.244876 Process32NextW	process_name: mscorsvw.exe snapshot_handle: 0x00000144 process_identifier: 3748	success	1
1619150089.212999 Process32NextW	process_name: hjiwws.exe snapshot_handle: 0x00000100 process_identifier: 2796	success	1
1619150089.212999 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 3824	success	1
1619150091.416626 Process32NextW	process_name: hjiwws.exe snapshot_handle: 0x00000100 process_identifier: 3944	success	1
1619150091.416626 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 3892	success	1
1619150093.447626 Process32NextW	process_name: GoogleUpdate.exe snapshot_handle: 0x00000118 process_identifier: 1688	success	1
1619150093.510626 Process32NextW	process_name: sppsvc.exe snapshot_handle: 0x00000118 process_identifier: 920	success	1
1619150095.275876 Process32NextW	process_name: GoogleCrashHandler64.exe snapshot_handle: 0x00000100 process_identifier: 2184	success	1
1619150095.275876 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 300	success	1

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.4126063770166315

section

{'size_of_data': '0x00078600', 'virtual_address': '0x000b1000', 'entropy': 7.4126063770166315, 'name': '.rsrc', 'virtual_size': '0x00078518'}

description

A section with a high entropy has been found

entropy

0.41295025728987994

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 个事件)

process

hjiwws.exe

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (32 个事件)

Time & API	Arguments	Status
1619134514.143081 Process32NextW	process_name: 05d706b427d5bf71f40f80891ae615b1.exe snapshot_handle: 0x00000100 process_identifier: 2248	failed
1619150028.853876 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 3116	failed
1619150030.275876 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 3300	failed
1619150038.385876 Process32NextW	process_name: hjiwws.exe snapshot_handle: 0x00000190 process_identifier: 3236	failed
1619150038.916876 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 3448	failed
1619150041.853626 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 3616	failed
1619150045.166626 Process32NextW	process_name: hjiwws.exe snapshot_handle: 0x00000140 process_identifier: 3528	failed
1619150045.682249 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 3704	failed
1619150048.666626 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 3876	failed
1619150051.463626 Process32NextW	process_name: hjiwws.exe snapshot_handle: 0x00000148 process_identifier: 3788	failed
1619150052.791249 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 3952	failed
1619150055.697626 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 2852	failed
1619150059.072626 Process32NextW	process_name: hjiwws.exe snapshot_handle: 0x0000014c process_identifier: 4048	failed
1619150060.416626 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 392	failed
1619150063.041626 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 3408	failed
1619150067.713626 Process32NextW	process_name: hjiwws.exe snapshot_handle: 0x0000018c process_identifier: 1272	failed
1619150069.509999 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 3392	failed
1619150072.728626 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 3764	failed
1619150074.869626 Process32NextW	process_name: hjiwws.exe snapshot_handle: 0x00000138 process_identifier: 2960	failed
1619150075.603249 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 3864	failed
1619150077.541374 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 4020	failed
1619150078.916374 Process32NextW	process_name: hjiwws.exe snapshot_handle: 0x00000120 process_identifier: 3940	failed
1619150079.650374 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 1464	failed
1619150081.603124 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000104 process_identifier: 3232	failed
1619150082.682124 Process32NextW	process_name: hjiwws.exe snapshot_handle: 0x00000124 process_identifier: 1060	failed
1619150083.540999 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 1760	failed
1619150085.728876 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 708	failed
1619150088.244876 Process32NextW	process_name: mscorsvw.exe snapshot_handle: 0x00000144 process_identifier: 3748	failed
1619150089.227999 Process32NextW	process_name: mscorsvw.exe snapshot_handle: 0x00000100 process_identifier: 3852	failed
1619150091.416626 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 3892	failed
1619150093.510626 Process32NextW	process_name: sppsvc.exe snapshot_handle: 0x00000118 process_identifier: 920	failed
1619150095.275876 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000100 process_identifier: 300	failed

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Creates an Alternate Data Stream (ADS) (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe:ZoneIdentifier

Allocates execute permission to another process indicative of possible code injection (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619134514.737081 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000108 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x000b0000	success	0	0

Installs itself for autorun at Windows startup (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.vbs

Deletes executed files from disk (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe

Creates a thread using NtQueueApcThread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2248 created a thread in remote process 2996
1619134514.737081 NtQueueApcThread	thread_handle: 0x00000110 process_identifier: 2996 function_address: 0x000b05c0 parameter: 0x000c0000	success	0	0

Potential code injection by writing to the memory of another process (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619134514.737081 WriteProcessMemory	process_identifier: 2996 buffer: Q¹0d@@@$$YÃVWR¾§ÆgNèYøv· ¿Zwf;Ït ¿Ntf;ÏuÂèÀtÎÁáþÁïÏ¾:Ï3ñBHué_Æ^ÃUìQQMSVWÉt;¸MZf9u1A<Át*8PEu"@xeüÁxX$p @ùÙñEøÀu 3À_^[ÉÃMEüÑèOÿÿÿ;Et ÿEüEü;Eøràë×Eü·CEëÊUìQSW3ÿWWjWjh@ÿuÿVØûÿu3Àë&WWWS}üÿV0W}EüPWÿuSÿVSÿV3À9}üÀ_[ÉÃÉtèÀt3ÉfÃUììVðäüÿÿP3ÀPPjPÿVlÀj\XfEü3Àj.fEþXjvfEðXfEòjbXfEôjsXfEö3ÀfEøUüäüÿÿèÖUèÎUðèÆÿuìþÿÿÿuPÿVxÄäüÿÿPÿVìþÿÿPèÂ@PìþÿÿPäüÿÿPèîþÿÿÄ^ÉÃUìì,j:XjZfEÜXjofEÞXjnfEàXjefEâXjIfEäXjdfEæXjefEèXjnfEêXjtfEìXjifEîXjffEðXjifEòXfEôjeXfEöjrXfEø3ÀfEúÔýÿÿè¬UÜè÷EÿPÆEÿèPEÿPÔýÿÿPè?þÿÿÄÉÃUìQeüVðEüPÿuèþYYÀt}ütÿuüPÿuèþÿÿÄÀt3À@ë3À^ÉÃUììSVðÏøýÿÿè'Èè(þÿÿ3ÛSøýÿÿPÿVWÿV8]uWÿuÆè~ÿÿÿYYØë }u5SWÿuÿWÿV(3ÛøÿÏÃèªþÿÿûu9]uWÿV(ÈPWÿV,3À@ë3À^[ÉÃUììSVWèsüÿÿøÿ"h"¿WèÌüÿÿØYYÛjh0hjÿÓðöñh¼Û«½W~`^@èüÿÿhÒ¼WF$èüÿÿh\|QgjWF(èyüÿÿhëIWF,èküÿÿhå©WF0è]üÿÿh¥°(WF4èOüÿÿh)·WF8èAüÿÿh[uðWFDè3üÿÿÄ@ØhdóuW^ è üÿÿh¢¦aëWFèüÿÿhÕOd"WFèüÿÿhy.ÃWFèöûÿÿh±÷WFèèûÿÿheóW÷WFèÚûÿÿh¯4PWFèÌûÿÿh{=#WF<è¾ûÿÿÄ@hOû~ WFèûÿÿhà=!6WFHèûÿÿhh#WèûÿÿFLhÍeWèûÿÿhÓ1ÆVWFPèvûÿÿh7½WFTèhûÿÿh£-ãWFXèZûÿÿF\Ä8EðPÇEðshelÇEôl32ÿÓøÿt"hÀåz°W~dè,ûÿÿhêêºWFlèûÿÿÄFpEøPÇEøuserfÇEü32ÆEþÿV øÿtAhqV°0W~hèìúÿÿhkV°0WFxèÞúÿÿh&cjWFtèÐúÿÿh<cjWF\|èÂúÿÿÄ Æë3À_^[ÉÃUìì\VuW3ÿ;÷îSè¤ýÿÿØ;ßuWÿDéÕEüPëj2ÿSPÿuüWWÿSLÀuïjdÿSPFEøE9>tYÿ¶¶QP¾Ãè¾üÿÿ}3ÿÄ9>t1jDE¤WPèjEèWPèüÄEèPE¤PWWj WWWWÿuÿS$9¾(tlP,PÿuÃè½úÿÿÄ9¾tëj2ÿSPÿuüWWÿSLÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂUììSW3ÿWWjWjhÿu}øÿVØûÿu3Àë>WSÿVEô;Çt+jh0PWÿV@Eø;ÇtWMüQÿuô}üPSÿVEüMSÿVEø_[ÉÃ·ffÒtVð+ñÁ·ffÒuñ^ÃUìQQEEüEüEEøEü;EøtEüMEü@EüëçEÉÃf8Vðt Æf>u÷+ò· fÂfÉuñ^ÃD$@Éuù+D$HÃÉu3ÀÃf9Át Àf8u÷+ÁÑøÃÉt èÚÿÿÿÀtDAþë fù\t è·fÉuï3ÀÃ process_handle: 0x00000108 base_address: 0x000b0000	success	1	0
1619134514.737081 WriteProcessMemory	process_identifier: 2996 buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\05d706b427d5bf71f40f80891ae615b1.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\05d706b427d5bf71f40f80891ae615b1.exe" winset prusazE = CREAteobjeCt("wscRipt.shELL") PRUSaZE.RuN """%ls""", 0, False process_handle: 0x00000108 base_address: 0x000c0000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (20 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 580 called NtSetContextThread to modify thread in remote process 3156
Process injection	Process 3388 called NtSetContextThread to modify thread in remote process 3464
Process injection	Process 3644 called NtSetContextThread to modify thread in remote process 3720
Process injection	Process 3900 called NtSetContextThread to modify thread in remote process 3976
Process injection	Process 3224 called NtSetContextThread to modify thread in remote process 1888
Process injection	Process 1816 called NtSetContextThread to modify thread in remote process 3600
Process injection	Process 3784 called NtSetContextThread to modify thread in remote process 2496
Process injection	Process 4044 called NtSetContextThread to modify thread in remote process 884
Process injection	Process 3420 called NtSetContextThread to modify thread in remote process 1752
Process injection	Process 2796 called NtSetContextThread to modify thread in remote process 3944
1619150029.150876 NtSetContextThread	thread_handle: 0x00000110 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5508096 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3156	success	0	0
1619150039.353876 NtSetContextThread	thread_handle: 0x00000110 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5508096 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3464	success	0	0
1619150046.088249 NtSetContextThread	thread_handle: 0x00000110 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5508096 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3720	success	0	0
1619150054.244249 NtSetContextThread	thread_handle: 0x00000110 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5508096 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3976	success	0	0
1619150060.916626 NtSetContextThread	thread_handle: 0x00000110 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5508096 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1888	success	0	0
1619150071.165999 NtSetContextThread	thread_handle: 0x00000110 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5508096 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3600	success	0	0
1619150075.791249 NtSetContextThread	thread_handle: 0x00000110 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5508096 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2496	success	0	0
1619150079.885374 NtSetContextThread	thread_handle: 0x00000110 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5508096 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 884	success	0	0
1619150084.477999 NtSetContextThread	thread_handle: 0x00000110 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5508096 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1752	success	0	0
1619150089.837999 NtSetContextThread	thread_handle: 0x00000110 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5508096 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3944	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (20 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 580 resumed a thread in remote process 3156
Process injection	Process 3388 resumed a thread in remote process 3464
Process injection	Process 3644 resumed a thread in remote process 3720
Process injection	Process 3900 resumed a thread in remote process 3976
Process injection	Process 3224 resumed a thread in remote process 1888
Process injection	Process 1816 resumed a thread in remote process 3600
Process injection	Process 3784 resumed a thread in remote process 2496
Process injection	Process 4044 resumed a thread in remote process 884
Process injection	Process 3420 resumed a thread in remote process 1752
Process injection	Process 2796 resumed a thread in remote process 3944
1619150029.619876 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 3156	success	0	0
1619150040.166876 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 3464	success	0	0
1619150047.338249 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 3720	success	0	0
1619150054.963249 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 3976	success	0	0
1619150062.260626 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 1888	success	0	0
1619150071.884999 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 3600	success	0	0
1619150076.432249 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 2496	success	0	0
1619150080.385374 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 884	success	0	0
1619150085.149999 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 1752	success	0	0
1619150090.134999 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 3944	success	0	0

Executed a process and injected code into it, probably while unpacking (50 out of 86 个事件)

Time & API	Arguments	Status	Return
1619134514.737081 CreateProcessInternalW	thread_identifier: 2308 thread_handle: 0x00000110 process_identifier: 2996 current_directory: filepath: C:\Windows\System32\notepad.exe track: 1 command_line: filepath_r: C:\Windows\system32\notepad.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000108 inherit_handles: 0	success	1
1619134514.737081 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000108 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x000b0000	success	0
1619134514.737081 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000108 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x000c0000	success	0
1619134514.737081 WriteProcessMemory	process_identifier: 2996 buffer: Q¹0d@@@$$YÃVWR¾§ÆgNèYøv· ¿Zwf;Ït ¿Ntf;ÏuÂèÀtÎÁáþÁïÏ¾:Ï3ñBHué_Æ^ÃUìQQMSVWÉt;¸MZf9u1A<Át*8PEu"@xeüÁxX$p @ùÙñEøÀu 3À_^[ÉÃMEüÑèOÿÿÿ;Et ÿEüEü;Eøràë×Eü·CEëÊUìQSW3ÿWWjWjh@ÿuÿVØûÿu3Àë&WWWS}üÿV0W}EüPWÿuSÿVSÿV3À9}üÀ_[ÉÃÉtèÀt3ÉfÃUììVðäüÿÿP3ÀPPjPÿVlÀj\XfEü3Àj.fEþXjvfEðXfEòjbXfEôjsXfEö3ÀfEøUüäüÿÿèÖUèÎUðèÆÿuìþÿÿÿuPÿVxÄäüÿÿPÿVìþÿÿPèÂ@PìþÿÿPäüÿÿPèîþÿÿÄ^ÉÃUìì,j:XjZfEÜXjofEÞXjnfEàXjefEâXjIfEäXjdfEæXjefEèXjnfEêXjtfEìXjifEîXjffEðXjifEòXfEôjeXfEöjrXfEø3ÀfEúÔýÿÿè¬UÜè÷EÿPÆEÿèPEÿPÔýÿÿPè?þÿÿÄÉÃUìQeüVðEüPÿuèþYYÀt}ütÿuüPÿuèþÿÿÄÀt3À@ë3À^ÉÃUììSVðÏøýÿÿè'Èè(þÿÿ3ÛSøýÿÿPÿVWÿV8]uWÿuÆè~ÿÿÿYYØë }u5SWÿuÿWÿV(3ÛøÿÏÃèªþÿÿûu9]uWÿV(ÈPWÿV,3À@ë3À^[ÉÃUììSVWèsüÿÿøÿ"h"¿WèÌüÿÿØYYÛjh0hjÿÓðöñh¼Û«½W~`^@èüÿÿhÒ¼WF$èüÿÿh\|QgjWF(èyüÿÿhëIWF,èküÿÿhå©WF0è]üÿÿh¥°(WF4èOüÿÿh)·WF8èAüÿÿh[uðWFDè3üÿÿÄ@ØhdóuW^ è üÿÿh¢¦aëWFèüÿÿhÕOd"WFèüÿÿhy.ÃWFèöûÿÿh±÷WFèèûÿÿheóW÷WFèÚûÿÿh¯4PWFèÌûÿÿh{=#WF<è¾ûÿÿÄ@hOû~ WFèûÿÿhà=!6WFHèûÿÿhh#WèûÿÿFLhÍeWèûÿÿhÓ1ÆVWFPèvûÿÿh7½WFTèhûÿÿh£-ãWFXèZûÿÿF\Ä8EðPÇEðshelÇEôl32ÿÓøÿt"hÀåz°W~dè,ûÿÿhêêºWFlèûÿÿÄFpEøPÇEøuserfÇEü32ÆEþÿV øÿtAhqV°0W~hèìúÿÿhkV°0WFxèÞúÿÿh&cjWFtèÐúÿÿh<cjWF\|èÂúÿÿÄ Æë3À_^[ÉÃUìì\VuW3ÿ;÷îSè¤ýÿÿØ;ßuWÿDéÕEüPëj2ÿSPÿuüWWÿSLÀuïjdÿSPFEøE9>tYÿ¶¶QP¾Ãè¾üÿÿ}3ÿÄ9>t1jDE¤WPèjEèWPèüÄEèPE¤PWWj WWWWÿuÿS$9¾(tlP,PÿuÃè½úÿÿÄ9¾tëj2ÿSPÿuüWWÿSLÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂUììSW3ÿWWjWjhÿu}øÿVØûÿu3Àë>WSÿVEô;Çt+jh0PWÿV@Eø;ÇtWMüQÿuô}üPSÿVEüMSÿVEø_[ÉÃ·ffÒtVð+ñÁ·ffÒuñ^ÃUìQQEEüEüEEøEü;EøtEüMEü@EüëçEÉÃf8Vðt Æf>u÷+ò· fÂfÉuñ^ÃD$@Éuù+D$HÃÉu3ÀÃf9Át Àf8u÷+ÁÑøÃÉt èÚÿÿÿÀtDAþë fù\t è·fÉuï3ÀÃ process_handle: 0x00000108 base_address: 0x000b0000	success	1
1619134514.737081 WriteProcessMemory	process_identifier: 2996 buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\05d706b427d5bf71f40f80891ae615b1.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\05d706b427d5bf71f40f80891ae615b1.exe" winset prusazE = CREAteobjeCt("wscRipt.shELL") PRUSaZE.RuN """%ls""", 0, False process_handle: 0x00000108 base_address: 0x000c0000	success	1
1619150028.510876 CreateProcessInternalW	thread_identifier: 2228 thread_handle: 0x000000d0 process_identifier: 580 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x000000cc inherit_handles: 0	success	1
1619150029.072876 CreateProcessInternalW	thread_identifier: 3160 thread_handle: 0x00000110 process_identifier: 3156 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000108 inherit_handles: 0	success	1
1619150029.072876 NtUnmapViewOfSection	process_identifier: 3156 region_size: 4096 process_handle: 0x00000108 base_address: 0x00400000	success	0
1619150029.072876 NtMapViewOfSection	section_handle: 0x00000118 process_identifier: 3156 commit_size: 1318912 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000108 allocation_type: 0 () section_offset: 0 view_size: 1318912 base_address: 0x00400000	success	0
1619150029.150876 NtGetContextThread	thread_handle: 0x00000110	success	0
1619150029.150876 NtSetContextThread	thread_handle: 0x00000110 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5508096 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3156	success	0
1619150029.619876 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 3156	success	0
1619150029.791876 CreateProcessInternalW	thread_identifier: 3240 thread_handle: 0x00000114 process_identifier: 3236 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe" 2 3156 7289812 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000124 inherit_handles: 0	success	1
1619150038.525876 CreateProcessInternalW	thread_identifier: 3392 thread_handle: 0x00000194 process_identifier: 3388 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000198 inherit_handles: 0	success	1
1619150039.307876 CreateProcessInternalW	thread_identifier: 3468 thread_handle: 0x00000110 process_identifier: 3464 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000108 inherit_handles: 0	success	1
1619150039.307876 NtUnmapViewOfSection	process_identifier: 3464 region_size: 4096 process_handle: 0x00000108 base_address: 0x00400000	success	0
1619150039.322876 NtMapViewOfSection	section_handle: 0x00000118 process_identifier: 3464 commit_size: 1318912 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000108 allocation_type: 0 () section_offset: 0 view_size: 1318912 base_address: 0x00400000	success	0
1619150039.353876 NtGetContextThread	thread_handle: 0x00000110	success	0
1619150039.353876 NtSetContextThread	thread_handle: 0x00000110 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5508096 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3464	success	0
1619150040.166876 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 3464	success	0
1619150041.213876 CreateProcessInternalW	thread_identifier: 3532 thread_handle: 0x00000114 process_identifier: 3528 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe" 2 3464 7300359 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000124 inherit_handles: 0	success	1
1619150045.260626 CreateProcessInternalW	thread_identifier: 3648 thread_handle: 0x00000144 process_identifier: 3644 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000148 inherit_handles: 0	success	1
1619150046.010249 CreateProcessInternalW	thread_identifier: 3724 thread_handle: 0x00000110 process_identifier: 3720 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000108 inherit_handles: 0	success	1
1619150046.010249 NtUnmapViewOfSection	process_identifier: 3720 region_size: 4096 process_handle: 0x00000108 base_address: 0x00400000	success	0
1619150046.041249 NtMapViewOfSection	section_handle: 0x00000118 process_identifier: 3720 commit_size: 1318912 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000108 allocation_type: 0 () section_offset: 0 view_size: 1318912 base_address: 0x00400000	success	0
1619150046.088249 NtGetContextThread	thread_handle: 0x00000110	success	0
1619150046.088249 NtSetContextThread	thread_handle: 0x00000110 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5508096 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3720	success	0
1619150047.338249 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 3720	success	0
1619150048.182249 CreateProcessInternalW	thread_identifier: 3792 thread_handle: 0x00000114 process_identifier: 3788 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe" 2 3720 7307531 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000124 inherit_handles: 0	success	1
1619150052.088626 CreateProcessInternalW	thread_identifier: 3904 thread_handle: 0x0000014c process_identifier: 3900 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000150 inherit_handles: 0	success	1
1619150054.135249 CreateProcessInternalW	thread_identifier: 3980 thread_handle: 0x00000110 process_identifier: 3976 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000108 inherit_handles: 0	success	1
1619150054.135249 NtUnmapViewOfSection	process_identifier: 3976 region_size: 4096 process_handle: 0x00000108 base_address: 0x00400000	success	0
1619150054.150249 NtMapViewOfSection	section_handle: 0x00000118 process_identifier: 3976 commit_size: 1318912 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000108 allocation_type: 0 () section_offset: 0 view_size: 1318912 base_address: 0x00400000	success	0
1619150054.244249 NtGetContextThread	thread_handle: 0x00000110	success	0
1619150054.244249 NtSetContextThread	thread_handle: 0x00000110 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5508096 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3976	success	0
1619150054.963249 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 3976	success	0
1619150055.057249 CreateProcessInternalW	thread_identifier: 4052 thread_handle: 0x00000114 process_identifier: 4048 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe" 2 3976 7315156 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000124 inherit_handles: 0	success	1
1619150059.478626 CreateProcessInternalW	thread_identifier: 3232 thread_handle: 0x00000150 process_identifier: 3224 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000154 inherit_handles: 0	success	1
1619150060.666626 CreateProcessInternalW	thread_identifier: 1940 thread_handle: 0x00000110 process_identifier: 1888 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000108 inherit_handles: 0	success	1
1619150060.666626 NtUnmapViewOfSection	process_identifier: 1888 region_size: 4096 process_handle: 0x00000108 base_address: 0x00400000	success	0
1619150060.682626 NtMapViewOfSection	section_handle: 0x00000118 process_identifier: 1888 commit_size: 1318912 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000108 allocation_type: 0 () section_offset: 0 view_size: 1318912 base_address: 0x00400000	success	0
1619150060.916626 NtGetContextThread	thread_handle: 0x00000110	success	0
1619150060.916626 NtSetContextThread	thread_handle: 0x00000110 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5508096 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1888	success	0
1619150062.260626 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 1888	success	0
1619150062.307626 CreateProcessInternalW	thread_identifier: 2296 thread_handle: 0x00000114 process_identifier: 1272 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe" 2 1888 7322453 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000124 inherit_handles: 0	success	1
1619150068.135626 CreateProcessInternalW	thread_identifier: 3500 thread_handle: 0x00000190 process_identifier: 1816 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000194 inherit_handles: 0	success	1
1619150070.727999 CreateProcessInternalW	thread_identifier: 3596 thread_handle: 0x00000110 process_identifier: 3600 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000108 inherit_handles: 0	success	1
1619150070.727999 NtUnmapViewOfSection	process_identifier: 3600 region_size: 4096 process_handle: 0x00000108 base_address: 0x00400000	success	0
1619150070.743999 NtMapViewOfSection	section_handle: 0x00000118 process_identifier: 3600 commit_size: 1318912 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000108 allocation_type: 0 () section_offset: 0 view_size: 1318912 base_address: 0x00400000	success	0
1619150071.165999 NtGetContextThread	thread_handle: 0x00000110	success	0

File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.FareitIH.S15127631
Qihoo-360	Win32/Trojan.469
McAfee	Fareit-FVZ!05D706B427D5
Cylance	Unsafe
Zillya	Trojan.Kryptik.Win32.2153857
K7AntiVirus	Trojan ( 0056a36b1 )
Alibaba	Trojan:Win32/DelfInject.ali2000015
K7GW	Trojan ( 0056a36b1 )
CrowdStrike	win/malicious_confidence_90% (W)
Invincea	heuristic
Cyren	W32/Injector.OEGP-4909
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win32/Injector.EMOP
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Dropper.AgentTesla-8985766-1
Kaspersky	HEUR:Trojan.Win32.Kryptik.gen
BitDefender	Trojan.Delf.FareIt.Gen.7
NANO-Antivirus	Trojan.Win32.Kryptik.hnsacj
MicroWorld-eScan	Trojan.Delf.FareIt.Gen.7
Avast	Win32:MalwareX-gen [Trj]
Ad-Aware	Trojan.Delf.FareIt.Gen.7
Comodo	Malware@#1h9fupxwl24i2
F-Secure	Trojan.TR/Injector.grpgp
DrWeb	Trojan.PWS.Stealer.28810
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TSPY_HPLOKI.SMBD
FireEye	Generic.mg.05d706b427d5bf71
Sophos	Mal/Generic-S
SentinelOne	DFI - Suspicious PE
GData	Trojan.Delf.FareIt.Gen.7
Jiangmin	Trojan.Kryptik.bus
Webroot	W32.Trojan.Delf.Fareit.Gen
Avira	TR/Injector.grpgp
Antiy-AVL	Trojan/Win32.Kryptik
Arcabit	Trojan.Delf.FareIt.Gen.7
AegisLab	Trojan.Win32.Kryptik.4!c
ZoneAlarm	HEUR:Trojan.Win32.Kryptik.gen
Microsoft	PWS:Win32/Fareit.AQ!MTB
AhnLab-V3	Suspicious/Win.Delphiless.X2091
VBA32	TScope.Trojan.Delf
ALYac	Trojan.Delf.FareIt.Gen.7
MAX	malware (ai score=89)
Malwarebytes	Trojan.MalPack.DLF
Zoner	Trojan.Win32.91516
TrendMicro-HouseCall	TSPY_HPLOKI.SMBD
Rising	Trojan.Injector!1.C99D (CLASSIC)

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x4a0168 DeleteCriticalSection

• 0x4a016c LeaveCriticalSection

• 0x4a0170 EnterCriticalSection

• 0x4a0174 InitializeCriticalSection

• 0x4a0178 VirtualFree

• 0x4a017c VirtualAlloc

• 0x4a0180 LocalFree

• 0x4a0184 LocalAlloc

• 0x4a0188 GetVersion

• 0x4a018c GetCurrentThreadId

• 0x4a0190 InterlockedDecrement

• 0x4a0194 InterlockedIncrement

• 0x4a0198 VirtualQuery

• 0x4a019c WideCharToMultiByte

• 0x4a01a0 MultiByteToWideChar

• 0x4a01a4 lstrlenA

• 0x4a01a8 lstrcpynA

• 0x4a01ac LoadLibraryExA

• 0x4a01b0 GetThreadLocale

• 0x4a01b4 GetStartupInfoA

• 0x4a01b8 GetProcAddress

• 0x4a01bc GetModuleHandleA

• 0x4a01c0 GetModuleFileNameA

• 0x4a01c4 GetLocaleInfoA

• 0x4a01c8 GetCommandLineA

• 0x4a01cc FreeLibrary

• 0x4a01d0 FindFirstFileA

• 0x4a01d4 FindClose

• 0x4a01d8 ExitProcess

• 0x4a01dc WriteFile

• 0x4a01e0 UnhandledExceptionFilter

• 0x4a01e4 RtlUnwind

• 0x4a01e8 RaiseException

• 0x4a01ec GetStdHandle

Library user32.dll:

• 0x4a01f4 GetKeyboardType

• 0x4a01f8 LoadStringA

• 0x4a01fc MessageBoxA

• 0x4a0200 CharNextA

Library advapi32.dll:

• 0x4a0208 RegQueryValueExA

• 0x4a020c RegOpenKeyExA

• 0x4a0210 RegCloseKey

Library oleaut32.dll:

• 0x4a0218 SysFreeString

• 0x4a021c SysReAllocStringLen

• 0x4a0220 SysAllocStringLen

Library kernel32.dll:

• 0x4a0228 TlsSetValue

• 0x4a022c TlsGetValue

• 0x4a0230 LocalAlloc

• 0x4a0234 GetModuleHandleA

Library advapi32.dll:

• 0x4a023c RegQueryValueExA

• 0x4a0240 RegOpenKeyExA

• 0x4a0244 RegCloseKey

Library kernel32.dll:

• 0x4a024c lstrcpyA

• 0x4a0250 WriteFile

• 0x4a0254 WideCharToMultiByte

• 0x4a0258 WaitForSingleObject

• 0x4a025c VirtualQuery

• 0x4a0260 VirtualProtectEx

• 0x4a0264 VirtualAlloc

• 0x4a0268 Sleep

• 0x4a026c SizeofResource

• 0x4a0270 SetThreadLocale

• 0x4a0274 SetFilePointer

• 0x4a0278 SetEvent

• 0x4a027c SetErrorMode

• 0x4a0280 SetEndOfFile

• 0x4a0284 ResetEvent

• 0x4a0288 ReadFile

• 0x4a028c MultiByteToWideChar

• 0x4a0290 MulDiv

• 0x4a0294 LockResource

• 0x4a0298 LoadResource

• 0x4a029c LoadLibraryA

• 0x4a02a0 LeaveCriticalSection

• 0x4a02a4 InitializeCriticalSection

• 0x4a02a8 GlobalUnlock

• 0x4a02ac GlobalReAlloc

• 0x4a02b0 GlobalHandle

• 0x4a02b4 GlobalLock

• 0x4a02b8 GlobalFree

• 0x4a02bc GlobalFindAtomA

• 0x4a02c0 GlobalDeleteAtom

• 0x4a02c4 GlobalAlloc

• 0x4a02c8 GlobalAddAtomA

• 0x4a02cc GetVersionExA

• 0x4a02d0 GetVersion

• 0x4a02d4 GetTickCount

• 0x4a02d8 GetThreadLocale

• 0x4a02dc GetSystemInfo

• 0x4a02e0 GetStringTypeExA

• 0x4a02e4 GetStdHandle

• 0x4a02e8 GetProcAddress

• 0x4a02ec GetModuleHandleA

• 0x4a02f0 GetModuleFileNameA

• 0x4a02f4 GetLocaleInfoA

• 0x4a02f8 GetLocalTime

• 0x4a02fc GetLastError

• 0x4a0300 GetFullPathNameA

• 0x4a0304 GetFileAttributesA

• 0x4a0308 GetDiskFreeSpaceA

• 0x4a030c GetDateFormatA

• 0x4a0310 GetCurrentThreadId

• 0x4a0314 GetCurrentProcessId

• 0x4a0318 GetCurrentProcess

• 0x4a031c GetCPInfo

• 0x4a0320 GetACP

• 0x4a0324 FreeResource

• 0x4a0328 InterlockedExchange

• 0x4a032c FreeLibrary

• 0x4a0330 FormatMessageA

• 0x4a0334 FindResourceA

• 0x4a0338 FindFirstFileA

• 0x4a033c FindClose

• 0x4a0340 FileTimeToLocalFileTime

• 0x4a0344 FileTimeToDosDateTime

• 0x4a0348 EnumCalendarInfoA

• 0x4a034c EnterCriticalSection

• 0x4a0350 DeleteCriticalSection

• 0x4a0354 CreateThread

• 0x4a0358 CreateFileA

• 0x4a035c CreateEventA

• 0x4a0360 CompareStringA

• 0x4a0364 CloseHandle

Library version.dll:

• 0x4a036c VerQueryValueA

• 0x4a0370 GetFileVersionInfoSizeA

• 0x4a0374 GetFileVersionInfoA

Library gdi32.dll:

• 0x4a037c UnrealizeObject

• 0x4a0380 StretchBlt

• 0x4a0384 SetWindowOrgEx

• 0x4a0388 SetWinMetaFileBits

• 0x4a038c SetViewportOrgEx

• 0x4a0390 SetTextColor

• 0x4a0394 SetStretchBltMode

• 0x4a0398 SetROP2

• 0x4a039c SetPixel

• 0x4a03a0 SetEnhMetaFileBits

• 0x4a03a4 SetDIBColorTable

• 0x4a03a8 SetBrushOrgEx

• 0x4a03ac SetBkMode

• 0x4a03b0 SetBkColor

• 0x4a03b4 SelectPalette

• 0x4a03b8 SelectObject

• 0x4a03bc SelectClipPath

• 0x4a03c0 SaveDC

• 0x4a03c4 RestoreDC

• 0x4a03c8 Rectangle

• 0x4a03cc RectVisible

• 0x4a03d0 RealizePalette

• 0x4a03d4 Polyline

• 0x4a03d8 PlayEnhMetaFile

• 0x4a03dc PatBlt

• 0x4a03e0 MoveToEx

• 0x4a03e4 MaskBlt

• 0x4a03e8 LineTo

• 0x4a03ec IntersectClipRect

• 0x4a03f0 GetWindowOrgEx

• 0x4a03f4 GetWinMetaFileBits

• 0x4a03f8 GetTextMetricsA

• 0x4a03fc GetTextExtentPoint32A

• 0x4a0400 GetSystemPaletteEntries

• 0x4a0404 GetStockObject

• 0x4a0408 GetPixel

• 0x4a040c GetPaletteEntries

• 0x4a0410 GetObjectA

• 0x4a0414 GetEnhMetaFilePaletteEntries

• 0x4a0418 GetEnhMetaFileHeader

• 0x4a041c GetEnhMetaFileBits

• 0x4a0420 GetDeviceCaps

• 0x4a0424 GetDIBits

• 0x4a0428 GetDIBColorTable

• 0x4a042c GetDCOrgEx

• 0x4a0430 GetCurrentPositionEx

• 0x4a0434 GetClipBox

• 0x4a0438 GetBrushOrgEx

• 0x4a043c GetBitmapBits

• 0x4a0440 ExcludeClipRect

• 0x4a0444 DeleteObject

• 0x4a0448 DeleteEnhMetaFile

• 0x4a044c DeleteDC

• 0x4a0450 CreateSolidBrush

• 0x4a0454 CreatePenIndirect

• 0x4a0458 CreatePen

• 0x4a045c CreatePalette

• 0x4a0460 CreateHalftonePalette

• 0x4a0464 CreateFontIndirectA

• 0x4a0468 CreateDIBitmap

• 0x4a046c CreateDIBSection

• 0x4a0470 CreateCompatibleDC

• 0x4a0474 CreateCompatibleBitmap

• 0x4a0478 CreateBrushIndirect

• 0x4a047c CreateBitmap

• 0x4a0480 CopyEnhMetaFileA

• 0x4a0484 BitBlt

Library user32.dll:

• 0x4a048c CreateWindowExA

• 0x4a0490 WindowFromPoint

• 0x4a0494 WinHelpA

• 0x4a0498 WaitMessage

• 0x4a049c ValidateRect

• 0x4a04a0 UpdateWindow

• 0x4a04a4 UnregisterClassA

• 0x4a04a8 UnhookWindowsHookEx

• 0x4a04ac TranslateMessage

• 0x4a04b0 TranslateMDISysAccel

• 0x4a04b4 TrackPopupMenu

• 0x4a04b8 SystemParametersInfoA

• 0x4a04bc ShowWindow

• 0x4a04c0 ShowScrollBar

• 0x4a04c4 ShowOwnedPopups

• 0x4a04c8 ShowCursor

• 0x4a04cc SetWindowsHookExA

• 0x4a04d0 SetWindowPos

• 0x4a04d4 SetWindowPlacement

• 0x4a04d8 SetWindowLongA

• 0x4a04dc SetTimer

• 0x4a04e0 SetScrollRange

• 0x4a04e4 SetScrollPos

• 0x4a04e8 SetScrollInfo

• 0x4a04ec SetRect

• 0x4a04f0 SetPropA

• 0x4a04f4 SetParent

• 0x4a04f8 SetMenuItemInfoA

• 0x4a04fc SetMenu

• 0x4a0500 SetForegroundWindow

• 0x4a0504 SetFocus

• 0x4a0508 SetCursor

• 0x4a050c SetClassLongA

• 0x4a0510 SetCapture

• 0x4a0514 SetActiveWindow

• 0x4a0518 SendMessageA

• 0x4a051c ScrollWindow

• 0x4a0520 ScreenToClient

• 0x4a0524 RemovePropA

• 0x4a0528 RemoveMenu

• 0x4a052c ReleaseDC

• 0x4a0530 ReleaseCapture

• 0x4a0534 RegisterWindowMessageA

• 0x4a0538 RegisterClipboardFormatA

• 0x4a053c RegisterClassA

• 0x4a0540 RedrawWindow

• 0x4a0544 PtInRect

• 0x4a0548 PostQuitMessage

• 0x4a054c PostMessageA

• 0x4a0550 PeekMessageA

• 0x4a0554 OffsetRect

• 0x4a0558 OemToCharA

• 0x4a055c MessageBoxA

• 0x4a0560 MapWindowPoints

• 0x4a0564 MapVirtualKeyA

• 0x4a0568 LoadStringA

• 0x4a056c LoadKeyboardLayoutA

• 0x4a0570 LoadIconA

• 0x4a0574 LoadCursorA

• 0x4a0578 LoadBitmapA

• 0x4a057c KillTimer

• 0x4a0580 IsZoomed

• 0x4a0584 IsWindowVisible

• 0x4a0588 IsWindowEnabled

• 0x4a058c IsWindow

• 0x4a0590 IsRectEmpty

• 0x4a0594 IsIconic

• 0x4a0598 IsDialogMessageA

• 0x4a059c IsChild

• 0x4a05a0 InvalidateRect

• 0x4a05a4 IntersectRect

• 0x4a05a8 InsertMenuItemA

• 0x4a05ac InsertMenuA

• 0x4a05b0 InflateRect

• 0x4a05b4 GetWindowThreadProcessId

• 0x4a05b8 GetWindowTextA

• 0x4a05bc GetWindowRect

• 0x4a05c0 GetWindowPlacement

• 0x4a05c4 GetWindowLongA

• 0x4a05c8 GetWindowDC

• 0x4a05cc GetTopWindow

• 0x4a05d0 GetSystemMetrics

• 0x4a05d4 GetSystemMenu

• 0x4a05d8 GetSysColorBrush

• 0x4a05dc GetSysColor

• 0x4a05e0 GetSubMenu

• 0x4a05e4 GetScrollRange

• 0x4a05e8 GetScrollPos

• 0x4a05ec GetScrollInfo

• 0x4a05f0 GetPropA

• 0x4a05f4 GetParent

• 0x4a05f8 GetWindow

• 0x4a05fc GetMenuStringA

• 0x4a0600 GetMenuState

• 0x4a0604 GetMenuItemInfoA

• 0x4a0608 GetMenuItemID

• 0x4a060c GetMenuItemCount

• 0x4a0610 GetMenu

• 0x4a0614 GetLastActivePopup

• 0x4a0618 GetKeyboardState

• 0x4a061c GetKeyboardLayoutList

• 0x4a0620 GetKeyboardLayout

• 0x4a0624 GetKeyState

• 0x4a0628 GetKeyNameTextA

• 0x4a062c GetIconInfo

• 0x4a0630 GetForegroundWindow

• 0x4a0634 GetFocus

• 0x4a0638 GetDlgItem

• 0x4a063c GetDesktopWindow

• 0x4a0640 GetDCEx

• 0x4a0644 GetDC

• 0x4a0648 GetCursorPos

• 0x4a064c GetCursor

• 0x4a0650 GetClipboardData

• 0x4a0654 GetClientRect

• 0x4a0658 GetClassNameA

• 0x4a065c GetClassInfoA

• 0x4a0660 GetCapture

• 0x4a0664 GetActiveWindow

• 0x4a0668 FrameRect

• 0x4a066c FindWindowA

• 0x4a0670 FillRect

• 0x4a0674 EqualRect

• 0x4a0678 EnumWindows

• 0x4a067c EnumThreadWindows

• 0x4a0680 EndPaint

• 0x4a0684 EnableWindow

• 0x4a0688 EnableScrollBar

• 0x4a068c EnableMenuItem

• 0x4a0690 DrawTextA

• 0x4a0694 DrawMenuBar

• 0x4a0698 DrawIconEx

• 0x4a069c DrawIcon

• 0x4a06a0 DrawFrameControl

• 0x4a06a4 DrawFocusRect

• 0x4a06a8 DrawEdge

• 0x4a06ac DispatchMessageA

• 0x4a06b0 DestroyWindow

• 0x4a06b4 DestroyMenu

• 0x4a06b8 DestroyIcon

• 0x4a06bc DestroyCursor

• 0x4a06c0 DeleteMenu

• 0x4a06c4 DefWindowProcA

• 0x4a06c8 DefMDIChildProcA

• 0x4a06cc DefFrameProcA

• 0x4a06d0 CreatePopupMenu

• 0x4a06d4 CreateMenu

• 0x4a06d8 CreateIcon

• 0x4a06dc ClientToScreen

• 0x4a06e0 CheckMenuItem

• 0x4a06e4 CallWindowProcA

• 0x4a06e8 CallNextHookEx

• 0x4a06ec BeginPaint

• 0x4a06f0 CharNextA

• 0x4a06f4 CharLowerBuffA

• 0x4a06f8 CharLowerA

• 0x4a06fc CharUpperBuffA

• 0x4a0700 CharToOemA

• 0x4a0704 AdjustWindowRectEx

• 0x4a0708 ActivateKeyboardLayout

Library kernel32.dll:

• 0x4a0710 Sleep

Library oleaut32.dll:

• 0x4a0718 SafeArrayPtrOfIndex

• 0x4a071c SafeArrayPutElement

• 0x4a0720 SafeArrayGetElement

• 0x4a0724 SafeArrayUnaccessData

• 0x4a0728 SafeArrayAccessData

• 0x4a072c SafeArrayGetUBound

• 0x4a0730 SafeArrayGetLBound

• 0x4a0734 SafeArrayRedim

• 0x4a0738 SafeArrayCreate

• 0x4a073c VariantChangeType

• 0x4a0740 VariantCopyInd

• 0x4a0744 VariantCopy

• 0x4a0748 VariantClear

• 0x4a074c VariantInit

Library ole32.dll:

• 0x4a0754 CoCreateInstance

• 0x4a0758 CoGetMalloc

• 0x4a075c CoUninitialize

• 0x4a0760 CoInitialize

Library oleaut32.dll:

• 0x4a0768 GetErrorInfo

• 0x4a076c SysStringLen

• 0x4a0770 SysFreeString

Library comctl32.dll:

• 0x4a0778 ImageList_SetIconSize

• 0x4a077c ImageList_GetIconSize

• 0x4a0780 ImageList_Write

• 0x4a0784 ImageList_Read

• 0x4a0788 ImageList_GetDragImage

• 0x4a078c ImageList_DragShowNolock

• 0x4a0790 ImageList_SetDragCursorImage

• 0x4a0794 ImageList_DragMove

• 0x4a0798 ImageList_DragLeave

• 0x4a079c ImageList_DragEnter

• 0x4a07a0 ImageList_EndDrag

• 0x4a07a4 ImageList_BeginDrag

• 0x4a07a8 ImageList_Remove

• 0x4a07ac ImageList_DrawEx

• 0x4a07b0 ImageList_Replace

• 0x4a07b4 ImageList_Draw

• 0x4a07b8 ImageList_GetBkColor

• 0x4a07bc ImageList_SetBkColor

• 0x4a07c0 ImageList_ReplaceIcon

• 0x4a07c4 ImageList_Add

• 0x4a07c8 ImageList_GetImageCount

• 0x4a07cc ImageList_Destroy

• 0x4a07d0 ImageList_Create

• 0x4a07d4 InitCommonControls

Library comdlg32.dll:

• 0x4a07dc GetSaveFileNameA

• 0x4a07e0 GetOpenFileNameA

Library winmm.dll:

• 0x4a07e8 mciSendCommandA

• 0x4a07ec mciGetErrorStringA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58370	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	62192	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.