11.2
0-day
48 个模型检测该样本为恶意！
重新分析
更多

f2dd61088f2fe5b380d81e84248125e3f3da1aa0d0c23e29082285f3754c6394

20c91a42722d240a2e696490eecb110f.exe

分析耗时

129s

最近分析

文件大小

933.5KB
静态报毒 动态报毒 100% 6GW@AGCBSTEI 6GW@MGCBSTEI AIDETECT ALI2000015 CONFIDENCE DELF DELFINJECT DELPHILESS EMZL ENBI FAREIT HIGH CONFIDENCE HQLT HSJDKH HWUB6UOA KRYPTIK LOKIBOT MALWARE1 MALWARE@#2VS645U443IN2 N5IKDQMEKEC PONYRAT SAVE SCORE STATIC AI SUSPICIOUS PE UDIBS UNSAFE X2094 YUGK ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Baidu 20190318 1.0.0.2
Avast Win32:Malware-gen 20210226 21.1.5827.0
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
Kingsoft 20210227 2017.9.26.565
McAfee Fareit-FPQ!20C91A42722D 20210226 6.0.6.653
Tencent Win32.Trojan.Kryptik.Hqlt 20210226 1.0.0.1
CrowdStrike win/malicious_confidence_100% (W) 20210203 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (5 个事件)
Time & API Arguments Status Return Repeated
1619292104.521374
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
kjhgbnsmnd+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75114b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75115d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff54148d
success 0 0
1619292112.943751
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
kjhgbnsmnd+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x751c4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x751c5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdb2148d
success 0 0
1619292122.490876
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
kjhgbnsmnd+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75124b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75125d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdb8148d
success 0 0
1619292128.833501
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
kjhgbnsmnd+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x751c4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x751c5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff4a148d
success 0 0
1619292138.802249
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
kjhgbnsmnd+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdb6148d
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (50 out of 158 个事件)
Time & API Arguments Status Return Repeated
1619269227.610567
NtAllocateVirtualMemory
process_identifier: 1404
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00360000
success 0 0
1619269227.798567
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 73728
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00461000
success 0 0
1619269227.798567
NtAllocateVirtualMemory
process_identifier: 1404
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x003c0000
success 0 0
1619292103.052751
NtAllocateVirtualMemory
process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003d0000
success 0 0
1619292103.052751
NtProtectVirtualMemory
process_identifier: 2228
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 73728
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00461000
success 0 0
1619292103.068751
NtAllocateVirtualMemory
process_identifier: 2228
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00520000
success 0 0
1619292103.865374
NtProtectVirtualMemory
process_identifier: 2424
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619292103.943374
NtAllocateVirtualMemory
process_identifier: 2424
region_size: 2097152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02100000
success 0 0
1619292103.943374
NtAllocateVirtualMemory
process_identifier: 2424
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x022c0000
success 0 0
1619292103.943374
NtAllocateVirtualMemory
process_identifier: 2424
region_size: 630784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f10000
success 0 0
1619292103.943374
NtProtectVirtualMemory
process_identifier: 2424
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 602112
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f12000
success 0 0
1619292104.490374
NtProtectVirtualMemory
process_identifier: 2424
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fe2000
success 0 0
1619292104.490374
NtProtectVirtualMemory
process_identifier: 2424
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619292104.490374
NtProtectVirtualMemory
process_identifier: 2424
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fe2000
success 0 0
1619292104.490374
NtProtectVirtualMemory
process_identifier: 2424
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619292104.490374
NtProtectVirtualMemory
process_identifier: 2424
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fe2000
success 0 0
1619292104.490374
NtProtectVirtualMemory
process_identifier: 2424
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619292104.490374
NtProtectVirtualMemory
process_identifier: 2424
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fe2000
success 0 0
1619292104.490374
NtProtectVirtualMemory
process_identifier: 2424
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619292104.490374
NtProtectVirtualMemory
process_identifier: 2424
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fe2000
success 0 0
1619292104.490374
NtProtectVirtualMemory
process_identifier: 2424
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619292104.490374
NtProtectVirtualMemory
process_identifier: 2424
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fe2000
success 0 0
1619292104.490374
NtProtectVirtualMemory
process_identifier: 2424
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619292104.490374
NtProtectVirtualMemory
process_identifier: 2424
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fe2000
success 0 0
1619292104.490374
NtProtectVirtualMemory
process_identifier: 2424
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619292104.490374
NtProtectVirtualMemory
process_identifier: 2424
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fe2000
success 0 0
1619292104.490374
NtProtectVirtualMemory
process_identifier: 2424
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619292104.490374
NtProtectVirtualMemory
process_identifier: 2424
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fe2000
success 0 0
1619292104.490374
NtProtectVirtualMemory
process_identifier: 2424
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619292104.490374
NtProtectVirtualMemory
process_identifier: 2424
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fe2000
success 0 0
1619292104.490374
NtProtectVirtualMemory
process_identifier: 2424
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619292104.630374
NtAllocateVirtualMemory
process_identifier: 3084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619292104.677374
NtProtectVirtualMemory
process_identifier: 3084
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 73728
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00461000
success 0 0
1619292104.755374
NtAllocateVirtualMemory
process_identifier: 3084
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00630000
success 0 0
1619292111.349126
NtAllocateVirtualMemory
process_identifier: 3216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003d0000
success 0 0
1619292111.349126
NtProtectVirtualMemory
process_identifier: 3216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 73728
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00461000
success 0 0
1619292111.349126
NtAllocateVirtualMemory
process_identifier: 3216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00520000
success 0 0
1619292112.677751
NtProtectVirtualMemory
process_identifier: 3284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619292112.724751
NtAllocateVirtualMemory
process_identifier: 3284
region_size: 1179648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02000000
success 0 0
1619292112.724751
NtAllocateVirtualMemory
process_identifier: 3284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020e0000
success 0 0
1619292112.755751
NtAllocateVirtualMemory
process_identifier: 3284
region_size: 630784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02000000
success 0 0
1619292112.755751
NtProtectVirtualMemory
process_identifier: 3284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 602112
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02002000
success 0 0
1619292112.927751
NtProtectVirtualMemory
process_identifier: 3284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005c2000
success 0 0
1619292112.927751
NtProtectVirtualMemory
process_identifier: 3284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619292112.927751
NtProtectVirtualMemory
process_identifier: 3284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005c2000
success 0 0
1619292112.927751
NtProtectVirtualMemory
process_identifier: 3284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619292112.927751
NtProtectVirtualMemory
process_identifier: 3284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005c2000
success 0 0
1619292112.927751
NtProtectVirtualMemory
process_identifier: 3284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619292112.927751
NtProtectVirtualMemory
process_identifier: 3284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005c2000
success 0 0
1619292112.927751
NtProtectVirtualMemory
process_identifier: 3284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\web.vbs
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (26 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.665589315346755 section {'size_of_data': '0x0006c000', 'virtual_address': '0x00084000', 'entropy': 7.665589315346755, 'name': '.rsrc', 'virtual_size': '0x0006bea4'} description A section with a high entropy has been found
entropy 0.46327077747989276 description Overall entropy of this PE file is high
Repeatedly searches for a not-found process, you may want to run a web browser during analysis (15 个事件)
Time & API Arguments Status Return Repeated
1619269227.829567
Process32NextW
process_name: 20c91a42722d240a2e696490eecb110f.exe
snapshot_handle: 0x000000f4
process_identifier: 1404
failed 0 0
1619292103.083751
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 2144
failed 0 0
1619292104.802374
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3180
failed 0 0
1619292110.990374
Process32NextW
process_name: kjhgbnsmnd.exe
snapshot_handle: 0x0000017c
process_identifier: 3084
failed 0 0
1619292111.349126
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3272
failed 0 0
1619292113.646751
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3440
failed 0 0
1619292115.240751
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000118
process_identifier: 3440
failed 0 0
1619292116.255001
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3512
failed 0 0
1619292122.833751
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3696
failed 0 0
1619292125.505751
Process32NextW
process_name: kjhgbnsmnd.exe
snapshot_handle: 0x00000138
process_identifier: 3600
failed 0 0
1619292126.458876
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3772
failed 0 0
1619292130.021374
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3956
failed 0 0
1619292136.802374
Process32NextW
process_name: kjhgbnsmnd.exe
snapshot_handle: 0x000001b8
process_identifier: 3856
failed 0 0
1619292137.380374
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3000
failed 0 0
1619292139.193499
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3316
failed 0 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Creates an Alternate Data Stream (ADS) (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\kjhgbnsmnd.exe:ZoneIdentifier
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619269228.454567
NtAllocateVirtualMemory
process_identifier: 2528
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000000fc
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
Installs itself for autorun at Windows startup (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\web.vbs
Deletes executed files from disk (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\kjhgbnsmnd.exe
Creates a thread using NtQueueApcThread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 1404 created a thread in remote process 2528
Time & API Arguments Status Return Repeated
1619269228.517567
NtQueueApcThread
thread_handle: 0x00000104
process_identifier: 2528
function_address: 0x000b05c0
parameter: 0x000c0000
success 0 0
Potential code injection by writing to the memory of another process (2 个事件)
Time & API Arguments Status Return Repeated
1619269228.454567
WriteProcessMemory
process_identifier: 2528
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x000000fc
base_address: 0x000b0000
success 1 0
1619269228.454567
WriteProcessMemory
process_identifier: 2528
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\20c91a42722d240a2e696490eecb110f.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\kjhgbnsmnd.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\20c91a42722d240a2e696490eecb110f.exe" webseT iNulOlIPD = cREateobjecT("WscrIpT.shelL") iNUlOlipD.rUn """%ls""", 0, False
process_handle: 0x000000fc
base_address: 0x000c0000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (10 个事件)
Process injection Process 2228 called NtSetContextThread to modify thread in remote process 2424
Process injection Process 3216 called NtSetContextThread to modify thread in remote process 3284
Process injection Process 3456 called NtSetContextThread to modify thread in remote process 3524
Process injection Process 3708 called NtSetContextThread to modify thread in remote process 3784
Process injection Process 3116 called NtSetContextThread to modify thread in remote process 2668
Time & API Arguments Status Return Repeated
1619292103.271751
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502816
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2424
success 0 0
1619292111.865126
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502816
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3284
success 0 0
1619292118.958001
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502816
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3524
success 0 0
1619292127.896876
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502816
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3784
success 0 0
1619292137.724374
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502816
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2668
success 0 0
Expresses interest in specific running processes (2 个事件)
process kjhgbnsmnd.exe
process: potential process injection target svchost.exe
Resumed a suspended thread in a remote process potentially indicative of process injection (10 个事件)
Process injection Process 2228 resumed a thread in remote process 2424
Process injection Process 3216 resumed a thread in remote process 3284
Process injection Process 3456 resumed a thread in remote process 3524
Process injection Process 3708 resumed a thread in remote process 3784
Process injection Process 3116 resumed a thread in remote process 2668
Time & API Arguments Status Return Repeated
1619292103.693751
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 2424
success 0 0
1619292112.396126
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3284
success 0 0
1619292122.255001
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3524
success 0 0
1619292128.505876
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3784
success 0 0
1619292138.302374
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 2668
success 0 0
Executed a process and injected code into it, probably while unpacking (45 个事件)
Time & API Arguments Status Return Repeated
1619269228.454567
CreateProcessInternalW
thread_identifier: 1436
thread_handle: 0x00000104
process_identifier: 2528
current_directory:
filepath: C:\Windows\System32\notepad.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\notepad.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619269228.454567
NtAllocateVirtualMemory
process_identifier: 2528
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000000fc
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
1619269228.454567
NtAllocateVirtualMemory
process_identifier: 2528
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
process_handle: 0x000000fc
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000c0000
success 0 0
1619269228.454567
WriteProcessMemory
process_identifier: 2528
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x000000fc
base_address: 0x000b0000
success 1 0
1619269228.454567
WriteProcessMemory
process_identifier: 2528
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\20c91a42722d240a2e696490eecb110f.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\kjhgbnsmnd.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\20c91a42722d240a2e696490eecb110f.exe" webseT iNulOlIPD = cREateobjecT("WscrIpT.shelL") iNUlOlipD.rUn """%ls""", 0, False
process_handle: 0x000000fc
base_address: 0x000c0000
success 1 0
1619269228.856805
CreateProcessInternalW
thread_identifier: 3060
thread_handle: 0x000000d0
process_identifier: 2228
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\kjhgbnsmnd.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\kjhgbnsmnd.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000000cc
inherit_handles: 0
success 1 0
1619292103.162751
CreateProcessInternalW
thread_identifier: 944
thread_handle: 0x00000104
process_identifier: 2424
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\kjhgbnsmnd.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619292103.162751
NtUnmapViewOfSection
process_identifier: 2424
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1619292103.162751
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 2424
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619292103.271751
NtGetContextThread
thread_handle: 0x00000104
success 0 0
1619292103.271751
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502816
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2424
success 0 0
1619292103.693751
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 2424
success 0 0
1619292103.818751
CreateProcessInternalW
thread_identifier: 3088
thread_handle: 0x00000108
process_identifier: 3084
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\kjhgbnsmnd.exe" 2 2424 13288406
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619292111.146374
CreateProcessInternalW
thread_identifier: 3220
thread_handle: 0x00000180
process_identifier: 3216
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\kjhgbnsmnd.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\kjhgbnsmnd.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000184
inherit_handles: 0
success 1 0
1619292111.771126
CreateProcessInternalW
thread_identifier: 3288
thread_handle: 0x00000104
process_identifier: 3284
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\kjhgbnsmnd.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619292111.771126
NtUnmapViewOfSection
process_identifier: 3284
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1619292111.787126
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 3284
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619292111.849126
NtGetContextThread
thread_handle: 0x00000104
success 0 0
1619292111.865126
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502816
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3284
success 0 0
1619292112.396126
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3284
success 0 0
1619292113.177126
CreateProcessInternalW
thread_identifier: 3348
thread_handle: 0x00000108
process_identifier: 3344
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\kjhgbnsmnd.exe" 2 3284 13297109
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619292115.677751
CreateProcessInternalW
thread_identifier: 3460
thread_handle: 0x0000011c
process_identifier: 3456
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\kjhgbnsmnd.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\kjhgbnsmnd.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000120
inherit_handles: 0
success 1 0
1619292116.740001
CreateProcessInternalW
thread_identifier: 3528
thread_handle: 0x00000104
process_identifier: 3524
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\kjhgbnsmnd.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619292116.740001
NtUnmapViewOfSection
process_identifier: 3524
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1619292116.755001
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 3524
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619292118.943001
NtGetContextThread
thread_handle: 0x00000104
success 0 0
1619292118.958001
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502816
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3524
success 0 0
1619292122.255001
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3524
success 0 0
1619292122.396001
CreateProcessInternalW
thread_identifier: 3604
thread_handle: 0x00000108
process_identifier: 3600
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\kjhgbnsmnd.exe" 2 3524 13306968
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619292125.849751
CreateProcessInternalW
thread_identifier: 3712
thread_handle: 0x0000013c
process_identifier: 3708
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\kjhgbnsmnd.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\kjhgbnsmnd.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000140
inherit_handles: 0
success 1 0
1619292126.708876
CreateProcessInternalW
thread_identifier: 3788
thread_handle: 0x00000104
process_identifier: 3784
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\kjhgbnsmnd.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619292126.708876
NtUnmapViewOfSection
process_identifier: 3784
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1619292126.708876
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 3784
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619292127.880876
NtGetContextThread
thread_handle: 0x00000104
success 0 0
1619292127.896876
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502816
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3784
success 0 0
1619292128.505876
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3784
success 0 0
1619292128.755876
CreateProcessInternalW
thread_identifier: 3860
thread_handle: 0x00000108
process_identifier: 3856
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\kjhgbnsmnd.exe" 2 3784 13313218
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619292136.958374
CreateProcessInternalW
thread_identifier: 3132
thread_handle: 0x000001bc
process_identifier: 3116
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\kjhgbnsmnd.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\kjhgbnsmnd.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000001c0
inherit_handles: 0
success 1 0
1619292137.615374
CreateProcessInternalW
thread_identifier: 376
thread_handle: 0x00000104
process_identifier: 2668
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\kjhgbnsmnd.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619292137.615374
NtUnmapViewOfSection
process_identifier: 2668
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1619292137.646374
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 2668
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619292137.708374
NtGetContextThread
thread_handle: 0x00000104
success 0 0
1619292137.724374
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502816
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2668
success 0 0
1619292138.302374
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 2668
success 0 0
1619292138.833374
CreateProcessInternalW
thread_identifier: 2040
thread_handle: 0x00000108
process_identifier: 1056
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\kjhgbnsmnd.exe" 2 2668 13323015
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 个事件)
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Delf.FareIt.Gen.6GW@mGCBStei
FireEye Generic.mg.20c91a42722d240a
ALYac Trojan.Delf.FareIt.Gen.6GW@mGCBStei
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
AegisLab Trojan.Win32.Kryptik.4!c
Sangfor Trojan.Win32.Save.a
K7AntiVirus Spyware ( 004bf6371 )
BitDefender Trojan.Delf.FareIt.Gen.6GW@mGCBStei
K7GW Spyware ( 004bf6371 )
Cybereason malicious.2722d2
Cyren W32/Injector.YUGK-1152
Symantec Infostealer.Lokibot!43
APEX Malicious
Avast Win32:Malware-gen
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
Alibaba Trojan:Win32/DelfInject.ali2000015
NANO-Antivirus Trojan.Win32.Kryptik.hsjdkh
Ad-Aware Trojan.Delf.FareIt.Gen.6GW@mGCBStei
Emsisoft Trojan.Delf.FareIt.Gen.6GW@mGCBStei (B)
Comodo Malware@#2vs645u443in2
Zillya Trojan.Agent.Win32.1374984
McAfee-GW-Edition BehavesLike.Win32.Fareit.dc
Ikarus Trojan.Inject
Jiangmin Trojan.Kryptik.ccu
Avira TR/Injector.udibs
Antiy-AVL Trojan[Spy]/MSIL.Agent
Gridinsoft Trojan.Win32.Kryptik.oa
Arcabit Trojan.Delf.FareIt.Gen.ED4CAA
GData Trojan.Delf.FareIt.Gen.6GW@mGCBStei
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2094
McAfee Fareit-FPQ!20C91A42722D
Malwarebytes Trojan.MalPack.DLF
Panda Trj/CI.A
Zoner Trojan.Win32.92379
ESET-NOD32 a variant of Win32/Injector.ENBI
Tencent Win32.Trojan.Kryptik.Hqlt
Yandex Trojan.Injector!n5IKDqMeKEc
SentinelOne Static AI - Suspicious PE
Fortinet W32/Injector.EMZL!tr
BitDefenderTheta Gen:NN.ZelphiF.34590.6GW@aGCBStei
AVG Win32:Malware-gen
Paloalto generic.ml
CrowdStrike win/malicious_confidence_100% (W)
Qihoo-360 Win32/Backdoor.PonyRAT.HwUB6uoA
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x477150 VirtualFree
• 0x477154 VirtualAlloc
• 0x477158 LocalFree
• 0x47715c LocalAlloc
• 0x477160 GetVersion
• 0x477164 GetCurrentThreadId
• 0x477170 VirtualQuery
• 0x477174 WideCharToMultiByte
• 0x477178 MultiByteToWideChar
• 0x47717c lstrlenA
• 0x477180 lstrcpynA
• 0x477184 LoadLibraryExA
• 0x477188 GetThreadLocale
• 0x47718c GetStartupInfoA
• 0x477190 GetProcAddress
• 0x477194 GetModuleHandleA
• 0x477198 GetModuleFileNameA
• 0x47719c GetLocaleInfoA
• 0x4771a0 GetCommandLineA
• 0x4771a4 FreeLibrary
• 0x4771a8 FindFirstFileA
• 0x4771ac FindClose
• 0x4771b0 ExitProcess
• 0x4771b4 WriteFile
• 0x4771bc RtlUnwind
• 0x4771c0 RaiseException
• 0x4771c4 GetStdHandle
Library user32.dll:
• 0x4771cc GetKeyboardType
• 0x4771d0 LoadStringA
• 0x4771d4 MessageBoxA
• 0x4771d8 CharNextA
Library advapi32.dll:
• 0x4771e0 RegQueryValueExA
• 0x4771e4 RegOpenKeyExA
• 0x4771e8 RegCloseKey
Library oleaut32.dll:
• 0x4771f0 SysFreeString
• 0x4771f4 SysReAllocStringLen
• 0x4771f8 SysAllocStringLen
Library kernel32.dll:
• 0x477200 TlsSetValue
• 0x477204 TlsGetValue
• 0x477208 LocalAlloc
• 0x47720c GetModuleHandleA
Library advapi32.dll:
• 0x477214 RegQueryValueExA
• 0x477218 RegOpenKeyExA
• 0x47721c RegCloseKey
Library kernel32.dll:
• 0x477224 lstrcpyA
• 0x477228 WriteFile
• 0x47722c WinExec
• 0x477230 WaitForSingleObject
• 0x477234 VirtualQuery
• 0x477238 VirtualProtect
• 0x47723c VirtualAlloc
• 0x477240 Sleep
• 0x477244 SizeofResource
• 0x477248 SetThreadLocale
• 0x47724c SetFilePointer
• 0x477250 SetEvent
• 0x477254 SetErrorMode
• 0x477258 SetEndOfFile
• 0x47725c ResetEvent
• 0x477260 ReadFile
• 0x477264 MulDiv
• 0x477268 LockResource
• 0x47726c LoadResource
• 0x477270 LoadLibraryA
• 0x47727c GlobalUnlock
• 0x477280 GlobalReAlloc
• 0x477284 GlobalHandle
• 0x477288 GlobalLock
• 0x47728c GlobalFree
• 0x477290 GlobalFindAtomA
• 0x477294 GlobalDeleteAtom
• 0x477298 GlobalAlloc
• 0x47729c GlobalAddAtomA
• 0x4772a0 GetVersionExA
• 0x4772a4 GetVersion
• 0x4772a8 GetTickCount
• 0x4772ac GetThreadLocale
• 0x4772b4 GetSystemInfo
• 0x4772b8 GetStringTypeExA
• 0x4772bc GetStdHandle
• 0x4772c0 GetProcAddress
• 0x4772c4 GetModuleHandleA
• 0x4772c8 GetModuleFileNameA
• 0x4772cc GetLocaleInfoA
• 0x4772d0 GetLocalTime
• 0x4772d4 GetLastError
• 0x4772d8 GetFullPathNameA
• 0x4772dc GetFileAttributesA
• 0x4772e0 GetDiskFreeSpaceA
• 0x4772e4 GetDateFormatA
• 0x4772e8 GetCurrentThreadId
• 0x4772ec GetCurrentProcessId
• 0x4772f0 GetCPInfo
• 0x4772f4 GetACP
• 0x4772f8 FreeResource
• 0x4772fc InterlockedExchange
• 0x477300 FreeLibrary
• 0x477304 FormatMessageA
• 0x477308 FindResourceA
• 0x47730c FindFirstFileA
• 0x477310 FindClose
• 0x477320 EnumCalendarInfoA
• 0x47732c CreateThread
• 0x477330 CreateFileA
• 0x477334 CreateEventA
• 0x477338 CompareStringA
• 0x47733c CloseHandle
Library version.dll:
• 0x477344 VerQueryValueA
• 0x47734c GetFileVersionInfoA
Library gdi32.dll:
• 0x477354 UnrealizeObject
• 0x477358 StretchBlt
• 0x47735c SetWindowOrgEx
• 0x477360 SetWinMetaFileBits
• 0x477364 SetViewportOrgEx
• 0x477368 SetTextColor
• 0x47736c SetStretchBltMode
• 0x477370 SetROP2
• 0x477374 SetPixel
• 0x477378 SetEnhMetaFileBits
• 0x47737c SetDIBColorTable
• 0x477380 SetBrushOrgEx
• 0x477384 SetBkMode
• 0x477388 SetBkColor
• 0x47738c SelectPalette
• 0x477390 SelectObject
• 0x477394 SaveDC
• 0x477398 RestoreDC
• 0x47739c Rectangle
• 0x4773a0 RectVisible
• 0x4773a4 RealizePalette
• 0x4773a8 Polyline
• 0x4773ac PlayEnhMetaFile
• 0x4773b0 PatBlt
• 0x4773b4 MoveToEx
• 0x4773b8 MaskBlt
• 0x4773bc LineTo
• 0x4773c0 IntersectClipRect
• 0x4773c4 GetWindowOrgEx
• 0x4773c8 GetWinMetaFileBits
• 0x4773cc GetTextMetricsA
• 0x4773d8 GetStockObject
• 0x4773dc GetPixel
• 0x4773e0 GetPaletteEntries
• 0x4773e4 GetObjectA
• 0x4773f0 GetEnhMetaFileBits
• 0x4773f4 GetDeviceCaps
• 0x4773f8 GetDIBits
• 0x4773fc GetDIBColorTable
• 0x477400 GetDCOrgEx
• 0x477408 GetClipBox
• 0x47740c GetBrushOrgEx
• 0x477410 GetBitmapBits
• 0x477414 ExtTextOutA
• 0x477418 ExcludeClipRect
• 0x47741c DeleteObject
• 0x477420 DeleteEnhMetaFile
• 0x477424 DeleteDC
• 0x477428 CreateSolidBrush
• 0x47742c CreatePenIndirect
• 0x477430 CreatePalette
• 0x477438 CreateFontIndirectA
• 0x47743c CreateDIBitmap
• 0x477440 CreateDIBSection
• 0x477444 CreateCompatibleDC
• 0x47744c CreateBrushIndirect
• 0x477450 CreateBitmap
• 0x477454 CopyEnhMetaFileA
• 0x477458 BitBlt
Library user32.dll:
• 0x477460 CreateWindowExA
• 0x477464 WindowFromPoint
• 0x477468 WinHelpA
• 0x47746c WaitMessage
• 0x477470 UpdateWindow
• 0x477474 UnregisterClassA
• 0x477478 UnhookWindowsHookEx
• 0x47747c TranslateMessage
• 0x477484 TrackPopupMenu
• 0x47748c ShowWindow
• 0x477490 ShowScrollBar
• 0x477494 ShowOwnedPopups
• 0x477498 ShowCursor
• 0x47749c SetWindowsHookExA
• 0x4774a0 SetWindowTextA
• 0x4774a4 SetWindowPos
• 0x4774a8 SetWindowPlacement
• 0x4774ac SetWindowLongA
• 0x4774b0 SetTimer
• 0x4774b4 SetScrollRange
• 0x4774b8 SetScrollPos
• 0x4774bc SetScrollInfo
• 0x4774c0 SetRect
• 0x4774c4 SetPropA
• 0x4774c8 SetParent
• 0x4774cc SetMenuItemInfoA
• 0x4774d0 SetMenu
• 0x4774d4 SetForegroundWindow
• 0x4774d8 SetFocus
• 0x4774dc SetCursor
• 0x4774e0 SetClassLongA
• 0x4774e4 SetCapture
• 0x4774e8 SetActiveWindow
• 0x4774ec SendMessageA
• 0x4774f0 ScrollWindow
• 0x4774f4 ScreenToClient
• 0x4774f8 RemovePropA
• 0x4774fc RemoveMenu
• 0x477500 ReleaseDC
• 0x477504 ReleaseCapture
• 0x477510 RegisterClassA
• 0x477514 RedrawWindow
• 0x477518 PtInRect
• 0x47751c PostQuitMessage
• 0x477520 PostMessageA
• 0x477524 PeekMessageA
• 0x477528 OffsetRect
• 0x47752c OemToCharA
• 0x477530 MessageBoxA
• 0x477534 MapWindowPoints
• 0x477538 MapVirtualKeyA
• 0x47753c LoadStringA
• 0x477540 LoadKeyboardLayoutA
• 0x477544 LoadIconA
• 0x477548 LoadCursorA
• 0x47754c LoadBitmapA
• 0x477550 KillTimer
• 0x477554 IsZoomed
• 0x477558 IsWindowVisible
• 0x47755c IsWindowEnabled
• 0x477560 IsWindow
• 0x477564 IsRectEmpty
• 0x477568 IsIconic
• 0x47756c IsDialogMessageA
• 0x477570 IsChild
• 0x477574 InvalidateRect
• 0x477578 IntersectRect
• 0x47757c InsertMenuItemA
• 0x477580 InsertMenuA
• 0x477584 InflateRect
• 0x47758c GetWindowTextA
• 0x477590 GetWindowRect
• 0x477594 GetWindowPlacement
• 0x477598 GetWindowLongA
• 0x47759c GetWindowDC
• 0x4775a0 GetTopWindow
• 0x4775a4 GetSystemMetrics
• 0x4775a8 GetSystemMenu
• 0x4775ac GetSysColorBrush
• 0x4775b0 GetSysColor
• 0x4775b4 GetSubMenu
• 0x4775b8 GetScrollRange
• 0x4775bc GetScrollPos
• 0x4775c0 GetScrollInfo
• 0x4775c4 GetPropA
• 0x4775c8 GetParent
• 0x4775cc GetWindow
• 0x4775d0 GetMenuStringA
• 0x4775d4 GetMenuState
• 0x4775d8 GetMenuItemInfoA
• 0x4775dc GetMenuItemID
• 0x4775e0 GetMenuItemCount
• 0x4775e4 GetMenu
• 0x4775e8 GetLastActivePopup
• 0x4775ec GetKeyboardState
• 0x4775f4 GetKeyboardLayout
• 0x4775f8 GetKeyState
• 0x4775fc GetKeyNameTextA
• 0x477600 GetInputState
• 0x477604 GetIconInfo
• 0x477608 GetForegroundWindow
• 0x47760c GetFocus
• 0x477610 GetDlgItem
• 0x477614 GetDesktopWindow
• 0x477618 GetDCEx
• 0x47761c GetDC
• 0x477620 GetCursorPos
• 0x477624 GetCursor
• 0x477628 GetClipboardData
• 0x47762c GetClientRect
• 0x477630 GetClassNameA
• 0x477634 GetClassInfoA
• 0x477638 GetCapture
• 0x47763c GetActiveWindow
• 0x477640 FrameRect
• 0x477644 FindWindowA
• 0x477648 FillRect
• 0x47764c EqualRect
• 0x477650 EnumWindows
• 0x477654 EnumThreadWindows
• 0x477658 EndPaint
• 0x47765c EnableWindow
• 0x477660 EnableScrollBar
• 0x477664 EnableMenuItem
• 0x477668 DrawTextA
• 0x47766c DrawMenuBar
• 0x477670 DrawIconEx
• 0x477674 DrawIcon
• 0x477678 DrawFrameControl
• 0x47767c DrawFocusRect
• 0x477680 DrawEdge
• 0x477684 DispatchMessageA
• 0x477688 DestroyWindow
• 0x47768c DestroyMenu
• 0x477690 DestroyIcon
• 0x477694 DestroyCursor
• 0x477698 DeleteMenu
• 0x47769c DefWindowProcA
• 0x4776a0 DefMDIChildProcA
• 0x4776a4 DefFrameProcA
• 0x4776a8 CreatePopupMenu
• 0x4776ac CreateMenu
• 0x4776b0 CreateIcon
• 0x4776b4 ClientToScreen
• 0x4776b8 CheckMenuItem
• 0x4776bc CallWindowProcA
• 0x4776c0 CallNextHookEx
• 0x4776c4 BeginPaint
• 0x4776c8 CharNextA
• 0x4776cc CharLowerBuffA
• 0x4776d0 CharLowerA
• 0x4776d4 CharToOemA
• 0x4776d8 AdjustWindowRectEx
Library kernel32.dll:
• 0x4776e4 Sleep
Library oleaut32.dll:
• 0x4776ec SafeArrayPtrOfIndex
• 0x4776f0 SafeArrayGetUBound
• 0x4776f4 SafeArrayGetLBound
• 0x4776f8 SafeArrayCreate
• 0x4776fc VariantChangeType
• 0x477700 VariantCopy
• 0x477704 VariantClear
• 0x477708 VariantInit
Library comctl32.dll:
• 0x477718 ImageList_Write
• 0x47771c ImageList_Read
• 0x47772c ImageList_DragMove
• 0x477730 ImageList_DragLeave
• 0x477734 ImageList_DragEnter
• 0x477738 ImageList_EndDrag
• 0x47773c ImageList_BeginDrag
• 0x477740 ImageList_Remove
• 0x477744 ImageList_DrawEx
• 0x477748 ImageList_Replace
• 0x47774c ImageList_Draw
• 0x47775c ImageList_Add
• 0x477764 ImageList_Destroy
• 0x477768 ImageList_Create
Library comdlg32.dll:
• 0x477770 GetOpenFileNameA
Library user32.dll:
• 0x477778 DdeCmpStringHandles
• 0x47777c DdeFreeStringHandle
• 0x477780 DdeQueryStringA
• 0x477788 DdeGetLastError
• 0x47778c DdeFreeDataHandle
• 0x477790 DdeUnaccessData
• 0x477794 DdeAccessData
• 0x477798 DdeCreateDataHandle
• 0x4777a0 DdeNameService
• 0x4777a4 DdePostAdvise
• 0x4777a8 DdeSetUserHandle
• 0x4777ac DdeQueryConvInfo
• 0x4777b0 DdeDisconnect
• 0x4777b4 DdeConnect
• 0x4777b8 DdeUninitialize
• 0x4777bc DdeInitializeA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.