12.6
0-day
该样本未表现出任何异常！
重新分析
更多

1571b2ee13c7552f19b2fffc1c3f7dc63dffa8652d0cfa32136852629763018d

26b47b54536e9c45a5d8e9f9141b9859.exe

分析耗时

89s

最近分析

文件大小

8.7MB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
Queries for the computername (2 个事件)
Time & API Arguments Status Return Repeated
1619281462.893502
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619281462.064
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619281462.893502
GlobalMemoryStatusEx
success 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section
section .themida
section .boot
One or more processes crashed (9 个事件)
Time & API Arguments Status Return Repeated
1619281448.877125
__exception__
stacktrace: 
26b47b54536e9c45a5d8e9f9141b9859+0xa68427 @ 0xe68427
26b47b54536e9c45a5d8e9f9141b9859+0x980bad @ 0xd80bad

registers.esp: 22150916
registers.edi: 11444224
registers.eax: 22150916
registers.ebp: 22150996
registers.edx: 2130566132
registers.ebx: 0
registers.esi: 2010805291
registers.ecx: 3320905728
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xc000008e
exception.offset: 46887
exception.address: 0x778eb727
success 0 0
1619281448.939125
__exception__
stacktrace: 

                
            
            
            

        
    
        
            
                registers.esp:
                22151036
                

            
                registers.edi:
                2960906
                

            
                registers.eax:
                1750617430
                

            
                registers.ebp:
                11444224
                

            
                registers.edx:
                22614
                

            
                registers.ebx:
                4194304
                

            
                registers.esi:
                11808892
                

            
                registers.ecx:
                20
                

            
        
    
        
            
                exception.instruction_r:
                ed e9 49 f9 03 00 c3 e9 a7 91 ff ff 1e fb 6e 91
                

            
                exception.symbol:
                26b47b54536e9c45a5d8e9f9141b9859+0xa488a6
                

            
                exception.instruction:
                in eax, dx
                

            
                exception.module:
                26b47b54536e9c45a5d8e9f9141b9859.exe
                

            
                exception.exception_code:
                0xc0000096
                

            
                exception.offset:
                10782886
                

            
                exception.address:
                0xe488a6
                

            
        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281448.939125

    __exception__
    
        

        
            
        
    


    
        
            stacktrace:
            
                
                    

                
            
            
            

        
    
        
            
                registers.esp:
                22151036
                

            
                registers.edi:
                2960906
                

            
                registers.eax:
                1447909480
                

            
                registers.ebp:
                11444224
                

            
                registers.edx:
                22104
                

            
                registers.ebx:
                2256917605
                

            
                registers.esi:
                11808892
                

            
                registers.ecx:
                10
                

            
        
    
        
            
                exception.instruction_r:
                ed e9 11 96 04 00 cf e9 c5 12 18 00 0e 00 00 00
                

            
                exception.symbol:
                26b47b54536e9c45a5d8e9f9141b9859+0xa2ee26
                

            
                exception.instruction:
                in eax, dx
                

            
                exception.module:
                26b47b54536e9c45a5d8e9f9141b9859.exe
                

            
                exception.exception_code:
                0xc0000096
                

            
                exception.offset:
                10677798
                

            
                exception.address:
                0xe2ee26
                

            
        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281454.408502

    __exception__
    
        

        
            
        
    


    
        
            stacktrace:
            
                
                    
ivm31_protected+0x3f031f @ 0x7f031f
ivm31_protected+0x372b2d @ 0x772b2d

                
            
            
            

        
    
        
            
                registers.esp:
                1638148
                

            
                registers.edi:
                4886528
                

            
                registers.eax:
                1638148
                

            
                registers.ebp:
                1638228
                

            
                registers.edx:
                2130566132
                

            
                registers.ebx:
                1638276
                

            
                registers.esi:
                2010805291
                

            
                registers.ecx:
                4203085824
                

            
        
    
        
            
                exception.instruction_r:
                c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
                

            
                exception.symbol:
                RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
                

            
                exception.instruction:
                leave
                

            
                exception.module:
                KERNELBASE.dll
                

            
                exception.exception_code:
                0xc000008e
                

            
                exception.offset:
                46887
                

            
                exception.address:
                0x778eb727
                

            
        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281454.471502

    __exception__
    
        

        
            
        
    


    
        
            stacktrace:
            
                
                    

                
            
            
            

        
    
        
            
                registers.esp:
                1638268
                

            
                registers.edi:
                3026022
                

            
                registers.eax:
                1750617430
                

            
                registers.ebp:
                4886528
                

            
                registers.edx:
                2130532438
                

            
                registers.ebx:
                0
                

            
                registers.esi:
                5123880
                

            
                registers.ecx:
                20
                

            
        
    
        
            
                exception.instruction_r:
                ed e9 84 7a 11 00 c3 e9 7d 8c 12 00 75 92 33 34
                

            
                exception.symbol:
                ivm31_protected+0x334776
                

            
                exception.instruction:
                in eax, dx
                

            
                exception.module:
                ivm31_protected.exe
                

            
                exception.exception_code:
                0xc0000096
                

            
                exception.offset:
                3360630
                

            
                exception.address:
                0x734776
                

            
        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281454.471502

    __exception__
    
        

        
            
        
    


    
        
            stacktrace:
            
                
                    

                
            
            
            

        
    
        
            
                registers.esp:
                1638268
                

            
                registers.edi:
                3026022
                

            
                registers.eax:
                1447909480
                

            
                registers.ebp:
                4886528
                

            
                registers.edx:
                22104
                

            
                registers.ebx:
                2256917605
                

            
                registers.esi:
                5123880
                

            
                registers.ecx:
                10
                

            
        
    
        
            
                exception.instruction_r:
                ed e9 46 28 ff ff d6 f1 ff ff 5f 82 12 0e cb 88
                

            
                exception.symbol:
                ivm31_protected+0x44613e
                

            
                exception.instruction:
                in eax, dx
                

            
                exception.module:
                ivm31_protected.exe
                

            
                exception.exception_code:
                0xc0000096
                

            
                exception.offset:
                4481342
                

            
                exception.address:
                0x84613e
                

            
        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281456.986

    __exception__
    
        

        
            
        
    


    
        
            stacktrace:
            
                
                    
ivm32_protected+0x4a15b2 @ 0xdb15b2
ivm32_protected+0x4a422e @ 0xdb422e

                
            
            
            

        
    
        
            
                registers.esp:
                2816612
                

            
                registers.edi:
                11005952
                

            
                registers.eax:
                2816612
                

            
                registers.ebp:
                2816692
                

            
                registers.edx:
                2130566132
                

            
                registers.ebx:
                0
                

            
                registers.esi:
                2010805291
                

            
                registers.ecx:
                3837198336
                

            
        
    
        
            
                exception.instruction_r:
                c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
                

            
                exception.symbol:
                RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
                

            
                exception.instruction:
                leave
                

            
                exception.module:
                KERNELBASE.dll
                

            
                exception.exception_code:
                0xc000008e
                

            
                exception.offset:
                46887
                

            
                exception.address:
                0x778eb727
                

            
        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281456.986

    __exception__
    
        

        
            
        
    


    
        
            stacktrace:
            
                
                    

                
            
            
            

        
    
        
            
                registers.esp:
                2816732
                

            
                registers.edi:
                4926686
                

            
                registers.eax:
                1750617430
                

            
                registers.ebp:
                11005952
                

            
                registers.edx:
                1071190
                

            
                registers.ebx:
                0
                

            
                registers.esi:
                13
                

            
                registers.ecx:
                20
                

            
        
    
        
            
                exception.instruction_r:
                ed e9 e8 dc ff ff 03 34 5c 29 32 59 a1 06 f7 23
                

            
                exception.symbol:
                ivm32_protected+0x4c8a60
                

            
                exception.instruction:
                in eax, dx
                

            
                exception.module:
                ivm32_protected.exe
                

            
                exception.exception_code:
                0xc0000096
                

            
                exception.offset:
                5016160
                

            
                exception.address:
                0xdd8a60
                

            
        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281456.986

    __exception__
    
        

        
            
        
    


    
        
            stacktrace:
            
                
                    

                
            
            
            

        
    
        
            
                registers.esp:
                2816732
                

            
                registers.edi:
                4926686
                

            
                registers.eax:
                1447909480
                

            
                registers.ebp:
                11005952
                

            
                registers.edx:
                22104
                

            
                registers.ebx:
                2256917605
                

            
                registers.esi:
                13
                

            
                registers.ecx:
                10
                

            
        
    
        
            
                exception.instruction_r:
                ed e9 69 e2 0e 00 c3 e9 37 48 01 00 0c 00 8d 00
                

            
                exception.symbol:
                ivm32_protected+0x3fdc7e
                

            
                exception.instruction:
                in eax, dx
                

            
                exception.module:
                ivm32_protected.exe
                

            
                exception.exception_code:
                0xc0000096
                

            
                exception.offset:
                4185214
                

            
                exception.address:
                0xd0dc7e
                

            
        
    


    
        success
    

0

    
        0
    


                        

                    
                
            

        

    

    

    

    

    

    

    

    

    

    

    

    

    

    

    

    

    

    

    

    

    

    

    

    








      

    


    

      

        行为判定
        
        
      

      

        



    

      
      动态指标
    

    

    
    

    

    

    

    
        
            

                One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
                
            

        

        

            

                
            

        

    

    
        
            

                Performs some HTTP requests
                
                    
                        (1 个事件)
                    
                
            

        

        

            

                
                    
                        

                            request
                            GET http://ip-api.com/line
                            
                        

                    
                
            

        

    

    
        
            

                Resolves a suspicious Top Level Domain (TLD)
                
                    
                        (3 个事件)
                    
                
            

        

        

            

                
                    
                        

                            
                                
                                    domain
                                    sdaurr04.top
                                
                            
                                
                            
                                
                                    description
                                    Generic top level domain TLD
                                
                            
                        

                    
                
                    
                        

                            
                                
                                    domain
                                    asload02.top
                                
                            
                                
                            
                                
                                    description
                                    Generic top level domain TLD
                                
                            
                        

                    
                
                    
                        

                            
                                
                                    domain
                                    moraa03.top
                                
                            
                                
                            
                                
                                    description
                                    Generic top level domain TLD
                                
                            
                        

                    
                
            

        

    

    
        
            

                Allocates read-write-execute memory (usually to unpack itself)
                
                    
                        (18 个事件)
                    
                
            

        

        

            

                
                    
                        
                            
                                

                                    Time & API
                                    Arguments
                                    Status
                                    Return
                                    Repeated
                                

                            
                        
                        

                            

    1619281448.877125

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    420
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    8192
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x77dcf000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281448.877125

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    420
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    8192
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x77d40000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281449.236125

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    420
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    4096
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x004bf000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281449.236125

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    420
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    4096
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x0049f000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281449.236125

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    420
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    4096
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x0049f000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281454.377502

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    428
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    8192
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x77dcf000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281454.377502

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    428
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    8192
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x77d40000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281454.502502

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    428
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    4096
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x0049b000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281454.502502

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    428
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    4096
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x00484000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281454.502502

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    428
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    4096
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x00484000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281463.268502

    NtAllocateVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    428
                
            
            
            

        
    
        
            region_size:
            
                
                    4096
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            allocation_type:
            
                
                    4096
                
            
            
                (MEM_COMMIT)
            
            

        
    
        
            base_address:
            
                
                    0x04730000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281456.939

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    2528
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    8192
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x77dcf000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281456.939

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    2528
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    8192
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x77d40000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281457.096

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    2528
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    4096
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x009b9000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281457.096

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    2528
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    4096
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x0099d000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281457.096

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    2528
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    4096
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x0099d000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281457.143

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    2528
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    122880
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x0099d000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281462.377

    NtAllocateVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    2528
                
            
            
            

        
    
        
            region_size:
            
                
                    4096
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            allocation_type:
            
                
                    4096
                
            
            
                (MEM_COMMIT)
            
            

        
    
        
            base_address:
            
                
                    0x03950000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
            

        

    

    
        
            

                A process attempted to delay the analysis task.
                
                    
                        (3 个事件)
                    
                
            

        

        

            

                
                    
                        

                            
                                
                            
                                
                                    description
                                    ivm31_protected.exe tried to sleep 145 seconds, actually delayed analysis time by 145 seconds
                                
                            
                        

                    
                
                    
                        

                            
                                
                            
                                
                                    description
                                    26b47b54536e9c45a5d8e9f9141b9859.exe tried to sleep 133 seconds, actually delayed analysis time by 133 seconds
                                
                            
                        

                    
                
                    
                        

                            
                                
                            
                                
                                    description
                                    ivm32_protected.exe tried to sleep 144 seconds, actually delayed analysis time by 144 seconds
                                
                            
                        

                    
                
            

        

    

    
        
            

                Steals private information from local Internet browsers
                
                    
                        (38 个事件)
                    
                
            

        

        

            

                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\CookiesCopy-journal
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Profile 1\LoginDataCopy
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Profile 2\Web Data
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Profile 3\Web Data
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\WebDataCopy-wal
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\CookiesCopy-wal
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Profile 2\WebDataCopy
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Web Data
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\WebDataCopy
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\WebDataCopy-journal
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Profile 1\CookiesCopy
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Profile 3\CookiesCopy
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Profile 3\LoginDataCopy
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Profile 3\WebDataCopy
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Profile 2\LoginDataCopy
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Local State
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Profile 1\Web Data
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Profile 1\WebDataCopy
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Web Data-wal
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\LoginDataCopy
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\LoginDataCopy-wal
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\LoginDataCopy-journal
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\CookiesCopy
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Profile 2\CookiesCopy
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\LoginDataCopy
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Profile 2\LoginDataCopy
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Profile 3\WebDataCopy
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Profile 1\CookiesCopy
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Profile 1\WebDataCopy
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Profile 3\CookiesCopy
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Profile 2\WebDataCopy
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Profile 3\LoginDataCopy
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Profile 1\LoginDataCopy
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Local State
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Profile 2\CookiesCopy
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\WebDataCopy
                            
                        

                    
                
                    
                        

                            file
                            C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\CookiesCopy
                            
                        

                    
                
            

        

    

    
        
            

                Looks up the external IP address
                
                    
                        (1 个事件)
                    
                
            

        

        

            

                
                    
                        

                            domain
                            ip-api.com
                            
                        

                    
                
            

        

    

    
        
            

                Creates executable files on the filesystem
                
                    
                        (2 个事件)
                    
                
            

        

        

            

                
                    
                        

                            file
                            C:\ProgramData\Gds\ivm32_protected.exe
                            
                        

                    
                
                    
                        

                            file
                            C:\ProgramData\Gds\ivm31_protected.exe
                            
                        

                    
                
            

        

    

    
        
            

                Checks adapter addresses which can be used to detect virtual network interfaces
                
                    
                        (1 个事件)
                    
                
            

        

        

            

                
                    
                        
                            
                                

                                    Time & API
                                    Arguments
                                    Status
                                    Return
                                    Repeated
                                

                            
                        
                        

                            

    1619281459.346125

    GetAdaptersAddresses
    
        

        
            
        
    


    
        
            flags:
            
                
                    0
                
            
            
            

        
    
        
            family:
            
                
                    0
                
            
            
            

        
    


    
        failed
    

111

    
        0
    


                        

                    
                
            

        

    

    
        
            

                The binary likely contains encrypted or compressed data indicative of a packer
                
                    
                        (6 个事件)
                    
                
            

        

        

            

                
                    
                        

                            
                                
                                    entropy
                                    7.976173180922792
                                
                            
                                
                                    section
                                    {'size_of_data': '0x00053e00', 'virtual_address': '0x00001000', 'entropy': 7.976173180922792, 'name': '        ', 'virtual_size': '0x0009d5d1'}
                                
                            
                                
                            
                                
                                    description
                                    A section with a high entropy has been found
                                
                            
                        

                    
                
                    
                        

                            
                                
                                    entropy
                                    7.9734048118898935
                                
                            
                                
                                    section
                                    {'size_of_data': '0x00007a00', 'virtual_address': '0x0009f000', 'entropy': 7.9734048118898935, 'name': '        ', 'virtual_size': '0x000233f6'}
                                
                            
                                
                            
                                
                                    description
                                    A section with a high entropy has been found
                                
                            
                        

                    
                
                    
                        

                            
                                
                                    entropy
                                    7.845893477841245
                                
                            
                                
                                    section
                                    {'size_of_data': '0x00001200', 'virtual_address': '0x000c3000', 'entropy': 7.845893477841245, 'name': '        ', 'virtual_size': '0x0000a0d8'}
                                
                            
                                
                            
                                
                                    description
                                    A section with a high entropy has been found
                                
                            
                        

                    
                
                    
                        

                            
                                
                                    entropy
                                    7.937982385115726
                                
                            
                                
                                    section
                                    {'size_of_data': '0x00615c00', 'virtual_address': '0x000ce000', 'entropy': 7.937982385115726, 'name': '        ', 'virtual_size': '0x00615a54'}
                                
                            
                                
                            
                                
                                    description
                                    A section with a high entropy has been found
                                
                            
                        

                    
                
                    
                        

                            
                                
                                    entropy
                                    7.957198147290428
                                
                            
                                
                                    section
                                    {'size_of_data': '0x00246000', 'virtual_address': '0x00ad2000', 'entropy': 7.957198147290428, 'name': '.boot', 'virtual_size': '0x00246000'}
                                
                            
                                
                            
                                
                                    description
                                    A section with a high entropy has been found
                                
                            
                        

                    
                
                    
                        

                            
                                
                                    entropy
                                    0.9979882648784577
                                
                            
                                
                            
                                
                                    description
                                    Overall entropy of this PE file is high
                                
                            
                        

                    
                
            

        

    

    
        
            

                Queries for potentially installed applications
                
                    
                        (2 个事件)
                    
                
            

        

        

            

                
                    
                        
                            
                                

                                    Time & API
                                    Arguments
                                    Status
                                    Return
                                    Repeated
                                

                            
                        
                        

                            

    1619281462.924502

    RegOpenKeyExW
    
        

        
            
        
    


    
        
            access:
            
                
                    0x00020119
                
            
            
            

        
    
        
            base_handle:
            
                
                    0x80000001
                
            
            
            

        
    
        
            key_handle:
            
                
                    0x00000000
                
            
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
                
            
            
            

        
    
        
            regkey_r:
            
                
                    SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
                
            
            
            

        
    
        
            options:
            
                
                    0
                
            
            
            

        
    


    
        failed
    

2

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281462.064

    RegOpenKeyExW
    
        

        
            
        
    


    
        
            access:
            
                
                    0x00020119
                
            
            
            

        
    
        
            base_handle:
            
                
                    0x80000001
                
            
            
            

        
    
        
            key_handle:
            
                
                    0x00000000
                
            
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
                
            
            
            

        
    
        
            regkey_r:
            
                
                    SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
                
            
            
            

        
    
        
            options:
            
                
                    0
                
            
            
            

        
    


    
        failed
    

2

    
        0
    


                        

                    
                
            

        

    

    

    

    

    

    

    

    

    

    

    

    

    







        



    

      
      网络通信
    

    


    

    

    

    

    

    

    

    

    

    

    

    

    

    

    

    
        
            

                Communicates with host for which no DNS query was performed
                
                    
                        (1 个事件)
                    
                
            

        

        

            

                
                    
                        

                            
                                
                                    host
                                    172.217.24.14
                                
                            
                                
                            
                        

                    
                
            

        

    

    
        
            

                Attempts to identify installed AV products by installation directory
                
                    
                        (2 个事件)
                    
                
            

        

        

            

                
                    
                        

                            file
                            C:\ProgramData\AVAST Software
                            
                        

                    
                
                    
                        

                            file
                            C:\ProgramData\Avg
                            
                        

                    
                
            

        

    

    
        
            

                Checks for the presence of known windows from debuggers and forensic tools
                
                    
                        (50 out of 293 个事件)
                    
                
            

        

        

            

                
                    
                        
                            
                                

                                    Time & API
                                    Arguments
                                    Status
                                    Return
                                    Repeated
                                

                            
                        
                        

                            

    1619281448.877125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    FilemonClass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281448.877125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    FilemonClass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281448.877125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    File Monitor - Sysinternals: www.sysinternals.com
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281448.877125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    PROCMON_WINDOW_CLASS
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281448.877125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Process Monitor - Sysinternals: www.sysinternals.com
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281448.893125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    RegmonClass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281448.893125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    RegmonClass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281448.893125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Registry Monitor - Sysinternals: www.sysinternals.com
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281448.893125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    18467-41
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281452.939125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Regmonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281452.939125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Regmonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281453.252125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    18467-41
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281453.564125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Filemonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281453.564125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Filemonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281453.564125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    PROCMON_WINDOW_CLASS
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281457.580125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Regmonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281457.580125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Regmonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281457.893125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    18467-41
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281458.205125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Filemonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281458.205125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Filemonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281458.205125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    PROCMON_WINDOW_CLASS
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281462.205125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Regmonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281462.205125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Regmonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281462.518125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    18467-41
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281462.830125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Filemonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281462.830125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Filemonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281462.830125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    PROCMON_WINDOW_CLASS
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281466.830125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Regmonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281466.830125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Regmonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281467.143125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    18467-41
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281467.455125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Filemonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281467.455125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Filemonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281467.455125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    PROCMON_WINDOW_CLASS
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281471.455125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Regmonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281471.455125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Regmonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281471.768125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    18467-41
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281472.080125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Filemonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281472.080125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Filemonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281472.080125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    PROCMON_WINDOW_CLASS
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281476.080125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Regmonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281476.080125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Regmonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281476.393125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    18467-41
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281476.705125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Filemonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281476.705125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Filemonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281476.705125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    PROCMON_WINDOW_CLASS
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281480.705125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Regmonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281480.705125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Regmonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281481.018125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    18467-41
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281481.330125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Filemonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281481.330125

    FindWindowA
    
        

        
            
        
    


    
        
            class_name:
            
                
                    Filemonclass
                
            
            
            

        
    
        
            window_name:
            
                
                    
                
            
            
            

        
    


    
        failed
    

0

    
        0
    


                        

                    
                
            

        

    

    
        
            

                Checks the version of Bios, possibly for anti-virtualization
                
                    
                        (2 个事件)
                    
                
            

        

        

            

                
                    
                        

                            registry
                            HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
                            
                        

                    
                
                    
                        

                            registry
                            HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion
                            
                        

                    
                
            

        

    

    
        
            

                Checks the CPU name from registry, possibly for anti-virtualization
                
                    
                        (1 个事件)
                    
                
            

        

        

            

                
                    
                        

                            registry
                            HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString
                            
                        

                    
                
            

        

    

    
        
            

                Attempts to access Bitcoin/ALTCoin wallets
                
                    
                        (2 个事件)
                    
                
            

        

        

            

                
                    
                        

                            file
                            C:\ProgramData\bRIu5nmc4alVaV6\Files\Crypto\Electrum\wallets
                            
                        

                    
                
                    
                        

                            file
                            C:\ProgramData\QwFYDtoqVvZq\Files\Coins\Electrum\wallets
                            
                        

                    
                
            

        

    

    
        
            

                Sets or modifies WPAD proxy autoconfiguration file for traffic interception
                
                    
                        (36 个事件)
                    
                
            

        

        

            

                
                    
                        
                            
                                

                                    Time & API
                                    Arguments
                                    Status
                                    Return
                                    Repeated
                                

                            
                        
                        

                            

    1619281461.908125

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x000003c4
                
            
            
            

        
    
        
            value:
            
                
                    1
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecisionReason
                
            
            
            

        
    
        
            reg_type:
            
                
                    4
                
            
            
                (REG_DWORD)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281461.908125

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x000003c4
                
            
            
            

        
    
        
            value:
            
                
                    @U9×
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecisionTime
                
            
            
            

        
    
        
            reg_type:
            
                
                    3
                
            
            
                (REG_BINARY)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281461.908125

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x000003c4
                
            
            
            

        
    
        
            value:
            
                
                    3
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecision
                
            
            
            

        
    
        
            reg_type:
            
                
                    4
                
            
            
                (REG_DWORD)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281461.908125

    RegSetValueExW
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x000003c4
                
            
            
            

        
    
        
            value:
            
                
                    网络  2
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadNetworkName
                
            
            
            

        
    
        
            reg_type:
            
                
                    1
                
            
            
                (REG_SZ)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281461.924125

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x000003e0
                
            
            
            

        
    
        
            value:
            
                
                    1
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecisionReason
                
            
            
            

        
    
        
            reg_type:
            
                
                    4
                
            
            
                (REG_DWORD)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281461.924125

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x000003e0
                
            
            
            

        
    
        
            value:
            
                
                    @U9×
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecisionTime
                
            
            
            

        
    
        
            reg_type:
            
                
                    3
                
            
            
                (REG_BINARY)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281461.924125

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x000003e0
                
            
            
            

        
    
        
            value:
            
                
                    3
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecision
                
            
            
            

        
    
        
            reg_type:
            
                
                    4
                
            
            
                (REG_DWORD)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281461.299502

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x00000418
                
            
            
            

        
    
        
            value:
            
                
                    1
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecisionReason
                
            
            
            

        
    
        
            reg_type:
            
                
                    4
                
            
            
                (REG_DWORD)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281461.299502

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x00000418
                
            
            
            

        
    
        
            value:
            
                
                    0÷!9×
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecisionTime
                
            
            
            

        
    
        
            reg_type:
            
                
                    3
                
            
            
                (REG_BINARY)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281461.299502

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x00000418
                
            
            
            

        
    
        
            value:
            
                
                    3
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecision
                
            
            
            

        
    
        
            reg_type:
            
                
                    4
                
            
            
                (REG_DWORD)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281461.299502

    RegSetValueExW
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x00000418
                
            
            
            

        
    
        
            value:
            
                
                    网络  2
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadNetworkName
                
            
            
            

        
    
        
            reg_type:
            
                
                    1
                
            
            
                (REG_SZ)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281461.299502

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x0000042c
                
            
            
            

        
    
        
            value:
            
                
                    1
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecisionReason
                
            
            
            

        
    
        
            reg_type:
            
                
                    4
                
            
            
                (REG_DWORD)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281461.299502

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x0000042c
                
            
            
            

        
    
        
            value:
            
                
                    0÷!9×
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecisionTime
                
            
            
            

        
    
        
            reg_type:
            
                
                    3
                
            
            
                (REG_BINARY)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281461.299502

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x0000042c
                
            
            
            

        
    
        
            value:
            
                
                    3
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecision
                
            
            
            

        
    
        
            reg_type:
            
                
                    4
                
            
            
                (REG_DWORD)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281461.330502

    RegSetValueExW
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x00000414
                
            
            
            

        
    
        
            value:
            
                
                    {40112ABE-63B3-43C3-BE93-1440EE3AF106}
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadLastNetwork
                
            
            
            

        
    
        
            reg_type:
            
                
                    1
                
            
            
                (REG_SZ)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281462.924502

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x00000444
                
            
            
            

        
    
        
            value:
            
                
                    1
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecisionReason
                
            
            
            

        
    
        
            reg_type:
            
                
                    4
                
            
            
                (REG_DWORD)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281462.924502

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x00000444
                
            
            
            

        
    
        
            value:
            
                
                    À\9×
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecisionTime
                
            
            
            

        
    
        
            reg_type:
            
                
                    3
                
            
            
                (REG_BINARY)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281462.924502

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x00000444
                
            
            
            

        
    
        
            value:
            
                
                    0
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecision
                
            
            
            

        
    
        
            reg_type:
            
                
                    4
                
            
            
                (REG_DWORD)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281462.924502

    RegSetValueExW
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x00000444
                
            
            
            

        
    
        
            value:
            
                
                    网络  2
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadNetworkName
                
            
            
            

        
    
        
            reg_type:
            
                
                    1
                
            
            
                (REG_SZ)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281462.924502

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x00000208
                
            
            
            

        
    
        
            value:
            
                
                    1
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecisionReason
                
            
            
            

        
    
        
            reg_type:
            
                
                    4
                
            
            
                (REG_DWORD)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281462.924502

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x00000208
                
            
            
            

        
    
        
            value:
            
                
                    À\9×
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecisionTime
                
            
            
            

        
    
        
            reg_type:
            
                
                    3
                
            
            
                (REG_BINARY)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281462.924502

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x00000208
                
            
            
            

        
    
        
            value:
            
                
                    0
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecision
                
            
            
            

        
    
        
            reg_type:
            
                
                    4
                
            
            
                (REG_DWORD)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281461.486

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x000003c4
                
            
            
            

        
    
        
            value:
            
                
                    1
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecisionReason
                
            
            
            

        
    
        
            reg_type:
            
                
                    4
                
            
            
                (REG_DWORD)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281461.502

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x000003c4
                
            
            
            

        
    
        
            value:
            
                
                    àð@9×
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecisionTime
                
            
            
            

        
    
        
            reg_type:
            
                
                    3
                
            
            
                (REG_BINARY)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281461.502

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x000003c4
                
            
            
            

        
    
        
            value:
            
                
                    3
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecision
                
            
            
            

        
    
        
            reg_type:
            
                
                    4
                
            
            
                (REG_DWORD)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281461.502

    RegSetValueExW
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x000003c4
                
            
            
            

        
    
        
            value:
            
                
                    网络  2
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadNetworkName
                
            
            
            

        
    
        
            reg_type:
            
                
                    1
                
            
            
                (REG_SZ)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281461.502

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x000003d8
                
            
            
            

        
    
        
            value:
            
                
                    1
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecisionReason
                
            
            
            

        
    
        
            reg_type:
            
                
                    4
                
            
            
                (REG_DWORD)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281461.502

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x000003d8
                
            
            
            

        
    
        
            value:
            
                
                    àð@9×
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecisionTime
                
            
            
            

        
    
        
            reg_type:
            
                
                    3
                
            
            
                (REG_BINARY)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281461.502

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x000003d8
                
            
            
            

        
    
        
            value:
            
                
                    3
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecision
                
            
            
            

        
    
        
            reg_type:
            
                
                    4
                
            
            
                (REG_DWORD)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281462.002

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x000003ec
                
            
            
            

        
    
        
            value:
            
                
                    1
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecisionReason
                
            
            
            

        
    
        
            reg_type:
            
                
                    4
                
            
            
                (REG_DWORD)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281462.002

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x000003ec
                
            
            
            

        
    
        
            value:
            
                
                     ­9×
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecisionTime
                
            
            
            

        
    
        
            reg_type:
            
                
                    3
                
            
            
                (REG_BINARY)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281462.002

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x000003ec
                
            
            
            

        
    
        
            value:
            
                
                    0
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecision
                
            
            
            

        
    
        
            reg_type:
            
                
                    4
                
            
            
                (REG_DWORD)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281462.002

    RegSetValueExW
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x000003ec
                
            
            
            

        
    
        
            value:
            
                
                    网络  2
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadNetworkName
                
            
            
            

        
    
        
            reg_type:
            
                
                    1
                
            
            
                (REG_SZ)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281462.002

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x000003f0
                
            
            
            

        
    
        
            value:
            
                
                    1
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecisionReason
                
            
            
            

        
    
        
            reg_type:
            
                
                    4
                
            
            
                (REG_DWORD)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281462.002

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x000003f0
                
            
            
            

        
    
        
            value:
            
                
                     ­9×
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecisionTime
                
            
            
            

        
    
        
            reg_type:
            
                
                    3
                
            
            
                (REG_BINARY)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619281462.002

    RegSetValueExA
    
        

        
            
        
    


    
        
            key_handle:
            
                
                    0x000003f0
                
            
            
            

        
    
        
            value:
            
                
                    0
                
            
            
            

        
    
        
            regkey_r:
            
                
                    WpadDecision
                
            
            
            

        
    
        
            reg_type:
            
                
                    4
                
            
            
                (REG_DWORD)
            
            

        
    
        
            regkey:
            
                
                    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
            

        

    

    
        
            

                Network activity contains more than one unique useragent
                
                    
                        (3 个事件)
                    
                
            

        

        

            

                
                    
                        

                            
                                
                                    process
                                    26b47b54536e9c45a5d8e9f9141b9859.exe
                                
                            
                                
                                    useragent
                                    AutoHotkey
                                
                            
                                
                            
                        

                    
                
                    
                        

                            
                                
                                    process
                                    ivm31_protected.exe
                                
                            
                                
                                    useragent
                                    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3988.132 Safari/537.36
                                
                            
                                
                            
                        

                    
                
                    
                        

                            
                                
                                    process
                                    ivm32_protected.exe
                                
                            
                                
                                    useragent
                                    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.106 Safari/537.36
                                
                            
                                
                            
                        

                    
                
            

        

    

    
        
            

                Detects VirtualBox through the presence of a registry key
                
                    
                        (1 个事件)
                    
                
            

        

        

            

                
                    
                        

                            registry
                            HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                            
                        

                    
                
            

        

    

    
        
            

                Detects Virtual Machines through their custom firmware
                
                    
                        (1 个事件)
                    
                
            

        

        

            

                
                    
                        
                            
                                

                                    Time & API
                                    Arguments
                                    Status
                                    Return
                                    Repeated
                                

                            
                        
                        

                            

    1619281448.939125

    NtQuerySystemInformation
    
        

        
            
        
    


    
        
            information_class:
            
                
                    76
                
            
            
                (SystemFirmwareTableInformation)
            
            

        
    


    
        failed
    

3221225507

    
        0
    


                        

                    
                
            

        

    

    
        
            

                Detects VMWare through the in instruction feature
                
                    
                        (1 个事件)
                    
                
            

        

        

            

                
                    
                        
                            
                                

                                    Time & API
                                    Arguments
                                    Status
                                    Return
                                    Repeated
                                

                            
                        
                        

                            

    1619281448.939125

    __exception__
    
        

        
            
        
    


    
        
            stacktrace:
            
                
                    

                
            
            
            

        
    
        
            
                registers.esp:
                22151036
                

            
                registers.edi:
                2960906
                

            
                registers.eax:
                1447909480
                

            
                registers.ebp:
                11444224
                

            
                registers.edx:
                22104
                

            
                registers.ebx:
                2256917605
                

            
                registers.esi:
                11808892
                

            
                registers.ecx:
                10
                

            
        
    
        
            
                exception.instruction_r:
                ed e9 11 96 04 00 cf e9 c5 12 18 00 0e 00 00 00
                

            
                exception.symbol:
                26b47b54536e9c45a5d8e9f9141b9859+0xa2ee26
                

            
                exception.instruction:
                in eax, dx
                

            
                exception.module:
                26b47b54536e9c45a5d8e9f9141b9859.exe
                

            
                exception.exception_code:
                0xc0000096
                

            
                exception.offset:
                10677798
                

            
                exception.address:
                0xe2ee26
                

            
        
    


    
        success
    

0

    
        0
    


                        

                    
                
            

        

    

    
        
            

                Generates some ICMP traffic
                
            

        

        

            

                
            

        

    






      


    


    

      

        可视化分析
        
        
      

      

        


    

      
      二进制图像
    

    
        

            

                
                

                    暂无二进制图像
                    该样本未生成二进制可视化图像
                

            

        

    





        

    

      
      运行截图
    

    
        

            

                
                

                    暂无运行截图
                    该样本运行过程中未生成截图
                

            

        

    





      


    


  



    

    

        





    

        

            
👋 欢迎使用 ChatHawk

            
我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

            

                
🔍 主要威胁分析

                
⚡ 行为特征

                
🛡️ 防护建议

                
🔧 技术手段

                
🎯 检测方法

            

        

    

    

        

            
🤖

            

                

                

                

            

        

    

    

        
        
    








    

    

        

    
    

        

            
                

    
        
            

                
 PE Compile Time

                
2018-01-21 08:27:26

            

            

        
        
        
        
        
        
        

        

        
            

                
Imports

                

                    
                        

                            
Library kernel32.dll:

                            
                                
• 0xae4278 GetModuleHandleA

                            
                        

                    
                        

                            
Library WSOCK32.dll:

                            
                                
• 0xae4280 WSACleanup

                            
                        

                    
                        

                            
Library WINMM.dll:

                            
                                
                            
                        

                    
                        

                            
Library VERSION.dll:

                            
                                
• 0xae4290 VerQueryValueW

                            
                        

                    
                        

                            
Library COMCTL32.dll:

                            
                                
• 0xae4298 ImageList_Create

                            
                        

                    
                        

                            
Library PSAPI.DLL:

                            
                                
• 0xae42a0 GetModuleBaseNameW

                            
                        

                    
                        

                            
Library USER32.dll:

                            
                                
• 0xae42a8 GetSubMenu

                            
                        

                    
                        

                            
Library GDI32.dll:

                            
                                
• 0xae42b0 GetPixel

                            
                        

                    
                        

                            
Library COMDLG32.dll:

                            
                                
                            
                        

                    
                        

                            
Library ADVAPI32.dll:

                            
                                
• 0xae42c0 RegDeleteKeyW

                            
                        

                    
                        

                            
Library SHELL32.dll:

                            
                                
• 0xae42c8 DragQueryPoint

                            
                        

                    
                        

                            
Library ole32.dll:

                            
                                
• 0xae42d0 OleInitialize

                            
                        

                    
                        

                            
Library OLEAUT32.dll:

                            
                                
• 0xae42d8 SafeArrayGetLBound

                            
                        

                    
                

            

            

        

        
    



            
        

        

            

    

        
    



        

    



    

    
    

        

    
    

        

    
Hosts

    
        
No hosts contacted.

    




        
        





    
TCP

    
        

            

                

                    

                        Source
                        Source Port
                        Destination
                        Destination Port
                    

                    
                        

                            192.168.56.101
                            49183
                            208.95.112.1 ip-api.com
                            80
                        

                    
                        

                            192.168.56.101
                            49184
                            208.95.112.1 ip-api.com
                            80
                        

                    
                

            

            

        

    





        





    
UDP

    
        

            

                

                    

                        Source
                        Source Port
                        Destination
                        Destination Port
                    

                    
                        

                            192.168.56.101
                            49713
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            50002
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            50534
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            53210
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            53237
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            53380
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            54260
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            55368
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            56539
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            57236
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            58367
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            60088
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            60221
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            60384
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            62912
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            65004
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            137
                            192.168.56.255 
                            137
                        

                    
                        

                            192.168.56.101
                            138
                            192.168.56.255 
                            138
                        

                    
                        

                            192.168.56.101
                            123
                            20.189.79.72 time.windows.com
                            123
                        

                    
                        

                            192.168.56.101
                            49235
                            224.0.0.252 
                            5355
                        

                    
                

            

            

        

    




        



HTTP & HTTPS Requests




    

        URI
        Data
    

    
    

        http://ip-api.com/line
        
GET /line HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: ip-api.com
Connection: Keep-Alive



    

    





        
ICMP traffic



No ICMP traffic performed.



        
IRC traffic



No IRC requests performed.



        
Suricata Alerts


    
No Suricata Alerts




Suricata TLS


    
No Suricata TLS




        
Snort Alerts


    
No Snort Alerts




    




    

    

        
    
Sorry! No dropped files.



    

    

        
    
Sorry! No dropped buffers.