7.6
高危
61 个模型检测该样本为恶意！
重新分析
更多

dbbaf0499e544e3832699110f71f62a521ec93cc8a74656c92af7023f554d897

37d0f2c1177b55d247c8580a3f63c165.exe

分析耗时

110s

最近分析

文件大小

694.0KB
静态报毒 动态报毒 0RWUYKOMEJQ 100% AGENTTESLA AI SCORE=85 AIDETECTVM ALI2000015 AUTO CLASSIC CMZTD CONFIDENCE DELF DELFINJECT DELPHILESS ELDORADO ELZG EMHC FAREIT GENERICKD GENETIC HIGH CONFIDENCE HKOMRH KRYPTIK MALWARE2 MALWARE@#3IUQRIT444ZMY NANOCORE REMCOS RGW@AIIDFHFI S + TROJ SCORE STATIC AI SUSGEN SUSPICIOUS PE THKAOBO TSCOPE UNSAFE WACATAC X2066 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Avast Win32:Malware-gen 20201210 21.1.5827.0
Kingsoft 20201211 2017.9.26.565
McAfee Fareit-FTB!37D0F2C1177B 20201211 6.0.6.653
Tencent Win32.Trojan.Inject.Auto 20201211 1.0.0.1
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (13 个事件)
Time & API Arguments Status Return Repeated
1619350314.992498
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
37d0f2c1177b55d247c8580a3f63c165+0x5a3f8 @ 0x45a3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdaf14ad
success 0 0
1619350322.99225
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
37d0f2c1177b55d247c8580a3f63c165+0x5a3f8 @ 0x45a3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75124b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75125d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfd9314ad
success 0 0
1619350327.945375
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
37d0f2c1177b55d247c8580a3f63c165+0x5a3f8 @ 0x45a3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff4414ad
success 0 0
1619350334.24225
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
37d0f2c1177b55d247c8580a3f63c165+0x5a3f8 @ 0x45a3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x751c4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x751c5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff4314ad
success 0 0
1619350339.367375
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
37d0f2c1177b55d247c8580a3f63c165+0x5a3f8 @ 0x45a3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfd9114ad
success 0 0
1619350345.945
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
37d0f2c1177b55d247c8580a3f63c165+0x5a3f8 @ 0x45a3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75124b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75125d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdce14ad
success 0 0
1619350351.305
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
37d0f2c1177b55d247c8580a3f63c165+0x5a3f8 @ 0x45a3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x751c4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x751c5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff2014ad
success 0 0
1619350355.133498
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
37d0f2c1177b55d247c8580a3f63c165+0x5a3f8 @ 0x45a3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75124b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75125d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff4214ad
success 0 0
1619350359.78975
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
37d0f2c1177b55d247c8580a3f63c165+0x5a3f8 @ 0x45a3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x751c4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x751c5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfd8814ad
success 0 0
1619350364.289498
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
37d0f2c1177b55d247c8580a3f63c165+0x5a3f8 @ 0x45a3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff2c14ad
success 0 0
1619350369.570498
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
37d0f2c1177b55d247c8580a3f63c165+0x5a3f8 @ 0x45a3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75124b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75125d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff2514ad
success 0 0
1619350374.070625
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
37d0f2c1177b55d247c8580a3f63c165+0x5a3f8 @ 0x45a3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff3b14ad
success 0 0
1619350379.211875
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
37d0f2c1177b55d247c8580a3f63c165+0x5a3f8 @ 0x45a3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfd8c14ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (50 out of 406 个事件)
Time & API Arguments Status Return Repeated
1619345031.07685
NtAllocateVirtualMemory
process_identifier: 3060
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00360000
success 0 0
1619345031.26385
NtProtectVirtualMemory
process_identifier: 3060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00454000
success 0 0
1619345031.26385
NtAllocateVirtualMemory
process_identifier: 3060
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02e20000
success 0 0
1619350314.242498
NtProtectVirtualMemory
process_identifier: 884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619350314.305498
NtAllocateVirtualMemory
process_identifier: 884
region_size: 1179648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x006c0000
success 0 0
1619350314.305498
NtAllocateVirtualMemory
process_identifier: 884
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007a0000
success 0 0
1619350314.305498
NtAllocateVirtualMemory
process_identifier: 884
region_size: 335872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00510000
success 0 0
1619350314.320498
NtProtectVirtualMemory
process_identifier: 884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 307200
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00512000
success 0 0
1619350314.977498
NtProtectVirtualMemory
process_identifier: 884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00592000
success 0 0
1619350314.977498
NtProtectVirtualMemory
process_identifier: 884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619350314.977498
NtProtectVirtualMemory
process_identifier: 884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00592000
success 0 0
1619350314.977498
NtProtectVirtualMemory
process_identifier: 884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619350314.977498
NtProtectVirtualMemory
process_identifier: 884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00592000
success 0 0
1619350314.977498
NtProtectVirtualMemory
process_identifier: 884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619350314.977498
NtProtectVirtualMemory
process_identifier: 884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00592000
success 0 0
1619350314.977498
NtProtectVirtualMemory
process_identifier: 884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619350314.977498
NtProtectVirtualMemory
process_identifier: 884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00592000
success 0 0
1619350314.977498
NtProtectVirtualMemory
process_identifier: 884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619350314.977498
NtProtectVirtualMemory
process_identifier: 884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00592000
success 0 0
1619350314.977498
NtProtectVirtualMemory
process_identifier: 884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619350314.977498
NtProtectVirtualMemory
process_identifier: 884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00592000
success 0 0
1619350314.977498
NtProtectVirtualMemory
process_identifier: 884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619350314.977498
NtProtectVirtualMemory
process_identifier: 884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00592000
success 0 0
1619350314.977498
NtProtectVirtualMemory
process_identifier: 884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619350314.977498
NtProtectVirtualMemory
process_identifier: 884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00592000
success 0 0
1619350314.977498
NtProtectVirtualMemory
process_identifier: 884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619350314.977498
NtProtectVirtualMemory
process_identifier: 884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00592000
success 0 0
1619350314.977498
NtProtectVirtualMemory
process_identifier: 884
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619350314.320375
NtAllocateVirtualMemory
process_identifier: 2860
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619350314.383375
NtProtectVirtualMemory
process_identifier: 2860
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00454000
success 0 0
1619350314.399375
NtAllocateVirtualMemory
process_identifier: 2860
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01e80000
success 0 0
1619350320.28975
NtAllocateVirtualMemory
process_identifier: 2764
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619350320.43075
NtProtectVirtualMemory
process_identifier: 2764
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00454000
success 0 0
1619350320.44575
NtAllocateVirtualMemory
process_identifier: 2764
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f70000
success 0 0
1619350322.75825
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619350322.78925
NtAllocateVirtualMemory
process_identifier: 2196
region_size: 917504
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01e30000
success 0 0
1619350322.78925
NtAllocateVirtualMemory
process_identifier: 2196
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01ed0000
success 0 0
1619350322.78925
NtAllocateVirtualMemory
process_identifier: 2196
region_size: 335872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00560000
success 0 0
1619350322.78925
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 307200
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619350322.96125
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003d2000
success 0 0
1619350322.96125
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619350322.96125
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003d2000
success 0 0
1619350322.96125
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619350322.96125
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003d2000
success 0 0
1619350322.96125
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619350322.96125
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003d2000
success 0 0
1619350322.96125
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619350322.96125
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003d2000
success 0 0
1619350322.96125
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619350322.96125
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003d2000
success 0 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (50 out of 54 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.254247640367094 section {'size_of_data': '0x00047200', 'virtual_address': '0x0006d000', 'entropy': 7.254247640367094, 'name': '.rsrc', 'virtual_size': '0x000471e0'} description A section with a high entropy has been found
entropy 0.41053391053391053 description Overall entropy of this PE file is high
Expresses interest in specific running processes (1 个事件)
process 37d0f2c1177b55d247c8580a3f63c165.exe
Repeatedly searches for a not-found process, you may want to run a web browser during analysis (40 个事件)
Time & API Arguments Status Return Repeated
1619345031.27985
Process32NextW
process_name: 37d0f2c1177b55d247c8580a3f63c165.exe
snapshot_handle: 0x000000f8
process_identifier: 3060
failed 0 0
1619350314.461375
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 2900
failed 0 0
1619350319.617375
Process32NextW
process_name: 37d0f2c1177b55d247c8580a3f63c165.exe
snapshot_handle: 0x00000194
process_identifier: 2860
failed 0 0
1619350320.52475
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 392
failed 0 0
1619350323.14925
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 648
failed 0 0
1619350325.60225
Process32NextW
process_name: 37d0f2c1177b55d247c8580a3f63c165.exe
snapshot_handle: 0x0000014c
process_identifier: 1908
failed 0 0
1619350326.336
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000fc
process_identifier: 624
failed 0 0
1619350328.14975
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 1948
failed 0 0
1619350330.44575
Process32NextW
process_name: 37d0f2c1177b55d247c8580a3f63c165.exe
snapshot_handle: 0x00000138
process_identifier: 2040
failed 0 0
1619350331.44575
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 1940
failed 0 0
1619350333.899625
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 2240
failed 0 0
1619350336.602625
Process32NextW
process_name: 37d0f2c1177b55d247c8580a3f63c165.exe
snapshot_handle: 0x0000013c
process_identifier: 1320
failed 0 0
1619350337.258
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3036
failed 0 0
1619350339.758125
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3220
failed 0 0
1619350342.524125
Process32NextW
process_name: 37d0f2c1177b55d247c8580a3f63c165.exe
snapshot_handle: 0x00000128
process_identifier: 3144
failed 0 0
1619350344.19525
Process32NextW
process_name: 37d0f2c1177b55d247c8580a3f63c165.exe
snapshot_handle: 0x000000f8
process_identifier: 3248
failed 0 0
1619350346.039
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3576
failed 0 0
1619350349.664
Process32NextW
process_name: dllhost.exe
snapshot_handle: 0x0000013c
process_identifier: 3644
failed 0 0
1619350350.149
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3740
failed 0 0
1619350351.930498
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3908
failed 0 0
1619350353.383498
Process32NextW
process_name: 37d0f2c1177b55d247c8580a3f63c165.exe
snapshot_handle: 0x00000128
process_identifier: 3816
failed 0 0
1619350354.149375
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000fc
process_identifier: 3984
failed 0 0
1619350355.664
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000fc
process_identifier: 2840
failed 0 0
1619350356.977
Process32NextW
process_name: 37d0f2c1177b55d247c8580a3f63c165.exe
snapshot_handle: 0x00000120
process_identifier: 4060
failed 0 0
1619350357.89975
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 1244
failed 0 0
1619350359.945
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3564
failed 0 0
1619350362.024
Process32NextW
process_name: 37d0f2c1177b55d247c8580a3f63c165.exe
snapshot_handle: 0x00000128
process_identifier: 1664
failed 0 0
1619350362.6645
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000fc
process_identifier: 3416
failed 0 0
1619350364.539375
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3844
failed 0 0
1619350366.539375
Process32NextW
process_name: 37d0f2c1177b55d247c8580a3f63c165.exe
snapshot_handle: 0x0000011c
process_identifier: 3828
failed 0 0
1619350367.55575
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 1740
failed 0 0
1619350369.977875
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3588
failed 0 0
1619350371.930875
Process32NextW
process_name: 37d0f2c1177b55d247c8580a3f63c165.exe
snapshot_handle: 0x00000130
process_identifier: 3928
failed 0 0
1619350372.617625
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000fc
process_identifier: 2796
failed 0 0
1619350374.633625
Process32NextW
process_name: 37d0f2c1177b55d247c8580a3f63c165.exe
snapshot_handle: 0x000000f8
process_identifier: 3424
failed 0 0
1619350376.117625
Process32NextW
process_name: mscorsvw.exe
snapshot_handle: 0x00000124
process_identifier: 3760
failed 0 0
1619350377.242
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3216
failed 0 0
1619350380.649
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3864
failed 0 0
1619350383.133
Process32NextW
process_name: 37d0f2c1177b55d247c8580a3f63c165.exe
snapshot_handle: 0x00000114
process_identifier: 3292
failed 0 0
1619350384.164375
Process32NextW
process_name: sppsvc.exe
snapshot_handle: 0x000000f8
process_identifier: 3264
failed 0 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Manipulates memory of a non-child process indicative of process injection (3 个事件)
Process injection Process 2212 manipulating memory of non-child process 3492
Time & API Arguments Status Return Repeated
1619350385.867375
NtUnmapViewOfSection
process_identifier: 3492
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619350385.883375
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 3492
commit_size: 720896
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 720896
base_address: 0x00400000
success 0 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (28 个事件)
Process injection Process 3060 called NtSetContextThread to modify thread in remote process 884
Process injection Process 2764 called NtSetContextThread to modify thread in remote process 2196
Process injection Process 1712 called NtSetContextThread to modify thread in remote process 324
Process injection Process 1688 called NtSetContextThread to modify thread in remote process 1804
Process injection Process 3008 called NtSetContextThread to modify thread in remote process 1056
Process injection Process 3248 called NtSetContextThread to modify thread in remote process 3420
Process injection Process 3684 called NtSetContextThread to modify thread in remote process 3756
Process injection Process 3924 called NtSetContextThread to modify thread in remote process 4000
Process injection Process 2436 called NtSetContextThread to modify thread in remote process 2064
Process injection Process 3560 called NtSetContextThread to modify thread in remote process 3716
Process injection Process 3944 called NtSetContextThread to modify thread in remote process 4048
Process injection Process 2632 called NtSetContextThread to modify thread in remote process 3452
Process injection Process 3832 called NtSetContextThread to modify thread in remote process 3544
Process injection Process 2212 called NtSetContextThread to modify thread in remote process 3492
Time & API Arguments Status Return Repeated
1619345032.17085
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4908384
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 884
success 0 0
1619350322.21175
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4908384
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2196
success 0 0
1619350326.805
NtSetContextThread
thread_handle: 0x00000100
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4908384
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 324
success 0 0
1619350332.50875
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4908384
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1804
success 0 0
1619350338.336
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4908384
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1056
success 0 0
1619350345.28925
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4908384
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3420
success 0 0
1619350350.399
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4908384
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3756
success 0 0
1619350354.383375
NtSetContextThread
thread_handle: 0x00000100
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4908384
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 4000
success 0 0
1619350358.85275
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4908384
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2064
success 0 0
1619350363.3365
NtSetContextThread
thread_handle: 0x00000100
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4908384
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3716
success 0 0
1619350368.44575
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4908384
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 4048
success 0 0
1619350373.086625
NtSetContextThread
thread_handle: 0x00000100
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4908384
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3452
success 0 0
1619350377.633
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4908384
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3544
success 0 0
1619350386.195375
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4908384
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3492
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (26 个事件)
Process injection Process 3060 resumed a thread in remote process 884
Process injection Process 2764 resumed a thread in remote process 2196
Process injection Process 1712 resumed a thread in remote process 324
Process injection Process 1688 resumed a thread in remote process 1804
Process injection Process 3008 resumed a thread in remote process 1056
Process injection Process 3248 resumed a thread in remote process 3420
Process injection Process 3684 resumed a thread in remote process 3756
Process injection Process 3924 resumed a thread in remote process 4000
Process injection Process 2436 resumed a thread in remote process 2064
Process injection Process 3560 resumed a thread in remote process 3716
Process injection Process 3944 resumed a thread in remote process 4048
Process injection Process 2632 resumed a thread in remote process 3452
Process injection Process 3832 resumed a thread in remote process 3544
Time & API Arguments Status Return Repeated
1619345032.67085
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 884
success 0 0
1619350322.47775
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2196
success 0 0
1619350327.399
NtResumeThread
thread_handle: 0x00000100
suspend_count: 1
process_identifier: 324
success 0 0
1619350333.22775
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 1804
success 0 0
1619350339.008
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 1056
success 0 0
1619350345.53925
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 3420
success 0 0
1619350350.852
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 3756
success 0 0
1619350354.695375
NtResumeThread
thread_handle: 0x00000100
suspend_count: 1
process_identifier: 4000
success 0 0
1619350359.36775
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2064
success 0 0
1619350363.9775
NtResumeThread
thread_handle: 0x00000100
suspend_count: 1
process_identifier: 3716
success 0 0
1619350369.22775
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 4048
success 0 0
1619350373.742625
NtResumeThread
thread_handle: 0x00000100
suspend_count: 1
process_identifier: 3452
success 0 0
1619350378.445
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 3544
success 0 0
Executed a process and injected code into it, probably while unpacking (50 out of 109 个事件)
Time & API Arguments Status Return Repeated
1619345032.10785
CreateProcessInternalW
thread_identifier: 428
thread_handle: 0x000000fc
process_identifier: 884
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\37d0f2c1177b55d247c8580a3f63c165.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619345032.10785
NtUnmapViewOfSection
process_identifier: 884
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619345032.10785
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 884
commit_size: 720896
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 720896
base_address: 0x00400000
success 0 0
1619345032.17085
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1619345032.17085
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4908384
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 884
success 0 0
1619345032.67085
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 884
success 0 0
1619345032.68585
CreateProcessInternalW
thread_identifier: 2284
thread_handle: 0x00000104
process_identifier: 2860
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\37d0f2c1177b55d247c8580a3f63c165.exe" 2 884 28888375
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000114
inherit_handles: 0
success 1 0
1619350319.883375
CreateProcessInternalW
thread_identifier: 944
thread_handle: 0x00000198
process_identifier: 2764
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\37d0f2c1177b55d247c8580a3f63c165.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\37d0f2c1177b55d247c8580a3f63c165.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000019c
inherit_handles: 0
success 1 0
1619350322.14975
CreateProcessInternalW
thread_identifier: 2864
thread_handle: 0x000000fc
process_identifier: 2196
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\37d0f2c1177b55d247c8580a3f63c165.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619350322.14975
NtUnmapViewOfSection
process_identifier: 2196
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619350322.14975
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 2196
commit_size: 720896
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 720896
base_address: 0x00400000
success 0 0
1619350322.21175
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1619350322.21175
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4908384
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2196
success 0 0
1619350322.47775
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2196
success 0 0
1619350322.61775
CreateProcessInternalW
thread_identifier: 1888
thread_handle: 0x00000104
process_identifier: 1908
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\37d0f2c1177b55d247c8580a3f63c165.exe" 2 2196 28896828
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000114
inherit_handles: 0
success 1 0
1619350325.78925
CreateProcessInternalW
thread_identifier: 1688
thread_handle: 0x00000150
process_identifier: 1712
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\37d0f2c1177b55d247c8580a3f63c165.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\37d0f2c1177b55d247c8580a3f63c165.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000154
inherit_handles: 0
success 1 0
1619350326.695
CreateProcessInternalW
thread_identifier: 376
thread_handle: 0x00000100
process_identifier: 324
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\37d0f2c1177b55d247c8580a3f63c165.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000104
inherit_handles: 0
success 1 0
1619350326.695
NtUnmapViewOfSection
process_identifier: 324
region_size: 4096
process_handle: 0x00000104
base_address: 0x00400000
success 0 0
1619350326.758
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 324
commit_size: 720896
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000104
allocation_type: 0 ()
section_offset: 0
view_size: 720896
base_address: 0x00400000
success 0 0
1619350326.805
NtGetContextThread
thread_handle: 0x00000100
success 0 0
1619350326.805
NtSetContextThread
thread_handle: 0x00000100
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4908384
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 324
success 0 0
1619350327.399
NtResumeThread
thread_handle: 0x00000100
suspend_count: 1
process_identifier: 324
success 0 0
1619350327.602
CreateProcessInternalW
thread_identifier: 2864
thread_handle: 0x00000108
process_identifier: 2040
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\37d0f2c1177b55d247c8580a3f63c165.exe" 2 324 28901750
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619350330.63375
CreateProcessInternalW
thread_identifier: 1812
thread_handle: 0x0000013c
process_identifier: 1688
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\37d0f2c1177b55d247c8580a3f63c165.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\37d0f2c1177b55d247c8580a3f63c165.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000140
inherit_handles: 0
success 1 0
1619350332.38375
CreateProcessInternalW
thread_identifier: 2864
thread_handle: 0x000000fc
process_identifier: 1804
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\37d0f2c1177b55d247c8580a3f63c165.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619350332.38375
NtUnmapViewOfSection
process_identifier: 1804
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619350332.43075
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 1804
commit_size: 720896
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 720896
base_address: 0x00400000
success 0 0
1619350332.50875
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1619350332.50875
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4908384
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1804
success 0 0
1619350333.22775
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 1804
success 0 0
1619350333.33675
CreateProcessInternalW
thread_identifier: 1272
thread_handle: 0x00000104
process_identifier: 1320
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\37d0f2c1177b55d247c8580a3f63c165.exe" 2 1804 28907578
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000114
inherit_handles: 0
success 1 0
1619350336.805625
CreateProcessInternalW
thread_identifier: 2652
thread_handle: 0x00000140
process_identifier: 3008
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\37d0f2c1177b55d247c8580a3f63c165.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\37d0f2c1177b55d247c8580a3f63c165.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000144
inherit_handles: 0
success 1 0
1619350338.258
CreateProcessInternalW
thread_identifier: 2632
thread_handle: 0x000000fc
process_identifier: 1056
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\37d0f2c1177b55d247c8580a3f63c165.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619350338.258
NtUnmapViewOfSection
process_identifier: 1056
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619350338.274
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 1056
commit_size: 720896
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 720896
base_address: 0x00400000
success 0 0
1619350338.336
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1619350338.336
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4908384
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1056
success 0 0
1619350339.008
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 1056
success 0 0
1619350339.258
CreateProcessInternalW
thread_identifier: 3148
thread_handle: 0x00000104
process_identifier: 3144
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\37d0f2c1177b55d247c8580a3f63c165.exe" 2 1056 28913359
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000114
inherit_handles: 0
success 1 0
1619350343.102125
CreateProcessInternalW
thread_identifier: 3252
thread_handle: 0x0000012c
process_identifier: 3248
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\37d0f2c1177b55d247c8580a3f63c165.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\37d0f2c1177b55d247c8580a3f63c165.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000130
inherit_handles: 0
success 1 0
1619350345.03925
CreateProcessInternalW
thread_identifier: 3424
thread_handle: 0x000000fc
process_identifier: 3420
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\37d0f2c1177b55d247c8580a3f63c165.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619350345.03925
NtUnmapViewOfSection
process_identifier: 3420
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619350345.16425
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 3420
commit_size: 720896
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 720896
base_address: 0x00400000
success 0 0
1619350345.28925
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1619350345.28925
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4908384
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3420
success 0 0
1619350345.53925
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 3420
success 0 0
1619350345.69525
CreateProcessInternalW
thread_identifier: 3484
thread_handle: 0x00000104
process_identifier: 3480
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\37d0f2c1177b55d247c8580a3f63c165.exe" 2 3420 28919890
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000114
inherit_handles: 0
success 1 0
1619350349.82
CreateProcessInternalW
thread_identifier: 3688
thread_handle: 0x00000140
process_identifier: 3684
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\37d0f2c1177b55d247c8580a3f63c165.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\37d0f2c1177b55d247c8580a3f63c165.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000144
inherit_handles: 0
success 1 0
1619350350.336
CreateProcessInternalW
thread_identifier: 3760
thread_handle: 0x000000fc
process_identifier: 3756
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\37d0f2c1177b55d247c8580a3f63c165.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619350350.336
NtUnmapViewOfSection
process_identifier: 3756
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
File has been identified by 61 AntiVirus engines on VirusTotal as malicious (50 out of 61 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.43221902
FireEye Generic.mg.37d0f2c1177b55d2
ALYac Spyware.AgentTesla
Cylance Unsafe
Zillya Trojan.Injector.Win32.740058
Sangfor Malware
K7AntiVirus Trojan ( 0056739d1 )
Alibaba Trojan:Win32/DelfInject.ali2000015
K7GW Trojan ( 0056739d1 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Generic.D293838E
Cyren W32/Injector.ABY.gen!Eldorado
Symantec Trojan.Gen.MBT
APEX Malicious
Avast Win32:Malware-gen
ClamAV Win.Dropper.Remcos-7878921-0
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
BitDefender Trojan.GenericKD.43221902
NANO-Antivirus Trojan.Win32.Nanocore.hkomrh
Paloalto generic.ml
Rising Trojan.Injector!1.C6FA (CLASSIC)
Ad-Aware Trojan.GenericKD.43221902
Sophos Mal/Generic-S + Troj/Fareit-KPQ
Comodo Malware@#3iuqrit444zmy
F-Secure Trojan.TR/Injector.cmztd
DrWeb Trojan.Nanocore.23
VIPRE Trojan.Win32.Generic!BT
TrendMicro TrojanSpy.Win32.FAREIT.THKAOBO
McAfee-GW-Edition BehavesLike.Win32.Fareit.jc
Emsisoft Trojan.GenericKD.43221902 (B)
Ikarus Trojan.Inject
Webroot W32.Malware.Gen
Avira TR/Injector.cmztd
eGambit Unsafe.AI_Score_99%
Antiy-AVL Trojan/Win32.Wacatac
Microsoft PWS:Win32/Fareit.AKK!MTB
AegisLab Trojan.Multi.Generic.4!c
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
GData Trojan.GenericKD.43221902
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2066
Acronis suspicious
McAfee Fareit-FTB!37D0F2C1177B
MAX malware (ai score=85)
VBA32 TScope.Trojan.Delf
Malwarebytes Trojan.MalPack.DLF
Zoner Trojan.Win32.91342
ESET-NOD32 a variant of Win32/Injector.EMHC
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x46113c VirtualFree
• 0x461140 VirtualAlloc
• 0x461144 LocalFree
• 0x461148 LocalAlloc
• 0x46114c GetVersion
• 0x461150 GetCurrentThreadId
• 0x46115c VirtualQuery
• 0x461160 WideCharToMultiByte
• 0x461164 MultiByteToWideChar
• 0x461168 lstrlenA
• 0x46116c lstrcpynA
• 0x461170 LoadLibraryExA
• 0x461174 GetThreadLocale
• 0x461178 GetStartupInfoA
• 0x46117c GetProcAddress
• 0x461180 GetModuleHandleA
• 0x461184 GetModuleFileNameA
• 0x461188 GetLocaleInfoA
• 0x46118c GetCommandLineA
• 0x461190 FreeLibrary
• 0x461194 FindFirstFileA
• 0x461198 FindClose
• 0x46119c ExitProcess
• 0x4611a0 WriteFile
• 0x4611a8 RtlUnwind
• 0x4611ac RaiseException
• 0x4611b0 GetStdHandle
Library user32.dll:
• 0x4611b8 GetKeyboardType
• 0x4611bc LoadStringA
• 0x4611c0 MessageBoxA
• 0x4611c4 CharNextA
Library advapi32.dll:
• 0x4611cc RegQueryValueExA
• 0x4611d0 RegOpenKeyExA
• 0x4611d4 RegCloseKey
Library oleaut32.dll:
• 0x4611dc SysFreeString
• 0x4611e0 SysReAllocStringLen
• 0x4611e4 SysAllocStringLen
Library kernel32.dll:
• 0x4611ec TlsSetValue
• 0x4611f0 TlsGetValue
• 0x4611f4 LocalAlloc
• 0x4611f8 GetModuleHandleA
Library advapi32.dll:
• 0x461200 RegQueryValueExA
• 0x461204 RegOpenKeyExA
• 0x461208 RegCloseKey
Library kernel32.dll:
• 0x461210 lstrcpyA
• 0x461214 WriteFile
• 0x46121c WaitForSingleObject
• 0x461220 VirtualQuery
• 0x461224 VirtualAlloc
• 0x461228 Sleep
• 0x46122c SizeofResource
• 0x461230 SetThreadLocale
• 0x461234 SetFilePointer
• 0x461238 SetEvent
• 0x46123c SetErrorMode
• 0x461240 SetEndOfFile
• 0x461244 ResetEvent
• 0x461248 ReadFile
• 0x46124c MulDiv
• 0x461250 LockResource
• 0x461254 LoadResource
• 0x461258 LoadLibraryA
• 0x461264 GlobalUnlock
• 0x461268 GlobalReAlloc
• 0x46126c GlobalHandle
• 0x461270 GlobalLock
• 0x461274 GlobalFree
• 0x461278 GlobalFindAtomA
• 0x46127c GlobalDeleteAtom
• 0x461280 GlobalAlloc
• 0x461284 GlobalAddAtomA
• 0x461288 GetVersionExA
• 0x46128c GetVersion
• 0x461290 GetTickCount
• 0x461294 GetThreadLocale
• 0x46129c GetSystemTime
• 0x4612a0 GetSystemInfo
• 0x4612a4 GetStringTypeExA
• 0x4612a8 GetStdHandle
• 0x4612ac GetProcAddress
• 0x4612b0 GetModuleHandleA
• 0x4612b4 GetModuleFileNameA
• 0x4612b8 GetLocaleInfoA
• 0x4612bc GetLocalTime
• 0x4612c0 GetLastError
• 0x4612c4 GetFullPathNameA
• 0x4612c8 GetDiskFreeSpaceA
• 0x4612cc GetDateFormatA
• 0x4612d0 GetCurrentThreadId
• 0x4612d4 GetCurrentProcessId
• 0x4612d8 GetCPInfo
• 0x4612dc GetACP
• 0x4612e0 FreeResource
• 0x4612e4 InterlockedExchange
• 0x4612e8 FreeLibrary
• 0x4612ec FormatMessageA
• 0x4612f0 FindResourceA
• 0x4612f4 ExitThread
• 0x4612f8 EnumCalendarInfoA
• 0x461304 CreateThread
• 0x461308 CreateFileA
• 0x46130c CreateEventA
• 0x461310 CompareStringA
• 0x461314 CloseHandle
Library version.dll:
• 0x46131c VerQueryValueA
• 0x461324 GetFileVersionInfoA
Library gdi32.dll:
• 0x46132c UnrealizeObject
• 0x461330 StretchBlt
• 0x461334 SetWindowOrgEx
• 0x461338 SetViewportOrgEx
• 0x46133c SetTextColor
• 0x461340 SetStretchBltMode
• 0x461344 SetROP2
• 0x461348 SetPixel
• 0x46134c SetDIBColorTable
• 0x461350 SetBrushOrgEx
• 0x461354 SetBkMode
• 0x461358 SetBkColor
• 0x46135c SelectPalette
• 0x461360 SelectObject
• 0x461364 SelectClipPath
• 0x461368 SaveDC
• 0x46136c RestoreDC
• 0x461370 RectVisible
• 0x461374 RealizePalette
• 0x461378 PatBlt
• 0x46137c MoveToEx
• 0x461380 MaskBlt
• 0x461384 LineTo
• 0x461388 IntersectClipRect
• 0x46138c GetWindowOrgEx
• 0x461390 GetTextMetricsA
• 0x46139c GetStockObject
• 0x4613a0 GetPixel
• 0x4613a4 GetPaletteEntries
• 0x4613a8 GetObjectA
• 0x4613ac GetDeviceCaps
• 0x4613b0 GetDIBits
• 0x4613b4 GetDIBColorTable
• 0x4613b8 GetDCOrgEx
• 0x4613c0 GetClipBox
• 0x4613c4 GetBrushOrgEx
• 0x4613c8 GetBitmapBits
• 0x4613cc ExcludeClipRect
• 0x4613d0 DeleteObject
• 0x4613d4 DeleteDC
• 0x4613d8 CreateSolidBrush
• 0x4613dc CreatePenIndirect
• 0x4613e0 CreatePalette
• 0x4613e8 CreateFontIndirectA
• 0x4613ec CreateDIBitmap
• 0x4613f0 CreateDIBSection
• 0x4613f4 CreateCompatibleDC
• 0x4613fc CreateBrushIndirect
• 0x461400 CreateBitmap
• 0x461404 BitBlt
Library user32.dll:
• 0x46140c CreateWindowExA
• 0x461410 WindowFromPoint
• 0x461414 WinHelpA
• 0x461418 WaitMessage
• 0x46141c UpdateWindow
• 0x461420 UnregisterClassA
• 0x461424 UnhookWindowsHookEx
• 0x461428 TranslateMessage
• 0x461430 TrackPopupMenu
• 0x461438 ShowWindow
• 0x46143c ShowScrollBar
• 0x461440 ShowOwnedPopups
• 0x461444 ShowCursor
• 0x461448 SetWindowsHookExA
• 0x46144c SetWindowPos
• 0x461450 SetWindowPlacement
• 0x461454 SetWindowLongA
• 0x461458 SetTimer
• 0x46145c SetScrollRange
• 0x461460 SetScrollPos
• 0x461464 SetScrollInfo
• 0x461468 SetRect
• 0x46146c SetPropA
• 0x461470 SetParent
• 0x461474 SetMenuItemInfoA
• 0x461478 SetMenu
• 0x46147c SetForegroundWindow
• 0x461480 SetFocus
• 0x461484 SetCursor
• 0x461488 SetClassLongA
• 0x46148c SetCapture
• 0x461490 SetActiveWindow
• 0x461494 SendMessageA
• 0x461498 ScrollWindow
• 0x46149c ScreenToClient
• 0x4614a0 RemovePropA
• 0x4614a4 RemoveMenu
• 0x4614a8 ReleaseDC
• 0x4614ac ReleaseCapture
• 0x4614b8 RegisterClassA
• 0x4614bc RedrawWindow
• 0x4614c0 PtInRect
• 0x4614c4 PostQuitMessage
• 0x4614c8 PostMessageA
• 0x4614cc PeekMessageA
• 0x4614d0 OffsetRect
• 0x4614d4 OemToCharA
• 0x4614d8 MessageBoxA
• 0x4614dc MapWindowPoints
• 0x4614e0 MapVirtualKeyA
• 0x4614e4 LoadStringA
• 0x4614e8 LoadKeyboardLayoutA
• 0x4614ec LoadIconA
• 0x4614f0 LoadCursorA
• 0x4614f4 LoadBitmapA
• 0x4614f8 KillTimer
• 0x4614fc IsZoomed
• 0x461500 IsWindowVisible
• 0x461504 IsWindowEnabled
• 0x461508 IsWindow
• 0x46150c IsRectEmpty
• 0x461510 IsIconic
• 0x461514 IsDialogMessageA
• 0x461518 IsChild
• 0x46151c InvalidateRect
• 0x461520 IntersectRect
• 0x461524 InsertMenuItemA
• 0x461528 InsertMenuA
• 0x46152c InflateRect
• 0x461534 GetWindowTextA
• 0x461538 GetWindowRect
• 0x46153c GetWindowPlacement
• 0x461540 GetWindowLongA
• 0x461544 GetWindowDC
• 0x461548 GetTopWindow
• 0x46154c GetSystemMetrics
• 0x461550 GetSystemMenu
• 0x461554 GetSysColorBrush
• 0x461558 GetSysColor
• 0x46155c GetSubMenu
• 0x461560 GetScrollRange
• 0x461564 GetScrollPos
• 0x461568 GetScrollInfo
• 0x46156c GetPropA
• 0x461570 GetParent
• 0x461574 GetWindow
• 0x461578 GetMenuStringA
• 0x46157c GetMenuState
• 0x461580 GetMenuItemInfoA
• 0x461584 GetMenuItemID
• 0x461588 GetMenuItemCount
• 0x46158c GetMenu
• 0x461590 GetLastActivePopup
• 0x461594 GetKeyboardState
• 0x46159c GetKeyboardLayout
• 0x4615a0 GetKeyState
• 0x4615a4 GetKeyNameTextA
• 0x4615a8 GetIconInfo
• 0x4615ac GetForegroundWindow
• 0x4615b0 GetFocus
• 0x4615b4 GetDlgItem
• 0x4615b8 GetDesktopWindow
• 0x4615bc GetDCEx
• 0x4615c0 GetDC
• 0x4615c4 GetCursorPos
• 0x4615c8 GetCursor
• 0x4615cc GetClientRect
• 0x4615d0 GetClassNameA
• 0x4615d4 GetClassInfoA
• 0x4615d8 GetCapture
• 0x4615dc GetActiveWindow
• 0x4615e0 FrameRect
• 0x4615e4 FindWindowA
• 0x4615e8 FillRect
• 0x4615ec EqualRect
• 0x4615f0 EnumWindows
• 0x4615f4 EnumThreadWindows
• 0x4615f8 EndPaint
• 0x4615fc EnableWindow
• 0x461600 EnableScrollBar
• 0x461604 EnableMenuItem
• 0x461608 DrawTextA
• 0x46160c DrawMenuBar
• 0x461610 DrawIconEx
• 0x461614 DrawIcon
• 0x461618 DrawFrameControl
• 0x46161c DrawFocusRect
• 0x461620 DrawEdge
• 0x461624 DispatchMessageA
• 0x461628 DestroyWindow
• 0x46162c DestroyMenu
• 0x461630 DestroyIcon
• 0x461634 DestroyCursor
• 0x461638 DeleteMenu
• 0x46163c DefWindowProcA
• 0x461640 DefMDIChildProcA
• 0x461644 DefFrameProcA
• 0x461648 CreatePopupMenu
• 0x46164c CreateMenu
• 0x461650 CreateIcon
• 0x461654 ClientToScreen
• 0x461658 CheckMenuItem
• 0x46165c CallWindowProcA
• 0x461660 CallNextHookEx
• 0x461664 BeginPaint
• 0x461668 CharNextA
• 0x46166c CharLowerA
• 0x461670 CharToOemA
• 0x461674 AdjustWindowRectEx
Library kernel32.dll:
• 0x461680 Sleep
Library oleaut32.dll:
• 0x461688 SafeArrayPtrOfIndex
• 0x46168c SafeArrayGetUBound
• 0x461690 SafeArrayGetLBound
• 0x461694 SafeArrayCreate
• 0x461698 VariantChangeType
• 0x46169c VariantCopy
• 0x4616a0 VariantClear
• 0x4616a4 VariantInit
Library comctl32.dll:
• 0x4616b4 ImageList_Write
• 0x4616b8 ImageList_Read
• 0x4616c8 ImageList_DragMove
• 0x4616cc ImageList_DragLeave
• 0x4616d0 ImageList_DragEnter
• 0x4616d4 ImageList_EndDrag
• 0x4616d8 ImageList_BeginDrag
• 0x4616dc ImageList_Remove
• 0x4616e0 ImageList_DrawEx
• 0x4616e4 ImageList_Draw
• 0x4616f4 ImageList_Add
• 0x4616fc ImageList_Destroy
• 0x461700 ImageList_Create
• 0x461704 InitCommonControls
Library comdlg32.dll:
• 0x46170c GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.