SmartHawk

8.0

高危

50 个模型检测该样本为恶意！

重新分析

下载样本

a21b3130f42991d83a8b77522bb94fe0c87affda1dd962639fdbc7dc2d753600

590348aa35640856f9c7350fd6df4e39.exe

分析耗时

77s

最近分析

文件大小

2.8MB

静态报毒动态报毒 1S0@AEEAQXB AGEN AI SCORE=83 AIDETECTVM ARTEMIS ATTRIBUTE BIFROSE BIFROST CKGENERIC CLASSIC FRAUDROP GENERICKD HIGH CONFIDENCE HIGHCONFIDENCE KRYPTIK KVXS MALICIOUS PE MALWARE1 OCCAMY PWSX RACEALER SCORE THFABBO TPH3 TROJANPSW UNSAFE WACATAC ZEXAF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	TrojanPSW:Win32/Racealer.7953a4a1	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:PWSX-gen [Trj]	20200804	18.4.3895.0
Tencent		20200804	1.0.0.1
Kingsoft		20200804	2013.8.14.323
McAfee	Artemis!590348AA3564	20200804	6.0.6.653
CrowdStrike		20190702	1.0

Checks if process is being debugged by a debugger (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513306.837307 IsDebuggerPresent		failed	0	0
1619513306.837307 IsDebuggerPresent		failed	0	0

Uses Windows APIs to generate a cryptographic key (5 个事件)

Time & API	Arguments	Status	Return
1619513307.415307 CryptExportKey	crypto_handle: 0x008cc9b8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619513307.431307 CryptExportKey	crypto_handle: 0x008ccfd8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619513308.024307 CryptExportKey	crypto_handle: 0x008dafa8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619513308.024307 CryptExportKey	crypto_handle: 0x008dafa8 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1
1619513308.118307 CryptExportKey	crypto_handle: 0x008dac28 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1

This executable has a PDB path (1 个事件)

pdb_path

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513306.915307 GlobalMemoryStatusEx		success	1	0

One or more processes crashed (50 out of 694 个事件)

Time & API	Arguments	Status
1619513305.743307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636996 registers.edi: 4350172 registers.eax: 0 registers.ebp: 1637012 registers.edx: 0 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 4 exception.instruction_r: f3 aa 8b 45 f0 8b 4d 08 8b 55 10 03 c8 2b d0 52 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xf088 exception.instruction: stosb byte ptr es:[edi], al exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61576 exception.address: 0x40f088	success
1619513305.743307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4354016 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 22145 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.743307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4358112 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 22113 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.743307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4362208 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 22081 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.743307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4366304 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 22049 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.743307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4370400 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 22017 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.743307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4374496 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21985 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.743307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4378592 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21953 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.743307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4382688 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21921 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.743307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4386784 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21889 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.743307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4390880 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21857 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.743307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4394976 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21825 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.743307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4399072 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21793 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.743307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4403168 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21761 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4407264 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21729 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4411360 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21697 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4415456 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21665 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4419552 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21633 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4423648 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21601 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4427744 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21569 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4431840 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21537 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4435936 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21505 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4440032 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21473 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4444128 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21441 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4448224 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21409 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4452320 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21377 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4456416 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21345 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4460512 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21313 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4464608 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21281 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4468704 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21249 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4472800 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21217 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4476896 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21185 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4480992 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21153 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4485088 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21121 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4489184 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21089 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4493280 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21057 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4497376 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 21025 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4501472 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 20993 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4505568 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 20961 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4509664 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 20929 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4513760 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 20897 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4517856 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 20865 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4521952 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 20833 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4526048 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 20801 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4530144 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 20769 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4534240 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 20737 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4538336 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 20705 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4542432 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 20673 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.759307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4546528 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 20641 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success
1619513305.774307 __exception__	stacktrace: 590348aa35640856f9c7350fd6df4e39+0xf054 @ 0x40f054 590348aa35640856f9c7350fd6df4e39+0xf0a0 @ 0x40f0a0 590348aa35640856f9c7350fd6df4e39+0x1fa2 @ 0x401fa2 registers.esp: 1636940 registers.edi: 4550624 registers.eax: 4350176 registers.ebp: 1636944 registers.edx: 15 registers.ebx: 0 registers.esi: 37158944 registers.ecx: 20609 exception.instruction_r: 66 0f 7f 47 20 66 0f 7f 47 30 66 0f 7f 47 40 66 exception.symbol: 590348aa35640856f9c7350fd6df4e39+0xeff0 exception.address: 0x40eff0 exception.module: 590348aa35640856f9c7350fd6df4e39.exe exception.exception_code: 0xc0000005 exception.offset: 61424	success

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (40 个事件)

Time & API	Arguments	Status
1619513306.165307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02bc0000	success
1619513306.165307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02d80000	success
1619513306.196307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02aa0000	success
1619513306.196307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02b20000	success
1619513306.509307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 1179648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02bc0000	success
1619513306.509307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02ca0000	success
1619513306.665307 NtProtectVirtualMemory	process_identifier: 648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e71000	success
1619513306.837307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x029f0000	success
1619513306.837307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02a50000	success
1619513306.853307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006fa000	success
1619513306.853307 NtProtectVirtualMemory	process_identifier: 648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e72000	success
1619513306.853307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006f2000	success
1619513307.118307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00702000	success
1619513307.196307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00725000	success
1619513307.196307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0072b000	success
1619513307.196307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00727000	success
1619513307.274307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02ca1000	success
1619513307.306307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02ca2000	success
1619513307.384307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006fc000	success
1619513307.462307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00703000	success
1619513307.462307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02ca3000	success
1619513307.524307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0070c000	success
1619513307.524307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02ca4000	success
1619513307.524307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02ca5000	success
1619513307.524307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02ca7000	success
1619513307.618307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02d20000	success
1619513307.931307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00704000	success
1619513307.931307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00706000	success
1619513308.040307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00707000	success
1619513308.056307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00708000	success
1619513308.087307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02d21000	success
1619513308.196307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00709000	success
1619513308.212307 NtAllocateVirtualMemory	process_identifier: 648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02d25000	success
1619535725.753626 NtProtectVirtualMemory	process_identifier: 2288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77531000	success
1619535725.753626 NtProtectVirtualMemory	process_identifier: 2288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x75a01000	success
1619535725.800626 NtProtectVirtualMemory	process_identifier: 2288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x755d1000	success
1619535725.800626 NtProtectVirtualMemory	process_identifier: 2288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x74571000	success
1619535725.816626 NtProtectVirtualMemory	process_identifier: 2288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x74531000	success
1619535725.832626 NtProtectVirtualMemory	process_identifier: 2288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73c01000	success
1619535726.425626 NtProtectVirtualMemory	process_identifier: 2288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73b41000	success

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.999927096910723

section

{'size_of_data': '0x002b5600', 'virtual_address': '0x00026000', 'entropy': 7.999927096910723, 'name': '.rsrc', 'virtual_size': '0x002b54d8'}

description

A section with a high entropy has been found

entropy

0.9535843218153688

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (2 个事件)

host	172.217.24.14
host	192.35.177.64

Allocates execute permission to another process indicative of possible code injection (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513308.524307 NtAllocateVirtualMemory	process_identifier: 2288 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000001ec allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0	0

Potential code injection by writing to the memory of another process (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513308.524307 WriteProcessMemory	process_identifier: 2288 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $Î F¯ãóF¯ãóF¯ãóÇàòW¯ãóÇæòú¯ãóÇäòG¯ãóÂçòU¯ãóÂàò^¯ãóÂæò¯ãóÇçò_¯ãóÇåòG¯ãóÇâò]¯ãóF¯âó¶¯ãóÜÁêòH¯ãóÜÁáòG¯ãóRichF¯ãóPELk¼^à6õõ°@ @L°,LÀã8øã@°.textB `.rdata`±°²@@.data5p(N@À.reloc,L°Nv@B process_handle: 0x000001ec base_address: 0x00400000	success	1	0
1619513308.540307 WriteProcessMemory	process_identifier: 2288 buffer: @ process_handle: 0x000001ec base_address: 0x7efde008	success	1	0

Code injection by writing an executable or DLL to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513308.524307 WriteProcessMemory	process_identifier: 2288 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $Î F¯ãóF¯ãóF¯ãóÇàòW¯ãóÇæòú¯ãóÇäòG¯ãóÂçòU¯ãóÂàò^¯ãóÂæò¯ãóÇçò_¯ãóÇåòG¯ãóÇâò]¯ãóF¯âó¶¯ãóÜÁêòH¯ãóÜÁáòG¯ãóRichF¯ãóPELk¼^à6õõ°@ @L°,LÀã8øã@°.textB `.rdata`±°²@@.data5p(N@À.reloc,L°Nv@B process_handle: 0x000001ec base_address: 0x00400000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 648 called NtSetContextThread to modify thread in remote process 2288
1619513308.540307 NtSetContextThread	thread_handle: 0x000001e8 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4453877 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2288	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 648 resumed a thread in remote process 2288
1619513308.899307 NtResumeThread	thread_handle: 0x000001e8 suspend_count: 1 process_identifier: 2288	success	0	0

Executed a process and injected code into it, probably while unpacking (15 个事件)

Time & API	Arguments	Status	Return
1619513306.837307 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 648	success	0
1619513306.868307 NtResumeThread	thread_handle: 0x00000160 suspend_count: 1 process_identifier: 648	success	0
1619513306.915307 NtResumeThread	thread_handle: 0x000001a8 suspend_count: 1 process_identifier: 648	success	0
1619513308.524307 CreateProcessInternalW	thread_identifier: 2440 thread_handle: 0x000001e8 process_identifier: 2288 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) process_handle: 0x000001ec inherit_handles: 0	success	1
1619513308.524307 NtGetContextThread	thread_handle: 0x000001e8	success	0
1619513308.524307 NtAllocateVirtualMemory	process_identifier: 2288 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000001ec allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619513308.524307 WriteProcessMemory	process_identifier: 2288 buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $Î F¯ãóF¯ãóF¯ãóÇàòW¯ãóÇæòú¯ãóÇäòG¯ãóÂçòU¯ãóÂàò^¯ãóÂæò¯ãóÇçò_¯ãóÇåòG¯ãóÇâò]¯ãóF¯âó¶¯ãóÜÁêòH¯ãóÜÁáòG¯ãóRichF¯ãóPELk¼^à6õõ°@ @L°,LÀã8øã@°.textB `.rdata`±°²@@.data5p(N@À.reloc,L°Nv@B process_handle: 0x000001ec base_address: 0x00400000	success	1
1619513308.524307 WriteProcessMemory	process_identifier: 2288 buffer: process_handle: 0x000001ec base_address: 0x00401000	success	1
1619513308.524307 WriteProcessMemory	process_identifier: 2288 buffer: process_handle: 0x000001ec base_address: 0x0046b000	success	1
1619513308.540307 WriteProcessMemory	process_identifier: 2288 buffer: process_handle: 0x000001ec base_address: 0x00487000	success	1
1619513308.540307 WriteProcessMemory	process_identifier: 2288 buffer: process_handle: 0x000001ec base_address: 0x0048b000	success	1
1619513308.540307 WriteProcessMemory	process_identifier: 2288 buffer: @ process_handle: 0x000001ec base_address: 0x7efde008	success	1
1619513308.540307 NtSetContextThread	thread_handle: 0x000001e8 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4453877 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2288	success	0
1619513308.899307 NtResumeThread	thread_handle: 0x000001e8 suspend_count: 1 process_identifier: 2288	success	0
1619535725.785626 NtResumeThread	thread_handle: 0x00000188 suspend_count: 1 process_identifier: 2288	success	0

File has been identified by 50 AntiVirus engines on VirusTotal as malicious (50 个事件)

Bkav	W32.AIDetectVM.malware1
MicroWorld-eScan	Trojan.GenericKD.43320290
FireEye	Generic.mg.590348aa35640856
CAT-QuickHeal	Trojan.CKGENERIC
ALYac	Trojan.GenericKD.43320290
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Trojan ( 005635901 )
Alibaba	TrojanPSW:Win32/Racealer.7953a4a1
K7GW	Trojan ( 005635901 )
Cybereason	malicious.c99877
Arcabit	Trojan.Generic.D29503E2
Invincea	heuristic
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
Kaspersky	Trojan-PSW.Win32.Racealer.gex
BitDefender	Trojan.GenericKD.43320290
Paloalto	generic.ml
AegisLab	Trojan.Win32.FrauDrop.tpH3
Ad-Aware	Trojan.GenericKD.43320290
Emsisoft	Trojan.GenericKD.43320290 (B)
F-Secure	Heuristic.HEUR/AGEN.1133144
DrWeb	BackDoor.Bifrost.29284
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Trojan.Win32.WACATAC.THFABBO
Sophos	Mal/Generic-S
SentinelOne	DFI - Malicious PE
Cyren	W32/Trojan.KVXS-3205
Avira	HEUR/AGEN.1133144
Antiy-AVL	Trojan[PSW]/Win32.Racealer
Microsoft	Trojan:Win32/Occamy.CA2
Endgame	malicious (high confidence)
ZoneAlarm	Trojan-PSW.Win32.Racealer.gex
GData	Trojan.GenericKD.43320290
Cynet	Malicious (score: 100)
McAfee	Artemis!590348AA3564
MAX	malware (ai score=83)
VBA32	Backdoor.Bifrose
Malwarebytes	Trojan.MalPack.Generic
ESET-NOD32	a variant of MSIL/Kryptik.VFM
TrendMicro-HouseCall	Trojan.Win32.WACATAC.THFABBO
Rising	Trojan.Kryptik!1.C864 (CLASSIC)
Ikarus	Trojan.Inject
eGambit	Unsafe.AI_Score_85%
Fortinet	W32/Kryptik.VFM!tr
BitDefenderTheta	Gen:NN.ZexaF.34150.1s0@aeeAQXb
AVG	Win32:PWSX-gen [Trj]
Panda	Trj/CI.A
Qihoo-360	Win32/Trojan.PSW.431

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2012-07-14 06:47:16

Imports

Library KERNEL32.dll:

• 0x41b000 RaiseException

• 0x41b004 GetLastError

• 0x41b008 MultiByteToWideChar

• 0x41b00c lstrlenA

• 0x41b010 InterlockedDecrement

• 0x41b014 GetProcAddress

• 0x41b018 LoadLibraryA

• 0x41b01c FreeResource

• 0x41b020 SizeofResource

• 0x41b024 LockResource

• 0x41b028 LoadResource

• 0x41b02c FindResourceA

• 0x41b030 GetModuleHandleA

• 0x41b034 Module32Next

• 0x41b038 CloseHandle

• 0x41b03c Module32First

• 0x41b040 CreateToolhelp32Snapshot

• 0x41b044 GetCurrentProcessId

• 0x41b048 SetEndOfFile

• 0x41b04c GetStringTypeW

• 0x41b050 GetStringTypeA

• 0x41b054 LCMapStringW

• 0x41b058 LCMapStringA

• 0x41b05c GetLocaleInfoA

• 0x41b060 HeapFree

• 0x41b064 GetProcessHeap

• 0x41b068 HeapAlloc

• 0x41b06c GetCommandLineA

• 0x41b070 HeapCreate

• 0x41b074 VirtualFree

• 0x41b078 DeleteCriticalSection

• 0x41b07c LeaveCriticalSection

• 0x41b080 EnterCriticalSection

• 0x41b084 VirtualAlloc

• 0x41b088 HeapReAlloc

• 0x41b08c HeapSize

• 0x41b090 TerminateProcess

• 0x41b094 GetCurrentProcess

• 0x41b098 UnhandledExceptionFilter

• 0x41b09c SetUnhandledExceptionFilter

• 0x41b0a0 IsDebuggerPresent

• 0x41b0a4 GetModuleHandleW

• 0x41b0a8 Sleep

• 0x41b0ac ExitProcess

• 0x41b0b0 WriteFile

• 0x41b0b4 GetStdHandle

• 0x41b0b8 GetModuleFileNameA

• 0x41b0bc WideCharToMultiByte

• 0x41b0c0 GetConsoleCP

• 0x41b0c4 GetConsoleMode

• 0x41b0c8 ReadFile

• 0x41b0cc TlsGetValue

• 0x41b0d0 TlsAlloc

• 0x41b0d4 TlsSetValue

• 0x41b0d8 TlsFree

• 0x41b0dc InterlockedIncrement

• 0x41b0e0 SetLastError

• 0x41b0e4 GetCurrentThreadId

• 0x41b0e8 FlushFileBuffers

• 0x41b0ec SetFilePointer

• 0x41b0f0 SetHandleCount

• 0x41b0f4 GetFileType

• 0x41b0f8 GetStartupInfoA

• 0x41b0fc RtlUnwind

• 0x41b100 FreeEnvironmentStringsA

• 0x41b104 GetEnvironmentStrings

• 0x41b108 FreeEnvironmentStringsW

• 0x41b10c GetEnvironmentStringsW

• 0x41b110 QueryPerformanceCounter

• 0x41b114 GetTickCount

• 0x41b118 GetSystemTimeAsFileTime

• 0x41b11c InitializeCriticalSectionAndSpinCount

• 0x41b120 GetCPInfo

• 0x41b124 GetACP

• 0x41b128 GetOEMCP

• 0x41b12c IsValidCodePage

• 0x41b130 CompareStringA

• 0x41b134 CompareStringW

• 0x41b138 SetEnvironmentVariableA

• 0x41b13c WriteConsoleA

• 0x41b140 GetConsoleOutputCP

• 0x41b144 WriteConsoleW

• 0x41b148 SetStdHandle

• 0x41b14c CreateFileA

Library ole32.dll:

• 0x41b17c OleInitialize

Library OLEAUT32.dll:

• 0x41b154 SafeArrayCreate

• 0x41b158 SafeArrayAccessData

• 0x41b15c SafeArrayUnaccessData

• 0x41b160 SafeArrayDestroy

• 0x41b164 SafeArrayCreateVector

• 0x41b168 VariantClear

• 0x41b16c VariantInit

• 0x41b170 SysFreeString

• 0x41b174 SysAllocString

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
telete.in	A 31.13.85.4	31.13.85.4
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49176	31.13.85.4 telete.in	443
192.168.56.101	49182	31.13.85.4 telete.in	443

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.