12.4
0-day
59 个模型检测该样本为恶意！
重新分析
更多

030b56f2c3d4f312d274d0d8d6176e609967ec6a280c7e3356e380fc1d4cbe51

66565199e6989f47ba9f652e0789ff23.exe

分析耗时

122s

最近分析

文件大小

1.1MB
静态报毒 动态报毒 9YCE0Q AI SCORE=84 AIDETECTVM ALI2000015 AUTO BSCOPE CLASSIC CONFIDENCE DELF DELFINJECT DELPHILESS EMOY FAREIT HHW@AAEAKJCI HIGH CONFIDENCE HNTFMZ HPLOKI LTHGS MALICIOUS PE MALWARE1 MALWARE@#2PFESQD4MXOQ2 MZRB PWSX RATNET SCORE SMBD STATIC AI SUSGEN TROJANPSW TSPY UHYS UNSAFE X2094 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FTB!66565199E698 20201211 6.0.6.653
Baidu 20190318 1.0.0.2
Avast Win32:PWSX-gen [Trj] 20201210 21.1.5827.0
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
Tencent Win32.Trojan.Inject.Auto 20201211 1.0.0.1
Kingsoft 20201211 2017.9.26.565
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (40 个事件)
Time & API Arguments Status Return Repeated
1619623118.872999
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 48758596
registers.edi: 0
registers.eax: 0
registers.ebp: 48758664
registers.edx: 18
registers.ebx: 0
registers.esi: 0
registers.ecx: 873
exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00
exception.symbol: 66565199e6989f47ba9f652e0789ff23+0x955b5
exception.instruction: div eax
exception.module: 66565199e6989f47ba9f652e0789ff23.exe
exception.exception_code: 0xc0000094
exception.offset: 611765
exception.address: 0x4955b5
success 0 0
1619623119.950751
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 36044612
registers.edi: 0
registers.eax: 0
registers.ebp: 36044680
registers.edx: 18
registers.ebx: 0
registers.esi: 0
registers.ecx: 951
exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00
exception.symbol: hshbbb+0x955b5
exception.instruction: div eax
exception.module: hshbbb.exe
exception.exception_code: 0xc0000094
exception.offset: 611765
exception.address: 0x4955b5
success 0 0
1619623124.810501
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hshbbb+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74104b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74105d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe981485
success 0 0
1619623120.325374
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49938244
registers.edi: 0
registers.eax: 0
registers.ebp: 49938312
registers.edx: 18
registers.ebx: 0
registers.esi: 0
registers.ecx: 326
exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00
exception.symbol: hshbbb+0x955b5
exception.instruction: div eax
exception.module: hshbbb.exe
exception.exception_code: 0xc0000094
exception.offset: 611765
exception.address: 0x4955b5
success 0 0
1619623137.357876
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49807172
registers.edi: 0
registers.eax: 0
registers.ebp: 49807240
registers.edx: 18
registers.ebx: 0
registers.esi: 0
registers.ecx: 357
exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00
exception.symbol: hshbbb+0x955b5
exception.instruction: div eax
exception.module: hshbbb.exe
exception.exception_code: 0xc0000094
exception.offset: 611765
exception.address: 0x4955b5
success 0 0
1619623137.638876
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hshbbb+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x741b4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x741b5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfcbd1485
success 0 0
1619623137.653499
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34996036
registers.edi: 0
registers.eax: 0
registers.ebp: 34996104
registers.edx: 18
registers.ebx: 0
registers.esi: 0
registers.ecx: 654
exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00
exception.symbol: hshbbb+0x955b5
exception.instruction: div eax
exception.module: hshbbb.exe
exception.exception_code: 0xc0000094
exception.offset: 611765
exception.address: 0x4955b5
success 0 0
1619623138.482876
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 35127108
registers.edi: 0
registers.eax: 0
registers.ebp: 35127176
registers.edx: 18
registers.ebx: 0
registers.esi: 0
registers.ecx: 482
exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00
exception.symbol: hshbbb+0x955b5
exception.instruction: div eax
exception.module: hshbbb.exe
exception.exception_code: 0xc0000094
exception.offset: 611765
exception.address: 0x4955b5
success 0 0
1619623140.716999
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hshbbb+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74164b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74165d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfcde1485
success 0 0
1619623140.733249
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49413956
registers.edi: 0
registers.eax: 0
registers.ebp: 49414024
registers.edx: 19
registers.ebx: 0
registers.esi: 0
registers.ecx: 732
exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00
exception.symbol: hshbbb+0x955b5
exception.instruction: div eax
exception.module: hshbbb.exe
exception.exception_code: 0xc0000094
exception.offset: 611765
exception.address: 0x4955b5
success 0 0
1619623141.217249
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49020740
registers.edi: 0
registers.eax: 0
registers.ebp: 49020808
registers.edx: 19
registers.ebx: 0
registers.esi: 0
registers.ecx: 216
exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00
exception.symbol: hshbbb+0x955b5
exception.instruction: div eax
exception.module: hshbbb.exe
exception.exception_code: 0xc0000094
exception.offset: 611765
exception.address: 0x4955b5
success 0 0
1619623141.747626
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hshbbb+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x741b4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x741b5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe751485
success 0 0
1619623141.717249
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49217348
registers.edi: 0
registers.eax: 0
registers.ebp: 49217416
registers.edx: 19
registers.ebx: 0
registers.esi: 0
registers.ecx: 716
exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00
exception.symbol: hshbbb+0x955b5
exception.instruction: div eax
exception.module: hshbbb.exe
exception.exception_code: 0xc0000094
exception.offset: 611765
exception.address: 0x4955b5
success 0 0
1619623142.685999
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 35258180
registers.edi: 0
registers.eax: 0
registers.ebp: 35258248
registers.edx: 19
registers.ebx: 0
registers.esi: 0
registers.ecx: 685
exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00
exception.symbol: hshbbb+0x955b5
exception.instruction: div eax
exception.module: hshbbb.exe
exception.exception_code: 0xc0000094
exception.offset: 611765
exception.address: 0x4955b5
success 0 0
1619623143.216626
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hshbbb+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74114b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74115d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfcbf1485
success 0 0
1619623143.232876
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49086276
registers.edi: 0
registers.eax: 0
registers.ebp: 49086344
registers.edx: 19
registers.ebx: 0
registers.esi: 0
registers.ecx: 232
exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00
exception.symbol: hshbbb+0x955b5
exception.instruction: div eax
exception.module: hshbbb.exe
exception.exception_code: 0xc0000094
exception.offset: 611765
exception.address: 0x4955b5
success 0 0
1619623144.592249
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49610564
registers.edi: 0
registers.eax: 0
registers.ebp: 49610632
registers.edx: 19
registers.ebx: 0
registers.esi: 0
registers.ecx: 591
exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00
exception.symbol: hshbbb+0x955b5
exception.instruction: div eax
exception.module: hshbbb.exe
exception.exception_code: 0xc0000094
exception.offset: 611765
exception.address: 0x4955b5
success 0 0
1619623145.529124
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hshbbb+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74164b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74165d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe6b1485
success 0 0
1619623145.544374
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49151812
registers.edi: 0
registers.eax: 0
registers.ebp: 49151880
registers.edx: 19
registers.ebx: 0
registers.esi: 0
registers.ecx: 544
exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00
exception.symbol: hshbbb+0x955b5
exception.instruction: div eax
exception.module: hshbbb.exe
exception.exception_code: 0xc0000094
exception.offset: 611765
exception.address: 0x4955b5
success 0 0
1619623146.278501
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 48496452
registers.edi: 0
registers.eax: 0
registers.ebp: 48496520
registers.edx: 19
registers.ebx: 0
registers.esi: 0
registers.ecx: 279
exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00
exception.symbol: hshbbb+0x955b5
exception.instruction: div eax
exception.module: hshbbb.exe
exception.exception_code: 0xc0000094
exception.offset: 611765
exception.address: 0x4955b5
success 0 0
1619623147.232626
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hshbbb+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74114b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74115d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfcf01485
success 0 0
1619623147.279124
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 35258180
registers.edi: 0
registers.eax: 0
registers.ebp: 35258248
registers.edx: 19
registers.ebx: 0
registers.esi: 0
registers.ecx: 279
exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00
exception.symbol: hshbbb+0x955b5
exception.instruction: div eax
exception.module: hshbbb.exe
exception.exception_code: 0xc0000094
exception.offset: 611765
exception.address: 0x4955b5
success 0 0
1619623161.169751
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 48824132
registers.edi: 0
registers.eax: 0
registers.ebp: 48824200
registers.edx: 19
registers.ebx: 0
registers.esi: 0
registers.ecx: 587
exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00
exception.symbol: hshbbb+0x955b5
exception.instruction: div eax
exception.module: hshbbb.exe
exception.exception_code: 0xc0000094
exception.offset: 611765
exception.address: 0x4955b5
success 0 0
1619623161.885125
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hshbbb+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74164b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74165d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfd051485
success 0 0
1619623161.901125
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49479492
registers.edi: 0
registers.eax: 0
registers.ebp: 49479560
registers.edx: 19
registers.ebx: 0
registers.esi: 0
registers.ecx: 913
exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00
exception.symbol: hshbbb+0x955b5
exception.instruction: div eax
exception.module: hshbbb.exe
exception.exception_code: 0xc0000094
exception.offset: 611765
exception.address: 0x4955b5
success 0 0
1619623164.15725
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49086276
registers.edi: 0
registers.eax: 0
registers.ebp: 49086344
registers.edx: 19
registers.ebx: 0
registers.esi: 0
registers.ecx: 165
exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00
exception.symbol: hshbbb+0x955b5
exception.instruction: div eax
exception.module: hshbbb.exe
exception.exception_code: 0xc0000094
exception.offset: 611765
exception.address: 0x4955b5
success 0 0
1619623164.449437
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hshbbb+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x741b4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x741b5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe7b1485
success 0 0
1619623164.450626
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34996036
registers.edi: 0
registers.eax: 0
registers.ebp: 34996104
registers.edx: 19
registers.ebx: 0
registers.esi: 0
registers.ecx: 457
exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00
exception.symbol: hshbbb+0x955b5
exception.instruction: div eax
exception.module: hshbbb.exe
exception.exception_code: 0xc0000094
exception.offset: 611765
exception.address: 0x4955b5
success 0 0
1619623165.256062
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49086276
registers.edi: 0
registers.eax: 0
registers.ebp: 49086344
registers.edx: 19
registers.ebx: 0
registers.esi: 0
registers.ecx: 265
exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00
exception.symbol: hshbbb+0x955b5
exception.instruction: div eax
exception.module: hshbbb.exe
exception.exception_code: 0xc0000094
exception.offset: 611765
exception.address: 0x4955b5
success 0 0
1619623166.116626
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hshbbb+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74114b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74115d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe751485
success 0 0
1619623166.136
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 35061572
registers.edi: 0
registers.eax: 0
registers.ebp: 35061640
registers.edx: 19
registers.ebx: 0
registers.esi: 0
registers.ecx: 141
exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00
exception.symbol: hshbbb+0x955b5
exception.instruction: div eax
exception.module: hshbbb.exe
exception.exception_code: 0xc0000094
exception.offset: 611765
exception.address: 0x4955b5
success 0 0
1619623167.043564
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34668356
registers.edi: 0
registers.eax: 0
registers.ebp: 34668424
registers.edx: 19
registers.ebx: 0
registers.esi: 0
registers.ecx: 52
exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00
exception.symbol: hshbbb+0x955b5
exception.instruction: div eax
exception.module: hshbbb.exe
exception.exception_code: 0xc0000094
exception.offset: 611765
exception.address: 0x4955b5
success 0 0
1619623169.264183
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hshbbb+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x741b4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x741b5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfcbf1485
success 0 0
1619623169.304902
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34668356
registers.edi: 0
registers.eax: 0
registers.ebp: 34668424
registers.edx: 19
registers.ebx: 0
registers.esi: 0
registers.ecx: 321
exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00
exception.symbol: hshbbb+0x955b5
exception.instruction: div eax
exception.module: hshbbb.exe
exception.exception_code: 0xc0000094
exception.offset: 611765
exception.address: 0x4955b5
success 0 0
1619623178.06138
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49020740
registers.edi: 0
registers.eax: 0
registers.ebp: 49020808
registers.edx: 19
registers.ebx: 0
registers.esi: 0
registers.ecx: 75
exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00
exception.symbol: hshbbb+0x955b5
exception.instruction: div eax
exception.module: hshbbb.exe
exception.exception_code: 0xc0000094
exception.offset: 611765
exception.address: 0x4955b5
success 0 0
1619623180.234878
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hshbbb+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x741b4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x741b5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe721485
success 0 0
1619623179.004783
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49676100
registers.edi: 0
registers.eax: 0
registers.ebp: 49676168
registers.edx: 19
registers.ebx: 0
registers.esi: 0
registers.ecx: 20
exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00
exception.symbol: hshbbb+0x955b5
exception.instruction: div eax
exception.module: hshbbb.exe
exception.exception_code: 0xc0000094
exception.offset: 611765
exception.address: 0x4955b5
success 0 0
1619623182.472467
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 50921284
registers.edi: 0
registers.eax: 0
registers.ebp: 50921352
registers.edx: 19
registers.ebx: 0
registers.esi: 0
registers.ecx: 472
exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00
exception.symbol: hshbbb+0x955b5
exception.instruction: div eax
exception.module: hshbbb.exe
exception.exception_code: 0xc0000094
exception.offset: 611765
exception.address: 0x4955b5
success 0 0
1619623184.925967
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hshbbb+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x741b4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x741b5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe741485
success 0 0
1619623185.082594
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 35389252
registers.edi: 0
registers.eax: 0
registers.ebp: 35389320
registers.edx: 19
registers.ebx: 0
registers.esi: 0
registers.ecx: 82
exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00
exception.symbol: hshbbb+0x955b5
exception.instruction: div eax
exception.module: hshbbb.exe
exception.exception_code: 0xc0000094
exception.offset: 611765
exception.address: 0x4955b5
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (50 out of 406 个事件)
Time & API Arguments Status Return Repeated
1619623118.763999
NtAllocateVirtualMemory
process_identifier: 624
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01d30000
success 0 0
1619623118.872999
NtProtectVirtualMemory
process_identifier: 624
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 28672
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00495000
success 0 0
1619623118.872999
NtAllocateVirtualMemory
process_identifier: 624
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02e90000
success 0 0
1619623119.919751
NtAllocateVirtualMemory
process_identifier: 1888
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619623119.950751
NtProtectVirtualMemory
process_identifier: 1888
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 28672
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00495000
success 0 0
1619623119.950751
NtAllocateVirtualMemory
process_identifier: 1888
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x007b0000
success 0 0
1619623120.294501
NtProtectVirtualMemory
process_identifier: 880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619623120.357501
NtAllocateVirtualMemory
process_identifier: 880
region_size: 1769472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02170000
success 0 0
1619623120.357501
NtAllocateVirtualMemory
process_identifier: 880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x022e0000
success 0 0
1619623120.372501
NtAllocateVirtualMemory
process_identifier: 880
region_size: 630784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01fe0000
success 0 0
1619623120.372501
NtProtectVirtualMemory
process_identifier: 880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 602112
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fe2000
success 0 0
1619623124.716501
NtProtectVirtualMemory
process_identifier: 880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02162000
success 0 0
1619623124.716501
NtProtectVirtualMemory
process_identifier: 880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619623124.716501
NtProtectVirtualMemory
process_identifier: 880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02162000
success 0 0
1619623124.716501
NtProtectVirtualMemory
process_identifier: 880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619623124.716501
NtProtectVirtualMemory
process_identifier: 880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02162000
success 0 0
1619623124.716501
NtProtectVirtualMemory
process_identifier: 880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619623124.716501
NtProtectVirtualMemory
process_identifier: 880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02162000
success 0 0
1619623124.716501
NtProtectVirtualMemory
process_identifier: 880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619623124.716501
NtProtectVirtualMemory
process_identifier: 880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02162000
success 0 0
1619623124.716501
NtProtectVirtualMemory
process_identifier: 880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619623124.716501
NtProtectVirtualMemory
process_identifier: 880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02162000
success 0 0
1619623124.716501
NtProtectVirtualMemory
process_identifier: 880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619623124.716501
NtProtectVirtualMemory
process_identifier: 880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02162000
success 0 0
1619623124.716501
NtProtectVirtualMemory
process_identifier: 880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619623124.716501
NtProtectVirtualMemory
process_identifier: 880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02162000
success 0 0
1619623124.716501
NtProtectVirtualMemory
process_identifier: 880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619623124.716501
NtProtectVirtualMemory
process_identifier: 880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02162000
success 0 0
1619623124.716501
NtProtectVirtualMemory
process_identifier: 880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619623124.716501
NtProtectVirtualMemory
process_identifier: 880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02162000
success 0 0
1619623124.716501
NtProtectVirtualMemory
process_identifier: 880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619623120.310374
NtAllocateVirtualMemory
process_identifier: 1868
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619623120.325374
NtProtectVirtualMemory
process_identifier: 1868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 28672
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00495000
success 0 0
1619623120.325374
NtAllocateVirtualMemory
process_identifier: 1868
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01ef0000
success 0 0
1619623137.357876
NtAllocateVirtualMemory
process_identifier: 3192
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00350000
success 0 0
1619623137.357876
NtProtectVirtualMemory
process_identifier: 3192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 28672
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00495000
success 0 0
1619623137.372876
NtAllocateVirtualMemory
process_identifier: 3192
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x006e0000
success 0 0
1619623137.607876
NtProtectVirtualMemory
process_identifier: 3264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619623137.607876
NtAllocateVirtualMemory
process_identifier: 3264
region_size: 2031616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x021c0000
success 0 0
1619623137.607876
NtAllocateVirtualMemory
process_identifier: 3264
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02370000
success 0 0
1619623137.607876
NtAllocateVirtualMemory
process_identifier: 3264
region_size: 630784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01fd0000
success 0 0
1619623137.607876
NtProtectVirtualMemory
process_identifier: 3264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 602112
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fd2000
success 0 0
1619623137.622876
NtProtectVirtualMemory
process_identifier: 3264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003b2000
success 0 0
1619623137.622876
NtProtectVirtualMemory
process_identifier: 3264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619623137.622876
NtProtectVirtualMemory
process_identifier: 3264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003b2000
success 0 0
1619623137.622876
NtProtectVirtualMemory
process_identifier: 3264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619623137.622876
NtProtectVirtualMemory
process_identifier: 3264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003b2000
success 0 0
1619623137.622876
NtProtectVirtualMemory
process_identifier: 3264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619623137.622876
NtProtectVirtualMemory
process_identifier: 3264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003b2000
success 0 0
1619623137.622876
NtProtectVirtualMemory
process_identifier: 3264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.vbs
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (43 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.5024218094179576 section {'size_of_data': '0x00074c00', 'virtual_address': '0x000b1000', 'entropy': 7.5024218094179576, 'name': '.rsrc', 'virtual_size': '0x00074a54'} description A section with a high entropy has been found
entropy 0.40644038294168844 description Overall entropy of this PE file is high
Expresses interest in specific running processes (1 个事件)
process hshbbb.exe
Repeatedly searches for a not-found process, you may want to run a web browser during analysis (40 个事件)
Time & API Arguments Status Return Repeated
1619623118.888999
Process32NextW
process_name: 66565199e6989f47ba9f652e0789ff23.exe
snapshot_handle: 0x000000f8
process_identifier: 624
failed 0 0
1619623119.950751
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 300
failed 0 0
1619623120.325374
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 1056
failed 0 0
1619623136.966374
Process32NextW
process_name: conhost.exe
snapshot_handle: 0x0000035c
process_identifier: 3092
failed 0 0
1619623137.372876
Process32NextW
process_name: hshbbb.exe
snapshot_handle: 0x000000f8
process_identifier: 3192
failed 0 0
1619623137.653499
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3420
failed 0 0
1619623138.310499
Process32NextW
process_name: hshbbb.exe
snapshot_handle: 0x00000114
process_identifier: 3324
failed 0 0
1619623138.482876
Process32NextW
process_name: hshbbb.exe
snapshot_handle: 0x000000f8
process_identifier: 3536
failed 0 0
1619623140.733249
Process32NextW
process_name: hshbbb.exe
snapshot_handle: 0x000000f8
process_identifier: 3668
failed 0 0
1619623141.061249
Process32NextW
process_name: hshbbb.exe
snapshot_handle: 0x00000108
process_identifier: 3668
failed 0 0
1619623141.217249
Process32NextW
process_name: hshbbb.exe
snapshot_handle: 0x000000f8
process_identifier: 3808
failed 0 0
1619623141.717249
Process32NextW
process_name: hshbbb.exe
snapshot_handle: 0x000000f8
process_identifier: 3944
failed 0 0
1619623142.483249
Process32NextW
process_name: dllhost.exe
snapshot_handle: 0x00000118
process_identifier: 4048
failed 0 0
1619623142.700999
Process32NextW
process_name: hshbbb.exe
snapshot_handle: 0x000000f8
process_identifier: 4088
failed 0 0
1619623143.247876
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 2868
failed 0 0
1619623144.450876
Process32NextW
process_name: hshbbb.exe
snapshot_handle: 0x00000128
process_identifier: 1124
failed 0 0
1619623144.592249
Process32NextW
process_name: hshbbb.exe
snapshot_handle: 0x000000f8
process_identifier: 3208
failed 0 0
1619623145.544374
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3396
failed 0 0
1619623146.091374
Process32NextW
process_name: hshbbb.exe
snapshot_handle: 0x00000110
process_identifier: 3404
failed 0 0
1619623146.278501
Process32NextW
process_name: hshbbb.exe
snapshot_handle: 0x000000f8
process_identifier: 3652
failed 0 0
1619623147.279124
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3812
failed 0 0
1619623149.592124
Process32NextW
process_name: hshbbb.exe
snapshot_handle: 0x00000150
process_identifier: 3836
failed 0 0
1619623161.185751
Process32NextW
process_name: hshbbb.exe
snapshot_handle: 0x000000fc
process_identifier: 3456
failed 0 0
1619623161.917125
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3340
failed 0 0
1619623163.776125
Process32NextW
process_name: hshbbb.exe
snapshot_handle: 0x00000140
process_identifier: 2796
failed 0 0
1619623164.15725
Process32NextW
process_name: hshbbb.exe
snapshot_handle: 0x000000f8
process_identifier: 1632
failed 0 0
1619623164.450626
Process32NextW
process_name: is32bit.exe
snapshot_handle: 0x000000f8
process_identifier: 3904
failed 0 0
1619623165.013626
Process32NextW
process_name: hshbbb.exe
snapshot_handle: 0x00000110
process_identifier: 3604
failed 0 0
1619623165.256062
Process32NextW
process_name: hshbbb.exe
snapshot_handle: 0x000000f8
process_identifier: 3980
failed 0 0
1619623166.136
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3296
failed 0 0
1619623166.792
Process32NextW
process_name: hshbbb.exe
snapshot_handle: 0x00000114
process_identifier: 4016
failed 0 0
1619623167.058564
Process32NextW
process_name: hshbbb.exe
snapshot_handle: 0x000000f8
process_identifier: 3076
failed 0 0
1619623169.304902
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 1304
failed 0 0
1619623176.351902
Process32NextW
process_name: mscorsvw.exe
snapshot_handle: 0x000001fc
process_identifier: 3872
failed 0 0
1619623178.06138
Process32NextW
process_name: hshbbb.exe
snapshot_handle: 0x000000f8
process_identifier: 3880
failed 0 0
1619623179.004783
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 3752
failed 0 0
1619623182.097783
Process32NextW
process_name: hshbbb.exe
snapshot_handle: 0x0000016c
process_identifier: 4052
failed 0 0
1619623182.472467
Process32NextW
process_name: hshbbb.exe
snapshot_handle: 0x000000f8
process_identifier: 4080
failed 0 0
1619623185.082594
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f8
process_identifier: 2008
failed 0 0
1619623189.363594
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000198
process_identifier: 1100
failed 0 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Creates an Alternate Data Stream (ADS) (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe:ZoneIdentifier
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619623119.310999
NtAllocateVirtualMemory
process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000100
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
Installs itself for autorun at Windows startup (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.vbs
Deletes executed files from disk (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe
Creates a thread using NtQueueApcThread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 624 created a thread in remote process 2712
Time & API Arguments Status Return Repeated
1619623119.310999
NtQueueApcThread
thread_handle: 0x00000108
process_identifier: 2712
function_address: 0x000b05c0
parameter: 0x000c0000
success 0 0
Potential code injection by writing to the memory of another process (2 个事件)
Time & API Arguments Status Return Repeated
1619623119.310999
WriteProcessMemory
process_identifier: 2712
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000100
base_address: 0x000b0000
success 1 0
1619623119.310999
WriteProcessMemory
process_identifier: 2712
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\66565199e6989f47ba9f652e0789ff23.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\66565199e6989f47ba9f652e0789ff23.exe" winsET eSEODJ = crEaTeObject("WScriPt.ShELL") eSEODj.ruN """%ls""", 0, False
process_handle: 0x00000100
base_address: 0x000c0000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (26 个事件)
Process injection Process 1888 called NtSetContextThread to modify thread in remote process 880
Process injection Process 3192 called NtSetContextThread to modify thread in remote process 3264
Process injection Process 3536 called NtSetContextThread to modify thread in remote process 3608
Process injection Process 3808 called NtSetContextThread to modify thread in remote process 3884
Process injection Process 4088 called NtSetContextThread to modify thread in remote process 1464
Process injection Process 3208 called NtSetContextThread to modify thread in remote process 3312
Process injection Process 3652 called NtSetContextThread to modify thread in remote process 3756
Process injection Process 3456 called NtSetContextThread to modify thread in remote process 2368
Process injection Process 1632 called NtSetContextThread to modify thread in remote process 3620
Process injection Process 3980 called NtSetContextThread to modify thread in remote process 4012
Process injection Process 3076 called NtSetContextThread to modify thread in remote process 3688
Process injection Process 3880 called NtSetContextThread to modify thread in remote process 1948
Process injection Process 4080 called NtSetContextThread to modify thread in remote process 3612
Time & API Arguments Status Return Repeated
1619623120.013751
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 880
success 0 0
1619623137.450876
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3264
success 0 0
1619623138.716876
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3608
success 0 0
1619623141.545249
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3884
success 0 0
1619623143.013999
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1464
success 0 0
1619623145.295249
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3312
success 0 0
1619623146.888501
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3756
success 0 0
1619623161.247751
NtSetContextThread
thread_handle: 0x0000010c
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2368
success 0 0
1619623164.25125
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3620
success 0 0
1619623165.787062
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 4012
success 0 0
1619623167.558564
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3688
success 0 0
1619623178.60838
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1948
success 0 0
1619623182.675467
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3612
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (26 个事件)
Process injection Process 1888 resumed a thread in remote process 880
Process injection Process 3192 resumed a thread in remote process 3264
Process injection Process 3536 resumed a thread in remote process 3608
Process injection Process 3808 resumed a thread in remote process 3884
Process injection Process 4088 resumed a thread in remote process 1464
Process injection Process 3208 resumed a thread in remote process 3312
Process injection Process 3652 resumed a thread in remote process 3756
Process injection Process 3456 resumed a thread in remote process 2368
Process injection Process 1632 resumed a thread in remote process 3620
Process injection Process 3980 resumed a thread in remote process 4012
Process injection Process 3076 resumed a thread in remote process 3688
Process injection Process 3880 resumed a thread in remote process 1948
Process injection Process 4080 resumed a thread in remote process 3612
Time & API Arguments Status Return Repeated
1619623120.122751
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 880
success 0 0
1619623137.482876
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3264
success 0 0
1619623138.763876
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3608
success 0 0
1619623141.576249
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3884
success 0 0
1619623143.060999
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 1464
success 0 0
1619623145.373249
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3312
success 0 0
1619623147.075501
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3756
success 0 0
1619623161.263751
NtResumeThread
thread_handle: 0x0000010c
suspend_count: 1
process_identifier: 2368
success 0 0
1619623164.28225
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3620
success 0 0
1619623165.881062
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 4012
success 0 0
1619623168.793564
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3688
success 0 0
1619623178.68638
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 1948
success 0 0
1619623184.410467
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3612
success 0 0
Executed a process and injected code into it, probably while unpacking (50 out of 110 个事件)
Time & API Arguments Status Return Repeated
1619623119.310999
CreateProcessInternalW
thread_identifier: 1380
thread_handle: 0x00000108
process_identifier: 2712
current_directory:
filepath: C:\Windows\System32\notepad.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\notepad.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619623119.310999
NtAllocateVirtualMemory
process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000100
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
1619623119.310999
NtAllocateVirtualMemory
process_identifier: 2712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
process_handle: 0x00000100
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000c0000
success 0 0
1619623119.310999
WriteProcessMemory
process_identifier: 2712
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000100
base_address: 0x000b0000
success 1 0
1619623119.310999
WriteProcessMemory
process_identifier: 2712
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\66565199e6989f47ba9f652e0789ff23.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\66565199e6989f47ba9f652e0789ff23.exe" winsET eSEODJ = crEaTeObject("WScriPt.ShELL") eSEODj.ruN """%ls""", 0, False
process_handle: 0x00000100
base_address: 0x000c0000
success 1 0
1619623119.764249
CreateProcessInternalW
thread_identifier: 1320
thread_handle: 0x000000d0
process_identifier: 1888
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000000cc
inherit_handles: 0
success 1 0
1619623119.997751
CreateProcessInternalW
thread_identifier: 2636
thread_handle: 0x00000108
process_identifier: 880
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619623119.997751
NtUnmapViewOfSection
process_identifier: 880
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619623119.997751
NtMapViewOfSection
section_handle: 0x00000110
process_identifier: 880
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619623120.013751
NtGetContextThread
thread_handle: 0x00000108
success 0 0
1619623120.013751
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 880
success 0 0
1619623120.122751
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 880
success 0 0
1619623120.138751
CreateProcessInternalW
thread_identifier: 1804
thread_handle: 0x0000010c
process_identifier: 1868
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe" 2 880 25300390
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000011c
inherit_handles: 0
success 1 0
1619623137.185374
CreateProcessInternalW
thread_identifier: 3196
thread_handle: 0x00000360
process_identifier: 3192
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000364
inherit_handles: 0
success 1 0
1619623137.435876
CreateProcessInternalW
thread_identifier: 3268
thread_handle: 0x00000108
process_identifier: 3264
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619623137.435876
NtUnmapViewOfSection
process_identifier: 3264
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619623137.435876
NtMapViewOfSection
section_handle: 0x00000110
process_identifier: 3264
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619623137.450876
NtGetContextThread
thread_handle: 0x00000108
success 0 0
1619623137.450876
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3264
success 0 0
1619623137.482876
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3264
success 0 0
1619623137.497876
CreateProcessInternalW
thread_identifier: 3328
thread_handle: 0x0000010c
process_identifier: 3324
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe" 2 3264 25317750
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000011c
inherit_handles: 0
success 1 0
1619623138.357499
CreateProcessInternalW
thread_identifier: 3540
thread_handle: 0x00000118
process_identifier: 3536
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000011c
inherit_handles: 0
success 1 0
1619623138.513876
CreateProcessInternalW
thread_identifier: 3612
thread_handle: 0x00000108
process_identifier: 3608
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619623138.513876
NtUnmapViewOfSection
process_identifier: 3608
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619623138.513876
NtMapViewOfSection
section_handle: 0x00000110
process_identifier: 3608
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619623138.716876
NtGetContextThread
thread_handle: 0x00000108
success 0 0
1619623138.716876
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3608
success 0 0
1619623138.763876
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3608
success 0 0
1619623140.591876
CreateProcessInternalW
thread_identifier: 3672
thread_handle: 0x0000010c
process_identifier: 3668
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe" 2 3608 25319031
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000011c
inherit_handles: 0
success 1 0
1619623141.076249
CreateProcessInternalW
thread_identifier: 3812
thread_handle: 0x0000010c
process_identifier: 3808
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000110
inherit_handles: 0
success 1 0
1619623141.295249
CreateProcessInternalW
thread_identifier: 3888
thread_handle: 0x00000108
process_identifier: 3884
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619623141.295249
NtUnmapViewOfSection
process_identifier: 3884
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619623141.295249
NtMapViewOfSection
section_handle: 0x00000110
process_identifier: 3884
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619623141.545249
NtGetContextThread
thread_handle: 0x00000108
success 0 0
1619623141.545249
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3884
success 0 0
1619623141.576249
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3884
success 0 0
1619623141.576249
CreateProcessInternalW
thread_identifier: 3948
thread_handle: 0x0000010c
process_identifier: 3944
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe" 2 3884 25321843
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000011c
inherit_handles: 0
success 1 0
1619623142.545249
CreateProcessInternalW
thread_identifier: 4092
thread_handle: 0x0000011c
process_identifier: 4088
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000120
inherit_handles: 0
success 1 0
1619623142.747999
CreateProcessInternalW
thread_identifier: 3000
thread_handle: 0x00000108
process_identifier: 1464
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619623142.747999
NtUnmapViewOfSection
process_identifier: 1464
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619623142.747999
NtMapViewOfSection
section_handle: 0x00000110
process_identifier: 1464
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619623143.013999
NtGetContextThread
thread_handle: 0x00000108
success 0 0
1619623143.013999
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1464
success 0 0
1619623143.060999
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 1464
success 0 0
1619623143.091999
CreateProcessInternalW
thread_identifier: 3036
thread_handle: 0x0000010c
process_identifier: 1124
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe" 2 1464 25323328
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000011c
inherit_handles: 0
success 1 0
1619623144.466876
CreateProcessInternalW
thread_identifier: 3212
thread_handle: 0x0000012c
process_identifier: 3208
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000130
inherit_handles: 0
success 1 0
1619623144.654249
CreateProcessInternalW
thread_identifier: 3308
thread_handle: 0x00000108
process_identifier: 3312
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619623144.654249
NtUnmapViewOfSection
process_identifier: 3312
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619623144.654249
NtMapViewOfSection
section_handle: 0x00000110
process_identifier: 3312
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619623145.295249
NtGetContextThread
thread_handle: 0x00000108
success 0 0
File has been identified by 59 AntiVirus engines on VirusTotal as malicious (50 out of 59 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Delf.FareIt.Gen.7
FireEye Generic.mg.66565199e6989f47
Qihoo-360 Win32/Trojan.ed1
McAfee Fareit-FTB!66565199E698
Malwarebytes Trojan.MalPack.DLF
VIPRE Trojan.Win32.Generic!BT
AegisLab Trojan.Win32.Crypt.4!c
Sangfor Malware
K7AntiVirus Trojan ( 0056a59a1 )
BitDefender Trojan.Delf.FareIt.Gen.7
K7GW Trojan ( 0056a59a1 )
Cybereason malicious.9a87de
Arcabit Trojan.Delf.FareIt.Gen.7
Cyren W32/Trojan.MZRB-5079
Symantec Trojan.Gen.2
APEX Malicious
Avast Win32:PWSX-gen [Trj]
Kaspersky HEUR:Trojan.Win32.Crypt.gen
Alibaba Trojan:Win32/DelfInject.ali2000015
NANO-Antivirus Trojan.Win32.Crypt.hntfmz
Tencent Win32.Trojan.Inject.Auto
Ad-Aware Trojan.Delf.FareIt.Gen.7
Sophos Mal/Generic-S
Comodo Malware@#2pfesqd4mxoq2
F-Secure Trojan.TR/Injector.lthgs
DrWeb BackDoor.RatNET.2
Zillya Trojan.Crypt.Win32.63020
TrendMicro TSPY_HPLOKI.SMBD
McAfee-GW-Edition BehavesLike.Win32.Fareit.tc
Emsisoft Trojan.Delf.FareIt.Gen.7 (B)
SentinelOne Static AI - Malicious PE
Jiangmin AdWare.Generic.uhys
Avira TR/Injector.lthgs
Antiy-AVL Trojan/Win32.Crypt
Microsoft PWS:Win32/Fareit.AQ!MTB
SUPERAntiSpyware Trojan.Agent/Gen-Injector
ZoneAlarm HEUR:Trojan.Win32.Crypt.gen
GData Trojan.Delf.FareIt.Gen.7
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2094
BitDefenderTheta Gen:NN.ZelphiF.34670.hHW@aaeakjci
ALYac Trojan.Delf.FareIt.Gen.7
MAX malware (ai score=84)
VBA32 BScope.TrojanPSW.Fareit
Cylance Unsafe
Panda Trj/CI.A
Zoner Trojan.Win32.91516
ESET-NOD32 a variant of Win32/Injector.EMOY
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 172.217.24.14:443
dead_host 172.217.160.78:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x4a0164 VirtualFree
• 0x4a0168 VirtualAlloc
• 0x4a016c LocalFree
• 0x4a0170 LocalAlloc
• 0x4a0174 GetVersion
• 0x4a0178 GetCurrentThreadId
• 0x4a0184 VirtualQuery
• 0x4a0188 WideCharToMultiByte
• 0x4a018c MultiByteToWideChar
• 0x4a0190 lstrlenA
• 0x4a0194 lstrcpynA
• 0x4a0198 LoadLibraryExA
• 0x4a019c GetThreadLocale
• 0x4a01a0 GetStartupInfoA
• 0x4a01a4 GetProcAddress
• 0x4a01a8 GetModuleHandleA
• 0x4a01ac GetModuleFileNameA
• 0x4a01b0 GetLocaleInfoA
• 0x4a01b4 GetCommandLineA
• 0x4a01b8 FreeLibrary
• 0x4a01bc FindFirstFileA
• 0x4a01c0 FindClose
• 0x4a01c4 ExitProcess
• 0x4a01c8 WriteFile
• 0x4a01d0 RtlUnwind
• 0x4a01d4 RaiseException
• 0x4a01d8 GetStdHandle
Library user32.dll:
• 0x4a01e0 GetKeyboardType
• 0x4a01e4 LoadStringA
• 0x4a01e8 MessageBoxA
• 0x4a01ec CharNextA
Library advapi32.dll:
• 0x4a01f4 RegQueryValueExA
• 0x4a01f8 RegOpenKeyExA
• 0x4a01fc RegCloseKey
Library oleaut32.dll:
• 0x4a0204 SysFreeString
• 0x4a0208 SysReAllocStringLen
• 0x4a020c SysAllocStringLen
Library kernel32.dll:
• 0x4a0214 TlsSetValue
• 0x4a0218 TlsGetValue
• 0x4a021c LocalAlloc
• 0x4a0220 GetModuleHandleA
Library advapi32.dll:
• 0x4a0228 RegQueryValueExA
• 0x4a022c RegOpenKeyExA
• 0x4a0230 RegCloseKey
Library kernel32.dll:
• 0x4a0238 lstrcpyA
• 0x4a023c WriteFile
• 0x4a0240 WideCharToMultiByte
• 0x4a0244 WaitForSingleObject
• 0x4a0248 VirtualQuery
• 0x4a024c VirtualProtectEx
• 0x4a0250 VirtualAlloc
• 0x4a0254 Sleep
• 0x4a0258 SizeofResource
• 0x4a025c SetThreadLocale
• 0x4a0260 SetFilePointer
• 0x4a0264 SetEvent
• 0x4a0268 SetErrorMode
• 0x4a026c SetEndOfFile
• 0x4a0270 ResetEvent
• 0x4a0274 ReadFile
• 0x4a0278 MultiByteToWideChar
• 0x4a027c MulDiv
• 0x4a0280 LockResource
• 0x4a0284 LoadResource
• 0x4a0288 LoadLibraryA
• 0x4a0294 GlobalUnlock
• 0x4a0298 GlobalReAlloc
• 0x4a029c GlobalHandle
• 0x4a02a0 GlobalLock
• 0x4a02a4 GlobalFree
• 0x4a02a8 GlobalFindAtomA
• 0x4a02ac GlobalDeleteAtom
• 0x4a02b0 GlobalAlloc
• 0x4a02b4 GlobalAddAtomA
• 0x4a02b8 GetVersionExA
• 0x4a02bc GetVersion
• 0x4a02c0 GetTickCount
• 0x4a02c4 GetThreadLocale
• 0x4a02c8 GetSystemInfo
• 0x4a02cc GetStringTypeExA
• 0x4a02d0 GetStdHandle
• 0x4a02d4 GetProcAddress
• 0x4a02d8 GetModuleHandleA
• 0x4a02dc GetModuleFileNameA
• 0x4a02e0 GetLocaleInfoA
• 0x4a02e4 GetLocalTime
• 0x4a02e8 GetLastError
• 0x4a02ec GetFullPathNameA
• 0x4a02f0 GetFileAttributesA
• 0x4a02f4 GetDiskFreeSpaceA
• 0x4a02f8 GetDateFormatA
• 0x4a02fc GetCurrentThreadId
• 0x4a0300 GetCurrentProcessId
• 0x4a0304 GetCurrentProcess
• 0x4a0308 GetCPInfo
• 0x4a030c GetACP
• 0x4a0310 FreeResource
• 0x4a0314 InterlockedExchange
• 0x4a0318 FreeLibrary
• 0x4a031c FormatMessageA
• 0x4a0320 FindResourceA
• 0x4a0324 FindFirstFileA
• 0x4a0328 FindClose
• 0x4a0334 EnumCalendarInfoA
• 0x4a0340 CreateThread
• 0x4a0344 CreateFileA
• 0x4a0348 CreateEventA
• 0x4a034c CompareStringA
• 0x4a0350 CloseHandle
Library version.dll:
• 0x4a0358 VerQueryValueA
• 0x4a0360 GetFileVersionInfoA
Library gdi32.dll:
• 0x4a0368 UnrealizeObject
• 0x4a036c StretchBlt
• 0x4a0370 SetWindowOrgEx
• 0x4a0374 SetWinMetaFileBits
• 0x4a0378 SetViewportOrgEx
• 0x4a037c SetTextColor
• 0x4a0380 SetStretchBltMode
• 0x4a0384 SetROP2
• 0x4a0388 SetPixel
• 0x4a038c SetEnhMetaFileBits
• 0x4a0390 SetDIBColorTable
• 0x4a0394 SetBrushOrgEx
• 0x4a0398 SetBkMode
• 0x4a039c SetBkColor
• 0x4a03a0 SelectPalette
• 0x4a03a4 SelectObject
• 0x4a03a8 SaveDC
• 0x4a03ac RestoreDC
• 0x4a03b0 Rectangle
• 0x4a03b4 RectVisible
• 0x4a03b8 RealizePalette
• 0x4a03bc Polyline
• 0x4a03c0 PlayEnhMetaFile
• 0x4a03c4 PatBlt
• 0x4a03c8 MoveToEx
• 0x4a03cc MaskBlt
• 0x4a03d0 LineTo
• 0x4a03d4 IntersectClipRect
• 0x4a03d8 GetWindowOrgEx
• 0x4a03dc GetWinMetaFileBits
• 0x4a03e0 GetTextMetricsA
• 0x4a03ec GetStockObject
• 0x4a03f0 GetPixel
• 0x4a03f4 GetPaletteEntries
• 0x4a03f8 GetObjectA
• 0x4a0404 GetEnhMetaFileBits
• 0x4a0408 GetDeviceCaps
• 0x4a040c GetDIBits
• 0x4a0410 GetDIBColorTable
• 0x4a0414 GetDCOrgEx
• 0x4a041c GetClipBox
• 0x4a0420 GetBrushOrgEx
• 0x4a0424 GetBitmapBits
• 0x4a0428 ExcludeClipRect
• 0x4a042c DeleteObject
• 0x4a0430 DeleteEnhMetaFile
• 0x4a0434 DeleteDC
• 0x4a0438 CreateSolidBrush
• 0x4a043c CreatePenIndirect
• 0x4a0440 CreatePalette
• 0x4a0448 CreateFontIndirectA
• 0x4a044c CreateDIBitmap
• 0x4a0450 CreateDIBSection
• 0x4a0454 CreateCompatibleDC
• 0x4a045c CreateBrushIndirect
• 0x4a0460 CreateBitmap
• 0x4a0464 CopyEnhMetaFileA
• 0x4a0468 BitBlt
Library user32.dll:
• 0x4a0470 CreateWindowExA
• 0x4a0474 WindowFromPoint
• 0x4a0478 WinHelpA
• 0x4a047c WaitMessage
• 0x4a0480 UpdateWindow
• 0x4a0484 UnregisterClassA
• 0x4a0488 UnhookWindowsHookEx
• 0x4a048c TranslateMessage
• 0x4a0494 TrackPopupMenu
• 0x4a049c ShowWindow
• 0x4a04a0 ShowScrollBar
• 0x4a04a4 ShowOwnedPopups
• 0x4a04a8 ShowCursor
• 0x4a04ac SetWindowsHookExA
• 0x4a04b0 SetWindowPos
• 0x4a04b4 SetWindowPlacement
• 0x4a04b8 SetWindowLongA
• 0x4a04bc SetTimer
• 0x4a04c0 SetScrollRange
• 0x4a04c4 SetScrollPos
• 0x4a04c8 SetScrollInfo
• 0x4a04cc SetRect
• 0x4a04d0 SetPropA
• 0x4a04d4 SetParent
• 0x4a04d8 SetMenuItemInfoA
• 0x4a04dc SetMenu
• 0x4a04e0 SetForegroundWindow
• 0x4a04e4 SetFocus
• 0x4a04e8 SetCursor
• 0x4a04ec SetClassLongA
• 0x4a04f0 SetCapture
• 0x4a04f4 SetActiveWindow
• 0x4a04f8 SendMessageA
• 0x4a04fc ScrollWindow
• 0x4a0500 ScreenToClient
• 0x4a0504 RemovePropA
• 0x4a0508 RemoveMenu
• 0x4a050c ReleaseDC
• 0x4a0510 ReleaseCapture
• 0x4a051c RegisterClassA
• 0x4a0520 RedrawWindow
• 0x4a0524 PtInRect
• 0x4a0528 PostQuitMessage
• 0x4a052c PostMessageA
• 0x4a0530 PeekMessageA
• 0x4a0534 OffsetRect
• 0x4a0538 OemToCharA
• 0x4a053c MessageBoxA
• 0x4a0540 MapWindowPoints
• 0x4a0544 MapVirtualKeyA
• 0x4a0548 LoadStringA
• 0x4a054c LoadKeyboardLayoutA
• 0x4a0550 LoadIconA
• 0x4a0554 LoadCursorA
• 0x4a0558 LoadBitmapA
• 0x4a055c KillTimer
• 0x4a0560 IsZoomed
• 0x4a0564 IsWindowVisible
• 0x4a0568 IsWindowEnabled
• 0x4a056c IsWindow
• 0x4a0570 IsRectEmpty
• 0x4a0574 IsIconic
• 0x4a0578 IsDialogMessageA
• 0x4a057c IsChild
• 0x4a0580 InvalidateRect
• 0x4a0584 IntersectRect
• 0x4a0588 InsertMenuItemA
• 0x4a058c InsertMenuA
• 0x4a0590 InflateRect
• 0x4a0598 GetWindowTextA
• 0x4a059c GetWindowRect
• 0x4a05a0 GetWindowPlacement
• 0x4a05a4 GetWindowLongA
• 0x4a05a8 GetWindowDC
• 0x4a05ac GetTopWindow
• 0x4a05b0 GetSystemMetrics
• 0x4a05b4 GetSystemMenu
• 0x4a05b8 GetSysColorBrush
• 0x4a05bc GetSysColor
• 0x4a05c0 GetSubMenu
• 0x4a05c4 GetScrollRange
• 0x4a05c8 GetScrollPos
• 0x4a05cc GetScrollInfo
• 0x4a05d0 GetPropA
• 0x4a05d4 GetParent
• 0x4a05d8 GetWindow
• 0x4a05dc GetMenuStringA
• 0x4a05e0 GetMenuState
• 0x4a05e4 GetMenuItemInfoA
• 0x4a05e8 GetMenuItemID
• 0x4a05ec GetMenuItemCount
• 0x4a05f0 GetMenu
• 0x4a05f4 GetLastActivePopup
• 0x4a05f8 GetKeyboardState
• 0x4a0600 GetKeyboardLayout
• 0x4a0604 GetKeyState
• 0x4a0608 GetKeyNameTextA
• 0x4a060c GetIconInfo
• 0x4a0610 GetForegroundWindow
• 0x4a0614 GetFocus
• 0x4a0618 GetDlgItem
• 0x4a061c GetDesktopWindow
• 0x4a0620 GetDCEx
• 0x4a0624 GetDC
• 0x4a0628 GetCursorPos
• 0x4a062c GetCursor
• 0x4a0630 GetClipboardData
• 0x4a0634 GetClientRect
• 0x4a0638 GetClassNameA
• 0x4a063c GetClassInfoA
• 0x4a0640 GetCapture
• 0x4a0644 GetActiveWindow
• 0x4a0648 FrameRect
• 0x4a064c FindWindowA
• 0x4a0650 FillRect
• 0x4a0654 EqualRect
• 0x4a0658 EnumWindows
• 0x4a065c EnumThreadWindows
• 0x4a0660 EndPaint
• 0x4a0664 EnableWindow
• 0x4a0668 EnableScrollBar
• 0x4a066c EnableMenuItem
• 0x4a0670 DrawTextA
• 0x4a0674 DrawMenuBar
• 0x4a0678 DrawIconEx
• 0x4a067c DrawIcon
• 0x4a0680 DrawFrameControl
• 0x4a0684 DrawFocusRect
• 0x4a0688 DrawEdge
• 0x4a068c DispatchMessageA
• 0x4a0690 DestroyWindow
• 0x4a0694 DestroyMenu
• 0x4a0698 DestroyIcon
• 0x4a069c DestroyCursor
• 0x4a06a0 DeleteMenu
• 0x4a06a4 DefWindowProcA
• 0x4a06a8 DefMDIChildProcA
• 0x4a06ac DefFrameProcA
• 0x4a06b0 CreatePopupMenu
• 0x4a06b4 CreateMenu
• 0x4a06b8 CreateIcon
• 0x4a06bc ClientToScreen
• 0x4a06c0 CheckMenuItem
• 0x4a06c4 CallWindowProcA
• 0x4a06c8 CallNextHookEx
• 0x4a06cc BeginPaint
• 0x4a06d0 CharNextA
• 0x4a06d4 CharLowerBuffA
• 0x4a06d8 CharLowerA
• 0x4a06dc CharUpperBuffA
• 0x4a06e0 CharToOemA
• 0x4a06e4 AdjustWindowRectEx
Library kernel32.dll:
• 0x4a06f0 Sleep
Library oleaut32.dll:
• 0x4a06f8 SafeArrayPtrOfIndex
• 0x4a06fc SafeArrayPutElement
• 0x4a0700 SafeArrayGetElement
• 0x4a0708 SafeArrayAccessData
• 0x4a070c SafeArrayGetUBound
• 0x4a0710 SafeArrayGetLBound
• 0x4a0714 SafeArrayRedim
• 0x4a0718 SafeArrayCreate
• 0x4a071c VariantChangeType
• 0x4a0720 VariantCopyInd
• 0x4a0724 VariantCopy
• 0x4a0728 VariantClear
• 0x4a072c VariantInit
Library ole32.dll:
• 0x4a0734 CoCreateInstance
• 0x4a0738 CoGetMalloc
• 0x4a073c CoUninitialize
• 0x4a0740 CoInitialize
Library oleaut32.dll:
• 0x4a0748 GetErrorInfo
• 0x4a074c SysStringLen
• 0x4a0750 SysFreeString
Library comctl32.dll:
• 0x4a0760 ImageList_Write
• 0x4a0764 ImageList_Read
• 0x4a0774 ImageList_DragMove
• 0x4a0778 ImageList_DragLeave
• 0x4a077c ImageList_DragEnter
• 0x4a0780 ImageList_EndDrag
• 0x4a0784 ImageList_BeginDrag
• 0x4a0788 ImageList_Remove
• 0x4a078c ImageList_DrawEx
• 0x4a0790 ImageList_Replace
• 0x4a0794 ImageList_Draw
• 0x4a07a4 ImageList_Add
• 0x4a07ac ImageList_Destroy
• 0x4a07b0 ImageList_Create
• 0x4a07b4 InitCommonControls
Library comdlg32.dll:
• 0x4a07bc GetSaveFileNameA
• 0x4a07c0 GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50568 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 51379 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.