SmartHawk

12.4

0-day

58 个模型检测该样本为恶意！

重新分析

下载样本

68ee120de5e3ced8f322781d78428addf813a759ce03f61c12d96ab5184f4515

69febf2d3907f7e0a5002f5622e3c9be.exe

分析耗时

91s

最近分析

文件大小

1.2MB

静态报毒动态报毒 100% AGEN AI SCORE=84 AIDETECTVM BTW9NW CLASSIC CONFIDENCE DELF DELPHILESS ELKP ELLC FAREIT FORMBOOK GENERICKD HIGH CONFIDENCE HILHFE IGENT KRYPT KRYPTIK LOKIBOT MALWARE1 MALWARE@#8K94T15AD3Q9 MRPX PH0@AK36D R06EC0DI220 REMCOS S + MAL SCORE SIGGEN8 STATIC AI SUSGEN SUSPICIOUS PE TRJGEN TSCOPE UNSAFE X2059 ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FSK!69FEBF2D3907	20201229	6.0.6.653
Baidu		20190318	1.0.0.2
Alibaba	Trojan:Win32/FormBook.a5adabf1	20190527	0.3.0.5
Kingsoft		20201229	2017.9.26.565
Avast	Win32:Malware-gen	20201229	21.1.5827.0
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (29 个事件)

Time & API	Arguments	Status
1619610622.56225 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 49938248 registers.edi: 0 registers.eax: 4 registers.ebp: 49938312 registers.edx: 2130553844 registers.ebx: 1983198136 registers.esi: 0 registers.ecx: 3763470336 exception.instruction_r: 66 89 03 33 c0 5a 59 59 64 89 10 68 21 b8 4a 00 exception.symbol: 69febf2d3907f7e0a5002f5622e3c9be+0xab801 exception.instruction: mov word ptr [ebx], ax exception.module: 69febf2d3907f7e0a5002f5622e3c9be.exe exception.exception_code: 0xc0000005 exception.offset: 702465 exception.address: 0x4ab801	success
1619630833.39425 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 40042312 registers.edi: 0 registers.eax: 4 registers.ebp: 40042376 registers.edx: 2130553844 registers.ebx: 1983198136 registers.esi: 0 registers.ecx: 386072576 exception.instruction_r: 66 89 03 33 c0 5a 59 59 64 89 10 68 21 b8 4a 00 exception.symbol: winwin+0xab801 exception.instruction: mov word ptr [ebx], ax exception.module: WinWin.exe exception.exception_code: 0xc0000005 exception.offset: 702465 exception.address: 0x4ab801	success
1619630855.09725 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x737fe97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x737fea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x737fb25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x737fb4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x737fac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x737faed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x737f5511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x737f559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73eb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73eb4de3 winwin+0x58a4d @ 0x458a4d winwin+0x51254 @ 0x451254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 232 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 232 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfc7f1485	success
1619630844.2995 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 51838792 registers.edi: 0 registers.eax: 4 registers.ebp: 51838856 registers.edx: 2130553844 registers.ebx: 1983198136 registers.esi: 0 registers.ecx: 538640384 exception.instruction_r: 66 89 03 33 c0 5a 59 59 64 89 10 68 21 b8 4a 00 exception.symbol: winwin+0xab801 exception.instruction: mov word ptr [ebx], ax exception.module: WinWin.exe exception.exception_code: 0xc0000005 exception.offset: 702465 exception.address: 0x4ab801	success
1619630856.72175 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 40763208 registers.edi: 0 registers.eax: 4 registers.ebp: 40763272 registers.edx: 2130553844 registers.ebx: 1983198136 registers.esi: 0 registers.ecx: 1888550912 exception.instruction_r: 66 89 03 33 c0 5a 59 59 64 89 10 68 21 b8 4a 00 exception.symbol: winwin+0xab801 exception.instruction: mov word ptr [ebx], ax exception.module: WinWin.exe exception.exception_code: 0xc0000005 exception.offset: 702465 exception.address: 0x4ab801	success
1619630860.018373 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73dae97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73daea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73dab25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73dab4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73daac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73daaed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73da5511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73da559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 winwin+0x58a4d @ 0x458a4d winwin+0x51254 @ 0x451254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfc641485	success
1619630860.080373 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 41156424 registers.edi: 0 registers.eax: 4 registers.ebp: 41156488 registers.edx: 2130553844 registers.ebx: 1983198136 registers.esi: 0 registers.ecx: 2137128960 exception.instruction_r: 66 89 03 33 c0 5a 59 59 64 89 10 68 21 b8 4a 00 exception.symbol: winwin+0xab801 exception.instruction: mov word ptr [ebx], ax exception.module: WinWin.exe exception.exception_code: 0xc0000005 exception.offset: 702465 exception.address: 0x4ab801	success
1619630860.486625 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 50986824 registers.edi: 0 registers.eax: 4 registers.ebp: 50986888 registers.edx: 2130553844 registers.ebx: 1983198136 registers.esi: 0 registers.ecx: 1635057664 exception.instruction_r: 66 89 03 33 c0 5a 59 59 64 89 10 68 21 b8 4a 00 exception.symbol: winwin+0xab801 exception.instruction: mov word ptr [ebx], ax exception.module: WinWin.exe exception.exception_code: 0xc0000005 exception.offset: 702465 exception.address: 0x4ab801	success
1619630863.8145 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x737ae97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x737aea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x737ab25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x737ab4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x737aac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x737aaed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x737a5511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x737a559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73e67f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73e64de3 winwin+0x58a4d @ 0x458a4d winwin+0x51254 @ 0x451254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfe081485	success
1619630863.8775 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 50659144 registers.edi: 0 registers.eax: 4 registers.ebp: 50659208 registers.edx: 2130553844 registers.ebx: 1983198136 registers.esi: 0 registers.ecx: 1816592384 exception.instruction_r: 66 89 03 33 c0 5a 59 59 64 89 10 68 21 b8 4a 00 exception.symbol: winwin+0xab801 exception.instruction: mov word ptr [ebx], ax exception.module: WinWin.exe exception.exception_code: 0xc0000005 exception.offset: 702465 exception.address: 0x4ab801	success
1619630864.25325 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 50593608 registers.edi: 0 registers.eax: 4 registers.ebp: 50593672 registers.edx: 2130553844 registers.ebx: 1983198136 registers.esi: 0 registers.ecx: 1847263232 exception.instruction_r: 66 89 03 33 c0 5a 59 59 64 89 10 68 21 b8 4a 00 exception.symbol: winwin+0xab801 exception.instruction: mov word ptr [ebx], ax exception.module: WinWin.exe exception.exception_code: 0xc0000005 exception.offset: 702465 exception.address: 0x4ab801	success
1619630867.502373 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x737fe97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x737fea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x737fb25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x737fb4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x737fac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x737faed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x737f5511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x737f559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 winwin+0x58a4d @ 0x458a4d winwin+0x51254 @ 0x451254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfe291485	success
1619630867.519 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 51052360 registers.edi: 0 registers.eax: 4 registers.ebp: 51052424 registers.edx: 2130553844 registers.ebx: 1983198136 registers.esi: 0 registers.ecx: 2596143104 exception.instruction_r: 66 89 03 33 c0 5a 59 59 64 89 10 68 21 b8 4a 00 exception.symbol: winwin+0xab801 exception.instruction: mov word ptr [ebx], ax exception.module: WinWin.exe exception.exception_code: 0xc0000005 exception.offset: 702465 exception.address: 0x4ab801	success
1619630868.378 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 39976776 registers.edi: 0 registers.eax: 4 registers.ebp: 39976840 registers.edx: 2130553844 registers.ebx: 1983198136 registers.esi: 0 registers.ecx: 2652438528 exception.instruction_r: 66 89 03 33 c0 5a 59 59 64 89 10 68 21 b8 4a 00 exception.symbol: winwin+0xab801 exception.instruction: mov word ptr [ebx], ax exception.module: WinWin.exe exception.exception_code: 0xc0000005 exception.offset: 702465 exception.address: 0x4ab801	success
1619630871.956 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73dae97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73daea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73dab25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73dab4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73daac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73daaed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73da5511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73da559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73eb7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73eb4de3 winwin+0x58a4d @ 0x458a4d winwin+0x51254 @ 0x451254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfc611485	success
1619630871.658625 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 41156424 registers.edi: 0 registers.eax: 4 registers.ebp: 41156488 registers.edx: 2130553844 registers.ebx: 1983198136 registers.esi: 0 registers.ecx: 2329608192 exception.instruction_r: 66 89 03 33 c0 5a 59 59 64 89 10 68 21 b8 4a 00 exception.symbol: winwin+0xab801 exception.instruction: mov word ptr [ebx], ax exception.module: WinWin.exe exception.exception_code: 0xc0000005 exception.offset: 702465 exception.address: 0x4ab801	success
1619630872.362 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 40632136 registers.edi: 0 registers.eax: 4 registers.ebp: 40632200 registers.edx: 2130553844 registers.ebx: 1983198136 registers.esi: 0 registers.ecx: 2411266048 exception.instruction_r: 66 89 03 33 c0 5a 59 59 64 89 10 68 21 b8 4a 00 exception.symbol: winwin+0xab801 exception.instruction: mov word ptr [ebx], ax exception.module: WinWin.exe exception.exception_code: 0xc0000005 exception.offset: 702465 exception.address: 0x4ab801	success
1619630875.67525 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x737fe97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x737fea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x737fb25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x737fb4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x737fac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x737faed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x737f5511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x737f559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 winwin+0x58a4d @ 0x458a4d winwin+0x51254 @ 0x451254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfe131485	success
1619630875.721875 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 51969864 registers.edi: 0 registers.eax: 4 registers.ebp: 51969928 registers.edx: 2130553844 registers.ebx: 1983198136 registers.esi: 0 registers.ecx: 3131703296 exception.instruction_r: 66 89 03 33 c0 5a 59 59 64 89 10 68 21 b8 4a 00 exception.symbol: winwin+0xab801 exception.instruction: mov word ptr [ebx], ax exception.module: WinWin.exe exception.exception_code: 0xc0000005 exception.offset: 702465 exception.address: 0x4ab801	success
1619630876.362 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 50790216 registers.edi: 0 registers.eax: 4 registers.ebp: 50790280 registers.edx: 2130553844 registers.ebx: 1983198136 registers.esi: 0 registers.ecx: 3210280960 exception.instruction_r: 66 89 03 33 c0 5a 59 59 64 89 10 68 21 b8 4a 00 exception.symbol: winwin+0xab801 exception.instruction: mov word ptr [ebx], ax exception.module: WinWin.exe exception.exception_code: 0xc0000005 exception.offset: 702465 exception.address: 0x4ab801	success
1619630879.59675 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x737ae97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x737aea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x737ab25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x737ab4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x737aac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x737aaed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x737a5511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x737a559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73e67f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73e64de3 winwin+0x58a4d @ 0x458a4d winwin+0x51254 @ 0x451254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfc761485	success
1619630879.611373 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 40959816 registers.edi: 0 registers.eax: 4 registers.ebp: 40959880 registers.edx: 2130553844 registers.ebx: 1983198136 registers.esi: 0 registers.ecx: 2852847616 exception.instruction_r: 66 89 03 33 c0 5a 59 59 64 89 10 68 21 b8 4a 00 exception.symbol: winwin+0xab801 exception.instruction: mov word ptr [ebx], ax exception.module: WinWin.exe exception.exception_code: 0xc0000005 exception.offset: 702465 exception.address: 0x4ab801	success
1619630880.252625 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 51773256 registers.edi: 0 registers.eax: 4 registers.ebp: 51773320 registers.edx: 2130553844 registers.ebx: 1983198136 registers.esi: 0 registers.ecx: 2895839232 exception.instruction_r: 66 89 03 33 c0 5a 59 59 64 89 10 68 21 b8 4a 00 exception.symbol: winwin+0xab801 exception.instruction: mov word ptr [ebx], ax exception.module: WinWin.exe exception.exception_code: 0xc0000005 exception.offset: 702465 exception.address: 0x4ab801	success
1619630883.48675 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x736ce97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x736cea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x736cb25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x736cb4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x736cac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x736caed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x736c5511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x736c559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 winwin+0x58a4d @ 0x458a4d winwin+0x51254 @ 0x451254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfe121485	success
1619630883.486373 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 40042312 registers.edi: 0 registers.eax: 4 registers.ebp: 40042376 registers.edx: 2130553844 registers.ebx: 1983198136 registers.esi: 0 registers.ecx: 3677224960 exception.instruction_r: 66 89 03 33 c0 5a 59 59 64 89 10 68 21 b8 4a 00 exception.symbol: winwin+0xab801 exception.instruction: mov word ptr [ebx], ax exception.module: WinWin.exe exception.exception_code: 0xc0000005 exception.offset: 702465 exception.address: 0x4ab801	success
1619630884.127625 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 40238920 registers.edi: 0 registers.eax: 4 registers.ebp: 40238984 registers.edx: 2130553844 registers.ebx: 1983198136 registers.esi: 0 registers.ecx: 3719233536 exception.instruction_r: 66 89 03 33 c0 5a 59 59 64 89 10 68 21 b8 4a 00 exception.symbol: winwin+0xab801 exception.instruction: mov word ptr [ebx], ax exception.module: WinWin.exe exception.exception_code: 0xc0000005 exception.offset: 702465 exception.address: 0x4ab801	success
1619630887.394 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x736ce97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x736cea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x736cb25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x736cb4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x736cac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x736caed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x736c5511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x736c559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f07f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f04de3 winwin+0x58a4d @ 0x458a4d winwin+0x51254 @ 0x451254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfe141485	success
1619630887.408625 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 41025352 registers.edi: 0 registers.eax: 4 registers.ebp: 41025416 registers.edx: 2130553844 registers.ebx: 1983198136 registers.esi: 0 registers.ecx: 3362783232 exception.instruction_r: 66 89 03 33 c0 5a 59 59 64 89 10 68 21 b8 4a 00 exception.symbol: winwin+0xab801 exception.instruction: mov word ptr [ebx], ax exception.module: WinWin.exe exception.exception_code: 0xc0000005 exception.offset: 702465 exception.address: 0x4ab801	success
1619630888.081125 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 41877320 registers.edi: 0 registers.eax: 4 registers.ebp: 41877384 registers.edx: 2130553844 registers.ebx: 1983198136 registers.esi: 0 registers.ecx: 3440377856 exception.instruction_r: 66 89 03 33 c0 5a 59 59 64 89 10 68 21 b8 4a 00 exception.symbol: winwin+0xab801 exception.instruction: mov word ptr [ebx], ax exception.module: WinWin.exe exception.exception_code: 0xc0000005 exception.offset: 702465 exception.address: 0x4ab801	success

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 294 个事件)

Time & API	Arguments	Status
1619610622.37525 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00560000	success
1619610622.56225 NtAllocateVirtualMemory	process_identifier: 732 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x02fa0000	success
1619610622.57825 NtAllocateVirtualMemory	process_identifier: 732 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x02ff0000	success
1619630833.26925 NtAllocateVirtualMemory	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02390000	success
1619630833.39425 NtAllocateVirtualMemory	process_identifier: 1948 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x02fa0000	success
1619630833.40925 NtAllocateVirtualMemory	process_identifier: 1948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x02ff0000	success
1619630844.48725 NtAllocateVirtualMemory	process_identifier: 376 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01d90000	success
1619630844.48725 NtAllocateVirtualMemory	process_identifier: 376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01e50000	success
1619630844.48725 NtAllocateVirtualMemory	process_identifier: 376 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01d90000	success
1619630844.48725 NtProtectVirtualMemory	process_identifier: 376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 299008 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01d92000	success
1619630851.25325 NtAllocateVirtualMemory	process_identifier: 376 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01e90000	success
1619630851.25325 NtAllocateVirtualMemory	process_identifier: 376 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01ee0000	success
1619630855.05025 NtProtectVirtualMemory	process_identifier: 376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00592000	success
1619630855.05025 NtProtectVirtualMemory	process_identifier: 376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619630855.06525 NtProtectVirtualMemory	process_identifier: 376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00592000	success
1619630855.06525 NtProtectVirtualMemory	process_identifier: 376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619630855.06525 NtProtectVirtualMemory	process_identifier: 376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00592000	success
1619630855.06525 NtProtectVirtualMemory	process_identifier: 376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619630855.06525 NtProtectVirtualMemory	process_identifier: 376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00592000	success
1619630855.06525 NtProtectVirtualMemory	process_identifier: 376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619630855.06525 NtProtectVirtualMemory	process_identifier: 376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00592000	success
1619630855.06525 NtProtectVirtualMemory	process_identifier: 376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1619630855.06525 NtProtectVirtualMemory	process_identifier: 376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00592000	success
1619630855.06525 NtProtectVirtualMemory	process_identifier: 376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619630855.06525 NtProtectVirtualMemory	process_identifier: 376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00592000	success
1619630855.06525 NtProtectVirtualMemory	process_identifier: 376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619630855.06525 NtProtectVirtualMemory	process_identifier: 376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00592000	success
1619630855.06525 NtProtectVirtualMemory	process_identifier: 376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619630855.06525 NtProtectVirtualMemory	process_identifier: 376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00592000	success
1619630855.06525 NtProtectVirtualMemory	process_identifier: 376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619630855.06525 NtProtectVirtualMemory	process_identifier: 376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00592000	success
1619630855.06525 NtProtectVirtualMemory	process_identifier: 376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619630844.2995 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f0000	success
1619630844.2995 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x005c0000	success
1619630844.3145 NtAllocateVirtualMemory	process_identifier: 2340 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x008a0000	success
1619630856.70575 NtAllocateVirtualMemory	process_identifier: 3176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00640000	success
1619630856.72175 NtAllocateVirtualMemory	process_identifier: 3176 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x022e0000	success
1619630856.72175 NtAllocateVirtualMemory	process_identifier: 3176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x02330000	success
1619630859.986373 NtAllocateVirtualMemory	process_identifier: 3248 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00550000	success
1619630859.986373 NtAllocateVirtualMemory	process_identifier: 3248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00590000	success
1619630859.986373 NtAllocateVirtualMemory	process_identifier: 3248 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01e30000	success
1619630859.986373 NtProtectVirtualMemory	process_identifier: 3248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 299008 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01e32000	success
1619630859.986373 NtAllocateVirtualMemory	process_identifier: 3248 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01f80000	success
1619630859.986373 NtAllocateVirtualMemory	process_identifier: 3248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02170000	success
1619630860.018373 NtProtectVirtualMemory	process_identifier: 3248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003e2000	success
1619630860.018373 NtProtectVirtualMemory	process_identifier: 3248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619630860.018373 NtProtectVirtualMemory	process_identifier: 3248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003e2000	success
1619630860.018373 NtProtectVirtualMemory	process_identifier: 3248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619630860.018373 NtProtectVirtualMemory	process_identifier: 3248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x003e2000	success
1619630860.018373 NtProtectVirtualMemory	process_identifier: 3248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success

Creates executable files on the filesystem (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Cre65.vbs

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (26 个事件)

Time & API	Arguments	Status	Return
1619630844.3145 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x0000011c process_identifier: 2604	success	1
1619630856.5185 Process32NextW	process_name: dllhost.exe snapshot_handle: 0x000002dc process_identifier: 3120	success	1
1619630856.72175 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x0000011c process_identifier: 3232	success	1
1619630860.096373 Process32NextW	process_name: WinWin.exe snapshot_handle: 0x0000011c process_identifier: 3308	success	1
1619630860.502625 Process32NextW	process_name: WinWin.exe snapshot_handle: 0x0000011c process_identifier: 3416	success	1
1619630860.502625 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x0000011c process_identifier: 3480	success	1
1619630867.534 Process32NextW	process_name: WinWin.exe snapshot_handle: 0x0000011c process_identifier: 3744	success	1
1619630867.534 Process32NextW	process_name: WinWin.exe snapshot_handle: 0x0000011c process_identifier: 3804	success	1
1619630867.534 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x0000011c process_identifier: 3896	success	1
1619630868.394 Process32NextW	process_name: WinWin.exe snapshot_handle: 0x0000011c process_identifier: 3908	success	1
1619630868.394 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x0000011c process_identifier: 3964	success	1
1619630871.658625 Process32NextW	process_name: WinWin.exe snapshot_handle: 0x0000011c process_identifier: 3984	success	1
1619630871.658625 Process32NextW	process_name: WinWin.exe snapshot_handle: 0x0000011c process_identifier: 4044	success	1
1619630875.736875 Process32NextW	process_name: WinWin.exe snapshot_handle: 0x0000011c process_identifier: 3344	success	1
1619630875.736875 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x0000011c process_identifier: 3440	success	1
1619630879.627373 Process32NextW	process_name: WinWin.exe snapshot_handle: 0x0000011c process_identifier: 3540	success	1
1619630879.627373 Process32NextW	process_name: WinWin.exe snapshot_handle: 0x0000011c process_identifier: 3624	success	1
1619630879.627373 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x0000011c process_identifier: 3628	success	1
1619630880.252625 Process32NextW	process_name: WinWin.exe snapshot_handle: 0x0000011c process_identifier: 3760	success	1
1619630883.502373 Process32NextW	process_name: mscorsvw.exe snapshot_handle: 0x0000011c process_identifier: 3888	success	1
1619630883.502373 Process32NextW	process_name: WinWin.exe snapshot_handle: 0x0000011c process_identifier: 3928	success	1
1619630887.424625 Process32NextW	process_name: GoogleUpdate.exe snapshot_handle: 0x0000011c process_identifier: 3428	success	1
1619630887.424625 Process32NextW	process_name: GoogleUpdate.exe snapshot_handle: 0x0000011c process_identifier: 3484	success	1
1619630887.424625 Process32NextW	process_name: WinWin.exe snapshot_handle: 0x0000011c process_identifier: 3840	success	1
1619630887.424625 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x0000011c process_identifier: 3940	success	1
1619630888.097125 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x0000011c process_identifier: 3204	success	1

The binary likely contains encrypted or compressed data indicative of a packer (3 个事件)

entropy

7.623853351995816

section

{'size_of_data': '0x00012000', 'virtual_address': '0x000ac000', 'entropy': 7.623853351995816, 'name': 'DATA', 'virtual_size': '0x00011ff4'}

description

A section with a high entropy has been found

entropy

7.2600220445054715

section

{'size_of_data': '0x00071e00', 'virtual_address': '0x000d2000', 'entropy': 7.2600220445054715, 'name': '.rsrc', 'virtual_size': '0x00071d58'}

description

A section with a high entropy has been found

entropy

0.4130775254502741

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 个事件)

process

winwin.exe

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (20 个事件)

Time & API	Arguments	Status
1619610622.59425 Process32NextW	process_name: 69febf2d3907f7e0a5002f5622e3c9be.exe snapshot_handle: 0x0000011c process_identifier: 732	failed
1619630833.40925 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x0000011c process_identifier: 1824	failed
1619630856.5185 Process32NextW	process_name: dllhost.exe snapshot_handle: 0x000002dc process_identifier: 3120	failed
1619630856.72175 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x0000011c process_identifier: 3232	failed
1619630860.346373 Process32NextW	process_name: WinWin.exe snapshot_handle: 0x00000128 process_identifier: 3308	failed
1619630860.502625 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x0000011c process_identifier: 3480	failed
1619630864.1115 Process32NextW	process_name: WinWin.exe snapshot_handle: 0x00000128 process_identifier: 3556	failed
1619630864.26925 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x0000011c process_identifier: 3720	failed
1619630868.19 Process32NextW	process_name: WinWin.exe snapshot_handle: 0x00000138 process_identifier: 3804	failed
1619630868.394 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x0000011c process_identifier: 3964	failed
1619630872.205625 Process32NextW	process_name: WinWin.exe snapshot_handle: 0x00000134 process_identifier: 4044	failed
1619630872.378 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000120 process_identifier: 3228	failed
1619630876.174875 Process32NextW	process_name: WinWin.exe snapshot_handle: 0x00000130 process_identifier: 3344	failed
1619630876.378 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x0000011c process_identifier: 3516	failed
1619630880.080373 Process32NextW	process_name: WinWin.exe snapshot_handle: 0x00000130 process_identifier: 3624	failed
1619630880.252625 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x0000011c process_identifier: 176	failed
1619630883.939373 Process32NextW	process_name: WinWin.exe snapshot_handle: 0x00000130 process_identifier: 2812	failed
1619630884.127625 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x0000011c process_identifier: 2188	failed
1619630887.861625 Process32NextW	process_name: WinWin.exe snapshot_handle: 0x00000130 process_identifier: 3840	failed
1619630888.097125 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x0000011c process_identifier: 3204	failed

Communicates with host for which no DNS query was performed (2 个事件)

host	113.108.239.196
host	172.217.24.14

Creates an Alternate Data Stream (ADS) (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\WinWin.exe:ZoneIdentifier

Allocates execute permission to another process indicative of possible code injection (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619610626.14125 NtAllocateVirtualMemory	process_identifier: 2288 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000124 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x000f0000	success	0	0

Installs itself for autorun at Windows startup (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Cre65.vbs

Deletes executed files from disk (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\WinWin.exe

Creates a thread using NtQueueApcThread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 732 created a thread in remote process 2288
1619610626.15625 NtQueueApcThread	thread_handle: 0x0000012c process_identifier: 2288 function_address: 0x000f05c0 parameter: 0x00140000	success	0	0

Potential code injection by writing to the memory of another process (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619610626.14125 WriteProcessMemory	process_identifier: 2288 buffer: Q¹0d@@@$$YÃVWR¾§ÆgNèYøv· ¿Zwf;Ït ¿Ntf;ÏuÂèÀtÎÁáþÁïÏ¾:Ï3ñBHué_Æ^ÃUìQQMSVWÉt;¸MZf9u1A<Át*8PEu"@xeüÁxX$p @ùÙñEøÀu 3À_^[ÉÃMEüÑèOÿÿÿ;Et ÿEüEü;Eøràë×Eü·CEëÊUìQSW3ÿWWjWjh@ÿuÿVØûÿu3Àë&WWWS}üÿV0W}EüPWÿuSÿVSÿV3À9}üÀ_[ÉÃÉtèÀt3ÉfÃUììVðäüÿÿP3ÀPPjPÿVlÀj\XfEü3Àj.fEþXjvfEðXfEòjbXfEôjsXfEö3ÀfEøUüäüÿÿèÖUèÎUðèÆÿuìþÿÿÿuPÿVxÄäüÿÿPÿVìþÿÿPèÂ@PìþÿÿPäüÿÿPèîþÿÿÄ^ÉÃUìì,j:XjZfEÜXjofEÞXjnfEàXjefEâXjIfEäXjdfEæXjefEèXjnfEêXjtfEìXjifEîXjffEðXjifEòXfEôjeXfEöjrXfEø3ÀfEúÔýÿÿè¬UÜè÷EÿPÆEÿèPEÿPÔýÿÿPè?þÿÿÄÉÃUìQeüVðEüPÿuèþYYÀt}ütÿuüPÿuèþÿÿÄÀt3À@ë3À^ÉÃUììSVðÏøýÿÿè'Èè(þÿÿ3ÛSøýÿÿPÿVWÿV8]uWÿuÆè~ÿÿÿYYØë }u5SWÿuÿWÿV(3ÛøÿÏÃèªþÿÿûu9]uWÿV(ÈPWÿV,3À@ë3À^[ÉÃUììSVWèsüÿÿøÿ"h"¿WèÌüÿÿØYYÛjh0hjÿÓðöñh¼Û«½W~`^@èüÿÿhÒ¼WF$èüÿÿh\|QgjWF(èyüÿÿhëIWF,èküÿÿhå©WF0è]üÿÿh¥°(WF4èOüÿÿh)·WF8èAüÿÿh[uðWFDè3üÿÿÄ@ØhdóuW^ è üÿÿh¢¦aëWFèüÿÿhÕOd"WFèüÿÿhy.ÃWFèöûÿÿh±÷WFèèûÿÿheóW÷WFèÚûÿÿh¯4PWFèÌûÿÿh{=#WF<è¾ûÿÿÄ@hOû~ WFèûÿÿhà=!6WFHèûÿÿhh#WèûÿÿFLhÍeWèûÿÿhÓ1ÆVWFPèvûÿÿh7½WFTèhûÿÿh£-ãWFXèZûÿÿF\Ä8EðPÇEðshelÇEôl32ÿÓøÿt"hÀåz°W~dè,ûÿÿhêêºWFlèûÿÿÄFpEøPÇEøuserfÇEü32ÆEþÿV øÿtAhqV°0W~hèìúÿÿhkV°0WFxèÞúÿÿh&cjWFtèÐúÿÿh<cjWF\|èÂúÿÿÄ Æë3À_^[ÉÃUìì\VuW3ÿ;÷îSè¤ýÿÿØ;ßuWÿDéÕEüPëj2ÿSPÿuüWWÿSLÀuïjdÿSPFEøE9>tYÿ¶¶QP¾Ãè¾üÿÿ}3ÿÄ9>t1jDE¤WPèjEèWPèüÄEèPE¤PWWj WWWWÿuÿS$9¾(tlP,PÿuÃè½úÿÿÄ9¾tëj2ÿSPÿuüWWÿSLÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂUììSW3ÿWWjWjhÿu}øÿVØûÿu3Àë>WSÿVEô;Çt+jh0PWÿV@Eø;ÇtWMüQÿuô}üPSÿVEüMSÿVEø_[ÉÃ·ffÒtVð+ñÁ·ffÒuñ^ÃUìQQEEüEüEEøEü;EøtEüMEü@EüëçEÉÃf8Vðt Æf>u÷+ò· fÂfÉuñ^ÃD$@Éuù+D$HÃÉu3ÀÃf9Át Àf8u÷+ÁÑøÃÉt èÚÿÿÿÀtDAþë fù\t è·fÉuï3ÀÃ process_handle: 0x00000124 base_address: 0x000f0000	success	1	0
1619610626.14125 WriteProcessMemory	process_identifier: 2288 buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\69febf2d3907f7e0a5002f5622e3c9be.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\WinWin.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\69febf2d3907f7e0a5002f5622e3c9be.exe" Cre65sET dlWcDlamjSjbJffxZ = crEAtEOBJect("Wscript.SheLL") DLwCDlAMjsjbjFfxZ.run """%ls""", 0, False process_handle: 0x00000124 base_address: 0x00140000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (18 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1948 called NtSetContextThread to modify thread in remote process 376
Process injection	Process 3176 called NtSetContextThread to modify thread in remote process 3248
Process injection	Process 3416 called NtSetContextThread to modify thread in remote process 3496
Process injection	Process 3664 called NtSetContextThread to modify thread in remote process 3744
Process injection	Process 3908 called NtSetContextThread to modify thread in remote process 3984
Process injection	Process 708 called NtSetContextThread to modify thread in remote process 1432
Process injection	Process 3448 called NtSetContextThread to modify thread in remote process 3540
Process injection	Process 3760 called NtSetContextThread to modify thread in remote process 3928
Process injection	Process 1816 called NtSetContextThread to modify thread in remote process 1664
1619630839.01925 NtSetContextThread	thread_handle: 0x0000012c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4526783 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 376	success	0	0
1619630859.79975 NtSetContextThread	thread_handle: 0x0000012c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4526783 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3248	success	0	0
1619630863.580625 NtSetContextThread	thread_handle: 0x0000012c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4526783 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3496	success	0	0
1619630867.31525 NtSetContextThread	thread_handle: 0x0000012c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4526783 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3744	success	0	0
1619630871.44 NtSetContextThread	thread_handle: 0x0000012c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4526783 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3984	success	0	0
1619630875.456 NtSetContextThread	thread_handle: 0x00000130 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4526783 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1432	success	0	0
1619630879.425 NtSetContextThread	thread_handle: 0x0000012c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4526783 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3540	success	0	0
1619630883.299625 NtSetContextThread	thread_handle: 0x0000012c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4526783 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3928	success	0	0
1619630887.205625 NtSetContextThread	thread_handle: 0x0000012c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4526783 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1664	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (18 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1948 resumed a thread in remote process 376
Process injection	Process 3176 resumed a thread in remote process 3248
Process injection	Process 3416 resumed a thread in remote process 3496
Process injection	Process 3664 resumed a thread in remote process 3744
Process injection	Process 3908 resumed a thread in remote process 3984
Process injection	Process 708 resumed a thread in remote process 1432
Process injection	Process 3448 resumed a thread in remote process 3540
Process injection	Process 3760 resumed a thread in remote process 3928
Process injection	Process 1816 resumed a thread in remote process 1664
1619630844.12825 NtResumeThread	thread_handle: 0x0000012c suspend_count: 1 process_identifier: 376	success	0	0
1619630859.83075 NtResumeThread	thread_handle: 0x0000012c suspend_count: 1 process_identifier: 3248	success	0	0
1619630863.643625 NtResumeThread	thread_handle: 0x0000012c suspend_count: 1 process_identifier: 3496	success	0	0
1619630867.33125 NtResumeThread	thread_handle: 0x0000012c suspend_count: 1 process_identifier: 3744	success	0	0
1619630871.456 NtResumeThread	thread_handle: 0x0000012c suspend_count: 1 process_identifier: 3984	success	0	0
1619630875.503 NtResumeThread	thread_handle: 0x00000130 suspend_count: 1 process_identifier: 1432	success	0	0
1619630879.44 NtResumeThread	thread_handle: 0x0000012c suspend_count: 1 process_identifier: 3540	success	0	0
1619630883.314625 NtResumeThread	thread_handle: 0x0000012c suspend_count: 1 process_identifier: 3928	success	0	0
1619630887.221625 NtResumeThread	thread_handle: 0x0000012c suspend_count: 1 process_identifier: 1664	success	0	0

Executed a process and injected code into it, probably while unpacking (50 out of 78 个事件)

Time & API	Arguments	Status	Return
1619610626.14125 CreateProcessInternalW	thread_identifier: 1432 thread_handle: 0x0000012c process_identifier: 2288 current_directory: filepath: C:\Windows\System32\notepad.exe track: 1 command_line: filepath_r: C:\Windows\system32\notepad.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000124 inherit_handles: 0	success	1
1619610626.14125 NtAllocateVirtualMemory	process_identifier: 2288 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000124 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x000f0000	success	0
1619610626.14125 NtAllocateVirtualMemory	process_identifier: 2288 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000124 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00140000	success	0
1619610626.14125 WriteProcessMemory	process_identifier: 2288 buffer: Q¹0d@@@$$YÃVWR¾§ÆgNèYøv· ¿Zwf;Ït ¿Ntf;ÏuÂèÀtÎÁáþÁïÏ¾:Ï3ñBHué_Æ^ÃUìQQMSVWÉt;¸MZf9u1A<Át*8PEu"@xeüÁxX$p @ùÙñEøÀu 3À_^[ÉÃMEüÑèOÿÿÿ;Et ÿEüEü;Eøràë×Eü·CEëÊUìQSW3ÿWWjWjh@ÿuÿVØûÿu3Àë&WWWS}üÿV0W}EüPWÿuSÿVSÿV3À9}üÀ_[ÉÃÉtèÀt3ÉfÃUììVðäüÿÿP3ÀPPjPÿVlÀj\XfEü3Àj.fEþXjvfEðXfEòjbXfEôjsXfEö3ÀfEøUüäüÿÿèÖUèÎUðèÆÿuìþÿÿÿuPÿVxÄäüÿÿPÿVìþÿÿPèÂ@PìþÿÿPäüÿÿPèîþÿÿÄ^ÉÃUìì,j:XjZfEÜXjofEÞXjnfEàXjefEâXjIfEäXjdfEæXjefEèXjnfEêXjtfEìXjifEîXjffEðXjifEòXfEôjeXfEöjrXfEø3ÀfEúÔýÿÿè¬UÜè÷EÿPÆEÿèPEÿPÔýÿÿPè?þÿÿÄÉÃUìQeüVðEüPÿuèþYYÀt}ütÿuüPÿuèþÿÿÄÀt3À@ë3À^ÉÃUììSVðÏøýÿÿè'Èè(þÿÿ3ÛSøýÿÿPÿVWÿV8]uWÿuÆè~ÿÿÿYYØë }u5SWÿuÿWÿV(3ÛøÿÏÃèªþÿÿûu9]uWÿV(ÈPWÿV,3À@ë3À^[ÉÃUììSVWèsüÿÿøÿ"h"¿WèÌüÿÿØYYÛjh0hjÿÓðöñh¼Û«½W~`^@èüÿÿhÒ¼WF$èüÿÿh\|QgjWF(èyüÿÿhëIWF,èküÿÿhå©WF0è]üÿÿh¥°(WF4èOüÿÿh)·WF8èAüÿÿh[uðWFDè3üÿÿÄ@ØhdóuW^ è üÿÿh¢¦aëWFèüÿÿhÕOd"WFèüÿÿhy.ÃWFèöûÿÿh±÷WFèèûÿÿheóW÷WFèÚûÿÿh¯4PWFèÌûÿÿh{=#WF<è¾ûÿÿÄ@hOû~ WFèûÿÿhà=!6WFHèûÿÿhh#WèûÿÿFLhÍeWèûÿÿhÓ1ÆVWFPèvûÿÿh7½WFTèhûÿÿh£-ãWFXèZûÿÿF\Ä8EðPÇEðshelÇEôl32ÿÓøÿt"hÀåz°W~dè,ûÿÿhêêºWFlèûÿÿÄFpEøPÇEøuserfÇEü32ÆEþÿV øÿtAhqV°0W~hèìúÿÿhkV°0WFxèÞúÿÿh&cjWFtèÐúÿÿh<cjWF\|èÂúÿÿÄ Æë3À_^[ÉÃUìì\VuW3ÿ;÷îSè¤ýÿÿØ;ßuWÿDéÕEüPëj2ÿSPÿuüWWÿSLÀuïjdÿSPFEøE9>tYÿ¶¶QP¾Ãè¾üÿÿ}3ÿÄ9>t1jDE¤WPèjEèWPèüÄEèPE¤PWWj WWWWÿuÿS$9¾(tlP,PÿuÃè½úÿÿÄ9¾tëj2ÿSPÿuüWWÿSLÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂUììSW3ÿWWjWjhÿu}øÿVØûÿu3Àë>WSÿVEô;Çt+jh0PWÿV@Eø;ÇtWMüQÿuô}üPSÿVEüMSÿVEø_[ÉÃ·ffÒtVð+ñÁ·ffÒuñ^ÃUìQQEEüEüEEøEü;EøtEüMEü@EüëçEÉÃf8Vðt Æf>u÷+ò· fÂfÉuñ^ÃD$@Éuù+D$HÃÉu3ÀÃf9Át Àf8u÷+ÁÑøÃÉt èÚÿÿÿÀtDAþë fù\t è·fÉuï3ÀÃ process_handle: 0x00000124 base_address: 0x000f0000	success	1
1619610626.14125 WriteProcessMemory	process_identifier: 2288 buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\69febf2d3907f7e0a5002f5622e3c9be.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\WinWin.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\69febf2d3907f7e0a5002f5622e3c9be.exe" Cre65sET dlWcDlamjSjbJffxZ = crEAtEOBJect("Wscript.SheLL") DLwCDlAMjsjbjFfxZ.run """%ls""", 0, False process_handle: 0x00000124 base_address: 0x00140000	success	1
1619630833.112125 CreateProcessInternalW	thread_identifier: 708 thread_handle: 0x000000d0 process_identifier: 1948 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\WinWin.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\WinWin.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x000000cc inherit_handles: 0	success	1
1619630839.00325 CreateProcessInternalW	thread_identifier: 784 thread_handle: 0x0000012c process_identifier: 376 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\WinWin.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000124 inherit_handles: 0	success	1
1619630839.00325 NtUnmapViewOfSection	process_identifier: 376 region_size: 4096 process_handle: 0x00000124 base_address: 0x00400000	success	0
1619630839.00325 NtMapViewOfSection	section_handle: 0x00000134 process_identifier: 376 commit_size: 692224 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000124 allocation_type: 0 () section_offset: 0 view_size: 692224 base_address: 0x00400000	success	0
1619630839.01925 NtGetContextThread	thread_handle: 0x0000012c	success	0
1619630839.01925 NtSetContextThread	thread_handle: 0x0000012c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4526783 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 376	success	0
1619630844.12825 NtResumeThread	thread_handle: 0x0000012c suspend_count: 1 process_identifier: 376	success	0
1619630844.12825 CreateProcessInternalW	thread_identifier: 3040 thread_handle: 0x00000130 process_identifier: 2340 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\WinWin.exe" 2 376 34910859 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000140 inherit_handles: 0	success	1
1619630856.5495 CreateProcessInternalW	thread_identifier: 3180 thread_handle: 0x000002e0 process_identifier: 3176 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\WinWin.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\WinWin.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x000002e4 inherit_handles: 0	success	1
1619630859.78375 CreateProcessInternalW	thread_identifier: 3252 thread_handle: 0x0000012c process_identifier: 3248 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\WinWin.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000124 inherit_handles: 0	success	1
1619630859.78375 NtUnmapViewOfSection	process_identifier: 3248 region_size: 4096 process_handle: 0x00000124 base_address: 0x00400000	success	0
1619630859.78375 NtMapViewOfSection	section_handle: 0x00000134 process_identifier: 3248 commit_size: 692224 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000124 allocation_type: 0 () section_offset: 0 view_size: 692224 base_address: 0x00400000	success	0
1619630859.79975 NtGetContextThread	thread_handle: 0x0000012c	success	0
1619630859.79975 NtSetContextThread	thread_handle: 0x0000012c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4526783 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3248	success	0
1619630859.83075 NtResumeThread	thread_handle: 0x0000012c suspend_count: 1 process_identifier: 3248	success	0
1619630859.83075 CreateProcessInternalW	thread_identifier: 3312 thread_handle: 0x00000130 process_identifier: 3308 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\WinWin.exe" 2 3248 34926562 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000140 inherit_handles: 0	success	1
1619630860.361373 CreateProcessInternalW	thread_identifier: 3420 thread_handle: 0x0000012c process_identifier: 3416 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\WinWin.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\WinWin.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000130 inherit_handles: 0	success	1
1619630863.564625 CreateProcessInternalW	thread_identifier: 3500 thread_handle: 0x0000012c process_identifier: 3496 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\WinWin.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000124 inherit_handles: 0	success	1
1619630863.564625 NtUnmapViewOfSection	process_identifier: 3496 region_size: 4096 process_handle: 0x00000124 base_address: 0x00400000	success	0
1619630863.564625 NtMapViewOfSection	section_handle: 0x00000134 process_identifier: 3496 commit_size: 692224 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000124 allocation_type: 0 () section_offset: 0 view_size: 692224 base_address: 0x00400000	success	0
1619630863.580625 NtGetContextThread	thread_handle: 0x0000012c	success	0
1619630863.580625 NtSetContextThread	thread_handle: 0x0000012c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4526783 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3496	success	0
1619630863.643625 NtResumeThread	thread_handle: 0x0000012c suspend_count: 1 process_identifier: 3496	success	0
1619630863.643625 CreateProcessInternalW	thread_identifier: 3560 thread_handle: 0x00000130 process_identifier: 3556 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\WinWin.exe" 2 3496 34930375 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000140 inherit_handles: 0	success	1
1619630864.1115 CreateProcessInternalW	thread_identifier: 3668 thread_handle: 0x0000012c process_identifier: 3664 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\WinWin.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\WinWin.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000130 inherit_handles: 0	success	1
1619630867.30025 CreateProcessInternalW	thread_identifier: 3748 thread_handle: 0x0000012c process_identifier: 3744 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\WinWin.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000124 inherit_handles: 0	success	1
1619630867.30025 NtUnmapViewOfSection	process_identifier: 3744 region_size: 4096 process_handle: 0x00000124 base_address: 0x00400000	success	0
1619630867.30025 NtMapViewOfSection	section_handle: 0x00000134 process_identifier: 3744 commit_size: 692224 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000124 allocation_type: 0 () section_offset: 0 view_size: 692224 base_address: 0x00400000	success	0
1619630867.31525 NtGetContextThread	thread_handle: 0x0000012c	success	0
1619630867.31525 NtSetContextThread	thread_handle: 0x0000012c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4526783 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3744	success	0
1619630867.33125 NtResumeThread	thread_handle: 0x0000012c suspend_count: 1 process_identifier: 3744	success	0
1619630867.34725 CreateProcessInternalW	thread_identifier: 3808 thread_handle: 0x00000130 process_identifier: 3804 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\WinWin.exe" 2 3744 34934062 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000140 inherit_handles: 0	success	1
1619630868.206 CreateProcessInternalW	thread_identifier: 3912 thread_handle: 0x0000013c process_identifier: 3908 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\WinWin.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\WinWin.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000140 inherit_handles: 0	success	1
1619630871.425 CreateProcessInternalW	thread_identifier: 3988 thread_handle: 0x0000012c process_identifier: 3984 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\WinWin.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000124 inherit_handles: 0	success	1
1619630871.425 NtUnmapViewOfSection	process_identifier: 3984 region_size: 4096 process_handle: 0x00000124 base_address: 0x00400000	success	0
1619630871.425 NtMapViewOfSection	section_handle: 0x00000134 process_identifier: 3984 commit_size: 692224 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000124 allocation_type: 0 () section_offset: 0 view_size: 692224 base_address: 0x00400000	success	0
1619630871.44 NtGetContextThread	thread_handle: 0x0000012c	success	0
1619630871.44 NtSetContextThread	thread_handle: 0x0000012c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4526783 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3984	success	0
1619630871.456 NtResumeThread	thread_handle: 0x0000012c suspend_count: 1 process_identifier: 3984	success	0
1619630871.472 CreateProcessInternalW	thread_identifier: 4048 thread_handle: 0x00000130 process_identifier: 4044 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\WinWin.exe" 2 3984 34938187 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000140 inherit_handles: 0	success	1
1619630872.205625 CreateProcessInternalW	thread_identifier: 2248 thread_handle: 0x00000138 process_identifier: 708 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\WinWin.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\WinWin.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x0000013c inherit_handles: 0	success	1
1619630875.44 CreateProcessInternalW	thread_identifier: 2560 thread_handle: 0x00000130 process_identifier: 1432 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\AppData\WinWin.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000128 inherit_handles: 0	success	1
1619630875.44 NtUnmapViewOfSection	process_identifier: 1432 region_size: 4096 process_handle: 0x00000128 base_address: 0x00400000	success	0
1619630875.44 NtMapViewOfSection	section_handle: 0x00000138 process_identifier: 1432 commit_size: 692224 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000128 allocation_type: 0 () section_offset: 0 view_size: 692224 base_address: 0x00400000	success	0
1619630875.456 NtGetContextThread	thread_handle: 0x00000130	success	0

File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.33649071
FireEye	Generic.mg.69febf2d3907f7e0
McAfee	Fareit-FSK!69FEBF2D3907
Cylance	Unsafe
AegisLab	Trojan.Win32.Kryptik.4!c
Sangfor	Malware
K7AntiVirus	Trojan ( 005689e31 )
BitDefender	Trojan.GenericKD.33649071
K7GW	Trojan ( 005689e31 )
Cybereason	malicious.d3907f
Arcabit	Trojan.Generic.D20171AF
Cyren	W32/Trojan.MRPX-5904
Symantec	Trojan Horse
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Dropper.Remcos-7662488-0
Kaspersky	HEUR:Trojan.Win32.Kryptik.gen
Alibaba	Trojan:Win32/FormBook.a5adabf1
NANO-Antivirus	Trojan.Win32.TrjGen.hilhfe
Ad-Aware	Trojan.GenericKD.33649071
Sophos	Mal/Generic-S + Mal/Fareit-AA
Comodo	Malware@#8k94t15ad3q9
F-Secure	Heuristic.HEUR/AGEN.1135526
DrWeb	Trojan.Siggen8.46567
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R06EC0DI220
McAfee-GW-Edition	BehavesLike.Win32.Dropper.tc
Emsisoft	Trojan.GenericKD.33649071 (B)
SentinelOne	Static AI - Suspicious PE
Jiangmin	Trojan.Kryptik.bet
Avira	HEUR/AGEN.1135526
MAX	malware (ai score=84)
Antiy-AVL	Trojan/Win32.Kryptik
Gridinsoft	Trojan.Win32.Kryptik.ba!s1
Microsoft	Trojan:Win32/FormBook.BX!MTB
ZoneAlarm	HEUR:Trojan.Win32.Kryptik.gen
GData	Trojan.GenericKD.33649071
Cynet	Malicious (score: 100)
AhnLab-V3	Suspicious/Win.Delphiless.X2059
BitDefenderTheta	Gen:NN.ZelphiF.34700.pH0@aK36D!hi
ALYac	Trojan.Agent.MSIL.Krypt
VBA32	TScope.Trojan.Delf
Malwarebytes	Spyware.LokiBot
Panda	Trj/CI.A
Zoner	Trojan.Win32.90838
ESET-NOD32	a variant of Win32/Injector.ELLC
TrendMicro-HouseCall	TROJ_GEN.R06EC0DI220
Rising	Trojan.Injector!1.C561 (CLASSIC)

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x4bf190 DeleteCriticalSection

• 0x4bf194 LeaveCriticalSection

• 0x4bf198 EnterCriticalSection

• 0x4bf19c InitializeCriticalSection

• 0x4bf1a0 VirtualFree

• 0x4bf1a4 VirtualAlloc

• 0x4bf1a8 LocalFree

• 0x4bf1ac LocalAlloc

• 0x4bf1b0 GetVersion

• 0x4bf1b4 GetCurrentThreadId

• 0x4bf1b8 InterlockedDecrement

• 0x4bf1bc InterlockedIncrement

• 0x4bf1c0 VirtualQuery

• 0x4bf1c4 WideCharToMultiByte

• 0x4bf1c8 MultiByteToWideChar

• 0x4bf1cc lstrlenA

• 0x4bf1d0 lstrcpynA

• 0x4bf1d4 LoadLibraryExA

• 0x4bf1d8 GetThreadLocale

• 0x4bf1dc GetStartupInfoA

• 0x4bf1e0 GetProcAddress

• 0x4bf1e4 GetModuleHandleA

• 0x4bf1e8 GetModuleFileNameA

• 0x4bf1ec GetLocaleInfoA

• 0x4bf1f0 GetCommandLineA

• 0x4bf1f4 FreeLibrary

• 0x4bf1f8 FindFirstFileA

• 0x4bf1fc FindClose

• 0x4bf200 ExitProcess

• 0x4bf204 ExitThread

• 0x4bf208 CreateThread

• 0x4bf20c WriteFile

• 0x4bf210 UnhandledExceptionFilter

• 0x4bf214 RtlUnwind

• 0x4bf218 RaiseException

• 0x4bf21c GetStdHandle

Library user32.dll:

• 0x4bf224 GetKeyboardType

• 0x4bf228 LoadStringA

• 0x4bf22c MessageBoxA

• 0x4bf230 CharNextA

Library advapi32.dll:

• 0x4bf238 RegQueryValueExA

• 0x4bf23c RegOpenKeyExA

• 0x4bf240 RegCloseKey

Library oleaut32.dll:

• 0x4bf248 SysFreeString

• 0x4bf24c SysReAllocStringLen

• 0x4bf250 SysAllocStringLen

Library kernel32.dll:

• 0x4bf258 TlsSetValue

• 0x4bf25c TlsGetValue

• 0x4bf260 LocalAlloc

• 0x4bf264 GetModuleHandleA

Library advapi32.dll:

• 0x4bf26c RegQueryValueExA

• 0x4bf270 RegOpenKeyExA

• 0x4bf274 RegCloseKey

Library kernel32.dll:

• 0x4bf27c lstrcpyA

• 0x4bf280 WriteFile

• 0x4bf284 WinExec

• 0x4bf288 WaitForSingleObject

• 0x4bf28c VirtualQuery

• 0x4bf290 VirtualAlloc

• 0x4bf294 Sleep

• 0x4bf298 SizeofResource

• 0x4bf29c SetUnhandledExceptionFilter

• 0x4bf2a0 SetThreadLocale

• 0x4bf2a4 SetFilePointer

• 0x4bf2a8 SetEvent

• 0x4bf2ac SetErrorMode

• 0x4bf2b0 SetEndOfFile

• 0x4bf2b4 ResumeThread

• 0x4bf2b8 ResetEvent

• 0x4bf2bc ReadFile

• 0x4bf2c0 MultiByteToWideChar

• 0x4bf2c4 MulDiv

• 0x4bf2c8 LockResource

• 0x4bf2cc LoadResource

• 0x4bf2d0 LoadLibraryA

• 0x4bf2d4 LeaveCriticalSection

• 0x4bf2d8 InitializeCriticalSection

• 0x4bf2dc GlobalUnlock

• 0x4bf2e0 GlobalSize

• 0x4bf2e4 GlobalReAlloc

• 0x4bf2e8 GlobalHandle

• 0x4bf2ec GlobalLock

• 0x4bf2f0 GlobalFree

• 0x4bf2f4 GlobalFindAtomA

• 0x4bf2f8 GlobalDeleteAtom

• 0x4bf2fc GlobalAlloc

• 0x4bf300 GlobalAddAtomA

• 0x4bf304 GetVersionExA

• 0x4bf308 GetVersion

• 0x4bf30c GetTimeZoneInformation

• 0x4bf310 GetTickCount

• 0x4bf314 GetThreadLocale

• 0x4bf318 GetTempPathA

• 0x4bf31c GetSystemTimeAsFileTime

• 0x4bf320 GetSystemTime

• 0x4bf324 GetSystemInfo

• 0x4bf328 GetStringTypeExA

• 0x4bf32c GetStdHandle

• 0x4bf330 GetProfileStringA

• 0x4bf334 GetProcAddress

• 0x4bf338 GetModuleHandleA

• 0x4bf33c GetModuleFileNameA

• 0x4bf340 GetLocaleInfoA

• 0x4bf344 GetLocalTime

• 0x4bf348 GetLastError

• 0x4bf34c GetFullPathNameA

• 0x4bf350 GetFileSize

• 0x4bf354 GetFileAttributesA

• 0x4bf358 GetExitCodeThread

• 0x4bf35c GetDiskFreeSpaceA

• 0x4bf360 GetDateFormatA

• 0x4bf364 GetCurrentThreadId

• 0x4bf368 GetCurrentProcessId

• 0x4bf36c GetCPInfo

• 0x4bf370 GetACP

• 0x4bf374 FreeResource

• 0x4bf378 InterlockedIncrement

• 0x4bf37c InterlockedExchange

• 0x4bf380 InterlockedDecrement

• 0x4bf384 FreeLibrary

• 0x4bf388 FormatMessageA

• 0x4bf38c FindResourceA

• 0x4bf390 FindFirstFileA

• 0x4bf394 FindClose

• 0x4bf398 FileTimeToSystemTime

• 0x4bf39c FileTimeToLocalFileTime

• 0x4bf3a0 FileTimeToDosDateTime

• 0x4bf3a4 ExitThread

• 0x4bf3a8 EnumCalendarInfoA

• 0x4bf3ac EnterCriticalSection

• 0x4bf3b0 DeleteCriticalSection

• 0x4bf3b4 CreateThread

• 0x4bf3b8 CreateFileA

• 0x4bf3bc CreateEventA

• 0x4bf3c0 CompareStringA

• 0x4bf3c4 CloseHandle

Library version.dll:

• 0x4bf3cc VerQueryValueA

• 0x4bf3d0 GetFileVersionInfoSizeA

• 0x4bf3d4 GetFileVersionInfoA

Library gdi32.dll:

• 0x4bf3dc UnrealizeObject

• 0x4bf3e0 StretchBlt

• 0x4bf3e4 SetWindowOrgEx

• 0x4bf3e8 SetWinMetaFileBits

• 0x4bf3ec SetViewportOrgEx

• 0x4bf3f0 SetTextColor

• 0x4bf3f4 SetStretchBltMode

• 0x4bf3f8 SetROP2

• 0x4bf3fc SetPixel

• 0x4bf400 SetEnhMetaFileBits

• 0x4bf404 SetDIBColorTable

• 0x4bf408 SetBrushOrgEx

• 0x4bf40c SetBkMode

• 0x4bf410 SetBkColor

• 0x4bf414 SelectPalette

• 0x4bf418 SelectObject

• 0x4bf41c SelectClipRgn

• 0x4bf420 SaveDC

• 0x4bf424 RestoreDC

• 0x4bf428 Rectangle

• 0x4bf42c RectVisible

• 0x4bf430 RealizePalette

• 0x4bf434 Polyline

• 0x4bf438 PlayEnhMetaFile

• 0x4bf43c PatBlt

• 0x4bf440 MoveToEx

• 0x4bf444 MaskBlt

• 0x4bf448 LineTo

• 0x4bf44c IntersectClipRect

• 0x4bf450 GetWindowOrgEx

• 0x4bf454 GetWinMetaFileBits

• 0x4bf458 GetTextMetricsA

• 0x4bf45c GetTextExtentPoint32A

• 0x4bf460 GetSystemPaletteEntries

• 0x4bf464 GetStockObject

• 0x4bf468 GetRgnBox

• 0x4bf46c GetPixel

• 0x4bf470 GetPaletteEntries

• 0x4bf474 GetObjectA

• 0x4bf478 GetEnhMetaFilePaletteEntries

• 0x4bf47c GetEnhMetaFileHeader

• 0x4bf480 GetEnhMetaFileBits

• 0x4bf484 GetDeviceCaps

• 0x4bf488 GetDIBits

• 0x4bf48c GetDIBColorTable

• 0x4bf490 GetDCOrgEx

• 0x4bf494 GetCurrentPositionEx

• 0x4bf498 GetClipBox

• 0x4bf49c GetBrushOrgEx

• 0x4bf4a0 GetBitmapBits

• 0x4bf4a4 ExcludeClipRect

• 0x4bf4a8 EndPage

• 0x4bf4ac EndDoc

• 0x4bf4b0 DeleteObject

• 0x4bf4b4 DeleteEnhMetaFile

• 0x4bf4b8 DeleteDC

• 0x4bf4bc CreateSolidBrush

• 0x4bf4c0 CreateRectRgn

• 0x4bf4c4 CreatePenIndirect

• 0x4bf4c8 CreatePen

• 0x4bf4cc CreatePalette

• 0x4bf4d0 CreateICA

• 0x4bf4d4 CreateHalftonePalette

• 0x4bf4d8 CreateFontIndirectA

• 0x4bf4dc CreateDIBitmap

• 0x4bf4e0 CreateDIBSection

• 0x4bf4e4 CreateDCA

• 0x4bf4e8 CreateCompatibleDC

• 0x4bf4ec CreateCompatibleBitmap

• 0x4bf4f0 CreateBrushIndirect

• 0x4bf4f4 CreateBitmap

• 0x4bf4f8 CopyEnhMetaFileA

• 0x4bf4fc CombineRgn

• 0x4bf500 BitBlt

Library opengl32.dll:

• 0x4bf508 wglDeleteContext

Library user32.dll:

• 0x4bf510 CreateWindowExA

• 0x4bf514 WindowFromPoint

• 0x4bf518 WinHelpA

• 0x4bf51c WaitMessage

• 0x4bf520 ValidateRect

• 0x4bf524 UpdateWindow

• 0x4bf528 UnregisterClassA

• 0x4bf52c UnhookWindowsHookEx

• 0x4bf530 TranslateMessage

• 0x4bf534 TranslateMDISysAccel

• 0x4bf538 TrackPopupMenu

• 0x4bf53c SystemParametersInfoA

• 0x4bf540 ShowWindow

• 0x4bf544 ShowScrollBar

• 0x4bf548 ShowOwnedPopups

• 0x4bf54c ShowCursor

• 0x4bf550 SetWindowsHookExA

• 0x4bf554 SetWindowTextA

• 0x4bf558 SetWindowPos

• 0x4bf55c SetWindowPlacement

• 0x4bf560 SetWindowLongA

• 0x4bf564 SetTimer

• 0x4bf568 SetScrollRange

• 0x4bf56c SetScrollPos

• 0x4bf570 SetScrollInfo

• 0x4bf574 SetRect

• 0x4bf578 SetPropA

• 0x4bf57c SetParent

• 0x4bf580 SetMenuItemInfoA

• 0x4bf584 SetMenu

• 0x4bf588 SetForegroundWindow

• 0x4bf58c SetFocus

• 0x4bf590 SetCursor

• 0x4bf594 SetClassLongA

• 0x4bf598 SetCapture

• 0x4bf59c SetActiveWindow

• 0x4bf5a0 SendMessageA

• 0x4bf5a4 ScrollWindow

• 0x4bf5a8 ScreenToClient

• 0x4bf5ac RemovePropA

• 0x4bf5b0 RemoveMenu

• 0x4bf5b4 ReleaseDC

• 0x4bf5b8 ReleaseCapture

• 0x4bf5bc RegisterWindowMessageA

• 0x4bf5c0 RegisterClipboardFormatA

• 0x4bf5c4 RegisterClassA

• 0x4bf5c8 RedrawWindow

• 0x4bf5cc PtInRect

• 0x4bf5d0 PostQuitMessage

• 0x4bf5d4 PostMessageA

• 0x4bf5d8 PeekMessageA

• 0x4bf5dc OffsetRect

• 0x4bf5e0 OemToCharA

• 0x4bf5e4 MsgWaitForMultipleObjects

• 0x4bf5e8 MessageBoxA

• 0x4bf5ec MapWindowPoints

• 0x4bf5f0 MapVirtualKeyA

• 0x4bf5f4 LoadStringA

• 0x4bf5f8 LoadKeyboardLayoutA

• 0x4bf5fc LoadIconA

• 0x4bf600 LoadCursorA

• 0x4bf604 LoadBitmapA

• 0x4bf608 KillTimer

• 0x4bf60c IsZoomed

• 0x4bf610 IsWindowVisible

• 0x4bf614 IsWindowEnabled

• 0x4bf618 IsWindow

• 0x4bf61c IsRectEmpty

• 0x4bf620 IsIconic

• 0x4bf624 IsDialogMessageA

• 0x4bf628 IsChild

• 0x4bf62c InvalidateRect

• 0x4bf630 IntersectRect

• 0x4bf634 InsertMenuItemA

• 0x4bf638 InsertMenuA

• 0x4bf63c InflateRect

• 0x4bf640 GetWindowThreadProcessId

• 0x4bf644 GetWindowTextA

• 0x4bf648 GetWindowRect

• 0x4bf64c GetWindowPlacement

• 0x4bf650 GetWindowLongA

• 0x4bf654 GetWindowDC

• 0x4bf658 GetTopWindow

• 0x4bf65c GetSystemMetrics

• 0x4bf660 GetSystemMenu

• 0x4bf664 GetSysColorBrush

• 0x4bf668 GetSysColor

• 0x4bf66c GetSubMenu

• 0x4bf670 GetScrollRange

• 0x4bf674 GetScrollPos

• 0x4bf678 GetScrollInfo

• 0x4bf67c GetPropA

• 0x4bf680 GetParent

• 0x4bf684 GetWindow

• 0x4bf688 GetMenuStringA

• 0x4bf68c GetMenuState

• 0x4bf690 GetMenuItemInfoA

• 0x4bf694 GetMenuItemID

• 0x4bf698 GetMenuItemCount

• 0x4bf69c GetMenu

• 0x4bf6a0 GetLastActivePopup

• 0x4bf6a4 GetKeyboardState

• 0x4bf6a8 GetKeyboardLayoutList

• 0x4bf6ac GetKeyboardLayout

• 0x4bf6b0 GetKeyState

• 0x4bf6b4 GetKeyNameTextA

• 0x4bf6b8 GetIconInfo

• 0x4bf6bc GetForegroundWindow

• 0x4bf6c0 GetFocus

• 0x4bf6c4 GetDlgItem

• 0x4bf6c8 GetDesktopWindow

• 0x4bf6cc GetDCEx

• 0x4bf6d0 GetDC

• 0x4bf6d4 GetCursorPos

• 0x4bf6d8 GetCursor

• 0x4bf6dc GetClipboardData

• 0x4bf6e0 GetClientRect

• 0x4bf6e4 GetClassNameA

• 0x4bf6e8 GetClassInfoA

• 0x4bf6ec GetCapture

• 0x4bf6f0 GetActiveWindow

• 0x4bf6f4 FrameRect

• 0x4bf6f8 FindWindowA

• 0x4bf6fc FillRect

• 0x4bf700 EqualRect

• 0x4bf704 EnumWindows

• 0x4bf708 EnumThreadWindows

• 0x4bf70c EndPaint

• 0x4bf710 EndDeferWindowPos

• 0x4bf714 EnableWindow

• 0x4bf718 EnableScrollBar

• 0x4bf71c EnableMenuItem

• 0x4bf720 DrawTextA

• 0x4bf724 DrawMenuBar

• 0x4bf728 DrawIconEx

• 0x4bf72c DrawIcon

• 0x4bf730 DrawFrameControl

• 0x4bf734 DrawEdge

• 0x4bf738 DispatchMessageA

• 0x4bf73c DestroyWindow

• 0x4bf740 DestroyMenu

• 0x4bf744 DestroyIcon

• 0x4bf748 DestroyCursor

• 0x4bf74c DeleteMenu

• 0x4bf750 DeferWindowPos

• 0x4bf754 DefWindowProcA

• 0x4bf758 DefMDIChildProcA

• 0x4bf75c DefFrameProcA

• 0x4bf760 CreatePopupMenu

• 0x4bf764 CreateMenu

• 0x4bf768 CreateIcon

• 0x4bf76c ClientToScreen

• 0x4bf770 CheckMenuItem

• 0x4bf774 CallWindowProcA

• 0x4bf778 CallNextHookEx

• 0x4bf77c BeginPaint

• 0x4bf780 BeginDeferWindowPos

• 0x4bf784 CharNextA

• 0x4bf788 CharLowerBuffA

• 0x4bf78c CharLowerA

• 0x4bf790 CharUpperBuffA

• 0x4bf794 CharToOemA

• 0x4bf798 AdjustWindowRectEx

• 0x4bf79c ActivateKeyboardLayout

Library kernel32.dll:

• 0x4bf7a4 Sleep

Library oleaut32.dll:

• 0x4bf7ac SafeArrayPtrOfIndex

• 0x4bf7b0 SafeArrayPutElement

• 0x4bf7b4 SafeArrayGetElement

• 0x4bf7b8 SafeArrayUnaccessData

• 0x4bf7bc SafeArrayAccessData

• 0x4bf7c0 SafeArrayGetUBound

• 0x4bf7c4 SafeArrayGetLBound

• 0x4bf7c8 SafeArrayCreate

• 0x4bf7cc VariantChangeType

• 0x4bf7d0 VariantCopyInd

• 0x4bf7d4 VariantCopy

• 0x4bf7d8 VariantClear

• 0x4bf7dc VariantInit

Library ole32.dll:

• 0x4bf7e4 CoUninitialize

• 0x4bf7e8 CoInitialize

Library oleaut32.dll:

• 0x4bf7f0 GetErrorInfo

• 0x4bf7f4 SysFreeString

Library comctl32.dll:

• 0x4bf7fc ImageList_SetIconSize

• 0x4bf800 ImageList_GetIconSize

• 0x4bf804 ImageList_Write

• 0x4bf808 ImageList_Read

• 0x4bf80c ImageList_GetDragImage

• 0x4bf810 ImageList_DragShowNolock

• 0x4bf814 ImageList_SetDragCursorImage

• 0x4bf818 ImageList_DragMove

• 0x4bf81c ImageList_DragLeave

• 0x4bf820 ImageList_DragEnter

• 0x4bf824 ImageList_EndDrag

• 0x4bf828 ImageList_BeginDrag

• 0x4bf82c ImageList_Remove

• 0x4bf830 ImageList_DrawEx

• 0x4bf834 ImageList_Replace

• 0x4bf838 ImageList_Draw

• 0x4bf83c ImageList_GetBkColor

• 0x4bf840 ImageList_SetBkColor

• 0x4bf844 ImageList_ReplaceIcon

• 0x4bf848 ImageList_Add

• 0x4bf84c ImageList_GetImageCount

• 0x4bf850 ImageList_Destroy

• 0x4bf854 ImageList_Create

• 0x4bf858 InitCommonControls

Library winspool.drv:

• 0x4bf860 OpenPrinterA

• 0x4bf864 EnumPrintersA

• 0x4bf868 DocumentPropertiesA

• 0x4bf86c ClosePrinter

Library comdlg32.dll:

• 0x4bf874 PrintDlgA

• 0x4bf878 GetSaveFileNameA

• 0x4bf87c GetOpenFileNameA

Library user32.dll:

• 0x4bf884 DdeCmpStringHandles

• 0x4bf888 DdeFreeStringHandle

• 0x4bf88c DdeQueryStringA

• 0x4bf890 DdeCreateStringHandleA

• 0x4bf894 DdeGetLastError

• 0x4bf898 DdeFreeDataHandle

• 0x4bf89c DdeUnaccessData

• 0x4bf8a0 DdeAccessData

• 0x4bf8a4 DdeCreateDataHandle

• 0x4bf8a8 DdeClientTransaction

• 0x4bf8ac DdeNameService

• 0x4bf8b0 DdePostAdvise

• 0x4bf8b4 DdeSetUserHandle

• 0x4bf8b8 DdeQueryConvInfo

• 0x4bf8bc DdeDisconnect

• 0x4bf8c0 DdeConnect

• 0x4bf8c4 DdeUninitialize

• 0x4bf8c8 DdeInitializeA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	53210	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.