SmartHawk

11.0

0-day

55 个模型检测该样本为恶意！

重新分析

下载样本

36642a485593fe8180b9cce141253f97f59ab8322e6d93efbbbb856d09781870

769883685d1815c530b447c6b3922c01.exe

分析耗时

107s

最近分析

文件大小

1.1MB

静态报毒动态报毒 AI SCORE=89 AIDETECTVM BSCOPE CLASSIC CONFIDENCE DELF DELPHILESS EMOY FAREIT GENETIC HHW@AA@RD9EI HIGH CONFIDENCE HNTFMZ HPLOKI KRYPT MALWARE1 MALWARE@#2QXCQWNULIT2U MZRB OIZIY PWSX RATNET SCORE SMBD STATIC AI SUSPICIOUS PE TROJANPSW TSPY UHYS UNSAFE X2094 XCKPVZNCMMC ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FTB!769883685D18	20201211	6.0.6.653
Baidu		20190318	1.0.0.2
Avast		20201210	21.1.5827.0
Alibaba	Trojan:Win32/Injector.c0a5b502	20190527	0.3.0.5
Tencent		20201211	1.0.0.1
Kingsoft		20201211	2017.9.26.565
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (40 个事件)

Time & API	Arguments	Status
1619649224.558184 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 36110148 registers.edi: 0 registers.eax: 0 registers.ebp: 36110216 registers.edx: 13 registers.ebx: 0 registers.esi: 0 registers.ecx: 497 exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00 exception.symbol: 769883685d1815c530b447c6b3922c01+0x955b5 exception.instruction: div eax exception.module: 769883685d1815c530b447c6b3922c01.exe exception.exception_code: 0xc0000094 exception.offset: 611765 exception.address: 0x4955b5	success
1619662746.099498 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 50265924 registers.edi: 0 registers.eax: 0 registers.ebp: 50265992 registers.edx: 59 registers.ebx: 0 registers.esi: 0 registers.ecx: 100 exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00 exception.symbol: hshbbb+0x955b5 exception.instruction: div eax exception.module: hshbbb.exe exception.exception_code: 0xc0000094 exception.offset: 611765 exception.address: 0x4955b5	success
1619662748.271625 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a hshbbb+0xa23f8 @ 0x4a23f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75114b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75115d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfdba1485	success
1619662747.069 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34668356 registers.edi: 0 registers.eax: 0 registers.ebp: 34668424 registers.edx: 59 registers.ebx: 0 registers.esi: 0 registers.ecx: 53 exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00 exception.symbol: hshbbb+0x955b5 exception.instruction: div eax exception.module: hshbbb.exe exception.exception_code: 0xc0000094 exception.offset: 611765 exception.address: 0x4955b5	success
1619662754.412625 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34471748 registers.edi: 0 registers.eax: 0 registers.ebp: 34471816 registers.edx: 59 registers.ebx: 0 registers.esi: 0 registers.ecx: 396 exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00 exception.symbol: hshbbb+0x955b5 exception.instruction: div eax exception.module: hshbbb.exe exception.exception_code: 0xc0000094 exception.offset: 611765 exception.address: 0x4955b5	success
1619662755.880373 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a hshbbb+0xa23f8 @ 0x4a23f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xff561485	success
1619662756.319125 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 35127108 registers.edi: 0 registers.eax: 0 registers.ebp: 35127176 registers.edx: 59 registers.ebx: 0 registers.esi: 0 registers.ecx: 318 exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00 exception.symbol: hshbbb+0x955b5 exception.instruction: div eax exception.module: hshbbb.exe exception.exception_code: 0xc0000094 exception.offset: 611765 exception.address: 0x4955b5	success
1619662759.209373 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 50069316 registers.edi: 0 registers.eax: 0 registers.ebp: 50069384 registers.edx: 59 registers.ebx: 0 registers.esi: 0 registers.ecx: 209 exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00 exception.symbol: hshbbb+0x955b5 exception.instruction: div eax exception.module: hshbbb.exe exception.exception_code: 0xc0000094 exception.offset: 611765 exception.address: 0x4955b5	success
1619662761.3805 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a hshbbb+0xa23f8 @ 0x4a23f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x751c4b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x751c5d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfd941485	success
1619662761.568373 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 50265924 registers.edi: 0 registers.eax: 0 registers.ebp: 50265992 registers.edx: 59 registers.ebx: 0 registers.esi: 0 registers.ecx: 537 exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00 exception.symbol: hshbbb+0x955b5 exception.instruction: div eax exception.module: hshbbb.exe exception.exception_code: 0xc0000094 exception.offset: 611765 exception.address: 0x4955b5	success
1619662764.974373 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34799428 registers.edi: 0 registers.eax: 0 registers.ebp: 34799496 registers.edx: 59 registers.ebx: 0 registers.esi: 0 registers.ecx: 975 exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00 exception.symbol: hshbbb+0x955b5 exception.instruction: div eax exception.module: hshbbb.exe exception.exception_code: 0xc0000094 exception.offset: 611765 exception.address: 0x4955b5	success
1619662766.35025 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a hshbbb+0xa23f8 @ 0x4a23f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xff551485	success
1619662766.897 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 48758596 registers.edi: 0 registers.eax: 0 registers.ebp: 48758664 registers.edx: 59 registers.ebx: 0 registers.esi: 0 registers.ecx: 881 exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00 exception.symbol: hshbbb+0x955b5 exception.instruction: div eax exception.module: hshbbb.exe exception.exception_code: 0xc0000094 exception.offset: 611765 exception.address: 0x4955b5	success
1619662770.068625 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 35454788 registers.edi: 0 registers.eax: 0 registers.ebp: 35454856 registers.edx: 59 registers.ebx: 0 registers.esi: 0 registers.ecx: 68 exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00 exception.symbol: hshbbb+0x955b5 exception.instruction: div eax exception.module: hshbbb.exe exception.exception_code: 0xc0000094 exception.offset: 611765 exception.address: 0x4955b5	success
1619662772.11625 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a hshbbb+0xa23f8 @ 0x4a23f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75124b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75125d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xff391485	success
1619662772.58475 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 49676100 registers.edi: 0 registers.eax: 0 registers.ebp: 49676168 registers.edx: 59 registers.ebx: 0 registers.esi: 0 registers.ecx: 584 exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00 exception.symbol: hshbbb+0x955b5 exception.instruction: div eax exception.module: hshbbb.exe exception.exception_code: 0xc0000094 exception.offset: 611765 exception.address: 0x4955b5	success
1619662776.537625 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34668356 registers.edi: 0 registers.eax: 0 registers.ebp: 34668424 registers.edx: 59 registers.ebx: 0 registers.esi: 0 registers.ecx: 537 exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00 exception.symbol: hshbbb+0x955b5 exception.instruction: div eax exception.module: hshbbb.exe exception.exception_code: 0xc0000094 exception.offset: 611765 exception.address: 0x4955b5	success
1619662779.380498 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a hshbbb+0xa23f8 @ 0x4a23f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x751c4b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x751c5d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfd8c1485	success
1619662779.412625 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34996036 registers.edi: 0 registers.eax: 0 registers.ebp: 34996104 registers.edx: 59 registers.ebx: 0 registers.esi: 0 registers.ecx: 412 exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00 exception.symbol: hshbbb+0x955b5 exception.instruction: div eax exception.module: hshbbb.exe exception.exception_code: 0xc0000094 exception.offset: 611765 exception.address: 0x4955b5	success
1619662783.06925 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34537284 registers.edi: 0 registers.eax: 0 registers.ebp: 34537352 registers.edx: 59 registers.ebx: 0 registers.esi: 0 registers.ecx: 68 exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00 exception.symbol: hshbbb+0x955b5 exception.instruction: div eax exception.module: hshbbb.exe exception.exception_code: 0xc0000094 exception.offset: 611765 exception.address: 0x4955b5	success
1619662784.209498 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a hshbbb+0xa23f8 @ 0x4a23f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xff531485	success
1619662784.56875 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34930500 registers.edi: 0 registers.eax: 0 registers.ebp: 34930568 registers.edx: 59 registers.ebx: 0 registers.esi: 0 registers.ecx: 568 exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00 exception.symbol: hshbbb+0x955b5 exception.instruction: div eax exception.module: hshbbb.exe exception.exception_code: 0xc0000094 exception.offset: 611765 exception.address: 0x4955b5	success
1619662786.927625 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 49217348 registers.edi: 0 registers.eax: 0 registers.ebp: 49217416 registers.edx: 59 registers.ebx: 0 registers.esi: 0 registers.ecx: 896 exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00 exception.symbol: hshbbb+0x955b5 exception.instruction: div eax exception.module: hshbbb.exe exception.exception_code: 0xc0000094 exception.offset: 611765 exception.address: 0x4955b5	success
1619662788.630498 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a hshbbb+0xa23f8 @ 0x4a23f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75124b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75125d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xff421485	success
1619662789.380625 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 35258180 registers.edi: 0 registers.eax: 0 registers.ebp: 35258248 registers.edx: 59 registers.ebx: 0 registers.esi: 0 registers.ecx: 381 exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00 exception.symbol: hshbbb+0x955b5 exception.instruction: div eax exception.module: hshbbb.exe exception.exception_code: 0xc0000094 exception.offset: 611765 exception.address: 0x4955b5	success
1619662791.585125 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 35192644 registers.edi: 0 registers.eax: 0 registers.ebp: 35192712 registers.edx: 59 registers.ebx: 0 registers.esi: 0 registers.ecx: 584 exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00 exception.symbol: hshbbb+0x955b5 exception.instruction: div eax exception.module: hshbbb.exe exception.exception_code: 0xc0000094 exception.offset: 611765 exception.address: 0x4955b5	success
1619662792.88125 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a hshbbb+0xa23f8 @ 0x4a23f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xff5f1485	success
1619662793.318498 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 35520324 registers.edi: 0 registers.eax: 0 registers.ebp: 35520392 registers.edx: 59 registers.ebx: 0 registers.esi: 0 registers.ecx: 318 exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00 exception.symbol: hshbbb+0x955b5 exception.instruction: div eax exception.module: hshbbb.exe exception.exception_code: 0xc0000094 exception.offset: 611765 exception.address: 0x4955b5	success
1619662795.9595 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 50790212 registers.edi: 0 registers.eax: 0 registers.ebp: 50790280 registers.edx: 59 registers.ebx: 0 registers.esi: 0 registers.ecx: 959 exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00 exception.symbol: hshbbb+0x955b5 exception.instruction: div eax exception.module: hshbbb.exe exception.exception_code: 0xc0000094 exception.offset: 611765 exception.address: 0x4955b5	success
1619662797.335 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a hshbbb+0xa23f8 @ 0x4a23f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75124b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75125d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfdbb1485	success
1619662798.224498 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34471748 registers.edi: 0 registers.eax: 0 registers.ebp: 34471816 registers.edx: 59 registers.ebx: 0 registers.esi: 0 registers.ecx: 225 exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00 exception.symbol: hshbbb+0x955b5 exception.instruction: div eax exception.module: hshbbb.exe exception.exception_code: 0xc0000094 exception.offset: 611765 exception.address: 0x4955b5	success
1619662801.099373 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 49610564 registers.edi: 0 registers.eax: 0 registers.ebp: 49610632 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 100 exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00 exception.symbol: hshbbb+0x955b5 exception.instruction: div eax exception.module: hshbbb.exe exception.exception_code: 0xc0000094 exception.offset: 611765 exception.address: 0x4955b5	success
1619662802.552625 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a hshbbb+0xa23f8 @ 0x4a23f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x751c4b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x751c5d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xff6e1485	success
1619662803.099875 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 50003780 registers.edi: 0 registers.eax: 0 registers.ebp: 50003848 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 100 exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00 exception.symbol: hshbbb+0x955b5 exception.instruction: div eax exception.module: hshbbb.exe exception.exception_code: 0xc0000094 exception.offset: 611765 exception.address: 0x4955b5	success
1619662805.240625 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 49872708 registers.edi: 0 registers.eax: 0 registers.ebp: 49872776 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 240 exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00 exception.symbol: hshbbb+0x955b5 exception.instruction: div eax exception.module: hshbbb.exe exception.exception_code: 0xc0000094 exception.offset: 611765 exception.address: 0x4955b5	success
1619662807.099875 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a hshbbb+0xa23f8 @ 0x4a23f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x751c4b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x751c5d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xff591485	success
1619662807.302875 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 36306756 registers.edi: 0 registers.eax: 0 registers.ebp: 36306824 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 287 exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00 exception.symbol: hshbbb+0x955b5 exception.instruction: div eax exception.module: hshbbb.exe exception.exception_code: 0xc0000094 exception.offset: 611765 exception.address: 0x4955b5	success
1619662811.006 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 49086276 registers.edi: 0 registers.eax: 0 registers.ebp: 49086344 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 990 exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00 exception.symbol: hshbbb+0x955b5 exception.instruction: div eax exception.module: hshbbb.exe exception.exception_code: 0xc0000094 exception.offset: 611765 exception.address: 0x4955b5	success
1619662813.41325 __exception__	stacktrace: RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84 RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389 LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5 New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a hshbbb+0xa23f8 @ 0x4a23f8 _CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x751c4b0f _CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x751c5d3d 0x57005c registers.esp: 1633872 registers.edi: 0 registers.eax: 0 registers.ebp: 1633912 registers.edx: 582600 registers.ebx: 0 registers.esi: 1634116 registers.ecx: 176 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfdda1485	success
1619662814.288125 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34471748 registers.edi: 0 registers.eax: 0 registers.ebp: 34471816 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 287 exception.instruction_r: f7 f0 89 c9 33 c0 5a 59 59 64 89 10 e9 e0 67 00 exception.symbol: hshbbb+0x955b5 exception.instruction: div eax exception.module: hshbbb.exe exception.exception_code: 0xc0000094 exception.offset: 611765 exception.address: 0x4955b5	success

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 406 个事件)

Time & API	Arguments	Status
1619649224.418184 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00350000	success
1619649224.558184 NtProtectVirtualMemory	process_identifier: 368 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 28672 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00495000	success
1619649224.574184 NtAllocateVirtualMemory	process_identifier: 368 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x006e0000	success
1619662746.084498 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003d0000	success
1619662746.099498 NtProtectVirtualMemory	process_identifier: 3000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 28672 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00495000	success
1619662746.115498 NtAllocateVirtualMemory	process_identifier: 3000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01ef0000	success
1619662746.865625 NtProtectVirtualMemory	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1619662746.912625 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02130000	success
1619662746.912625 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02270000	success
1619662746.912625 NtAllocateVirtualMemory	process_identifier: 2868 region_size: 630784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01fd0000	success
1619662746.927625 NtProtectVirtualMemory	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 602112 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01fd2000	success
1619662748.162625 NtProtectVirtualMemory	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00642000	success
1619662748.162625 NtProtectVirtualMemory	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619662748.162625 NtProtectVirtualMemory	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00642000	success
1619662748.162625 NtProtectVirtualMemory	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619662748.162625 NtProtectVirtualMemory	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00642000	success
1619662748.162625 NtProtectVirtualMemory	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619662748.162625 NtProtectVirtualMemory	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00642000	success
1619662748.162625 NtProtectVirtualMemory	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619662748.177625 NtProtectVirtualMemory	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00642000	success
1619662748.177625 NtProtectVirtualMemory	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1619662748.177625 NtProtectVirtualMemory	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00642000	success
1619662748.177625 NtProtectVirtualMemory	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619662748.177625 NtProtectVirtualMemory	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00642000	success
1619662748.177625 NtProtectVirtualMemory	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619662748.177625 NtProtectVirtualMemory	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00642000	success
1619662748.177625 NtProtectVirtualMemory	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619662748.177625 NtProtectVirtualMemory	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00642000	success
1619662748.177625 NtProtectVirtualMemory	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619662748.177625 NtProtectVirtualMemory	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00642000	success
1619662748.177625 NtProtectVirtualMemory	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619662747.006 NtAllocateVirtualMemory	process_identifier: 3128 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00600000	success
1619662747.069 NtProtectVirtualMemory	process_identifier: 3128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 28672 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00495000	success
1619662747.085 NtAllocateVirtualMemory	process_identifier: 3128 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x02120000	success
1619662754.193625 NtAllocateVirtualMemory	process_identifier: 3308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01e40000	success
1619662754.412625 NtProtectVirtualMemory	process_identifier: 3308 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 28672 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00495000	success
1619662754.427625 NtAllocateVirtualMemory	process_identifier: 3308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x02e90000	success
1619662755.662373 NtProtectVirtualMemory	process_identifier: 3380 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1619662755.677373 NtAllocateVirtualMemory	process_identifier: 3380 region_size: 262144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x003b0000	success
1619662755.677373 NtAllocateVirtualMemory	process_identifier: 3380 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003b0000	success
1619662755.677373 NtAllocateVirtualMemory	process_identifier: 3380 region_size: 630784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01f10000	success
1619662755.677373 NtProtectVirtualMemory	process_identifier: 3380 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 602112 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01f12000	success
1619662755.787373 NtProtectVirtualMemory	process_identifier: 3380 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x02002000	success
1619662755.787373 NtProtectVirtualMemory	process_identifier: 3380 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619662755.787373 NtProtectVirtualMemory	process_identifier: 3380 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x02002000	success
1619662755.787373 NtProtectVirtualMemory	process_identifier: 3380 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619662755.787373 NtProtectVirtualMemory	process_identifier: 3380 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x02002000	success
1619662755.787373 NtProtectVirtualMemory	process_identifier: 3380 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619662755.787373 NtProtectVirtualMemory	process_identifier: 3380 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x02002000	success
1619662755.787373 NtProtectVirtualMemory	process_identifier: 3380 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success

Creates executable files on the filesystem (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.vbs

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (39 个事件)

Time & API	Arguments	Status	Return
1619662747.163 Process32NextW	process_name: hshbbb.exe snapshot_handle: 0x000000f8 process_identifier: 3128	success	1
1619662747.163 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 3192	success	1
1619662754.459625 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 3364	success	1
1619662756.335125 Process32NextW	process_name: hshbbb.exe snapshot_handle: 0x000000f8 process_identifier: 3440	success	1
1619662761.615373 Process32NextW	process_name: hshbbb.exe snapshot_handle: 0x000000f8 process_identifier: 3708	success	1
1619662761.615373 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 3808	success	1
1619662764.990373 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 3876	success	1
1619662767.053 Process32NextW	process_name: hshbbb.exe snapshot_handle: 0x000000f8 process_identifier: 3892	success	1
1619662767.053 Process32NextW	process_name: hshbbb.exe snapshot_handle: 0x000000f8 process_identifier: 3956	success	1
1619662767.053 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 4048	success	1
1619662770.084625 Process32NextW	process_name: hshbbb.exe snapshot_handle: 0x000000f8 process_identifier: 4064	success	1
1619662776.568625 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 1888	success	1
1619662779.443625 Process32NextW	process_name: hshbbb.exe snapshot_handle: 0x000000f8 process_identifier: 3204	success	1
1619662779.443625 Process32NextW	process_name: is32bit.exe snapshot_handle: 0x000000f8 process_identifier: 920	success	1
1619662782.130625 Process32NextW	process_name: dllhost.exe snapshot_handle: 0x00000148 process_identifier: 3496	success	1
1619662784.58475 Process32NextW	process_name: hshbbb.exe snapshot_handle: 0x000000f8 process_identifier: 3740	success	1
1619662784.58475 Process32NextW	process_name: hshbbb.exe snapshot_handle: 0x000000f8 process_identifier: 2604	success	1
1619662784.58475 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 3904	success	1
1619662784.58475 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 3920	success	1
1619662787.084625 Process32NextW	process_name: hshbbb.exe snapshot_handle: 0x000000f8 process_identifier: 3940	success	1
1619662789.380625 Process32NextW	process_name: hshbbb.exe snapshot_handle: 0x000000f8 process_identifier: 4024	success	1
1619662789.380625 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 1344	success	1
1619662789.380625 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 2576	success	1
1619662793.490498 Process32NextW	process_name: hshbbb.exe snapshot_handle: 0x000000f8 process_identifier: 3112	success	1
1619662798.240498 Process32NextW	process_name: hshbbb.exe snapshot_handle: 0x000000f8 process_identifier: 1812	success	1
1619662803.130875 Process32NextW	process_name: hshbbb.exe snapshot_handle: 0x000000f8 process_identifier: 3936	success	1
1619662803.130875 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 1396	success	1
1619662803.130875 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 2168	success	1
1619662807.505875 Process32NextW	process_name: hshbbb.exe snapshot_handle: 0x000000f8 process_identifier: 3200	success	1
1619662807.505875 Process32NextW	process_name: mscorsvw.exe snapshot_handle: 0x000000f8 process_identifier: 3312	success	1
1619662807.521875 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 3972	success	1
1619662807.521875 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 2620	success	1
1619662810.037875 Process32NextW	process_name: mscorsvw.exe snapshot_handle: 0x00000128 process_identifier: 3596	success	1
1619662811.131 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 3452	success	1
1619662814.397125 Process32NextW	process_name: hshbbb.exe snapshot_handle: 0x000000f8 process_identifier: 3472	success	1
1619662814.397125 Process32NextW	process_name: GoogleUpdate.exe snapshot_handle: 0x000000f8 process_identifier: 3284	success	1
1619662814.444125 Process32NextW	process_name: sppsvc.exe snapshot_handle: 0x000000f8 process_identifier: 2036	success	1
1619662814.444125 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 1976	success	1
1619662816.991125 Process32NextW	process_name: GoogleUpdate.exe snapshot_handle: 0x0000012c process_identifier: 1160	success	1

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.5325163560129615

section

{'size_of_data': '0x00074000', 'virtual_address': '0x000b1000', 'entropy': 7.5325163560129615, 'name': '.rsrc', 'virtual_size': '0x00073e28'}

description

A section with a high entropy has been found

entropy

0.4048865619546248

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 个事件)

process

hshbbb.exe

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (40 个事件)

Time & API	Arguments	Status
1619649224.605184 Process32NextW	process_name: 769883685d1815c530b447c6b3922c01.exe snapshot_handle: 0x000000f8 process_identifier: 368	failed
1619662746.209498 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 1704	failed
1619662747.163 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 3192	failed
1619662753.272 Process32NextW	process_name: hshbbb.exe snapshot_handle: 0x00000184 process_identifier: 3128	failed
1619662754.459625 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 3364	failed
1619662756.335125 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 3548	failed
1619662758.585125 Process32NextW	process_name: hshbbb.exe snapshot_handle: 0x00000138 process_identifier: 3440	failed
1619662759.271373 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 3620	failed
1619662761.615373 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 3808	failed
1619662764.334373 Process32NextW	process_name: hshbbb.exe snapshot_handle: 0x00000140 process_identifier: 3708	failed
1619662764.990373 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 3876	failed
1619662767.053 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 4048	failed
1619662769.225 Process32NextW	process_name: hshbbb.exe snapshot_handle: 0x00000128 process_identifier: 3956	failed
1619662770.084625 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 3080	failed
1619662772.59975 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 2424	failed
1619662775.95975 Process32NextW	process_name: hshbbb.exe snapshot_handle: 0x00000158 process_identifier: 196	failed
1619662776.568625 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 1888	failed
1619662779.443625 Process32NextW	process_name: is32bit.exe snapshot_handle: 0x000000f8 process_identifier: 920	failed
1619662782.130625 Process32NextW	process_name: dllhost.exe snapshot_handle: 0x00000148 process_identifier: 3496	failed
1619662783.08525 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 3728	failed
1619662784.58475 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 3920	failed
1619662786.16275 Process32NextW	process_name: hshbbb.exe snapshot_handle: 0x00000118 process_identifier: 2604	failed
1619662787.084625 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 4032	failed
1619662789.380625 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 2576	failed
1619662790.896625 Process32NextW	process_name: hshbbb.exe snapshot_handle: 0x0000012c process_identifier: 2436	failed
1619662791.600125 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 376	failed
1619662793.490498 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 3064	failed
1619662794.802498 Process32NextW	process_name: hshbbb.exe snapshot_handle: 0x00000118 process_identifier: 2316	failed
1619662795.9905 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 3672	failed
1619662798.240498 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 3744	failed
1619662800.646498 Process32NextW	process_name: hshbbb.exe snapshot_handle: 0x00000144 process_identifier: 2940	failed
1619662801.146373 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 2496	failed
1619662803.130875 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 2168	failed
1619662804.787875 Process32NextW	process_name: hshbbb.exe snapshot_handle: 0x00000120 process_identifier: 3936	failed
1619662805.334625 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 2260	failed
1619662807.537875 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 3456	failed
1619662810.037875 Process32NextW	process_name: mscorsvw.exe snapshot_handle: 0x00000128 process_identifier: 3596	failed
1619662811.131 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 3452	failed
1619662814.444125 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000f8 process_identifier: 324	failed
1619662816.991125 Process32NextW	process_name: GoogleUpdate.exe snapshot_handle: 0x0000012c process_identifier: 1160	failed

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Creates an Alternate Data Stream (ADS) (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe:ZoneIdentifier

Allocates execute permission to another process indicative of possible code injection (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619649225.449184 NtAllocateVirtualMemory	process_identifier: 2104 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000100 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00130000	success	0	0

Installs itself for autorun at Windows startup (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.vbs

Deletes executed files from disk (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe

Creates a thread using NtQueueApcThread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 368 created a thread in remote process 2104
1619649225.527184 NtQueueApcThread	thread_handle: 0x00000108 process_identifier: 2104 function_address: 0x001305c0 parameter: 0x00140000	success	0	0

Potential code injection by writing to the memory of another process (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619649225.449184 WriteProcessMemory	process_identifier: 2104 buffer: Q¹0d@@@$$YÃVWR¾§ÆgNèYøv· ¿Zwf;Ït ¿Ntf;ÏuÂèÀtÎÁáþÁïÏ¾:Ï3ñBHué_Æ^ÃUìQQMSVWÉt;¸MZf9u1A<Át*8PEu"@xeüÁxX$p @ùÙñEøÀu 3À_^[ÉÃMEüÑèOÿÿÿ;Et ÿEüEü;Eøràë×Eü·CEëÊUìQSW3ÿWWjWjh@ÿuÿVØûÿu3Àë&WWWS}üÿV0W}EüPWÿuSÿVSÿV3À9}üÀ_[ÉÃÉtèÀt3ÉfÃUììVðäüÿÿP3ÀPPjPÿVlÀj\XfEü3Àj.fEþXjvfEðXfEòjbXfEôjsXfEö3ÀfEøUüäüÿÿèÖUèÎUðèÆÿuìþÿÿÿuPÿVxÄäüÿÿPÿVìþÿÿPèÂ@PìþÿÿPäüÿÿPèîþÿÿÄ^ÉÃUìì,j:XjZfEÜXjofEÞXjnfEàXjefEâXjIfEäXjdfEæXjefEèXjnfEêXjtfEìXjifEîXjffEðXjifEòXfEôjeXfEöjrXfEø3ÀfEúÔýÿÿè¬UÜè÷EÿPÆEÿèPEÿPÔýÿÿPè?þÿÿÄÉÃUìQeüVðEüPÿuèþYYÀt}ütÿuüPÿuèþÿÿÄÀt3À@ë3À^ÉÃUììSVðÏøýÿÿè'Èè(þÿÿ3ÛSøýÿÿPÿVWÿV8]uWÿuÆè~ÿÿÿYYØë }u5SWÿuÿWÿV(3ÛøÿÏÃèªþÿÿûu9]uWÿV(ÈPWÿV,3À@ë3À^[ÉÃUììSVWèsüÿÿøÿ"h"¿WèÌüÿÿØYYÛjh0hjÿÓðöñh¼Û«½W~`^@èüÿÿhÒ¼WF$èüÿÿh\|QgjWF(èyüÿÿhëIWF,èküÿÿhå©WF0è]üÿÿh¥°(WF4èOüÿÿh)·WF8èAüÿÿh[uðWFDè3üÿÿÄ@ØhdóuW^ è üÿÿh¢¦aëWFèüÿÿhÕOd"WFèüÿÿhy.ÃWFèöûÿÿh±÷WFèèûÿÿheóW÷WFèÚûÿÿh¯4PWFèÌûÿÿh{=#WF<è¾ûÿÿÄ@hOû~ WFèûÿÿhà=!6WFHèûÿÿhh#WèûÿÿFLhÍeWèûÿÿhÓ1ÆVWFPèvûÿÿh7½WFTèhûÿÿh£-ãWFXèZûÿÿF\Ä8EðPÇEðshelÇEôl32ÿÓøÿt"hÀåz°W~dè,ûÿÿhêêºWFlèûÿÿÄFpEøPÇEøuserfÇEü32ÆEþÿV øÿtAhqV°0W~hèìúÿÿhkV°0WFxèÞúÿÿh&cjWFtèÐúÿÿh<cjWF\|èÂúÿÿÄ Æë3À_^[ÉÃUìì\VuW3ÿ;÷îSè¤ýÿÿØ;ßuWÿDéÕEüPëj2ÿSPÿuüWWÿSLÀuïjdÿSPFEøE9>tYÿ¶¶QP¾Ãè¾üÿÿ}3ÿÄ9>t1jDE¤WPèjEèWPèüÄEèPE¤PWWj WWWWÿuÿS$9¾(tlP,PÿuÃè½úÿÿÄ9¾tëj2ÿSPÿuüWWÿSLÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂUììSW3ÿWWjWjhÿu}øÿVØûÿu3Àë>WSÿVEô;Çt+jh0PWÿV@Eø;ÇtWMüQÿuô}üPSÿVEüMSÿVEø_[ÉÃ·ffÒtVð+ñÁ·ffÒuñ^ÃUìQQEEüEüEEøEü;EøtEüMEü@EüëçEÉÃf8Vðt Æf>u÷+ò· fÂfÉuñ^ÃD$@Éuù+D$HÃÉu3ÀÃf9Át Àf8u÷+ÁÑøÃÉt èÚÿÿÿÀtDAþë fù\t è·fÉuï3ÀÃ process_handle: 0x00000100 base_address: 0x00130000	success	1	0
1619649225.449184 WriteProcessMemory	process_identifier: 2104 buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\769883685d1815c530b447c6b3922c01.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\769883685d1815c530b447c6b3922c01.exe" winsEt bXIskDWYIZEYNvaZO = cReaTeObJecT("WsCRiPt.shelL") BxIskdWYIzEYNVaZO.run """%ls""", 0, False process_handle: 0x00000100 base_address: 0x00140000	success	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (26 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3000 called NtSetContextThread to modify thread in remote process 2868
Process injection	Process 3308 called NtSetContextThread to modify thread in remote process 3380
Process injection	Process 3564 called NtSetContextThread to modify thread in remote process 3640
Process injection	Process 3820 called NtSetContextThread to modify thread in remote process 3892
Process injection	Process 4064 called NtSetContextThread to modify thread in remote process 3140
Process injection	Process 3256 called NtSetContextThread to modify thread in remote process 1940
Process injection	Process 3624 called NtSetContextThread to modify thread in remote process 3740
Process injection	Process 3940 called NtSetContextThread to modify thread in remote process 4024
Process injection	Process 2856 called NtSetContextThread to modify thread in remote process 3112
Process injection	Process 2448 called NtSetContextThread to modify thread in remote process 1812
Process injection	Process 2964 called NtSetContextThread to modify thread in remote process 4084
Process injection	Process 2136 called NtSetContextThread to modify thread in remote process 3200
Process injection	Process 2944 called NtSetContextThread to modify thread in remote process 3472
1619662746.365498 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5502784 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2868	success	0	0
1619662754.787625 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5502784 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3380	success	0	0
1619662760.459373 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5502784 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3640	success	0	0
1619662765.365373 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5502784 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3892	success	0	0
1619662771.052625 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5502784 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3140	success	0	0
1619662777.287625 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5502784 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1940	success	0	0
1619662783.41325 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5502784 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3740	success	0	0
1619662787.552625 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5502784 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 4024	success	0	0
1619662792.085125 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5502784 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3112	success	0	0
1619662796.3345 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5502784 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1812	success	0	0
1619662801.599373 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5502784 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 4084	success	0	0
1619662806.037625 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5502784 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3200	success	0	0
1619662812.475 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5502784 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3472	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (26 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3000 resumed a thread in remote process 2868
Process injection	Process 3308 resumed a thread in remote process 3380
Process injection	Process 3564 resumed a thread in remote process 3640
Process injection	Process 3820 resumed a thread in remote process 3892
Process injection	Process 4064 resumed a thread in remote process 3140
Process injection	Process 3256 resumed a thread in remote process 1940
Process injection	Process 3624 resumed a thread in remote process 3740
Process injection	Process 3940 resumed a thread in remote process 4024
Process injection	Process 2856 resumed a thread in remote process 3112
Process injection	Process 2448 resumed a thread in remote process 1812
Process injection	Process 2964 resumed a thread in remote process 4084
Process injection	Process 2136 resumed a thread in remote process 3200
Process injection	Process 2944 resumed a thread in remote process 3472
1619662746.646498 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 2868	success	0	0
1619662755.349625 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 3380	success	0	0
1619662760.943373 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 3640	success	0	0
1619662765.834373 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 3892	success	0	0
1619662771.787625 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 3140	success	0	0
1619662778.459625 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 1940	success	0	0
1619662783.80325 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 3740	success	0	0
1619662788.302625 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 4024	success	0	0
1619662792.553125 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 3112	success	0	0
1619662796.8805 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 1812	success	0	0
1619662802.240373 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 4084	success	0	0
1619662806.459625 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 3200	success	0	0
1619662813.116 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 3472	success	0	0

Executed a process and injected code into it, probably while unpacking (50 out of 110 个事件)

Time & API	Arguments	Status	Return
1619649225.449184 CreateProcessInternalW	thread_identifier: 3060 thread_handle: 0x00000108 process_identifier: 2104 current_directory: filepath: C:\Windows\System32\notepad.exe track: 1 command_line: filepath_r: C:\Windows\system32\notepad.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000100 inherit_handles: 0	success	1
1619649225.449184 NtAllocateVirtualMemory	process_identifier: 2104 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00000100 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00130000	success	0
1619649225.449184 NtAllocateVirtualMemory	process_identifier: 2104 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 4 (PAGE_READWRITE) process_handle: 0x00000100 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00140000	success	0
1619649225.449184 WriteProcessMemory	process_identifier: 2104 buffer: Q¹0d@@@$$YÃVWR¾§ÆgNèYøv· ¿Zwf;Ït ¿Ntf;ÏuÂèÀtÎÁáþÁïÏ¾:Ï3ñBHué_Æ^ÃUìQQMSVWÉt;¸MZf9u1A<Át*8PEu"@xeüÁxX$p @ùÙñEøÀu 3À_^[ÉÃMEüÑèOÿÿÿ;Et ÿEüEü;Eøràë×Eü·CEëÊUìQSW3ÿWWjWjh@ÿuÿVØûÿu3Àë&WWWS}üÿV0W}EüPWÿuSÿVSÿV3À9}üÀ_[ÉÃÉtèÀt3ÉfÃUììVðäüÿÿP3ÀPPjPÿVlÀj\XfEü3Àj.fEþXjvfEðXfEòjbXfEôjsXfEö3ÀfEøUüäüÿÿèÖUèÎUðèÆÿuìþÿÿÿuPÿVxÄäüÿÿPÿVìþÿÿPèÂ@PìþÿÿPäüÿÿPèîþÿÿÄ^ÉÃUìì,j:XjZfEÜXjofEÞXjnfEàXjefEâXjIfEäXjdfEæXjefEèXjnfEêXjtfEìXjifEîXjffEðXjifEòXfEôjeXfEöjrXfEø3ÀfEúÔýÿÿè¬UÜè÷EÿPÆEÿèPEÿPÔýÿÿPè?þÿÿÄÉÃUìQeüVðEüPÿuèþYYÀt}ütÿuüPÿuèþÿÿÄÀt3À@ë3À^ÉÃUììSVðÏøýÿÿè'Èè(þÿÿ3ÛSøýÿÿPÿVWÿV8]uWÿuÆè~ÿÿÿYYØë }u5SWÿuÿWÿV(3ÛøÿÏÃèªþÿÿûu9]uWÿV(ÈPWÿV,3À@ë3À^[ÉÃUììSVWèsüÿÿøÿ"h"¿WèÌüÿÿØYYÛjh0hjÿÓðöñh¼Û«½W~`^@èüÿÿhÒ¼WF$èüÿÿh\|QgjWF(èyüÿÿhëIWF,èküÿÿhå©WF0è]üÿÿh¥°(WF4èOüÿÿh)·WF8èAüÿÿh[uðWFDè3üÿÿÄ@ØhdóuW^ è üÿÿh¢¦aëWFèüÿÿhÕOd"WFèüÿÿhy.ÃWFèöûÿÿh±÷WFèèûÿÿheóW÷WFèÚûÿÿh¯4PWFèÌûÿÿh{=#WF<è¾ûÿÿÄ@hOû~ WFèûÿÿhà=!6WFHèûÿÿhh#WèûÿÿFLhÍeWèûÿÿhÓ1ÆVWFPèvûÿÿh7½WFTèhûÿÿh£-ãWFXèZûÿÿF\Ä8EðPÇEðshelÇEôl32ÿÓøÿt"hÀåz°W~dè,ûÿÿhêêºWFlèûÿÿÄFpEøPÇEøuserfÇEü32ÆEþÿV øÿtAhqV°0W~hèìúÿÿhkV°0WFxèÞúÿÿh&cjWFtèÐúÿÿh<cjWF\|èÂúÿÿÄ Æë3À_^[ÉÃUìì\VuW3ÿ;÷îSè¤ýÿÿØ;ßuWÿDéÕEüPëj2ÿSPÿuüWWÿSLÀuïjdÿSPFEøE9>tYÿ¶¶QP¾Ãè¾üÿÿ}3ÿÄ9>t1jDE¤WPèjEèWPèüÄEèPE¤PWWj WWWWÿuÿS$9¾(tlP,PÿuÃè½úÿÿÄ9¾tëj2ÿSPÿuüWWÿSLÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂUììSW3ÿWWjWjhÿu}øÿVØûÿu3Àë>WSÿVEô;Çt+jh0PWÿV@Eø;ÇtWMüQÿuô}üPSÿVEüMSÿVEø_[ÉÃ·ffÒtVð+ñÁ·ffÒuñ^ÃUìQQEEüEüEEøEü;EøtEüMEü@EüëçEÉÃf8Vðt Æf>u÷+ò· fÂfÉuñ^ÃD$@Éuù+D$HÃÉu3ÀÃf9Át Àf8u÷+ÁÑøÃÉt èÚÿÿÿÀtDAþë fù\t è·fÉuï3ÀÃ process_handle: 0x00000100 base_address: 0x00130000	success	1
1619649225.449184 WriteProcessMemory	process_identifier: 2104 buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\769883685d1815c530b447c6b3922c01.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\769883685d1815c530b447c6b3922c01.exe" winsEt bXIskDWYIZEYNvaZO = cReaTeObJecT("WsCRiPt.shelL") BxIskdWYIzEYNVaZO.run """%ls""", 0, False process_handle: 0x00000100 base_address: 0x00140000	success	1
1619649225.79987 CreateProcessInternalW	thread_identifier: 2316 thread_handle: 0x000000d0 process_identifier: 3000 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x000000cc inherit_handles: 0	success	1
1619662746.318498 CreateProcessInternalW	thread_identifier: 1060 thread_handle: 0x00000108 process_identifier: 2868 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000100 inherit_handles: 0	success	1
1619662746.318498 NtUnmapViewOfSection	process_identifier: 2868 region_size: 4096 process_handle: 0x00000100 base_address: 0x00400000	success	0
1619662746.334498 NtMapViewOfSection	section_handle: 0x00000110 process_identifier: 2868 commit_size: 1314816 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000100 allocation_type: 0 () section_offset: 0 view_size: 1314816 base_address: 0x00400000	success	0
1619662746.365498 NtGetContextThread	thread_handle: 0x00000108	success	0
1619662746.365498 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5502784 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2868	success	0
1619662746.646498 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 2868	success	0
1619662746.755498 CreateProcessInternalW	thread_identifier: 3132 thread_handle: 0x0000010c process_identifier: 3128 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe" 2 2868 24088187 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x0000011c inherit_handles: 0	success	1
1619662753.881 CreateProcessInternalW	thread_identifier: 3312 thread_handle: 0x00000188 process_identifier: 3308 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x0000018c inherit_handles: 0	success	1
1619662754.662625 CreateProcessInternalW	thread_identifier: 3384 thread_handle: 0x00000108 process_identifier: 3380 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000100 inherit_handles: 0	success	1
1619662754.662625 NtUnmapViewOfSection	process_identifier: 3380 region_size: 4096 process_handle: 0x00000100 base_address: 0x00400000	success	0
1619662754.677625 NtMapViewOfSection	section_handle: 0x00000110 process_identifier: 3380 commit_size: 1314816 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000100 allocation_type: 0 () section_offset: 0 view_size: 1314816 base_address: 0x00400000	success	0
1619662754.787625 NtGetContextThread	thread_handle: 0x00000108	success	0
1619662754.787625 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5502784 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3380	success	0
1619662755.349625 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 3380	success	0
1619662755.459625 CreateProcessInternalW	thread_identifier: 3444 thread_handle: 0x0000010c process_identifier: 3440 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe" 2 3380 24096890 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x0000011c inherit_handles: 0	success	1
1619662758.725125 CreateProcessInternalW	thread_identifier: 3568 thread_handle: 0x0000013c process_identifier: 3564 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000140 inherit_handles: 0	success	1
1619662760.255373 CreateProcessInternalW	thread_identifier: 3644 thread_handle: 0x00000108 process_identifier: 3640 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000100 inherit_handles: 0	success	1
1619662760.255373 NtUnmapViewOfSection	process_identifier: 3640 region_size: 4096 process_handle: 0x00000100 base_address: 0x00400000	success	0
1619662760.334373 NtMapViewOfSection	section_handle: 0x00000110 process_identifier: 3640 commit_size: 1314816 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000100 allocation_type: 0 () section_offset: 0 view_size: 1314816 base_address: 0x00400000	success	0
1619662760.459373 NtGetContextThread	thread_handle: 0x00000108	success	0
1619662760.459373 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5502784 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3640	success	0
1619662760.943373 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 3640	success	0
1619662761.115373 CreateProcessInternalW	thread_identifier: 3712 thread_handle: 0x0000010c process_identifier: 3708 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe" 2 3640 24102484 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x0000011c inherit_handles: 0	success	1
1619662764.490373 CreateProcessInternalW	thread_identifier: 3824 thread_handle: 0x00000144 process_identifier: 3820 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000148 inherit_handles: 0	success	1
1619662765.271373 CreateProcessInternalW	thread_identifier: 3896 thread_handle: 0x00000108 process_identifier: 3892 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000100 inherit_handles: 0	success	1
1619662765.271373 NtUnmapViewOfSection	process_identifier: 3892 region_size: 4096 process_handle: 0x00000100 base_address: 0x00400000	success	0
1619662765.287373 NtMapViewOfSection	section_handle: 0x00000110 process_identifier: 3892 commit_size: 1314816 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000100 allocation_type: 0 () section_offset: 0 view_size: 1314816 base_address: 0x00400000	success	0
1619662765.365373 NtGetContextThread	thread_handle: 0x00000108	success	0
1619662765.365373 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5502784 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3892	success	0
1619662765.834373 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 3892	success	0
1619662766.521373 CreateProcessInternalW	thread_identifier: 3960 thread_handle: 0x0000010c process_identifier: 3956 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe" 2 3892 24107375 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x0000011c inherit_handles: 0	success	1
1619662769.6 CreateProcessInternalW	thread_identifier: 4068 thread_handle: 0x0000012c process_identifier: 4064 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000130 inherit_handles: 0	success	1
1619662770.896625 CreateProcessInternalW	thread_identifier: 3144 thread_handle: 0x00000108 process_identifier: 3140 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000100 inherit_handles: 0	success	1
1619662770.896625 NtUnmapViewOfSection	process_identifier: 3140 region_size: 4096 process_handle: 0x00000100 base_address: 0x00400000	success	0
1619662770.943625 NtMapViewOfSection	section_handle: 0x00000110 process_identifier: 3140 commit_size: 1314816 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000100 allocation_type: 0 () section_offset: 0 view_size: 1314816 base_address: 0x00400000	success	0
1619662771.052625 NtGetContextThread	thread_handle: 0x00000108	success	0
1619662771.052625 NtSetContextThread	thread_handle: 0x00000108 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 5502784 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3140	success	0
1619662771.787625 NtResumeThread	thread_handle: 0x00000108 suspend_count: 1 process_identifier: 3140	success	0
1619662771.943625 CreateProcessInternalW	thread_identifier: 2120 thread_handle: 0x0000010c process_identifier: 196 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe" 2 3140 24113328 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x0000011c inherit_handles: 0	success	1
1619662776.14675 CreateProcessInternalW	thread_identifier: 2244 thread_handle: 0x0000015c process_identifier: 3256 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000160 inherit_handles: 0	success	1
1619662777.146625 CreateProcessInternalW	thread_identifier: 624 thread_handle: 0x00000108 process_identifier: 1940 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hshbbb.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000100 inherit_handles: 0	success	1
1619662777.146625 NtUnmapViewOfSection	process_identifier: 1940 region_size: 4096 process_handle: 0x00000100 base_address: 0x00400000	success	0
1619662777.177625 NtMapViewOfSection	section_handle: 0x00000110 process_identifier: 1940 commit_size: 1314816 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000100 allocation_type: 0 () section_offset: 0 view_size: 1314816 base_address: 0x00400000	success	0
1619662777.287625 NtGetContextThread	thread_handle: 0x00000108	success	0

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Delf.FareIt.Gen.7
FireEye	Generic.mg.769883685d1815c5
McAfee	Fareit-FTB!769883685D18
Cylance	Unsafe
Zillya	Trojan.Crypt.Win32.63020
Sangfor	Malware
K7AntiVirus	Trojan ( 0056a59a1 )
BitDefender	Trojan.Delf.FareIt.Gen.7
K7GW	Trojan ( 0056a59a1 )
Cybereason	malicious.814939
Arcabit	Trojan.Delf.FareIt.Gen.7
Cyren	W32/Trojan.MZRB-5079
Symantec	Trojan.Gen.MBT
APEX	Malicious
Kaspersky	HEUR:Trojan.Win32.Crypt.gen
Alibaba	Trojan:Win32/Injector.c0a5b502
NANO-Antivirus	Trojan.Win32.Crypt.hntfmz
AegisLab	Trojan.Win32.FareIt.4!c
Ad-Aware	Trojan.Delf.FareIt.Gen.7
Sophos	Mal/Generic-S
Comodo	Malware@#2qxcqwnulit2u
F-Secure	Trojan.TR/Injector.oiziy
DrWeb	BackDoor.RatNET.2
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TSPY_HPLOKI.SMBD
McAfee-GW-Edition	BehavesLike.Win32.Fareit.tc
Emsisoft	Trojan.Delf.FareIt.Gen.7 (B)
SentinelOne	Static AI - Suspicious PE
Jiangmin	AdWare.Generic.uhys
Avira	TR/Injector.oiziy
MAX	malware (ai score=89)
Antiy-AVL	Trojan/Win32.Crypt
Microsoft	PWS:Win32/Fareit.AQ!MTB
SUPERAntiSpyware	Trojan.Agent/Gen-Injector
ZoneAlarm	HEUR:Trojan.Win32.Crypt.gen
GData	Trojan.Delf.FareIt.Gen.7
Cynet	Malicious (score: 100)
AhnLab-V3	Suspicious/Win.Delphiless.X2094
BitDefenderTheta	Gen:NN.ZelphiF.34670.hHW@aa@rd9ei
VBA32	BScope.TrojanPSW.Fareit
Malwarebytes	Trojan.MalPack.DLF
Panda	Trj/Genetic.gen
Zoner	Trojan.Win32.91516
ESET-NOD32	a variant of Win32/Injector.EMOY
TrendMicro-HouseCall	TSPY_HPLOKI.SMBD
Rising	Trojan.Injector!1.C99D (CLASSIC)
Yandex	Trojan.Injector!XCKpVZNcmMc
Ikarus	Trojan.Win32.Krypt

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x4a0154 DeleteCriticalSection

• 0x4a0158 LeaveCriticalSection

• 0x4a015c EnterCriticalSection

• 0x4a0160 InitializeCriticalSection

• 0x4a0164 VirtualFree

• 0x4a0168 VirtualAlloc

• 0x4a016c LocalFree

• 0x4a0170 LocalAlloc

• 0x4a0174 GetVersion

• 0x4a0178 GetCurrentThreadId

• 0x4a017c InterlockedDecrement

• 0x4a0180 InterlockedIncrement

• 0x4a0184 VirtualQuery

• 0x4a0188 WideCharToMultiByte

• 0x4a018c MultiByteToWideChar

• 0x4a0190 lstrlenA

• 0x4a0194 lstrcpynA

• 0x4a0198 LoadLibraryExA

• 0x4a019c GetThreadLocale

• 0x4a01a0 GetStartupInfoA

• 0x4a01a4 GetProcAddress

• 0x4a01a8 GetModuleHandleA

• 0x4a01ac GetModuleFileNameA

• 0x4a01b0 GetLocaleInfoA

• 0x4a01b4 GetCommandLineA

• 0x4a01b8 FreeLibrary

• 0x4a01bc FindFirstFileA

• 0x4a01c0 FindClose

• 0x4a01c4 ExitProcess

• 0x4a01c8 WriteFile

• 0x4a01cc UnhandledExceptionFilter

• 0x4a01d0 RtlUnwind

• 0x4a01d4 RaiseException

• 0x4a01d8 GetStdHandle

Library user32.dll:

• 0x4a01e0 GetKeyboardType

• 0x4a01e4 LoadStringA

• 0x4a01e8 MessageBoxA

• 0x4a01ec CharNextA

Library advapi32.dll:

• 0x4a01f4 RegQueryValueExA

• 0x4a01f8 RegOpenKeyExA

• 0x4a01fc RegCloseKey

Library oleaut32.dll:

• 0x4a0204 SysFreeString

• 0x4a0208 SysReAllocStringLen

• 0x4a020c SysAllocStringLen

Library kernel32.dll:

• 0x4a0214 TlsSetValue

• 0x4a0218 TlsGetValue

• 0x4a021c LocalAlloc

• 0x4a0220 GetModuleHandleA

Library advapi32.dll:

• 0x4a0228 RegQueryValueExA

• 0x4a022c RegOpenKeyExA

• 0x4a0230 RegCloseKey

Library kernel32.dll:

• 0x4a0238 lstrcpyA

• 0x4a023c WriteFile

• 0x4a0240 WideCharToMultiByte

• 0x4a0244 WaitForSingleObject

• 0x4a0248 VirtualQuery

• 0x4a024c VirtualProtectEx

• 0x4a0250 VirtualAlloc

• 0x4a0254 Sleep

• 0x4a0258 SizeofResource

• 0x4a025c SetThreadLocale

• 0x4a0260 SetFilePointer

• 0x4a0264 SetEvent

• 0x4a0268 SetErrorMode

• 0x4a026c SetEndOfFile

• 0x4a0270 ResetEvent

• 0x4a0274 ReadFile

• 0x4a0278 MultiByteToWideChar

• 0x4a027c MulDiv

• 0x4a0280 LockResource

• 0x4a0284 LoadResource

• 0x4a0288 LoadLibraryA

• 0x4a028c LeaveCriticalSection

• 0x4a0290 InitializeCriticalSection

• 0x4a0294 GlobalUnlock

• 0x4a0298 GlobalReAlloc

• 0x4a029c GlobalHandle

• 0x4a02a0 GlobalLock

• 0x4a02a4 GlobalFree

• 0x4a02a8 GlobalFindAtomA

• 0x4a02ac GlobalDeleteAtom

• 0x4a02b0 GlobalAlloc

• 0x4a02b4 GlobalAddAtomA

• 0x4a02b8 GetVersionExA

• 0x4a02bc GetVersion

• 0x4a02c0 GetTickCount

• 0x4a02c4 GetThreadLocale

• 0x4a02c8 GetSystemInfo

• 0x4a02cc GetStringTypeExA

• 0x4a02d0 GetStdHandle

• 0x4a02d4 GetProcAddress

• 0x4a02d8 GetModuleHandleA

• 0x4a02dc GetModuleFileNameA

• 0x4a02e0 GetLocaleInfoA

• 0x4a02e4 GetLocalTime

• 0x4a02e8 GetLastError

• 0x4a02ec GetFullPathNameA

• 0x4a02f0 GetFileAttributesA

• 0x4a02f4 GetDiskFreeSpaceA

• 0x4a02f8 GetDateFormatA

• 0x4a02fc GetCurrentThreadId

• 0x4a0300 GetCurrentProcessId

• 0x4a0304 GetCurrentProcess

• 0x4a0308 GetCPInfo

• 0x4a030c GetACP

• 0x4a0310 FreeResource

• 0x4a0314 InterlockedExchange

• 0x4a0318 FreeLibrary

• 0x4a031c FormatMessageA

• 0x4a0320 FindResourceA

• 0x4a0324 FindFirstFileA

• 0x4a0328 FindClose

• 0x4a032c FileTimeToLocalFileTime

• 0x4a0330 FileTimeToDosDateTime

• 0x4a0334 EnumCalendarInfoA

• 0x4a0338 EnterCriticalSection

• 0x4a033c DeleteCriticalSection

• 0x4a0340 CreateThread

• 0x4a0344 CreateFileA

• 0x4a0348 CreateEventA

• 0x4a034c CompareStringA

• 0x4a0350 CloseHandle

Library version.dll:

• 0x4a0358 VerQueryValueA

• 0x4a035c GetFileVersionInfoSizeA

• 0x4a0360 GetFileVersionInfoA

Library gdi32.dll:

• 0x4a0368 UnrealizeObject

• 0x4a036c StretchBlt

• 0x4a0370 SetWindowOrgEx

• 0x4a0374 SetWinMetaFileBits

• 0x4a0378 SetViewportOrgEx

• 0x4a037c SetTextColor

• 0x4a0380 SetStretchBltMode

• 0x4a0384 SetROP2

• 0x4a0388 SetPixel

• 0x4a038c SetEnhMetaFileBits

• 0x4a0390 SetDIBColorTable

• 0x4a0394 SetBrushOrgEx

• 0x4a0398 SetBkMode

• 0x4a039c SetBkColor

• 0x4a03a0 SelectPalette

• 0x4a03a4 SelectObject

• 0x4a03a8 SaveDC

• 0x4a03ac RestoreDC

• 0x4a03b0 Rectangle

• 0x4a03b4 RectVisible

• 0x4a03b8 RealizePalette

• 0x4a03bc Polyline

• 0x4a03c0 PlayEnhMetaFile

• 0x4a03c4 PatBlt

• 0x4a03c8 MoveToEx

• 0x4a03cc MaskBlt

• 0x4a03d0 LineTo

• 0x4a03d4 IntersectClipRect

• 0x4a03d8 GetWindowOrgEx

• 0x4a03dc GetWinMetaFileBits

• 0x4a03e0 GetTextMetricsA

• 0x4a03e4 GetTextExtentPoint32A

• 0x4a03e8 GetSystemPaletteEntries

• 0x4a03ec GetStockObject

• 0x4a03f0 GetPixel

• 0x4a03f4 GetPaletteEntries

• 0x4a03f8 GetObjectA

• 0x4a03fc GetEnhMetaFilePaletteEntries

• 0x4a0400 GetEnhMetaFileHeader

• 0x4a0404 GetEnhMetaFileBits

• 0x4a0408 GetDeviceCaps

• 0x4a040c GetDIBits

• 0x4a0410 GetDIBColorTable

• 0x4a0414 GetDCOrgEx

• 0x4a0418 GetCurrentPositionEx

• 0x4a041c GetClipBox

• 0x4a0420 GetBrushOrgEx

• 0x4a0424 GetBitmapBits

• 0x4a0428 ExcludeClipRect

• 0x4a042c DeleteObject

• 0x4a0430 DeleteEnhMetaFile

• 0x4a0434 DeleteDC

• 0x4a0438 CreateSolidBrush

• 0x4a043c CreatePenIndirect

• 0x4a0440 CreatePalette

• 0x4a0444 CreateHalftonePalette

• 0x4a0448 CreateFontIndirectA

• 0x4a044c CreateDIBitmap

• 0x4a0450 CreateDIBSection

• 0x4a0454 CreateCompatibleDC

• 0x4a0458 CreateCompatibleBitmap

• 0x4a045c CreateBrushIndirect

• 0x4a0460 CreateBitmap

• 0x4a0464 CopyEnhMetaFileA

• 0x4a0468 BitBlt

Library user32.dll:

• 0x4a0470 CreateWindowExA

• 0x4a0474 WindowFromPoint

• 0x4a0478 WinHelpA

• 0x4a047c WaitMessage

• 0x4a0480 UpdateWindow

• 0x4a0484 UnregisterClassA

• 0x4a0488 UnhookWindowsHookEx

• 0x4a048c TranslateMessage

• 0x4a0490 TranslateMDISysAccel

• 0x4a0494 TrackPopupMenu

• 0x4a0498 SystemParametersInfoA

• 0x4a049c ShowWindow

• 0x4a04a0 ShowScrollBar

• 0x4a04a4 ShowOwnedPopups

• 0x4a04a8 ShowCursor

• 0x4a04ac SetWindowsHookExA

• 0x4a04b0 SetWindowPos

• 0x4a04b4 SetWindowPlacement

• 0x4a04b8 SetWindowLongA

• 0x4a04bc SetTimer

• 0x4a04c0 SetScrollRange

• 0x4a04c4 SetScrollPos

• 0x4a04c8 SetScrollInfo

• 0x4a04cc SetRect

• 0x4a04d0 SetPropA

• 0x4a04d4 SetParent

• 0x4a04d8 SetMenuItemInfoA

• 0x4a04dc SetMenu

• 0x4a04e0 SetForegroundWindow

• 0x4a04e4 SetFocus

• 0x4a04e8 SetCursor

• 0x4a04ec SetClassLongA

• 0x4a04f0 SetCapture

• 0x4a04f4 SetActiveWindow

• 0x4a04f8 SendMessageA

• 0x4a04fc ScrollWindow

• 0x4a0500 ScreenToClient

• 0x4a0504 RemovePropA

• 0x4a0508 RemoveMenu

• 0x4a050c ReleaseDC

• 0x4a0510 ReleaseCapture

• 0x4a0514 RegisterWindowMessageA

• 0x4a0518 RegisterClipboardFormatA

• 0x4a051c RegisterClassA

• 0x4a0520 RedrawWindow

• 0x4a0524 PtInRect

• 0x4a0528 PostQuitMessage

• 0x4a052c PostMessageA

• 0x4a0530 PeekMessageA

• 0x4a0534 OffsetRect

• 0x4a0538 OemToCharA

• 0x4a053c MessageBoxA

• 0x4a0540 MapWindowPoints

• 0x4a0544 MapVirtualKeyA

• 0x4a0548 LoadStringA

• 0x4a054c LoadKeyboardLayoutA

• 0x4a0550 LoadIconA

• 0x4a0554 LoadCursorA

• 0x4a0558 LoadBitmapA

• 0x4a055c KillTimer

• 0x4a0560 IsZoomed

• 0x4a0564 IsWindowVisible

• 0x4a0568 IsWindowEnabled

• 0x4a056c IsWindow

• 0x4a0570 IsRectEmpty

• 0x4a0574 IsIconic

• 0x4a0578 IsDialogMessageA

• 0x4a057c IsChild

• 0x4a0580 InvalidateRect

• 0x4a0584 IntersectRect

• 0x4a0588 InsertMenuItemA

• 0x4a058c InsertMenuA

• 0x4a0590 InflateRect

• 0x4a0594 GetWindowThreadProcessId

• 0x4a0598 GetWindowTextA

• 0x4a059c GetWindowRect

• 0x4a05a0 GetWindowPlacement

• 0x4a05a4 GetWindowLongA

• 0x4a05a8 GetWindowDC

• 0x4a05ac GetTopWindow

• 0x4a05b0 GetSystemMetrics

• 0x4a05b4 GetSystemMenu

• 0x4a05b8 GetSysColorBrush

• 0x4a05bc GetSysColor

• 0x4a05c0 GetSubMenu

• 0x4a05c4 GetScrollRange

• 0x4a05c8 GetScrollPos

• 0x4a05cc GetScrollInfo

• 0x4a05d0 GetPropA

• 0x4a05d4 GetParent

• 0x4a05d8 GetWindow

• 0x4a05dc GetMenuStringA

• 0x4a05e0 GetMenuState

• 0x4a05e4 GetMenuItemInfoA

• 0x4a05e8 GetMenuItemID

• 0x4a05ec GetMenuItemCount

• 0x4a05f0 GetMenu

• 0x4a05f4 GetLastActivePopup

• 0x4a05f8 GetKeyboardState

• 0x4a05fc GetKeyboardLayoutList

• 0x4a0600 GetKeyboardLayout

• 0x4a0604 GetKeyState

• 0x4a0608 GetKeyNameTextA

• 0x4a060c GetIconInfo

• 0x4a0610 GetForegroundWindow

• 0x4a0614 GetFocus

• 0x4a0618 GetDlgItem

• 0x4a061c GetDesktopWindow

• 0x4a0620 GetDCEx

• 0x4a0624 GetDC

• 0x4a0628 GetCursorPos

• 0x4a062c GetCursor

• 0x4a0630 GetClipboardData

• 0x4a0634 GetClientRect

• 0x4a0638 GetClassNameA

• 0x4a063c GetClassInfoA

• 0x4a0640 GetCapture

• 0x4a0644 GetActiveWindow

• 0x4a0648 FrameRect

• 0x4a064c FindWindowA

• 0x4a0650 FillRect

• 0x4a0654 EqualRect

• 0x4a0658 EnumWindows

• 0x4a065c EnumThreadWindows

• 0x4a0660 EndPaint

• 0x4a0664 EnableWindow

• 0x4a0668 EnableScrollBar

• 0x4a066c EnableMenuItem

• 0x4a0670 DrawTextA

• 0x4a0674 DrawMenuBar

• 0x4a0678 DrawIconEx

• 0x4a067c DrawIcon

• 0x4a0680 DrawFrameControl

• 0x4a0684 DrawFocusRect

• 0x4a0688 DrawEdge

• 0x4a068c DispatchMessageA

• 0x4a0690 DestroyWindow

• 0x4a0694 DestroyMenu

• 0x4a0698 DestroyIcon

• 0x4a069c DestroyCursor

• 0x4a06a0 DeleteMenu

• 0x4a06a4 DefWindowProcA

• 0x4a06a8 DefMDIChildProcA

• 0x4a06ac DefFrameProcA

• 0x4a06b0 CreatePopupMenu

• 0x4a06b4 CreateMenu

• 0x4a06b8 CreateIcon

• 0x4a06bc ClientToScreen

• 0x4a06c0 CheckMenuItem

• 0x4a06c4 CallWindowProcA

• 0x4a06c8 CallNextHookEx

• 0x4a06cc BeginPaint

• 0x4a06d0 CharNextA

• 0x4a06d4 CharLowerBuffA

• 0x4a06d8 CharLowerA

• 0x4a06dc CharUpperBuffA

• 0x4a06e0 CharToOemA

• 0x4a06e4 AdjustWindowRectEx

• 0x4a06e8 ActivateKeyboardLayout

Library kernel32.dll:

• 0x4a06f0 Sleep

Library oleaut32.dll:

• 0x4a06f8 SafeArrayPtrOfIndex

• 0x4a06fc SafeArrayPutElement

• 0x4a0700 SafeArrayGetElement

• 0x4a0704 SafeArrayUnaccessData

• 0x4a0708 SafeArrayAccessData

• 0x4a070c SafeArrayGetUBound

• 0x4a0710 SafeArrayGetLBound

• 0x4a0714 SafeArrayRedim

• 0x4a0718 SafeArrayCreate

• 0x4a071c VariantChangeType

• 0x4a0720 VariantCopyInd

• 0x4a0724 VariantCopy

• 0x4a0728 VariantClear

• 0x4a072c VariantInit

Library ole32.dll:

• 0x4a0734 CoCreateInstance

• 0x4a0738 CoGetMalloc

• 0x4a073c CoUninitialize

• 0x4a0740 CoInitialize

Library oleaut32.dll:

• 0x4a0748 GetErrorInfo

• 0x4a074c SysStringLen

• 0x4a0750 SysFreeString

Library comctl32.dll:

• 0x4a0758 ImageList_SetIconSize

• 0x4a075c ImageList_GetIconSize

• 0x4a0760 ImageList_Write

• 0x4a0764 ImageList_Read

• 0x4a0768 ImageList_GetDragImage

• 0x4a076c ImageList_DragShowNolock

• 0x4a0770 ImageList_SetDragCursorImage

• 0x4a0774 ImageList_DragMove

• 0x4a0778 ImageList_DragLeave

• 0x4a077c ImageList_DragEnter

• 0x4a0780 ImageList_EndDrag

• 0x4a0784 ImageList_BeginDrag

• 0x4a0788 ImageList_Remove

• 0x4a078c ImageList_DrawEx

• 0x4a0790 ImageList_Replace

• 0x4a0794 ImageList_Draw

• 0x4a0798 ImageList_GetBkColor

• 0x4a079c ImageList_SetBkColor

• 0x4a07a0 ImageList_ReplaceIcon

• 0x4a07a4 ImageList_Add

• 0x4a07a8 ImageList_GetImageCount

• 0x4a07ac ImageList_Destroy

• 0x4a07b0 ImageList_Create

• 0x4a07b4 InitCommonControls

Library comdlg32.dll:

• 0x4a07bc GetSaveFileNameA

• 0x4a07c0 GetOpenFileNameA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.