SmartHawk

8.6

极危

58 个模型检测该样本为恶意！

重新分析

下载样本

381890c0b8c5955bb3f6c229f966fe8d6fc2bc707d9480752e1fed75bbc5b470

a6173ef48257f495537df09ef37c41e9.exe

分析耗时

214s

最近分析

文件大小

729.0KB

静态报毒动态报毒 AGEN AGENTTESLA AI SCORE=84 BTYPDC CLASSIC DELF DELPHILESS ELDORADO ELKP ELLX FAREIT FORMBOOK GDSDA GENERICKD HIGH CONFIDENCE HIQXAF IGENT KRYPTIK LKDJ MALWARE@#2KH9EAQ1M531P PWSX QVM05 R06EC0DI220 REMCOS S + MAL SCORE STATIC AI SUSGEN SUSPICIOUS PE TG0@A0IF3GKI TRJGEN TSCOPE UNSAFE X2059 ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FSK!A6173EF48257	20210126	6.0.6.653
Alibaba	Trojan:Win32/FormBook.d8b821b2	20190527	0.3.0.5
Avast	Win32:PWSX-gen [Trj]	20210126	21.1.5827.0
Tencent	Win32.Trojan.Kryptik.Lkdj	20210126	1.0.0.1
Baidu		20190318	1.0.0.2
Kingsoft		20210126	2017.9.26.565

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (27 个事件)

Time & API	Arguments	Status
1619781476.42225 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 48430912 registers.edi: 0 registers.eax: 0 registers.ebp: 48430984 registers.edx: 50 registers.ebx: 0 registers.esi: 0 registers.ecx: 384 exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5a e9 1c 4e fa exception.symbol: a6173ef48257f495537df09ef37c41e9+0x5e943 exception.instruction: div eax exception.module: a6173ef48257f495537df09ef37c41e9.exe exception.exception_code: 0xc0000094 exception.offset: 387395 exception.address: 0x45e943	success
1619821831.244499 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73aae97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73aaea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73aab25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73aab4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73aaac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73aaaed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73aa5511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73aa559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74167f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74164de3 a6173ef48257f495537df09ef37c41e9+0x58a4d @ 0x458a4d a6173ef48257f495537df09ef37c41e9+0x51254 @ 0x451254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfe5414ad	success
1619821830.103124 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 48955200 registers.edi: 0 registers.eax: 0 registers.ebp: 48955272 registers.edx: 50 registers.ebx: 0 registers.esi: 0 registers.ecx: 103 exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5a e9 1c 4e fa exception.symbol: a6173ef48257f495537df09ef37c41e9+0x5e943 exception.instruction: div eax exception.module: a6173ef48257f495537df09ef37c41e9.exe exception.exception_code: 0xc0000094 exception.offset: 387395 exception.address: 0x45e943	success
1619821833.556751 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 48758592 registers.edi: 0 registers.eax: 0 registers.ebp: 48758664 registers.edx: 50 registers.ebx: 0 registers.esi: 0 registers.ecx: 556 exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5a e9 1c 4e fa exception.symbol: a6173ef48257f495537df09ef37c41e9+0x5e943 exception.instruction: div eax exception.module: a6173ef48257f495537df09ef37c41e9.exe exception.exception_code: 0xc0000094 exception.offset: 387395 exception.address: 0x45e943	success
1619821834.150249 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7405e97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7405ea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7405b25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7405b4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7405ac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7405aed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x74055511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7405559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741b7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741b4de3 a6173ef48257f495537df09ef37c41e9+0x58a4d @ 0x458a4d a6173ef48257f495537df09ef37c41e9+0x51254 @ 0x451254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfe9714ad	success
1619821834.103874 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 48955200 registers.edi: 0 registers.eax: 0 registers.ebp: 48955272 registers.edx: 50 registers.ebx: 0 registers.esi: 0 registers.ecx: 103 exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5a e9 1c 4e fa exception.symbol: a6173ef48257f495537df09ef37c41e9+0x5e943 exception.instruction: div eax exception.module: a6173ef48257f495537df09ef37c41e9.exe exception.exception_code: 0xc0000094 exception.offset: 387395 exception.address: 0x45e943	success
1619821835.384751 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34668352 registers.edi: 0 registers.eax: 0 registers.ebp: 34668424 registers.edx: 50 registers.ebx: 0 registers.esi: 0 registers.ecx: 384 exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5a e9 1c 4e fa exception.symbol: a6173ef48257f495537df09ef37c41e9+0x5e943 exception.instruction: div eax exception.module: a6173ef48257f495537df09ef37c41e9.exe exception.exception_code: 0xc0000094 exception.offset: 387395 exception.address: 0x45e943	success
1619821836.775374 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73aae97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73aaea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73aab25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73aab4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73aaac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73aaaed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73aa5511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73aa559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74167f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74164de3 a6173ef48257f495537df09ef37c41e9+0x58a4d @ 0x458a4d a6173ef48257f495537df09ef37c41e9+0x51254 @ 0x451254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfcdc14ad	success
1619821837.072249 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34209600 registers.edi: 0 registers.eax: 0 registers.ebp: 34209672 registers.edx: 50 registers.ebx: 0 registers.esi: 0 registers.ecx: 72 exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5a e9 1c 4e fa exception.symbol: a6173ef48257f495537df09ef37c41e9+0x5e943 exception.instruction: div eax exception.module: a6173ef48257f495537df09ef37c41e9.exe exception.exception_code: 0xc0000094 exception.offset: 387395 exception.address: 0x45e943	success
1619821837.805999 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 49348416 registers.edi: 0 registers.eax: 0 registers.ebp: 49348488 registers.edx: 50 registers.ebx: 0 registers.esi: 0 registers.ecx: 806 exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5a e9 1c 4e fa exception.symbol: a6173ef48257f495537df09ef37c41e9+0x5e943 exception.instruction: div eax exception.module: a6173ef48257f495537df09ef37c41e9.exe exception.exception_code: 0xc0000094 exception.offset: 387395 exception.address: 0x45e943	success
1619821838.541874 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7405e97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7405ea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7405b25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7405b4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7405ac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7405aed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x74055511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7405559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741b7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741b4de3 a6173ef48257f495537df09ef37c41e9+0x58a4d @ 0x458a4d a6173ef48257f495537df09ef37c41e9+0x51254 @ 0x451254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfe6e14ad	success
1619821838.603751 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 33816384 registers.edi: 0 registers.eax: 0 registers.ebp: 33816456 registers.edx: 50 registers.ebx: 0 registers.esi: 0 registers.ecx: 603 exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5a e9 1c 4e fa exception.symbol: a6173ef48257f495537df09ef37c41e9+0x5e943 exception.instruction: div eax exception.module: a6173ef48257f495537df09ef37c41e9.exe exception.exception_code: 0xc0000094 exception.offset: 387395 exception.address: 0x45e943	success
1619821839.806751 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 49938240 registers.edi: 0 registers.eax: 0 registers.ebp: 49938312 registers.edx: 50 registers.ebx: 0 registers.esi: 0 registers.ecx: 806 exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5a e9 1c 4e fa exception.symbol: a6173ef48257f495537df09ef37c41e9+0x5e943 exception.instruction: div eax exception.module: a6173ef48257f495537df09ef37c41e9.exe exception.exception_code: 0xc0000094 exception.offset: 387395 exception.address: 0x45e943	success
1619821841.149999 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73aae97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73aaea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73aab25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73aab4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73aaac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73aaaed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73aa5511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73aa559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74167f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74164de3 a6173ef48257f495537df09ef37c41e9+0x58a4d @ 0x458a4d a6173ef48257f495537df09ef37c41e9+0x51254 @ 0x451254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfe7814ad	success
1619821840.681626 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 48496448 registers.edi: 0 registers.eax: 0 registers.ebp: 48496520 registers.edx: 50 registers.ebx: 0 registers.esi: 0 registers.ecx: 681 exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5a e9 1c 4e fa exception.symbol: a6173ef48257f495537df09ef37c41e9+0x5e943 exception.instruction: div eax exception.module: a6173ef48257f495537df09ef37c41e9.exe exception.exception_code: 0xc0000094 exception.offset: 387395 exception.address: 0x45e943	success
1619821850.713874 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 35323712 registers.edi: 0 registers.eax: 0 registers.ebp: 35323784 registers.edx: 50 registers.ebx: 0 registers.esi: 0 registers.ecx: 713 exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5a e9 1c 4e fa exception.symbol: a6173ef48257f495537df09ef37c41e9+0x5e943 exception.instruction: div eax exception.module: a6173ef48257f495537df09ef37c41e9.exe exception.exception_code: 0xc0000094 exception.offset: 387395 exception.address: 0x45e943	success
1619821852.681751 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73a5e97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73a5ea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73a5b25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73a5b4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73a5ac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73a5aed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73a55511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73a5559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74117f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74114de3 a6173ef48257f495537df09ef37c41e9+0x58a4d @ 0x458a4d a6173ef48257f495537df09ef37c41e9+0x51254 @ 0x451254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfe6214ad	success
1619821852.713124 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 49545024 registers.edi: 0 registers.eax: 0 registers.ebp: 49545096 registers.edx: 50 registers.ebx: 0 registers.esi: 0 registers.ecx: 713 exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5a e9 1c 4e fa exception.symbol: a6173ef48257f495537df09ef37c41e9+0x5e943 exception.instruction: div eax exception.module: a6173ef48257f495537df09ef37c41e9.exe exception.exception_code: 0xc0000094 exception.offset: 387395 exception.address: 0x45e943	success
1619821895.360521 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 49348416 registers.edi: 0 registers.eax: 0 registers.ebp: 49348488 registers.edx: 51 registers.ebx: 0 registers.esi: 0 registers.ecx: 381 exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5a e9 1c 4e fa exception.symbol: a6173ef48257f495537df09ef37c41e9+0x5e943 exception.instruction: div eax exception.module: a6173ef48257f495537df09ef37c41e9.exe exception.exception_code: 0xc0000094 exception.offset: 387395 exception.address: 0x45e943	success
1619821901.186395 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73aae97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73aaea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73aab25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73aab4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73aaac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73aaaed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73aa5511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73aa559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74167f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74164de3 a6173ef48257f495537df09ef37c41e9+0x58a4d @ 0x458a4d a6173ef48257f495537df09ef37c41e9+0x51254 @ 0x451254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfcd114ad	success
1619821900.564699 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 48889664 registers.edi: 0 registers.eax: 0 registers.ebp: 48889736 registers.edx: 51 registers.ebx: 0 registers.esi: 0 registers.ecx: 583 exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5a e9 1c 4e fa exception.symbol: a6173ef48257f495537df09ef37c41e9+0x5e943 exception.instruction: div eax exception.module: a6173ef48257f495537df09ef37c41e9.exe exception.exception_code: 0xc0000094 exception.offset: 387395 exception.address: 0x45e943	success
1619821919.215375 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34537280 registers.edi: 0 registers.eax: 0 registers.ebp: 34537352 registers.edx: 51 registers.ebx: 0 registers.esi: 0 registers.ecx: 221 exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5a e9 1c 4e fa exception.symbol: a6173ef48257f495537df09ef37c41e9+0x5e943 exception.instruction: div eax exception.module: a6173ef48257f495537df09ef37c41e9.exe exception.exception_code: 0xc0000094 exception.offset: 387395 exception.address: 0x45e943	success
1619821927.18248 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73a5e97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73a5ea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73a5b25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73a5b4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73a5ac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73a5aed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73a55511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73a5559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74167f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74164de3 a6173ef48257f495537df09ef37c41e9+0x58a4d @ 0x458a4d a6173ef48257f495537df09ef37c41e9+0x51254 @ 0x451254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfe6114ad	success
1619821927.100607 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 48365376 registers.edi: 0 registers.eax: 0 registers.ebp: 48365448 registers.edx: 52 registers.ebx: 0 registers.esi: 0 registers.ecx: 96 exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5a e9 1c 4e fa exception.symbol: a6173ef48257f495537df09ef37c41e9+0x5e943 exception.instruction: div eax exception.module: a6173ef48257f495537df09ef37c41e9.exe exception.exception_code: 0xc0000094 exception.offset: 387395 exception.address: 0x45e943	success
1619821938.509259 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34340672 registers.edi: 0 registers.eax: 0 registers.ebp: 34340744 registers.edx: 52 registers.ebx: 0 registers.esi: 0 registers.ecx: 499 exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5a e9 1c 4e fa exception.symbol: a6173ef48257f495537df09ef37c41e9+0x5e943 exception.instruction: div eax exception.module: a6173ef48257f495537df09ef37c41e9.exe exception.exception_code: 0xc0000094 exception.offset: 387395 exception.address: 0x45e943	success
1619821949.455849 __exception__	stacktrace: CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73 GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7400e97b GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7400ea8f RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7400b25a RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7400b4c7 RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7400ac75 RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7400aed6 CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x74005511 _CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7400559e CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74167f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74164de3 a6173ef48257f495537df09ef37c41e9+0x58a4d @ 0x458a4d a6173ef48257f495537df09ef37c41e9+0x51254 @ 0x451254 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634372 registers.edi: 2 registers.eax: 1 registers.ebp: 1634412 registers.edx: 228 registers.ebx: 983045 registers.esi: 1634532 registers.ecx: 228 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0xfe8b14ad	success
1619821948.888969 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 48365376 registers.edi: 0 registers.eax: 0 registers.ebp: 48365448 registers.edx: 52 registers.ebx: 0 registers.esi: 0 registers.ecx: 896 exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5a e9 1c 4e fa exception.symbol: a6173ef48257f495537df09ef37c41e9+0x5e943 exception.instruction: div eax exception.module: a6173ef48257f495537df09ef37c41e9.exe exception.exception_code: 0xc0000094 exception.offset: 387395 exception.address: 0x45e943	success

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 297 个事件)

Time & API	Arguments	Status
1619781476.07825 NtAllocateVirtualMemory	process_identifier: 2616 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01dc0000	success
1619781476.42225 NtAllocateVirtualMemory	process_identifier: 2616 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01e50000	success
1619781476.48525 NtAllocateVirtualMemory	process_identifier: 2616 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x02e30000	success
1619821830.072499 NtProtectVirtualMemory	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1619821830.197499 NtAllocateVirtualMemory	process_identifier: 2824 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01d50000	success
1619821830.197499 NtAllocateVirtualMemory	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f20000	success
1619821830.197499 NtAllocateVirtualMemory	process_identifier: 2824 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01d50000	success
1619821830.197499 NtProtectVirtualMemory	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 299008 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01d52000	success
1619821830.728499 NtAllocateVirtualMemory	process_identifier: 2824 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01f60000	success
1619821830.728499 NtAllocateVirtualMemory	process_identifier: 2824 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02060000	success
1619821831.228499 NtProtectVirtualMemory	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01d22000	success
1619821831.228499 NtProtectVirtualMemory	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619821831.228499 NtProtectVirtualMemory	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01d22000	success
1619821831.228499 NtProtectVirtualMemory	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619821831.228499 NtProtectVirtualMemory	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01d22000	success
1619821831.228499 NtProtectVirtualMemory	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619821831.228499 NtProtectVirtualMemory	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01d22000	success
1619821831.228499 NtProtectVirtualMemory	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619821831.228499 NtProtectVirtualMemory	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01d22000	success
1619821831.228499 NtProtectVirtualMemory	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1619821831.228499 NtProtectVirtualMemory	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01d22000	success
1619821831.228499 NtProtectVirtualMemory	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619821831.228499 NtProtectVirtualMemory	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01d22000	success
1619821831.228499 NtProtectVirtualMemory	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619821831.228499 NtProtectVirtualMemory	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01d22000	success
1619821831.228499 NtProtectVirtualMemory	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619821831.228499 NtProtectVirtualMemory	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01d22000	success
1619821831.228499 NtProtectVirtualMemory	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619821831.228499 NtProtectVirtualMemory	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01d22000	success
1619821831.228499 NtProtectVirtualMemory	process_identifier: 2824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619821830.009124 NtAllocateVirtualMemory	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e0000	success
1619821830.103124 NtAllocateVirtualMemory	process_identifier: 2200 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01f30000	success
1619821830.103124 NtAllocateVirtualMemory	process_identifier: 2200 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01f80000	success
1619821833.556751 NtAllocateVirtualMemory	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00360000	success
1619821833.556751 NtAllocateVirtualMemory	process_identifier: 3048 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00630000	success
1619821833.572751 NtAllocateVirtualMemory	process_identifier: 3048 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01f80000	success
1619821834.056249 NtProtectVirtualMemory	process_identifier: 1324 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1619821834.056249 NtAllocateVirtualMemory	process_identifier: 1324 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02160000	success
1619821834.056249 NtAllocateVirtualMemory	process_identifier: 1324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02320000	success
1619821834.056249 NtAllocateVirtualMemory	process_identifier: 1324 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00500000	success
1619821834.056249 NtProtectVirtualMemory	process_identifier: 1324 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 299008 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00502000	success
1619821834.072249 NtAllocateVirtualMemory	process_identifier: 1324 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00780000	success
1619821834.072249 NtAllocateVirtualMemory	process_identifier: 1324 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x007e0000	success
1619821834.103249 NtProtectVirtualMemory	process_identifier: 1324 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x02152000	success
1619821834.103249 NtProtectVirtualMemory	process_identifier: 1324 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76351000	success
1619821834.103249 NtProtectVirtualMemory	process_identifier: 1324 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x02152000	success
1619821834.103249 NtProtectVirtualMemory	process_identifier: 1324 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76353000	success
1619821834.103249 NtProtectVirtualMemory	process_identifier: 1324 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x02152000	success
1619821834.103249 NtProtectVirtualMemory	process_identifier: 1324 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76354000	success
1619821834.103249 NtProtectVirtualMemory	process_identifier: 1324 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x02152000	success

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (11 个事件)

Time & API	Arguments	Status	Return
1619821833.353124 Process32NextW	process_name: schtasks.exe snapshot_handle: 0x00000158 process_identifier: 616	success	1
1619821837.088249 Process32NextW	process_name: a6173ef48257f495537df09ef37c41e9.exe snapshot_handle: 0x000000e8 process_identifier: 3236	success	1
1619821838.619751 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000e8 process_identifier: 3604	success	1
1619821839.806751 Process32NextW	process_name: a6173ef48257f495537df09ef37c41e9.exe snapshot_handle: 0x000000e8 process_identifier: 3656	success	1
1619821840.713626 Process32NextW	process_name: a6173ef48257f495537df09ef37c41e9.exe snapshot_handle: 0x000000e8 process_identifier: 3728	success	1
1619821850.713874 Process32NextW	process_name: a6173ef48257f495537df09ef37c41e9.exe snapshot_handle: 0x000000e8 process_identifier: 3896	success	1
1619821900.564699 Process32NextW	process_name: a6173ef48257f495537df09ef37c41e9.exe snapshot_handle: 0x000000e8 process_identifier: 3636	success	1
1619821919.230375 Process32NextW	process_name: a6173ef48257f495537df09ef37c41e9.exe snapshot_handle: 0x000000e8 process_identifier: 3892	success	1
1619821927.100607 Process32NextW	process_name: a6173ef48257f495537df09ef37c41e9.exe snapshot_handle: 0x000000e8 process_identifier: 3204	success	1
1619821927.100607 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000e8 process_identifier: 3336	success	1
1619821948.904969 Process32NextW	process_name: a6173ef48257f495537df09ef37c41e9.exe snapshot_handle: 0x000000e8 process_identifier: 1928	success	1

The binary likely contains encrypted or compressed data indicative of a packer (3 个事件)

entropy

7.556870183078941

section

{'size_of_data': '0x0000d000', 'virtual_address': '0x0005f000', 'entropy': 7.556870183078941, 'name': 'DATA', 'virtual_size': '0x0000cfec'}

description

A section with a high entropy has been found

entropy

7.454979957033295

section

{'size_of_data': '0x00042400', 'virtual_address': '0x00078000', 'entropy': 7.454979957033295, 'name': '.rsrc', 'virtual_size': '0x000422d4'}

description

A section with a high entropy has been found

entropy

0.43543956043956045

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 个事件)

process

a6173ef48257f495537df09ef37c41e9.exe

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (17 个事件)

Time & API	Arguments	Status
1619781476.50025 Process32NextW	process_name: a6173ef48257f495537df09ef37c41e9.exe snapshot_handle: 0x000000e8 process_identifier: 2616	failed
1619821833.353124 Process32NextW	process_name: conhost.exe snapshot_handle: 0x00000158 process_identifier: 1760	failed
1619821833.572751 Process32NextW	process_name: a6173ef48257f495537df09ef37c41e9.exe snapshot_handle: 0x000000e8 process_identifier: 3048	failed
1619821835.166874 Process32NextW	process_name: a6173ef48257f495537df09ef37c41e9.exe snapshot_handle: 0x00000110 process_identifier: 1804	failed
1619821835.384751 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000e8 process_identifier: 3220	failed
1619821837.556249 Process32NextW	process_name: a6173ef48257f495537df09ef37c41e9.exe snapshot_handle: 0x000000fc process_identifier: 3296	failed
1619821837.821999 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000e8 process_identifier: 3460	failed
1619821839.603751 Process32NextW	process_name: a6173ef48257f495537df09ef37c41e9.exe snapshot_handle: 0x00000108 process_identifier: 3536	failed
1619821839.806751 Process32NextW	process_name: a6173ef48257f495537df09ef37c41e9.exe snapshot_handle: 0x000000e8 process_identifier: 3656	failed
1619821842.650626 Process32NextW	process_name: a6173ef48257f495537df09ef37c41e9.exe snapshot_handle: 0x0000012c process_identifier: 3788	failed
1619821850.713874 Process32NextW	process_name: a6173ef48257f495537df09ef37c41e9.exe snapshot_handle: 0x000000e8 process_identifier: 3896	failed
1619821888.400124 Process32NextW	process_name: mscorsvw.exe snapshot_handle: 0x00000508 process_identifier: 3424	failed
1619821895.376521 Process32NextW	process_name: a6173ef48257f495537df09ef37c41e9.exe snapshot_handle: 0x000000e8 process_identifier: 3420	failed
1619821915.720699 Process32NextW	process_name: a6173ef48257f495537df09ef37c41e9.exe snapshot_handle: 0x00000304 process_identifier: 3636	failed
1619821919.230375 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000e8 process_identifier: 2636	failed
1619821939.413607 Process32NextW	process_name: a6173ef48257f495537df09ef37c41e9.exe snapshot_handle: 0x000002a8 process_identifier: 3204	failed
1619821938.524259 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x000000e8 process_identifier: 2012	failed

Communicates with host for which no DNS query was performed (5 个事件)

host	113.108.239.196
host	172.217.24.14
host	203.208.40.98
host	203.208.41.65
host	203.208.41.98

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (18 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2616 called NtSetContextThread to modify thread in remote process 2824
Process injection	Process 3048 called NtSetContextThread to modify thread in remote process 1324
Process injection	Process 3164 called NtSetContextThread to modify thread in remote process 3236
Process injection	Process 3404 called NtSetContextThread to modify thread in remote process 3476
Process injection	Process 3656 called NtSetContextThread to modify thread in remote process 3728
Process injection	Process 3896 called NtSetContextThread to modify thread in remote process 4092
Process injection	Process 3420 called NtSetContextThread to modify thread in remote process 3556
Process injection	Process 3892 called NtSetContextThread to modify thread in remote process 3732
Process injection	Process 920 called NtSetContextThread to modify thread in remote process 2648
1619781476.64125 NtSetContextThread	thread_handle: 0x000000ec registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4894192 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2824	success	0	0
1619821833.697751 NtSetContextThread	thread_handle: 0x000000ec registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4894192 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1324	success	0	0
1619821835.556751 NtSetContextThread	thread_handle: 0x000000ec registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4894192 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3236	success	0	0
1619821838.040999 NtSetContextThread	thread_handle: 0x000000ec registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4894192 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3476	success	0	0
1619821840.103751 NtSetContextThread	thread_handle: 0x000000ec registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4894192 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3728	success	0	0
1619821851.150874 NtSetContextThread	thread_handle: 0x000000ec registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4894192 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 4092	success	0	0
1619821896.157521 NtSetContextThread	thread_handle: 0x000000ec registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4894192 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3556	success	0	0
1619821921.824375 NtSetContextThread	thread_handle: 0x000000ec registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4894192 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3732	success	0	0
1619821942.228259 NtSetContextThread	thread_handle: 0x000000ec registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4894192 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2648	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (18 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2616 resumed a thread in remote process 2824
Process injection	Process 3048 resumed a thread in remote process 1324
Process injection	Process 3164 resumed a thread in remote process 3236
Process injection	Process 3404 resumed a thread in remote process 3476
Process injection	Process 3656 resumed a thread in remote process 3728
Process injection	Process 3896 resumed a thread in remote process 4092
Process injection	Process 3420 resumed a thread in remote process 3556
Process injection	Process 3892 resumed a thread in remote process 3732
Process injection	Process 920 resumed a thread in remote process 2648
1619781476.84425 NtResumeThread	thread_handle: 0x000000ec suspend_count: 1 process_identifier: 2824	success	0	0
1619821833.916751 NtResumeThread	thread_handle: 0x000000ec suspend_count: 1 process_identifier: 1324	success	0	0
1619821836.338751 NtResumeThread	thread_handle: 0x000000ec suspend_count: 1 process_identifier: 3236	success	0	0
1619821838.305999 NtResumeThread	thread_handle: 0x000000ec suspend_count: 1 process_identifier: 3476	success	0	0
1619821840.509751 NtResumeThread	thread_handle: 0x000000ec suspend_count: 1 process_identifier: 3728	success	0	0
1619821852.369874 NtResumeThread	thread_handle: 0x000000ec suspend_count: 1 process_identifier: 4092	success	0	0
1619821899.282521 NtResumeThread	thread_handle: 0x000000ec suspend_count: 1 process_identifier: 3556	success	0	0
1619821926.918375 NtResumeThread	thread_handle: 0x000000ec suspend_count: 1 process_identifier: 3732	success	0	0
1619821943.181259 NtResumeThread	thread_handle: 0x000000ec suspend_count: 1 process_identifier: 2648	success	0	0

Executed a process and injected code into it, probably while unpacking (50 out of 71 个事件)

Time & API	Arguments	Status	Return
1619781476.62525 CreateProcessInternalW	thread_identifier: 1316 thread_handle: 0x000000ec process_identifier: 2824 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6173ef48257f495537df09ef37c41e9.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000000f0 inherit_handles: 0	success	1
1619781476.62525 NtUnmapViewOfSection	process_identifier: 2824 region_size: 4096 process_handle: 0x000000f0 base_address: 0x00400000	success	0
1619781476.62525 NtMapViewOfSection	section_handle: 0x000000f8 process_identifier: 2824 commit_size: 704512 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x000000f0 allocation_type: 0 () section_offset: 0 view_size: 704512 base_address: 0x00400000	success	0
1619781476.64125 NtGetContextThread	thread_handle: 0x000000ec	success	0
1619781476.64125 NtSetContextThread	thread_handle: 0x000000ec registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4894192 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2824	success	0
1619781476.84425 NtResumeThread	thread_handle: 0x000000ec suspend_count: 1 process_identifier: 2824	success	0
1619781476.87525 CreateProcessInternalW	thread_identifier: 420 thread_handle: 0x000000f4 process_identifier: 2200 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6173ef48257f495537df09ef37c41e9.exe" 2 2824 19298234 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000104 inherit_handles: 0	success	1
1619821833.369124 CreateProcessInternalW	thread_identifier: 2288 thread_handle: 0x0000015c process_identifier: 3048 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6173ef48257f495537df09ef37c41e9.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6173ef48257f495537df09ef37c41e9.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000160 inherit_handles: 0	success	1
1619821833.681751 CreateProcessInternalW	thread_identifier: 1868 thread_handle: 0x000000ec process_identifier: 1324 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6173ef48257f495537df09ef37c41e9.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000000f0 inherit_handles: 0	success	1
1619821833.681751 NtUnmapViewOfSection	process_identifier: 1324 region_size: 4096 process_handle: 0x000000f0 base_address: 0x00400000	success	0
1619821833.681751 NtMapViewOfSection	section_handle: 0x000000f8 process_identifier: 1324 commit_size: 704512 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x000000f0 allocation_type: 0 () section_offset: 0 view_size: 704512 base_address: 0x00400000	success	0
1619821833.697751 NtGetContextThread	thread_handle: 0x000000ec	success	0
1619821833.697751 NtSetContextThread	thread_handle: 0x000000ec registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4894192 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1324	success	0
1619821833.916751 NtResumeThread	thread_handle: 0x000000ec suspend_count: 1 process_identifier: 1324	success	0
1619821833.947751 CreateProcessInternalW	thread_identifier: 1916 thread_handle: 0x000000f4 process_identifier: 1804 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6173ef48257f495537df09ef37c41e9.exe" 2 1324 19302328 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000104 inherit_handles: 0	success	1
1619821835.244874 CreateProcessInternalW	thread_identifier: 3168 thread_handle: 0x00000114 process_identifier: 3164 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6173ef48257f495537df09ef37c41e9.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6173ef48257f495537df09ef37c41e9.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000118 inherit_handles: 0	success	1
1619821835.494751 CreateProcessInternalW	thread_identifier: 3240 thread_handle: 0x000000ec process_identifier: 3236 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6173ef48257f495537df09ef37c41e9.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000000f0 inherit_handles: 0	success	1
1619821835.494751 NtUnmapViewOfSection	process_identifier: 3236 region_size: 4096 process_handle: 0x000000f0 base_address: 0x00400000	success	0
1619821835.494751 NtMapViewOfSection	section_handle: 0x000000f8 process_identifier: 3236 commit_size: 704512 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x000000f0 allocation_type: 0 () section_offset: 0 view_size: 704512 base_address: 0x00400000	success	0
1619821835.556751 NtGetContextThread	thread_handle: 0x000000ec	success	0
1619821835.556751 NtSetContextThread	thread_handle: 0x000000ec registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4894192 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3236	success	0
1619821836.338751 NtResumeThread	thread_handle: 0x000000ec suspend_count: 1 process_identifier: 3236	success	0
1619821836.791751 CreateProcessInternalW	thread_identifier: 3300 thread_handle: 0x000000f4 process_identifier: 3296 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6173ef48257f495537df09ef37c41e9.exe" 2 3236 19304750 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000104 inherit_handles: 0	success	1
1619821837.650249 CreateProcessInternalW	thread_identifier: 3408 thread_handle: 0x00000100 process_identifier: 3404 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6173ef48257f495537df09ef37c41e9.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6173ef48257f495537df09ef37c41e9.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000104 inherit_handles: 0	success	1
1619821837.946999 CreateProcessInternalW	thread_identifier: 3480 thread_handle: 0x000000ec process_identifier: 3476 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6173ef48257f495537df09ef37c41e9.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000000f0 inherit_handles: 0	success	1
1619821837.946999 NtUnmapViewOfSection	process_identifier: 3476 region_size: 4096 process_handle: 0x000000f0 base_address: 0x00400000	success	0
1619821837.946999 NtMapViewOfSection	section_handle: 0x000000f8 process_identifier: 3476 commit_size: 704512 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x000000f0 allocation_type: 0 () section_offset: 0 view_size: 704512 base_address: 0x00400000	success	0
1619821838.040999 NtGetContextThread	thread_handle: 0x000000ec	success	0
1619821838.040999 NtSetContextThread	thread_handle: 0x000000ec registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4894192 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3476	success	0
1619821838.305999 NtResumeThread	thread_handle: 0x000000ec suspend_count: 1 process_identifier: 3476	success	0
1619821838.368999 CreateProcessInternalW	thread_identifier: 3540 thread_handle: 0x000000f4 process_identifier: 3536 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6173ef48257f495537df09ef37c41e9.exe" 2 3476 19306718 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000104 inherit_handles: 0	success	1
1619821839.619751 CreateProcessInternalW	thread_identifier: 3660 thread_handle: 0x0000010c process_identifier: 3656 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6173ef48257f495537df09ef37c41e9.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6173ef48257f495537df09ef37c41e9.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000110 inherit_handles: 0	success	1
1619821839.931751 CreateProcessInternalW	thread_identifier: 3732 thread_handle: 0x000000ec process_identifier: 3728 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6173ef48257f495537df09ef37c41e9.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000000f0 inherit_handles: 0	success	1
1619821839.931751 NtUnmapViewOfSection	process_identifier: 3728 region_size: 4096 process_handle: 0x000000f0 base_address: 0x00400000	success	0
1619821839.931751 NtMapViewOfSection	section_handle: 0x000000f8 process_identifier: 3728 commit_size: 704512 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x000000f0 allocation_type: 0 () section_offset: 0 view_size: 704512 base_address: 0x00400000	success	0
1619821840.103751 NtGetContextThread	thread_handle: 0x000000ec	success	0
1619821840.103751 NtSetContextThread	thread_handle: 0x000000ec registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4894192 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 3728	success	0
1619821840.509751 NtResumeThread	thread_handle: 0x000000ec suspend_count: 1 process_identifier: 3728	success	0
1619821840.525751 CreateProcessInternalW	thread_identifier: 3792 thread_handle: 0x000000f4 process_identifier: 3788 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6173ef48257f495537df09ef37c41e9.exe" 2 3728 19308921 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000104 inherit_handles: 0	success	1
1619821850.541626 CreateProcessInternalW	thread_identifier: 3900 thread_handle: 0x00000130 process_identifier: 3896 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6173ef48257f495537df09ef37c41e9.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6173ef48257f495537df09ef37c41e9.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000134 inherit_handles: 0	success	1
1619821850.884874 CreateProcessInternalW	thread_identifier: 3076 thread_handle: 0x000000ec process_identifier: 4092 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6173ef48257f495537df09ef37c41e9.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000000f0 inherit_handles: 0	success	1
1619821850.884874 NtUnmapViewOfSection	process_identifier: 4092 region_size: 4096 process_handle: 0x000000f0 base_address: 0x00400000	success	0
1619821850.884874 NtMapViewOfSection	section_handle: 0x000000f8 process_identifier: 4092 commit_size: 704512 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x000000f0 allocation_type: 0 () section_offset: 0 view_size: 704512 base_address: 0x00400000	success	0
1619821851.150874 NtGetContextThread	thread_handle: 0x000000ec	success	0
1619821851.150874 NtSetContextThread	thread_handle: 0x000000ec registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4894192 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 4092	success	0
1619821852.369874 NtResumeThread	thread_handle: 0x000000ec suspend_count: 1 process_identifier: 4092	success	0
1619821852.478874 CreateProcessInternalW	thread_identifier: 3196 thread_handle: 0x000000f4 process_identifier: 3176 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6173ef48257f495537df09ef37c41e9.exe" 2 4092 19320781 filepath_r: stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000104 inherit_handles: 0	success	1
1619821889.353124 CreateProcessInternalW	thread_identifier: 3432 thread_handle: 0x0000050c process_identifier: 3420 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6173ef48257f495537df09ef37c41e9.exe track: 1 command_line: filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6173ef48257f495537df09ef37c41e9.exe stack_pivoted: 0 creation_flags: 32 (NORMAL_PRIORITY_CLASS) process_handle: 0x00000510 inherit_handles: 0	success	1
1619821895.470521 CreateProcessInternalW	thread_identifier: 3552 thread_handle: 0x000000ec process_identifier: 3556 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a6173ef48257f495537df09ef37c41e9.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000000f0 inherit_handles: 0	success	1
1619821895.470521 NtUnmapViewOfSection	process_identifier: 3556 region_size: 4096 process_handle: 0x000000f0 base_address: 0x00400000	success	0

File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)

Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Stealer.27908
MicroWorld-eScan	Trojan.GenericKD.42986301
FireEye	Generic.mg.a6173ef48257f495
CAT-QuickHeal	Trojan.Kryptik
Qihoo-360	Generic/HEUR/QVM05.1.8D0F.Malware.Gen
McAfee	Fareit-FSK!A6173EF48257
Cylance	Unsafe
AegisLab	Trojan.Win32.Kryptik.4!c
Sangfor	Malware
K7AntiVirus	Trojan ( 0056a6721 )
Alibaba	Trojan:Win32/FormBook.d8b821b2
K7GW	Trojan ( 0056a6721 )
Cybereason	malicious.48257f
Arcabit	Trojan.Generic.D28FEB3D
BitDefenderTheta	Gen:NN.ZelphiF.34780.TG0@a0IF3gki
Cyren	W32/Fareit.JO.gen!Eldorado
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of Win32/Injector.ELLX
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Dropper.Remcos-7666473-0
Kaspersky	HEUR:Trojan.Win32.Kryptik.gen
BitDefender	Trojan.GenericKD.42986301
NANO-Antivirus	Trojan.Win32.TrjGen.hiqxaf
Avast	Win32:PWSX-gen [Trj]
Tencent	Win32.Trojan.Kryptik.Lkdj
Ad-Aware	Trojan.GenericKD.42986301
Emsisoft	Trojan.GenericKD.42986301 (B)
Comodo	Malware@#2kh9eaq1m531p
F-Secure	Heuristic.HEUR/AGEN.1136310
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R06EC0DI220
McAfee-GW-Edition	BehavesLike.Win32.Fareit.bc
Sophos	Mal/Generic-S + Mal/Fareit-AA
Ikarus	Trojan.Inject
Jiangmin	Trojan.Kryptik.anv
Avira	HEUR/AGEN.1136310
MAX	malware (ai score=84)
Antiy-AVL	Trojan/Win32.Kryptik
Microsoft	PWS:Win32/Fareit.AR!MTB
ZoneAlarm	HEUR:Trojan.Win32.Kryptik.gen
GData	Trojan.GenericKD.42986301
Cynet	Malicious (score: 100)
AhnLab-V3	Suspicious/Win.Delphiless.X2059
VBA32	TScope.Trojan.Delf
ALYac	Spyware.AgentTesla
TACHYON	Trojan/W32.DP-Agent.746496.K
Malwarebytes	Trojan.MalPack.DLF
TrendMicro-HouseCall	TROJ_GEN.R06EC0DI220

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (6 个事件)

dead_host	192.168.56.101:49181
dead_host	172.217.160.110:443
dead_host	172.217.27.142:443
dead_host	203.208.40.98:443
dead_host	172.217.24.14:443
dead_host	192.168.56.101:49190

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x46d118 DeleteCriticalSection

• 0x46d11c LeaveCriticalSection

• 0x46d120 EnterCriticalSection

• 0x46d124 InitializeCriticalSection

• 0x46d128 VirtualFree

• 0x46d12c VirtualAlloc

• 0x46d130 LocalFree

• 0x46d134 LocalAlloc

• 0x46d138 GetVersion

• 0x46d13c GetCurrentThreadId

• 0x46d140 InterlockedDecrement

• 0x46d144 InterlockedIncrement

• 0x46d148 VirtualQuery

• 0x46d14c WideCharToMultiByte

• 0x46d150 MultiByteToWideChar

• 0x46d154 lstrlenA

• 0x46d158 lstrcpynA

• 0x46d15c LoadLibraryExA

• 0x46d160 GetThreadLocale

• 0x46d164 GetStartupInfoA

• 0x46d168 GetProcAddress

• 0x46d16c GetModuleHandleA

• 0x46d170 GetModuleFileNameA

• 0x46d174 GetLocaleInfoA

• 0x46d178 GetCommandLineA

• 0x46d17c FreeLibrary

• 0x46d180 FindFirstFileA

• 0x46d184 FindClose

• 0x46d188 ExitProcess

• 0x46d18c WriteFile

• 0x46d190 UnhandledExceptionFilter

• 0x46d194 RtlUnwind

• 0x46d198 RaiseException

• 0x46d19c GetStdHandle

Library user32.dll:

• 0x46d1a4 GetKeyboardType

• 0x46d1a8 LoadStringA

• 0x46d1ac MessageBoxA

• 0x46d1b0 CharNextA

Library advapi32.dll:

• 0x46d1b8 RegQueryValueExA

• 0x46d1bc RegOpenKeyExA

• 0x46d1c0 RegCloseKey

Library oleaut32.dll:

• 0x46d1c8 SysFreeString

• 0x46d1cc SysReAllocStringLen

• 0x46d1d0 SysAllocStringLen

Library kernel32.dll:

• 0x46d1d8 TlsSetValue

• 0x46d1dc TlsGetValue

• 0x46d1e0 LocalAlloc

• 0x46d1e4 GetModuleHandleA

Library advapi32.dll:

• 0x46d1ec RegQueryValueExA

• 0x46d1f0 RegOpenKeyExA

• 0x46d1f4 RegCloseKey

Library kernel32.dll:

• 0x46d1fc lstrcpyA

• 0x46d200 WriteFile

• 0x46d204 WaitForSingleObject

• 0x46d208 VirtualQuery

• 0x46d20c VirtualAlloc

• 0x46d210 Sleep

• 0x46d214 SizeofResource

• 0x46d218 SetThreadLocale

• 0x46d21c SetFilePointer

• 0x46d220 SetEvent

• 0x46d224 SetErrorMode

• 0x46d228 SetEndOfFile

• 0x46d22c ResetEvent

• 0x46d230 ReadFile

• 0x46d234 MulDiv

• 0x46d238 LockResource

• 0x46d23c LoadResource

• 0x46d240 LoadLibraryA

• 0x46d244 LeaveCriticalSection

• 0x46d248 InitializeCriticalSection

• 0x46d24c GlobalUnlock

• 0x46d250 GlobalReAlloc

• 0x46d254 GlobalHandle

• 0x46d258 GlobalLock

• 0x46d25c GlobalFree

• 0x46d260 GlobalFindAtomA

• 0x46d264 GlobalDeleteAtom

• 0x46d268 GlobalAlloc

• 0x46d26c GlobalAddAtomA

• 0x46d270 GetVersionExA

• 0x46d274 GetVersion

• 0x46d278 GetTickCount

• 0x46d27c GetThreadLocale

• 0x46d280 GetSystemTimeAsFileTime

• 0x46d284 GetSystemTime

• 0x46d288 GetSystemInfo

• 0x46d28c GetStringTypeExA

• 0x46d290 GetStdHandle

• 0x46d294 GetProcAddress

• 0x46d298 GetPriorityClass

• 0x46d29c GetModuleHandleA

• 0x46d2a0 GetModuleFileNameA

• 0x46d2a4 GetLocaleInfoA

• 0x46d2a8 GetLocalTime

• 0x46d2ac GetLastError

• 0x46d2b0 GetFullPathNameA

• 0x46d2b4 GetDiskFreeSpaceA

• 0x46d2b8 GetDateFormatA

• 0x46d2bc GetCurrentThreadId

• 0x46d2c0 GetCurrentProcessId

• 0x46d2c4 GetCPInfo

• 0x46d2c8 GetACP

• 0x46d2cc FreeResource

• 0x46d2d0 InterlockedExchange

• 0x46d2d4 FreeLibrary

• 0x46d2d8 FormatMessageA

• 0x46d2dc FindResourceA

• 0x46d2e0 FileTimeToSystemTime

• 0x46d2e4 ExitThread

• 0x46d2e8 EnumCalendarInfoA

• 0x46d2ec EnterCriticalSection

• 0x46d2f0 DeleteCriticalSection

• 0x46d2f4 CreateThread

• 0x46d2f8 CreateFileA

• 0x46d2fc CreateEventA

• 0x46d300 CompareStringA

• 0x46d304 CloseHandle

Library version.dll:

• 0x46d30c VerQueryValueA

• 0x46d310 GetFileVersionInfoSizeA

• 0x46d314 GetFileVersionInfoA

Library gdi32.dll:

• 0x46d31c UnrealizeObject

• 0x46d320 StretchBlt

• 0x46d324 SetWindowOrgEx

• 0x46d328 SetViewportOrgEx

• 0x46d32c SetTextColor

• 0x46d330 SetStretchBltMode

• 0x46d334 SetROP2

• 0x46d338 SetPixel

• 0x46d33c SetDIBColorTable

• 0x46d340 SetBrushOrgEx

• 0x46d344 SetBkMode

• 0x46d348 SetBkColor

• 0x46d34c SelectPalette

• 0x46d350 SelectObject

• 0x46d354 SaveDC

• 0x46d358 RestoreDC

• 0x46d35c RectVisible

• 0x46d360 RealizePalette

• 0x46d364 PatBlt

• 0x46d368 MoveToEx

• 0x46d36c MaskBlt

• 0x46d370 LineTo

• 0x46d374 IntersectClipRect

• 0x46d378 GetWindowOrgEx

• 0x46d37c GetTextMetricsA

• 0x46d380 GetTextExtentPoint32A

• 0x46d384 GetSystemPaletteEntries

• 0x46d388 GetStockObject

• 0x46d38c GetPixel

• 0x46d390 GetPaletteEntries

• 0x46d394 GetObjectA

• 0x46d398 GetDeviceCaps

• 0x46d39c GetDIBits

• 0x46d3a0 GetDIBColorTable

• 0x46d3a4 GetDCOrgEx

• 0x46d3a8 GetCurrentPositionEx

• 0x46d3ac GetClipBox

• 0x46d3b0 GetBrushOrgEx

• 0x46d3b4 GetBitmapBits

• 0x46d3b8 ExcludeClipRect

• 0x46d3bc DeleteObject

• 0x46d3c0 DeleteDC

• 0x46d3c4 CreateSolidBrush

• 0x46d3c8 CreatePenIndirect

• 0x46d3cc CreatePalette

• 0x46d3d0 CreateHalftonePalette

• 0x46d3d4 CreateFontIndirectA

• 0x46d3d8 CreateDIBitmap

• 0x46d3dc CreateDIBSection

• 0x46d3e0 CreateCompatibleDC

• 0x46d3e4 CreateCompatibleBitmap

• 0x46d3e8 CreateBrushIndirect

• 0x46d3ec CreateBitmap

• 0x46d3f0 BitBlt

Library user32.dll:

• 0x46d3f8 CreateWindowExA

• 0x46d3fc WindowFromPoint

• 0x46d400 WinHelpA

• 0x46d404 WaitMessage

• 0x46d408 UpdateWindow

• 0x46d40c UnregisterClassA

• 0x46d410 UnhookWindowsHookEx

• 0x46d414 TranslateMessage

• 0x46d418 TranslateMDISysAccel

• 0x46d41c TrackPopupMenu

• 0x46d420 SystemParametersInfoA

• 0x46d424 ShowWindow

• 0x46d428 ShowScrollBar

• 0x46d42c ShowOwnedPopups

• 0x46d430 ShowCursor

• 0x46d434 SetWindowsHookExA

• 0x46d438 SetWindowTextA

• 0x46d43c SetWindowPos

• 0x46d440 SetWindowPlacement

• 0x46d444 SetWindowLongA

• 0x46d448 SetTimer

• 0x46d44c SetScrollRange

• 0x46d450 SetScrollPos

• 0x46d454 SetScrollInfo

• 0x46d458 SetRect

• 0x46d45c SetPropA

• 0x46d460 SetParent

• 0x46d464 SetMenuItemInfoA

• 0x46d468 SetMenu

• 0x46d46c SetForegroundWindow

• 0x46d470 SetFocus

• 0x46d474 SetCursor

• 0x46d478 SetClassLongA

• 0x46d47c SetCapture

• 0x46d480 SetActiveWindow

• 0x46d484 SendMessageA

• 0x46d488 ScrollWindow

• 0x46d48c ScreenToClient

• 0x46d490 RemovePropA

• 0x46d494 RemoveMenu

• 0x46d498 ReleaseDC

• 0x46d49c ReleaseCapture

• 0x46d4a0 RegisterWindowMessageA

• 0x46d4a4 RegisterClipboardFormatA

• 0x46d4a8 RegisterClassA

• 0x46d4ac RedrawWindow

• 0x46d4b0 PtInRect

• 0x46d4b4 PostQuitMessage

• 0x46d4b8 PostMessageA

• 0x46d4bc PeekMessageA

• 0x46d4c0 OffsetRect

• 0x46d4c4 OemToCharA

• 0x46d4c8 MessageBoxA

• 0x46d4cc MapWindowPoints

• 0x46d4d0 MapVirtualKeyA

• 0x46d4d4 LoadStringA

• 0x46d4d8 LoadKeyboardLayoutA

• 0x46d4dc LoadIconA

• 0x46d4e0 LoadCursorA

• 0x46d4e4 LoadBitmapA

• 0x46d4e8 KillTimer

• 0x46d4ec IsZoomed

• 0x46d4f0 IsWindowVisible

• 0x46d4f4 IsWindowEnabled

• 0x46d4f8 IsWindow

• 0x46d4fc IsRectEmpty

• 0x46d500 IsIconic

• 0x46d504 IsDialogMessageA

• 0x46d508 IsChild

• 0x46d50c InvalidateRect

• 0x46d510 IntersectRect

• 0x46d514 InsertMenuItemA

• 0x46d518 InsertMenuA

• 0x46d51c InflateRect

• 0x46d520 GetWindowThreadProcessId

• 0x46d524 GetWindowTextA

• 0x46d528 GetWindowRect

• 0x46d52c GetWindowPlacement

• 0x46d530 GetWindowLongA

• 0x46d534 GetWindowDC

• 0x46d538 GetTopWindow

• 0x46d53c GetSystemMetrics

• 0x46d540 GetSystemMenu

• 0x46d544 GetSysColorBrush

• 0x46d548 GetSysColor

• 0x46d54c GetSubMenu

• 0x46d550 GetScrollRange

• 0x46d554 GetScrollPos

• 0x46d558 GetScrollInfo

• 0x46d55c GetPropA

• 0x46d560 GetParent

• 0x46d564 GetWindow

• 0x46d568 GetMessagePos

• 0x46d56c GetMenuStringA

• 0x46d570 GetMenuState

• 0x46d574 GetMenuItemInfoA

• 0x46d578 GetMenuItemID

• 0x46d57c GetMenuItemCount

• 0x46d580 GetMenu

• 0x46d584 GetLastActivePopup

• 0x46d588 GetKeyboardState

• 0x46d58c GetKeyboardLayoutList

• 0x46d590 GetKeyboardLayout

• 0x46d594 GetKeyState

• 0x46d598 GetKeyNameTextA

• 0x46d59c GetIconInfo

• 0x46d5a0 GetForegroundWindow

• 0x46d5a4 GetFocus

• 0x46d5a8 GetDesktopWindow

• 0x46d5ac GetDCEx

• 0x46d5b0 GetDC

• 0x46d5b4 GetCursorPos

• 0x46d5b8 GetCursor

• 0x46d5bc GetClientRect

• 0x46d5c0 GetClassNameA

• 0x46d5c4 GetClassInfoA

• 0x46d5c8 GetCapture

• 0x46d5cc GetActiveWindow

• 0x46d5d0 FrameRect

• 0x46d5d4 FindWindowA

• 0x46d5d8 FillRect

• 0x46d5dc EqualRect

• 0x46d5e0 EnumWindows

• 0x46d5e4 EnumThreadWindows

• 0x46d5e8 EndPaint

• 0x46d5ec EnableWindow

• 0x46d5f0 EnableScrollBar

• 0x46d5f4 EnableMenuItem

• 0x46d5f8 DrawTextA

• 0x46d5fc DrawMenuBar

• 0x46d600 DrawIconEx

• 0x46d604 DrawIcon

• 0x46d608 DrawFrameControl

• 0x46d60c DrawEdge

• 0x46d610 DispatchMessageA

• 0x46d614 DestroyWindow

• 0x46d618 DestroyMenu

• 0x46d61c DestroyIcon

• 0x46d620 DestroyCursor

• 0x46d624 DeleteMenu

• 0x46d628 DefWindowProcA

• 0x46d62c DefMDIChildProcA

• 0x46d630 DefFrameProcA

• 0x46d634 CreatePopupMenu

• 0x46d638 CreateMenu

• 0x46d63c CreateIcon

• 0x46d640 ClientToScreen

• 0x46d644 CheckMenuItem

• 0x46d648 CallWindowProcA

• 0x46d64c CallNextHookEx

• 0x46d650 BeginPaint

• 0x46d654 CharNextA

• 0x46d658 CharLowerA

• 0x46d65c CharToOemA

• 0x46d660 AdjustWindowRectEx

• 0x46d664 ActivateKeyboardLayout

Library kernel32.dll:

• 0x46d66c Sleep

Library oleaut32.dll:

• 0x46d674 SafeArrayPtrOfIndex

• 0x46d678 SafeArrayGetUBound

• 0x46d67c SafeArrayGetLBound

• 0x46d680 SafeArrayCreate

• 0x46d684 VariantChangeType

• 0x46d688 VariantCopy

• 0x46d68c VariantClear

• 0x46d690 VariantInit

Library comctl32.dll:

• 0x46d698 ImageList_SetIconSize

• 0x46d69c ImageList_GetIconSize

• 0x46d6a0 ImageList_Write

• 0x46d6a4 ImageList_Read

• 0x46d6a8 ImageList_GetDragImage

• 0x46d6ac ImageList_DragShowNolock

• 0x46d6b0 ImageList_SetDragCursorImage

• 0x46d6b4 ImageList_DragMove

• 0x46d6b8 ImageList_DragLeave

• 0x46d6bc ImageList_DragEnter

• 0x46d6c0 ImageList_EndDrag

• 0x46d6c4 ImageList_BeginDrag

• 0x46d6c8 ImageList_Remove

• 0x46d6cc ImageList_DrawEx

• 0x46d6d0 ImageList_Draw

• 0x46d6d4 ImageList_GetBkColor

• 0x46d6d8 ImageList_SetBkColor

• 0x46d6dc ImageList_ReplaceIcon

• 0x46d6e0 ImageList_Add

• 0x46d6e4 ImageList_GetImageCount

• 0x46d6e8 ImageList_Destroy

• 0x46d6ec ImageList_Create

• 0x46d6f0 InitCommonControls

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com A 172.217.27.142	216.58.200.238
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51379	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.