SmartHawk

12.2

0-day

18 个模型检测该样本为恶意！

重新分析

下载样本

6974cfc49bf6946ff6e6d600a811435a412eab961e257fa07f5fcf36463943c0

b8f16399776ca866ae91fd9a02ce5765.exe

分析耗时

41s

最近分析

文件大小

5.2MB

静态报毒动态报毒 ARTEMIS BROWSEFOX BUNDLEINSTALLER GENERIC PUA NL GENERIC@ML HIGH CONFIDENCE MOKUVSBS6DY1 PUASSON QSADEUILG QVM41 R346996 RDML SOFT32 UNSAFE WEBCOMPANION WEBCOMPANION7806 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Artemis!B8F16399776C	20200906	6.0.6.653
Alibaba		20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast		20200906	18.4.3895.0
Tencent		20200906	1.0.0.1
Kingsoft		20200906	2013.8.14.323
CrowdStrike		20180202	1.0

Queries for the computername (31 个事件)

Time & API	Arguments	Status	Return
1619878581.880626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878582.365626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878582.521626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878582.599626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878582.802626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878582.880626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878582.958626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878583.037626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878583.068626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878583.099626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878583.099626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878583.130626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878583.177626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878583.208626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878583.240626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878583.318626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878583.349626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878583.412626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878584.865626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878586.162626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878587.443626 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878585.926751 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878587.676751 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878592.942751 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878593.036751 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878593.051751 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878593.067751 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878593.192751 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878594.567751 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878595.739751 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619878595.817751 GetComputerNameW	computer_name: OSKAR-PC	success	1

Checks if process is being debugged by a debugger (9 个事件)

Time & API	Arguments	Status	Return	Repeated
1619861118.471762 IsDebuggerPresent		failed	0	0
1619878583.348751 IsDebuggerPresent		failed	0	0
1619878583.348751 IsDebuggerPresent		failed	0	0
1619878594.348751 IsDebuggerPresent		failed	0	0
1619878594.457751 IsDebuggerPresent		failed	0	0
1619878594.551751 IsDebuggerPresent		failed	0	0
1619878594.911751 IsDebuggerPresent		failed	0	0
1619878595.082751 IsDebuggerPresent		failed	0	0
1619878595.254751 IsDebuggerPresent		failed	0	0

Uses Windows APIs to generate a cryptographic key (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619878586.442751 CryptExportKey	crypto_handle: 0x006b4f50 crypto_export_handle: 0x00000000 buffer: <INVALID POINTER> blob_type: 6 flags: 0	success	1	0

This executable is signed

Tries to locate where the browsers are installed (4 个事件)

file	C:\Program Files\Google\Chrome\Application\chrome.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\InstallDate
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619878581.458626 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)

section

.sxdata

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 个事件)

suspicious_features	POST method with no referer header, POST method with no useragent header	suspicious_request	POST http://flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubStart
suspicious_features	POST method with no referer header, POST method with no useragent header	suspicious_request	POST http://flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubBundleStart
suspicious_features	GET method with no useragent header	suspicious_request	GET https://h2oapi.adaware.com/v1/bundleinfo/3f9fbc84d45cb118d823b0c1c58e99eb10811a20

Performs some HTTP requests (3 个事件)

request	POST http://flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubStart
request	POST http://flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubBundleStart
request	GET https://h2oapi.adaware.com/v1/bundleinfo/3f9fbc84d45cb118d823b0c1c58e99eb10811a20

Sends data using the HTTP POST Method (2 个事件)

request	POST http://flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubStart
request	POST http://flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubBundleStart

Allocates read-write-execute memory (usually to unpack itself) (50 out of 272 个事件)

Time & API	Arguments	Status
1619878582.942751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00a30000	success
1619878582.942751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00ba0000	success
1619878583.192751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02300000	success
1619878583.192751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x024c0000	success
1619878583.254751 NtProtectVirtualMemory	process_identifier: 2520 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e71000	success
1619878583.348751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 393216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00430000	success
1619878583.348751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00450000	success
1619878583.348751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003ca000	success
1619878583.348751 NtProtectVirtualMemory	process_identifier: 2520 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e72000	success
1619878583.348751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003c2000	success
1619878583.520751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003d2000	success
1619878583.614751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00405000	success
1619878583.614751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0040b000	success
1619878583.614751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00407000	success
1619878583.848751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003d3000	success
1619878583.926751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003dc000	success
1619878584.129751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003d4000	success
1619878584.176751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02360000	success
1619878584.239751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003d5000	success
1619878584.239751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003d6000	success
1619878584.270751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003d7000	success
1619878584.317751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003d8000	success
1619878584.317751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003d9000	success
1619878584.348751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02400000	success
1619878584.348751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02401000	success
1619878584.348751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02402000	success
1619878584.348751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003dd000	success
1619878584.348751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02403000	success
1619878584.348751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02404000	success
1619878584.348751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02405000	success
1619878584.348751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02406000	success
1619878584.348751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02407000	success
1619878584.348751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02408000	success
1619878584.348751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003de000	success
1619878584.348751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02409000	success
1619878584.348751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0240a000	success
1619878584.348751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0240b000	success
1619878584.348751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0240c000	success
1619878584.364751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0240d000	success
1619878584.364751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0240e000	success
1619878584.364751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003df000	success
1619878584.364751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0240f000	success
1619878584.364751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02410000	success
1619878584.364751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02411000	success
1619878584.364751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02412000	success
1619878584.395751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02413000	success
1619878584.629751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02414000	success
1619878584.692751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02415000	success
1619878584.707751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x024b0000	success
1619878584.707751 NtAllocateVirtualMemory	process_identifier: 2520 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02416000	success

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619878596.724626 GetDiskFreeSpaceExW	root_path: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A free_bytes_available: 19460706304 total_number_of_free_bytes: 19460706304 total_number_of_bytes: 34252779520	success	1	0

Creates executable files on the filesystem (23 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\HtmlAgilityPack.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\it\DevLib.resources.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\es\DevLib.resources.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\installer.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Microsoft.Win32.TaskScheduler.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\OfferServiceBLL.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\ru\DevLib.resources.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\MyDownloader.Core.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\GenericSetup.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\DevLib.Services.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\fr\DevLib.resources.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\DevLib.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\pt\DevLib.resources.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\en\DevLib.resources.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\OfferServiceSDK.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Newtonsoft.Json.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Carrier.EXE
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\de\DevLib.resources.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\MyDownloader.Extension.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\H2OSciter.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\sciter32.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\GenericSetup.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Shared.dll

Drops a binary and executes it (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\GenericSetup.exe

Drops an executable to the user AppData folder (23 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\it\DevLib.resources.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\DevLib.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\MyDownloader.Core.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\HtmlAgilityPack.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\pt\DevLib.resources.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\MyDownloader.Extension.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Shared.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\installer.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\fr\DevLib.resources.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\DevLib.Services.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Microsoft.Win32.TaskScheduler.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\ru\DevLib.resources.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\H2OSciter.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Carrier.EXE
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\de\DevLib.resources.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\GenericSetup.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\es\DevLib.resources.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\OfferServiceBLL.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Newtonsoft.Json.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\GenericSetup.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\sciter32.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\OfferServiceSDK.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\en\DevLib.resources.dll

Executes one or more WMI queries (6 个事件)

wmi	SELECT * FROM Win32_VideoController
wmi	SELECT * FROM Win32_BIOS
wmi	SELECT * FROM Win32_DiskDrive
wmi	SELECT * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled=True
wmi	SELECT * FROM Win32_Processor
wmi	SELECT * FROM Win32_BaseBoard

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619878588.973751 GetAdaptersAddresses	flags: 15 family: 0	failed	111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619878585.645751 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Expresses interest in specific running processes (1 个事件)

process

installer.exe

Queries for potentially installed applications (13 个事件)

Time & API	Arguments	Status
1619878593.004751 RegOpenKeyExW	access: 0x00020019 base_handle: 0x80000002 key_handle: 0x000007a8 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall options: 0	success
1619878593.004751 RegOpenKeyExW	access: 0x00020019 base_handle: 0x000007a8 key_handle: 0x000007d0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook regkey_r: AddressBook options: 0	success
1619878593.004751 RegOpenKeyExW	access: 0x00020019 base_handle: 0x000007a8 key_handle: 0x000007d0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager regkey_r: Connection Manager options: 0	success
1619878593.004751 RegOpenKeyExW	access: 0x00020019 base_handle: 0x000007a8 key_handle: 0x000007d0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx regkey_r: DirectDrawEx options: 0	success
1619878593.004751 RegOpenKeyExW	access: 0x00020019 base_handle: 0x000007a8 key_handle: 0x000007d0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore regkey_r: Fontcore options: 0	success
1619878593.004751 RegOpenKeyExW	access: 0x00020019 base_handle: 0x000007a8 key_handle: 0x000007d0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome regkey_r: Google Chrome options: 0	success
1619878593.020751 RegOpenKeyExW	access: 0x00020019 base_handle: 0x000007a8 key_handle: 0x000007d0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40 regkey_r: IE40 options: 0	success
1619878593.020751 RegOpenKeyExW	access: 0x00020019 base_handle: 0x000007a8 key_handle: 0x000007d0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data regkey_r: IE4Data options: 0	success
1619878593.020751 RegOpenKeyExW	access: 0x00020019 base_handle: 0x000007a8 key_handle: 0x000007d0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX regkey_r: IE5BAKEX options: 0	success
1619878593.020751 RegOpenKeyExW	access: 0x00020019 base_handle: 0x000007a8 key_handle: 0x000007d0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData regkey_r: IEData options: 0	success
1619878593.020751 RegOpenKeyExW	access: 0x00020019 base_handle: 0x000007a8 key_handle: 0x000007d0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack regkey_r: MobileOptionPack options: 0	success
1619878593.020751 RegOpenKeyExW	access: 0x00020019 base_handle: 0x000007a8 key_handle: 0x000007d0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent regkey_r: SchedulingAgent options: 0	success
1619878593.020751 RegOpenKeyExW	access: 0x00020019 base_handle: 0x000007a8 key_handle: 0x000007d0 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC regkey_r: WIC options: 0	success

Executes one or more WMI queries which can be used to identify virtual machines (3 个事件)

wmi	SELECT * FROM Win32_Processor
wmi	SELECT * FROM Win32_BIOS
wmi	SELECT * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled=True

Communicates with host for which no DNS query was performed (2 个事件)

host	114.80.30.35
host	172.217.24.14

Attempts to identify installed AV products by registry key (2 个事件)

registry	HKEY_LOCAL_MACHINE\SOFTWARE\AVAST Software\Browser\Update
registry	HKEY_CURRENT_USER\SOFTWARE\AVAST Software\Browser\Update

Looks for the Windows Idle Time to determine the uptime (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619878593.832751 NtQuerySystemInformation	information_class: 8 (SystemProcessorPerformanceInformation)	success	0	0

File has been identified by 18 AntiVirus engines on VirusTotal as malicious (18 个事件)

Elastic	malicious (high confidence)
FireEye	Generic.mg.b8f16399776ca866
McAfee	Artemis!B8F16399776C
Cylance	Unsafe
Sangfor	Malware
Paloalto	generic.ml
DrWeb	Adware.Downware.19662
VIPRE	Trojan.Win32.Generic!BT
Invincea	Generic PUA NL (PUA)
Sophos	Generic PUA NL (PUA)
Webroot	W32.Adware.Soft32
Microsoft	PUA:Win32/Puasson.A!ml
AhnLab-V3	PUP/Win32.BrowseFox.R346996
ESET-NOD32	a variant of Win32/WebCompanion.B potentially unwanted
Malwarebytes	PUP.Optional.BundleInstaller
Rising	Trojan.Generic@ML.96 (RDML:MokUVSbS6dy1/QSadeuilg)
Fortinet	Riskware/WebCompanion7806
Qihoo-360	Generic/HEUR/QVM41.2.97BF.Malware.Gen

Performs 89 file moves indicative of a ransomware file encryption process (50 out of 89 个事件)

Time & API	Arguments	Status	Return
1619878579.083626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\de\DevLib.resources.dll newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\de\DevLib.resources.dll	success	1
1619878579.177626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\de newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\de	success	1
1619878579.177626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\en\DevLib.resources.dll newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\en\DevLib.resources.dll	success	1
1619878579.240626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\en newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\en	success	1
1619878579.255626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\es\DevLib.resources.dll newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\es\DevLib.resources.dll	success	1
1619878579.287626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\es newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\es	success	1
1619878579.302626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\fr\DevLib.resources.dll newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\fr\DevLib.resources.dll	success	1
1619878579.349626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\fr newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\fr	success	1
1619878579.349626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\it\DevLib.resources.dll newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\it\DevLib.resources.dll	success	1
1619878579.380626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\it newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\it	success	1
1619878579.396626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\pt\DevLib.resources.dll newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\pt\DevLib.resources.dll	success	1
1619878579.412626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\pt newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\pt	success	1
1619878579.412626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\images\loader.gif newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\images\loader.gif	success	1
1619878579.427626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\images\warning48x48.png newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\images\warning48x48.png	success	1
1619878579.443626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\images newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\images	success	1
1619878579.443626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\Config.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\Config.tis	success	1
1619878579.458626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\EventHandler.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\EventHandler.tis	success	1
1619878579.458626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\Log.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\Log.tis	success	1
1619878579.474626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\TranslateOfferTemplate.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\TranslateOfferTemplate.tis	success	1
1619878579.490626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\ViewStateLoader.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\ViewStateLoader.tis	success	1
1619878579.505626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis	success	1
1619878579.521626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\images\loader.gif newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\images\loader.gif	success	1
1619878579.537626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\images\warning48x48.png newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\images\warning48x48.png	success	1
1619878579.568626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\InstallingPage.html newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\InstallingPage.html	success	1
1619878579.615626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\LaunchCarrierPage.html newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\LaunchCarrierPage.html	success	1
1619878579.662626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\OfferPage.html newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\OfferPage.html	success	1
1619878579.693626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\ScanningPage.html newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\ScanningPage.html	success	1
1619878579.740626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\style.css newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\style.css	success	1
1619878579.787626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\Config.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\Config.tis	success	1
1619878579.802626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\EventHandler.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\EventHandler.tis	success	1
1619878579.833626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\Log.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\Log.tis	success	1
1619878579.865626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\TranslateOfferTemplate.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\TranslateOfferTemplate.tis	success	1
1619878579.880626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\ViewStateLoader.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\ViewStateLoader.tis	success	1
1619878579.896626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\WelcomePage.html newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\WelcomePage.html	success	1
1619878579.927626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources	success	1
1619878579.927626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\images\loader.gif newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\images\loader.gif	success	1
1619878579.943626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\images\warning48x48.png newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\images\warning48x48.png	success	1
1619878579.958626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\images newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\images	success	1
1619878579.974626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\Config.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\Config.tis	success	1
1619878579.990626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\EventHandler.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\EventHandler.tis	success	1
1619878580.005626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\Log.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\Log.tis	success	1
1619878580.021626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\TranslateOfferTemplate.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\TranslateOfferTemplate.tis	success	1
1619878580.037626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\ViewStateLoader.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\ViewStateLoader.tis	success	1
1619878580.052626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis	success	1
1619878580.068626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\ru\DevLib.resources.dll newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\ru\DevLib.resources.dll	success	1
1619878580.115626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\ru newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\ru	success	1
1619878580.130626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\2021.05.01_15.36.19.177375_installer_pid=580.txt newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\2021.05.01_15.36.19.177375_installer_pid=580.txt	success	1
1619878580.224626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\app.ico newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\app.ico	success	1
1619878580.255626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\BundleConfig.json newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\BundleConfig.json	success	1
1619878580.287626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Carrier.EXE newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Carrier.EXE	success	1

Appends a new file extension or content to 89 files indicative of a ransomware file encryption process (50 out of 89 个事件)

Time & API	Arguments	Status	Return
1619878579.083626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\de\DevLib.resources.dll newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\de\DevLib.resources.dll	success	1
1619878579.177626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\de newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\de	success	1
1619878579.177626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\en\DevLib.resources.dll newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\en\DevLib.resources.dll	success	1
1619878579.240626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\en newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\en	success	1
1619878579.255626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\es\DevLib.resources.dll newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\es\DevLib.resources.dll	success	1
1619878579.287626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\es newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\es	success	1
1619878579.302626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\fr\DevLib.resources.dll newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\fr\DevLib.resources.dll	success	1
1619878579.349626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\fr newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\fr	success	1
1619878579.349626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\it\DevLib.resources.dll newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\it\DevLib.resources.dll	success	1
1619878579.380626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\it newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\it	success	1
1619878579.396626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\pt\DevLib.resources.dll newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\pt\DevLib.resources.dll	success	1
1619878579.412626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\pt newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\pt	success	1
1619878579.412626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\images\loader.gif newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\images\loader.gif	success	1
1619878579.427626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\images\warning48x48.png newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\images\warning48x48.png	success	1
1619878579.443626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\images newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\images	success	1
1619878579.443626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\Config.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\Config.tis	success	1
1619878579.458626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\EventHandler.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\EventHandler.tis	success	1
1619878579.458626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\Log.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\Log.tis	success	1
1619878579.474626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\TranslateOfferTemplate.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\TranslateOfferTemplate.tis	success	1
1619878579.490626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\ViewStateLoader.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\ViewStateLoader.tis	success	1
1619878579.505626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis	success	1
1619878579.521626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\images\loader.gif newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\images\loader.gif	success	1
1619878579.537626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\images\warning48x48.png newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\images\warning48x48.png	success	1
1619878579.568626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\InstallingPage.html newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\InstallingPage.html	success	1
1619878579.615626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\LaunchCarrierPage.html newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\LaunchCarrierPage.html	success	1
1619878579.662626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\OfferPage.html newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\OfferPage.html	success	1
1619878579.693626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\ScanningPage.html newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\ScanningPage.html	success	1
1619878579.740626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\style.css newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\style.css	success	1
1619878579.787626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\Config.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\Config.tis	success	1
1619878579.802626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\EventHandler.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\EventHandler.tis	success	1
1619878579.833626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\Log.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\Log.tis	success	1
1619878579.865626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\TranslateOfferTemplate.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\TranslateOfferTemplate.tis	success	1
1619878579.880626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\ViewStateLoader.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\ViewStateLoader.tis	success	1
1619878579.896626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\WelcomePage.html newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\WelcomePage.html	success	1
1619878579.927626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources	success	1
1619878579.927626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\images\loader.gif newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\images\loader.gif	success	1
1619878579.943626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\images\warning48x48.png newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\images\warning48x48.png	success	1
1619878579.958626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\images newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\images	success	1
1619878579.974626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\Config.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\Config.tis	success	1
1619878579.990626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\EventHandler.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\EventHandler.tis	success	1
1619878580.005626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\Log.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\Log.tis	success	1
1619878580.021626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\TranslateOfferTemplate.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\TranslateOfferTemplate.tis	success	1
1619878580.037626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis\ViewStateLoader.tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis\ViewStateLoader.tis	success	1
1619878580.052626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Resources\tis newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Resources\tis	success	1
1619878580.068626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\ru\DevLib.resources.dll newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\ru\DevLib.resources.dll	success	1
1619878580.115626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\ru newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\ru	success	1
1619878580.130626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\2021.05.01_15.36.19.177375_installer_pid=580.txt newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\2021.05.01_15.36.19.177375_installer_pid=580.txt	success	1
1619878580.224626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\app.ico newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\app.ico	success	1
1619878580.255626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\BundleConfig.json newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\BundleConfig.json	success	1
1619878580.287626 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zSCC80788A\Carrier.EXE newfilepath: newfilepath_r: flags: 4 oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zSCC80788A\Carrier.EXE	success	1

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 580 resumed a thread in remote process 2520
1619878582.693626 NtResumeThread	thread_handle: 0x000002a4 suspend_count: 1 process_identifier: 2520	success	0	0

Generates some ICMP traffic

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2011-04-19 02:54:06

Imports

Library OLEAUT32.dll:

• 0x41b198 VariantClear

• 0x41b19c SysAllocString

Library USER32.dll:

• 0x41b1ac SendMessageA

• 0x41b1b0 SetTimer

• 0x41b1b4 DialogBoxParamW

• 0x41b1b8 DialogBoxParamA

• 0x41b1bc SetWindowLongA

• 0x41b1c0 GetWindowLongA

• 0x41b1c4 SetWindowTextW

• 0x41b1c8 LoadIconA

• 0x41b1cc LoadStringW

• 0x41b1d0 LoadStringA

• 0x41b1d4 CharUpperW

• 0x41b1d8 CharUpperA

• 0x41b1dc DestroyWindow

• 0x41b1e0 EndDialog

• 0x41b1e4 PostMessageA

• 0x41b1e8 ShowWindow

• 0x41b1ec MessageBoxW

• 0x41b1f0 GetDlgItem

• 0x41b1f4 KillTimer

• 0x41b1f8 SetWindowTextA

Library SHELL32.dll:

• 0x41b1a4 ShellExecuteExA

Library KERNEL32.dll:

• 0x41b000 GetCurrentDirectoryA

• 0x41b004 GetStringTypeW

• 0x41b008 GetStringTypeA

• 0x41b00c LCMapStringW

• 0x41b010 LCMapStringA

• 0x41b014 InterlockedIncrement

• 0x41b018 InterlockedDecrement

• 0x41b01c GetProcAddress

• 0x41b020 GetOEMCP

• 0x41b024 GetACP

• 0x41b028 GetCPInfo

• 0x41b02c IsBadCodePtr

• 0x41b030 IsBadReadPtr

• 0x41b034 GetFileType

• 0x41b038 SetHandleCount

• 0x41b03c GetEnvironmentStringsW

• 0x41b040 GetEnvironmentStrings

• 0x41b044 FreeEnvironmentStringsW

• 0x41b048 FreeEnvironmentStringsA

• 0x41b04c UnhandledExceptionFilter

• 0x41b050 HeapSize

• 0x41b054 GetCurrentProcess

• 0x41b058 TerminateProcess

• 0x41b05c IsBadWritePtr

• 0x41b060 HeapCreate

• 0x41b064 HeapDestroy

• 0x41b068 GetEnvironmentVariableA

• 0x41b06c SetUnhandledExceptionFilter

• 0x41b070 TlsAlloc

• 0x41b074 ExitProcess

• 0x41b078 GetVersion

• 0x41b07c GetCommandLineA

• 0x41b080 GetStartupInfoA

• 0x41b084 GetModuleHandleA

• 0x41b088 WaitForSingleObject

• 0x41b08c CloseHandle

• 0x41b090 CreateProcessA

• 0x41b094 GetCommandLineW

• 0x41b098 GetVersionExA

• 0x41b09c LeaveCriticalSection

• 0x41b0a0 EnterCriticalSection

• 0x41b0a4 DeleteCriticalSection

• 0x41b0a8 MultiByteToWideChar

• 0x41b0ac WideCharToMultiByte

• 0x41b0b0 GetLastError

• 0x41b0b4 LoadLibraryA

• 0x41b0b8 GetModuleFileNameW

• 0x41b0bc GetModuleFileNameA

• 0x41b0c0 LocalFree

• 0x41b0c4 FormatMessageW

• 0x41b0c8 FormatMessageA

• 0x41b0cc SetFileTime

• 0x41b0d0 CreateFileW

• 0x41b0d4 SetLastError

• 0x41b0d8 SetFileAttributesW

• 0x41b0dc SetFileAttributesA

• 0x41b0e0 RemoveDirectoryW

• 0x41b0e4 RemoveDirectoryA

• 0x41b0e8 CreateDirectoryW

• 0x41b0ec CreateDirectoryA

• 0x41b0f0 DeleteFileW

• 0x41b0f4 DeleteFileA

• 0x41b0f8 GetFullPathNameW

• 0x41b0fc GetFullPathNameA

• 0x41b100 SetCurrentDirectoryW

• 0x41b104 SetCurrentDirectoryA

• 0x41b108 GetCurrentDirectoryW

• 0x41b10c GetTempPathW

• 0x41b110 GetTempPathA

• 0x41b114 GetCurrentProcessId

• 0x41b118 GetTickCount

• 0x41b11c GetCurrentThreadId

• 0x41b120 FindClose

• 0x41b124 FindFirstFileW

• 0x41b128 FindFirstFileA

• 0x41b12c FindNextFileW

• 0x41b130 FindNextFileA

• 0x41b134 CreateFileA

• 0x41b138 GetFileSize

• 0x41b13c SetFilePointer

• 0x41b140 ReadFile

• 0x41b144 WriteFile

• 0x41b148 SetEndOfFile

• 0x41b14c GetStdHandle

• 0x41b150 WaitForMultipleObjects

• 0x41b154 Sleep

• 0x41b158 VirtualAlloc

• 0x41b15c VirtualFree

• 0x41b160 CreateEventA

• 0x41b164 SetEvent

• 0x41b168 ResetEvent

• 0x41b16c InitializeCriticalSection

• 0x41b170 RtlUnwind

• 0x41b174 RaiseException

• 0x41b178 HeapAlloc

• 0x41b17c HeapFree

• 0x41b180 HeapReAlloc

• 0x41b184 CreateThread

• 0x41b188 TlsSetValue

• 0x41b18c TlsGetValue

• 0x41b190 ExitThread

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
h2oapi.adaware.com	A 104.16.236.79 A 104.16.235.79	104.16.236.79
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
flow.lavasoft.com	A 104.18.88.101 A 104.18.87.101	104.18.87.101
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49226	104.16.236.79 h2oapi.adaware.com	443
192.168.56.101	49224	104.18.88.101 flow.lavasoft.com	80
192.168.56.101	49225	104.18.88.101 flow.lavasoft.com	80

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51809	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

URI	Data
http://flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubStart	POST /v1/event-stat?ProductID=IS&Type=StubStart HTTP/1.1 Host: flow.lavasoft.com Accept: application/json Content-Type: application/json charsets: utf-8 Content-Length: 266 {"Data":{"BundleId":"SFT002","MachineId":"a2288c9b-45c8-1668-b277-802b13ff8a29","InstallId":"15c20e31-ae2d-498e-81d0-46658ed9fa93","OsVersion":"Microsoft Windows 7 Ultimate Edition Service Pack 1 (build 7601), 64-bit","DotNetFramework":"3.5, 4.0 Client, 4.0 Full"}}
http://flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubBundleStart	POST /v1/event-stat?ProductID=IS&Type=StubBundleStart HTTP/1.1 Host: flow.lavasoft.com Accept: application/json Content-Type: application/json charsets: utf-8 Content-Length: 152 {"Data":{"BundleId":"SFT002","MachineId":"a2288c9b-45c8-1668-b277-802b13ff8a29","InstallId":"15c20e31-ae2d-498e-81d0-46658ed9fa93","InProcess":"true"}}

URI

Data

http://flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubStart

POST /v1/event-stat?ProductID=IS&Type=StubStart HTTP/1.1
Host: flow.lavasoft.com
Accept: application/json
Content-Type: application/json
charsets: utf-8
Content-Length: 266

{"Data":{"BundleId":"SFT002","MachineId":"a2288c9b-45c8-1668-b277-802b13ff8a29","InstallId":"15c20e31-ae2d-498e-81d0-46658ed9fa93","OsVersion":"Microsoft Windows 7 Ultimate Edition Service Pack 1 (build 7601), 64-bit","DotNetFramework":"3.5, 4.0 Client, 4.0 Full"}}

http://flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubBundleStart

POST /v1/event-stat?ProductID=IS&Type=StubBundleStart HTTP/1.1
Host: flow.lavasoft.com
Accept: application/json
Content-Type: application/json
charsets: utf-8
Content-Length: 152

{"Data":{"BundleId":"SFT002","MachineId":"a2288c9b-45c8-1668-b277-802b13ff8a29","InstallId":"15c20e31-ae2d-498e-81d0-46658ed9fa93","InProcess":"true"}}

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.