10.0
0-day
47 个模型检测该样本为恶意！
重新分析
更多

24aa1fe4e7a94cb8142293b8f0c0f610ded2221563535a0cd7ff984e694a0a24

bad3f0d1eef58b9dcc9bd6918090db9e.exe

分析耗时

102s

最近分析

文件大小

1.2MB
静态报毒 动态报毒 100% AI SCORE=83 AIDETECTVM ARTEMIS AUTOINJ AUTOIT BINTOSTR CLASSIC CONFIDENCE DRYCX ELDORADO GENERICKD GRAYWARE HIGH CONFIDENCE HLCWGZ MALWARE1 MALWARE@#354C3E9GGIPWP NANOCORE PREDATOR R06EC0DIA20 S1159 SAGONAIRE SCORE SUSGEN TROJANAITINJECT UNSAFE 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Artemis!BAD3F0D1EEF5 20201211 6.0.6.653
Alibaba Trojan:Win32/Predator.4118ca3e 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20201210 21.1.5827.0
Kingsoft 20201211 2017.9.26.565
Tencent 20201211 1.0.0.1
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
Checks if process is being debugged by a debugger (1 个事件)
Time & API Arguments Status Return Repeated
1619861621.390125
IsDebuggerPresent
failed 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (41 个事件)
Time & API Arguments Status Return Repeated
1619861622.187125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 348160
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02690000
success 0 0
1619861622.406125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 348160
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x026f0000
success 0 0
1619861622.499125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02750000
success 0 0
1619861622.718125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02e40000
success 0 0
1619861622.765125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02e70000
success 0 0
1619861622.796125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02ea0000
success 0 0
1619861622.828125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02ed0000
success 0 0
1619861622.906125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02f00000
success 0 0
1619861633.109125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 348160
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02d90000
success 0 0
1619861633.140125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02df0000
success 0 0
1619861633.171125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x03450000
success 0 0
1619861633.328125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x03480000
success 0 0
1619861633.515125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x034b0000
success 0 0
1619861633.578125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x034e0000
success 0 0
1619861633.640125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x03510000
success 0 0
1619861643.890125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 348160
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x033a0000
success 0 0
1619861643.921125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x03400000
success 0 0
1619861643.953125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x04dc0000
success 0 0
1619861643.984125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x05200000
success 0 0
1619861644.015125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x05230000
success 0 0
1619861644.062125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x05260000
success 0 0
1619861644.156125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x05290000
success 0 0
1619861654.406125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 348160
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x04d10000
success 0 0
1619861654.437125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x04d70000
success 0 0
1619861654.468125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x05370000
success 0 0
1619861654.499125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x053a0000
success 0 0
1619861654.546125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x053d0000
success 0 0
1619861654.578125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x05400000
success 0 0
1619861654.609125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x05430000
success 0 0
1619861664.843125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 348160
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x052c0000
success 0 0
1619861664.874125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x05320000
success 0 0
1619861665.031125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x05510000
success 0 0
1619861665.328125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x05540000
success 0 0
1619861665.406125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x05570000
success 0 0
1619861665.453125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x055a0000
success 0 0
1619861665.593125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x055d0000
success 0 0
1619861675.968125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 348160
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x05460000
success 0 0
1619861675.999125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x054c0000
success 0 0
1619861676.046125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x056b0000
success 0 0
1619861676.093125
NtAllocateVirtualMemory
process_identifier: 624
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x056e0000
success 0 0
1619884546.100375
NtAllocateVirtualMemory
process_identifier: 2196
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00ff0000
success 0 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (6 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.6453174349979784 section {'size_of_data': '0x00072600', 'virtual_address': '0x000c4000', 'entropy': 7.6453174349979784, 'name': '.rsrc', 'virtual_size': '0x00072528'} description A section with a high entropy has been found
entropy 0.3629512098373661 description Overall entropy of this PE file is high
Terminates another process (50 out of 64 个事件)
Time & API Arguments Status Return Repeated
1619861622.687125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 2860
process_handle: 0x00000128
failed 0 0
1619861622.687125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 2860
process_handle: 0x00000128
success 0 0
1619861622.749125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 1056
process_handle: 0x0000012c
failed 0 0
1619861622.749125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 1056
process_handle: 0x0000012c
success 0 0
1619861622.781125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 2964
process_handle: 0x0000013c
failed 0 0
1619861622.781125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 2964
process_handle: 0x0000013c
success 0 0
1619861622.812125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 392
process_handle: 0x00000144
failed 0 0
1619861622.812125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 392
process_handle: 0x00000144
success 0 0
1619861622.890125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 1320
process_handle: 0x0000014c
failed 0 0
1619861622.890125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 1320
process_handle: 0x0000014c
success 0 0
1619861622.937125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 364
process_handle: 0x00000154
failed 0 0
1619861622.937125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 364
process_handle: 0x00000154
success 0 0
1619861633.171125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 1704
process_handle: 0x0000015c
failed 0 0
1619861633.171125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 1704
process_handle: 0x0000015c
success 0 0
1619861633.312125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 2144
process_handle: 0x00000164
failed 0 0
1619861633.312125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 2144
process_handle: 0x00000164
success 0 0
1619861633.468125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 2576
process_handle: 0x0000016c
failed 0 0
1619861633.468125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 2576
process_handle: 0x0000016c
success 0 0
1619861633.562125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 3120
process_handle: 0x00000174
failed 0 0
1619861633.562125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 3120
process_handle: 0x00000174
success 0 0
1619861633.624125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 3180
process_handle: 0x0000017c
failed 0 0
1619861633.624125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 3180
process_handle: 0x0000017c
success 0 0
1619861633.671125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 3240
process_handle: 0x00000184
failed 0 0
1619861633.671125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 3240
process_handle: 0x00000184
success 0 0
1619861643.937125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 3412
process_handle: 0x0000018c
failed 0 0
1619861643.937125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 3412
process_handle: 0x0000018c
success 0 0
1619861643.984125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 3472
process_handle: 0x00000194
failed 0 0
1619861643.984125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 3472
process_handle: 0x00000194
success 0 0
1619861644.015125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 3532
process_handle: 0x0000019c
failed 0 0
1619861644.015125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 3532
process_handle: 0x0000019c
success 0 0
1619861644.046125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 3592
process_handle: 0x000001a4
failed 0 0
1619861644.046125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 3592
process_handle: 0x000001a4
success 0 0
1619861644.140125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 3652
process_handle: 0x000001ac
failed 0 0
1619861644.140125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 3652
process_handle: 0x000001ac
success 0 0
1619861644.187125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 3712
process_handle: 0x000001b4
failed 0 0
1619861644.187125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 3712
process_handle: 0x000001b4
success 0 0
1619861654.468125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 3792
process_handle: 0x000001bc
failed 0 0
1619861654.468125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 3792
process_handle: 0x000001bc
success 0 0
1619861654.499125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 3852
process_handle: 0x000001c4
failed 0 0
1619861654.499125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 3852
process_handle: 0x000001c4
success 0 0
1619861654.531125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 3912
process_handle: 0x000001cc
failed 0 0
1619861654.531125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 3912
process_handle: 0x000001cc
success 0 0
1619861654.562125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 3972
process_handle: 0x000001d4
failed 0 0
1619861654.562125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 3972
process_handle: 0x000001d4
success 0 0
1619861654.593125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 4032
process_handle: 0x000001dc
failed 0 0
1619861654.593125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 4032
process_handle: 0x000001dc
success 0 0
1619861654.640125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 4092
process_handle: 0x000001e4
failed 0 0
1619861654.640125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 4092
process_handle: 0x000001e4
success 0 0
1619861664.890125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 3620
process_handle: 0x000001ec
failed 0 0
1619861664.890125
NtTerminateProcess
status_code: 0x00000000
process_identifier: 3620
process_handle: 0x000001ec
success 0 0
网络通信
One or more of the buffers contains an embedded PE file (1 个事件)
buffer Buffer with sha1: 1af190111a24284f905dab7e287c938511e85fee
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (33 个事件)
Time & API Arguments Status Return Repeated
1619861622.499125
NtAllocateVirtualMemory
process_identifier: 2860
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000128
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861622.718125
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000012c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861622.765125
NtAllocateVirtualMemory
process_identifier: 2964
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000013c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861622.796125
NtAllocateVirtualMemory
process_identifier: 392
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000144
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861622.828125
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000014c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861622.906125
NtAllocateVirtualMemory
process_identifier: 364
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000154
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861633.140125
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000015c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861633.171125
NtAllocateVirtualMemory
process_identifier: 2144
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000164
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861633.328125
NtAllocateVirtualMemory
process_identifier: 2576
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000016c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861633.515125
NtAllocateVirtualMemory
process_identifier: 3120
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000174
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861633.578125
NtAllocateVirtualMemory
process_identifier: 3180
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000017c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861633.640125
NtAllocateVirtualMemory
process_identifier: 3240
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000184
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861643.921125
NtAllocateVirtualMemory
process_identifier: 3412
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000018c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861643.953125
NtAllocateVirtualMemory
process_identifier: 3472
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000194
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861643.984125
NtAllocateVirtualMemory
process_identifier: 3532
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000019c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861644.015125
NtAllocateVirtualMemory
process_identifier: 3592
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001a4
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861644.062125
NtAllocateVirtualMemory
process_identifier: 3652
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001ac
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861644.156125
NtAllocateVirtualMemory
process_identifier: 3712
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001b4
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861654.437125
NtAllocateVirtualMemory
process_identifier: 3792
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001bc
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861654.468125
NtAllocateVirtualMemory
process_identifier: 3852
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001c4
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861654.499125
NtAllocateVirtualMemory
process_identifier: 3912
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001cc
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861654.546125
NtAllocateVirtualMemory
process_identifier: 3972
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001d4
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861654.578125
NtAllocateVirtualMemory
process_identifier: 4032
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001dc
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861654.609125
NtAllocateVirtualMemory
process_identifier: 4092
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001e4
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861664.874125
NtAllocateVirtualMemory
process_identifier: 3620
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001ec
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861665.031125
NtAllocateVirtualMemory
process_identifier: 3728
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001f4
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861665.328125
NtAllocateVirtualMemory
process_identifier: 2456
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001fc
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861665.406125
NtAllocateVirtualMemory
process_identifier: 3880
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000204
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861665.453125
NtAllocateVirtualMemory
process_identifier: 3988
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000020c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861665.593125
NtAllocateVirtualMemory
process_identifier: 4072
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000214
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861675.999125
NtAllocateVirtualMemory
process_identifier: 880
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000021c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861676.046125
NtAllocateVirtualMemory
process_identifier: 1740
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000224
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861676.093125
NtAllocateVirtualMemory
process_identifier: 2196
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000022c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
Manipulates memory of a non-child process indicative of process injection (50 out of 64 个事件)
Process injection Process 624 manipulating memory of non-child process 2860
Process injection Process 624 manipulating memory of non-child process 1056
Process injection Process 624 manipulating memory of non-child process 2964
Process injection Process 624 manipulating memory of non-child process 392
Process injection Process 624 manipulating memory of non-child process 1320
Process injection Process 624 manipulating memory of non-child process 364
Process injection Process 624 manipulating memory of non-child process 1704
Process injection Process 624 manipulating memory of non-child process 2144
Process injection Process 624 manipulating memory of non-child process 2576
Process injection Process 624 manipulating memory of non-child process 3120
Process injection Process 624 manipulating memory of non-child process 3180
Process injection Process 624 manipulating memory of non-child process 3240
Process injection Process 624 manipulating memory of non-child process 3412
Process injection Process 624 manipulating memory of non-child process 3472
Process injection Process 624 manipulating memory of non-child process 3532
Process injection Process 624 manipulating memory of non-child process 3592
Process injection Process 624 manipulating memory of non-child process 3652
Process injection Process 624 manipulating memory of non-child process 3712
Process injection Process 624 manipulating memory of non-child process 3792
Process injection Process 624 manipulating memory of non-child process 3852
Process injection Process 624 manipulating memory of non-child process 3912
Process injection Process 624 manipulating memory of non-child process 3972
Process injection Process 624 manipulating memory of non-child process 4032
Process injection Process 624 manipulating memory of non-child process 4092
Process injection Process 624 manipulating memory of non-child process 3620
Time & API Arguments Status Return Repeated
1619861622.499125
NtAllocateVirtualMemory
process_identifier: 2860
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000128
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861622.718125
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000012c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861622.765125
NtAllocateVirtualMemory
process_identifier: 2964
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000013c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861622.796125
NtAllocateVirtualMemory
process_identifier: 392
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000144
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861622.828125
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000014c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861622.906125
NtAllocateVirtualMemory
process_identifier: 364
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000154
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861633.140125
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000015c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861633.171125
NtAllocateVirtualMemory
process_identifier: 2144
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000164
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861633.328125
NtAllocateVirtualMemory
process_identifier: 2576
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000016c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861633.515125
NtAllocateVirtualMemory
process_identifier: 3120
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000174
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861633.578125
NtAllocateVirtualMemory
process_identifier: 3180
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000017c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861633.640125
NtAllocateVirtualMemory
process_identifier: 3240
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000184
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861643.921125
NtAllocateVirtualMemory
process_identifier: 3412
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000018c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861643.953125
NtAllocateVirtualMemory
process_identifier: 3472
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000194
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861643.984125
NtAllocateVirtualMemory
process_identifier: 3532
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000019c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861644.015125
NtAllocateVirtualMemory
process_identifier: 3592
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001a4
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861644.062125
NtAllocateVirtualMemory
process_identifier: 3652
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001ac
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861644.156125
NtAllocateVirtualMemory
process_identifier: 3712
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001b4
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861654.437125
NtAllocateVirtualMemory
process_identifier: 3792
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001bc
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861654.468125
NtAllocateVirtualMemory
process_identifier: 3852
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001c4
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861654.499125
NtAllocateVirtualMemory
process_identifier: 3912
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001cc
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861654.546125
NtAllocateVirtualMemory
process_identifier: 3972
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001d4
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861654.578125
NtAllocateVirtualMemory
process_identifier: 4032
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001dc
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861654.609125
NtAllocateVirtualMemory
process_identifier: 4092
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001e4
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861664.874125
NtAllocateVirtualMemory
process_identifier: 3620
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001ec
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
Potential code injection by writing to the memory of another process (1 个事件)
Time & API Arguments Status Return Repeated
1619861676.093125
WriteProcessMemory
process_identifier: 2196
buffer: @
process_handle: 0x0000022c
base_address: 0xfffde008
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 624 called NtSetContextThread to modify thread in remote process 2196
Time & API Arguments Status Return Repeated
1619861676.093125
NtSetContextThread
thread_handle: 0x00000230
registers.eip: 2010382788
registers.esp: 8845636
registers.edi: 0
registers.eax: 4306576
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
process_identifier: 2196
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 624 resumed a thread in remote process 2196
Time & API Arguments Status Return Repeated
1619861676.124125
NtResumeThread
thread_handle: 0x00000230
suspend_count: 1
process_identifier: 2196
success 0 0
Executed a process and injected code into it, probably while unpacking (50 out of 103 个事件)
Time & API Arguments Status Return Repeated
1619861622.499125
CreateProcessInternalW
thread_identifier: 3064
thread_handle: 0x00000124
process_identifier: 2860
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000128
inherit_handles: 0
success 1 0
1619861622.499125
NtGetContextThread
thread_handle: 0x00000124
success 0 0
1619861622.499125
NtAllocateVirtualMemory
process_identifier: 2860
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000128
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861622.718125
CreateProcessInternalW
thread_identifier: 1712
thread_handle: 0x00000130
process_identifier: 1056
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x0000012c
inherit_handles: 0
success 1 0
1619861622.718125
NtGetContextThread
thread_handle: 0x00000130
success 0 0
1619861622.718125
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000012c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861622.765125
CreateProcessInternalW
thread_identifier: 2968
thread_handle: 0x00000140
process_identifier: 2964
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x0000013c
inherit_handles: 0
success 1 0
1619861622.765125
NtGetContextThread
thread_handle: 0x00000140
success 0 0
1619861622.765125
NtAllocateVirtualMemory
process_identifier: 2964
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000013c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861622.796125
CreateProcessInternalW
thread_identifier: 3040
thread_handle: 0x00000148
process_identifier: 392
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000144
inherit_handles: 0
success 1 0
1619861622.796125
NtGetContextThread
thread_handle: 0x00000148
success 0 0
1619861622.796125
NtAllocateVirtualMemory
process_identifier: 392
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000144
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861622.828125
CreateProcessInternalW
thread_identifier: 1888
thread_handle: 0x00000150
process_identifier: 1320
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x0000014c
inherit_handles: 0
success 1 0
1619861622.828125
NtGetContextThread
thread_handle: 0x00000150
success 0 0
1619861622.828125
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000014c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861622.906125
CreateProcessInternalW
thread_identifier: 2796
thread_handle: 0x00000158
process_identifier: 364
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000154
inherit_handles: 0
success 1 0
1619861622.906125
NtGetContextThread
thread_handle: 0x00000158
success 0 0
1619861622.906125
NtAllocateVirtualMemory
process_identifier: 364
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000154
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861633.140125
CreateProcessInternalW
thread_identifier: 2480
thread_handle: 0x00000160
process_identifier: 1704
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x0000015c
inherit_handles: 0
success 1 0
1619861633.140125
NtGetContextThread
thread_handle: 0x00000160
success 0 0
1619861633.140125
NtAllocateVirtualMemory
process_identifier: 1704
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000015c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861633.171125
CreateProcessInternalW
thread_identifier: 2840
thread_handle: 0x00000168
process_identifier: 2144
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000164
inherit_handles: 0
success 1 0
1619861633.171125
NtGetContextThread
thread_handle: 0x00000168
success 0 0
1619861633.171125
NtAllocateVirtualMemory
process_identifier: 2144
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000164
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861633.328125
CreateProcessInternalW
thread_identifier: 1244
thread_handle: 0x00000170
process_identifier: 2576
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x0000016c
inherit_handles: 0
success 1 0
1619861633.328125
NtGetContextThread
thread_handle: 0x00000170
success 0 0
1619861633.328125
NtAllocateVirtualMemory
process_identifier: 2576
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000016c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861633.515125
CreateProcessInternalW
thread_identifier: 3124
thread_handle: 0x00000178
process_identifier: 3120
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000174
inherit_handles: 0
success 1 0
1619861633.515125
NtGetContextThread
thread_handle: 0x00000178
success 0 0
1619861633.515125
NtAllocateVirtualMemory
process_identifier: 3120
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000174
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861633.578125
CreateProcessInternalW
thread_identifier: 3184
thread_handle: 0x00000180
process_identifier: 3180
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x0000017c
inherit_handles: 0
success 1 0
1619861633.578125
NtGetContextThread
thread_handle: 0x00000180
success 0 0
1619861633.578125
NtAllocateVirtualMemory
process_identifier: 3180
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000017c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861633.640125
CreateProcessInternalW
thread_identifier: 3244
thread_handle: 0x00000188
process_identifier: 3240
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000184
inherit_handles: 0
success 1 0
1619861633.640125
NtGetContextThread
thread_handle: 0x00000188
success 0 0
1619861633.640125
NtAllocateVirtualMemory
process_identifier: 3240
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000184
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861643.921125
CreateProcessInternalW
thread_identifier: 3416
thread_handle: 0x00000190
process_identifier: 3412
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x0000018c
inherit_handles: 0
success 1 0
1619861643.921125
NtGetContextThread
thread_handle: 0x00000190
success 0 0
1619861643.921125
NtAllocateVirtualMemory
process_identifier: 3412
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000018c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861643.953125
CreateProcessInternalW
thread_identifier: 3476
thread_handle: 0x00000198
process_identifier: 3472
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000194
inherit_handles: 0
success 1 0
1619861643.953125
NtGetContextThread
thread_handle: 0x00000198
success 0 0
1619861643.953125
NtAllocateVirtualMemory
process_identifier: 3472
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000194
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861643.984125
CreateProcessInternalW
thread_identifier: 3536
thread_handle: 0x000001a0
process_identifier: 3532
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x0000019c
inherit_handles: 0
success 1 0
1619861643.984125
NtGetContextThread
thread_handle: 0x000001a0
success 0 0
1619861643.984125
NtAllocateVirtualMemory
process_identifier: 3532
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000019c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861644.015125
CreateProcessInternalW
thread_identifier: 3596
thread_handle: 0x000001a8
process_identifier: 3592
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000001a4
inherit_handles: 0
success 1 0
1619861644.015125
NtGetContextThread
thread_handle: 0x000001a8
success 0 0
1619861644.015125
NtAllocateVirtualMemory
process_identifier: 3592
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000001a4
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619861644.062125
CreateProcessInternalW
thread_identifier: 3656
thread_handle: 0x000001b0
process_identifier: 3652
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bad3f0d1eef58b9dcc9bd6918090db9e.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000001ac
inherit_handles: 0
success 1 0
1619861644.062125
NtGetContextThread
thread_handle: 0x000001b0
success 0 0
File has been identified by 47 AntiVirus engines on VirusTotal as malicious (47 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.43154339
FireEye Generic.mg.bad3f0d1eef58b9d
McAfee Artemis!BAD3F0D1EEF5
Cylance Unsafe
Sangfor Malware
K7AntiVirus Trojan ( 0056697d1 )
Alibaba Trojan:Win32/Predator.4118ca3e
K7GW Trojan ( 0056697d1 )
Arcabit Trojan.Generic.D2927BA3
Cyren W32/AutoIt.OM.gen!Eldorado
Symantec Trojan.Gen.MBT
APEX Malicious
Avast Win32:Trojan-gen
Kaspersky HEUR:Trojan.Script.Generic
BitDefender Trojan.GenericKD.43154339
NANO-Antivirus Trojan.Win32.Inject.hlcwgz
Paloalto generic.ml
Rising Trojan.Obfus/Autoit!1.C6C8 (CLASSIC)
Ad-Aware Trojan.GenericKD.43154339
Sophos Mal/Generic-S
Comodo Malware@#354c3e9ggipwp
F-Secure Trojan.TR/AD.Sagonaire.drycx
DrWeb Trojan.AutoIt.907
TrendMicro TROJ_GEN.R06EC0DIA20
McAfee-GW-Edition BehavesLike.Win32.TrojanAitInject.tc
Emsisoft Trojan.GenericKD.43154339 (B)
Avira TR/AD.Sagonaire.drycx
MAX malware (ai score=83)
Antiy-AVL GrayWare/Autoit.BinToStr.a
Microsoft Trojan:Win32/Predator.ARA!MTB
AegisLab Trojan.Script.Generic.4!c
ZoneAlarm HEUR:Trojan.Script.Generic
GData Trojan.GenericKD.43154339
Cynet Malicious (score: 85)
AhnLab-V3 Trojan/AU3.AutoInj.S1159
ALYac Trojan.GenericKD.43154339
Malwarebytes Backdoor.NanoCore
ESET-NOD32 a variant of Win32/Injector.Autoit.FHN
TrendMicro-HouseCall TROJ_GEN.R06EC0DIA20
Ikarus Trojan.Autoit
Fortinet AutoIt/Injector.FHI!tr
MaxSecure Trojan.Malware.300983.susgen
AVG Win32:Trojan-gen
CrowdStrike win/malicious_confidence_100% (W)
Qihoo-360 Generic/Trojan.Script.ed4
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 172.217.24.14:443
dead_host 172.217.160.110:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-05-13 10:45:22

Imports

Library WSOCK32.dll:
• 0x48d7b0 __WSAFDIsSet
• 0x48d7b4 recv
• 0x48d7b8 send
• 0x48d7bc setsockopt
• 0x48d7c0 ntohs
• 0x48d7c4 recvfrom
• 0x48d7c8 select
• 0x48d7cc WSAStartup
• 0x48d7d0 htons
• 0x48d7d4 accept
• 0x48d7d8 listen
• 0x48d7dc bind
• 0x48d7e0 closesocket
• 0x48d7e4 connect
• 0x48d7e8 WSACleanup
• 0x48d7ec ioctlsocket
• 0x48d7f0 sendto
• 0x48d7f4 WSAGetLastError
• 0x48d7f8 inet_addr
• 0x48d7fc gethostbyname
• 0x48d800 gethostname
• 0x48d804 socket
Library VERSION.dll:
• 0x48d754 GetFileVersionInfoW
• 0x48d758 VerQueryValueW
Library WINMM.dll:
• 0x48d7a0 timeGetTime
• 0x48d7a4 waveOutSetVolume
• 0x48d7a8 mciSendStringW
Library COMCTL32.dll:
• 0x48d088 ImageList_Destroy
• 0x48d08c ImageList_Remove
• 0x48d094 ImageList_BeginDrag
• 0x48d098 ImageList_DragEnter
• 0x48d09c ImageList_DragLeave
• 0x48d0a0 ImageList_EndDrag
• 0x48d0a4 ImageList_DragMove
• 0x48d0a8 ImageList_Create
Library MPR.dll:
• 0x48d3e8 WNetUseConnectionW
• 0x48d3f0 WNetGetConnectionW
• 0x48d3f4 WNetAddConnection2W
Library WININET.dll:
• 0x48d764 InternetReadFile
• 0x48d768 InternetCloseHandle
• 0x48d76c InternetOpenW
• 0x48d770 InternetSetOptionW
• 0x48d774 InternetCrackUrlW
• 0x48d778 HttpQueryInfoW
• 0x48d780 HttpOpenRequestW
• 0x48d784 HttpSendRequestW
• 0x48d788 FtpOpenFileW
• 0x48d78c FtpGetFileSize
• 0x48d790 InternetOpenUrlW
• 0x48d794 InternetConnectW
Library PSAPI.DLL:
Library IPHLPAPI.DLL:
• 0x48d154 IcmpCreateFile
• 0x48d158 IcmpCloseHandle
• 0x48d15c IcmpSendEcho
Library USERENV.dll:
• 0x48d738 UnloadUserProfile
• 0x48d744 LoadUserProfileW
Library UxTheme.dll:
• 0x48d74c IsThemeActive
Library KERNEL32.dll:
• 0x48d164 HeapAlloc
• 0x48d168 GetProcessHeap
• 0x48d16c HeapFree
• 0x48d170 Sleep
• 0x48d174 GetCurrentThreadId
• 0x48d178 MultiByteToWideChar
• 0x48d17c MulDiv
• 0x48d180 GetVersionExW
• 0x48d184 GetSystemInfo
• 0x48d188 FreeLibrary
• 0x48d18c LoadLibraryA
• 0x48d190 GetProcAddress
• 0x48d194 SetErrorMode
• 0x48d198 GetModuleFileNameW
• 0x48d19c WideCharToMultiByte
• 0x48d1a0 lstrcpyW
• 0x48d1a4 lstrlenW
• 0x48d1a8 GetModuleHandleW
• 0x48d1b0 VirtualFreeEx
• 0x48d1b4 OpenProcess
• 0x48d1b8 VirtualAllocEx
• 0x48d1bc WriteProcessMemory
• 0x48d1c0 ReadProcessMemory
• 0x48d1c4 CreateFileW
• 0x48d1c8 SetFilePointerEx
• 0x48d1cc ReadFile
• 0x48d1d0 WriteFile
• 0x48d1d4 FlushFileBuffers
• 0x48d1d8 TerminateProcess
• 0x48d1e0 Process32FirstW
• 0x48d1e4 Process32NextW
• 0x48d1e8 SetFileTime
• 0x48d1ec GetFileAttributesW
• 0x48d1f0 FindFirstFileW
• 0x48d1f4 FindClose
• 0x48d1f8 GetLongPathNameW
• 0x48d1fc GetCurrentThread
• 0x48d200 FindNextFileW
• 0x48d204 MoveFileW
• 0x48d208 CopyFileW
• 0x48d20c CreateDirectoryW
• 0x48d210 RemoveDirectoryW
• 0x48d214 SetSystemPowerState
• 0x48d21c FindResourceW
• 0x48d220 LoadResource
• 0x48d224 LockResource
• 0x48d228 SizeofResource
• 0x48d22c EnumResourceNamesW
• 0x48d230 OutputDebugStringW
• 0x48d234 GetTempPathW
• 0x48d238 GetTempFileNameW
• 0x48d23c DeviceIoControl
• 0x48d240 GetLocalTime
• 0x48d244 CompareStringW
• 0x48d24c WaitForSingleObject
• 0x48d254 GetStdHandle
• 0x48d258 CreatePipe
• 0x48d25c InterlockedExchange
• 0x48d260 TerminateThread
• 0x48d264 LoadLibraryExW
• 0x48d268 FindResourceExW
• 0x48d26c VirtualFree
• 0x48d270 FormatMessageW
• 0x48d274 GetExitCodeProcess
• 0x48d29c GetDriveTypeW
• 0x48d2a0 GetDiskFreeSpaceExW
• 0x48d2a4 GetDiskFreeSpaceW
• 0x48d2ac SetVolumeLabelW
• 0x48d2b0 CreateHardLinkW
• 0x48d2b4 SetFileAttributesW
• 0x48d2b8 GetShortPathNameW
• 0x48d2bc CreateEventW
• 0x48d2c0 SetEvent
• 0x48d2cc GlobalLock
• 0x48d2d0 GlobalUnlock
• 0x48d2d4 GlobalAlloc
• 0x48d2d8 GetFileSize
• 0x48d2dc GlobalFree
• 0x48d2e4 Beep
• 0x48d2e8 GetSystemDirectoryW
• 0x48d2ec GetComputerNameW
• 0x48d2f4 GetCurrentProcessId
• 0x48d2fc CreateProcessW
• 0x48d300 SetPriorityClass
• 0x48d304 LoadLibraryW
• 0x48d308 VirtualAlloc
• 0x48d30c CloseHandle
• 0x48d310 GetLastError
• 0x48d314 GetFullPathNameW
• 0x48d31c IsDebuggerPresent
• 0x48d324 lstrcmpiW
• 0x48d328 RaiseException
• 0x48d338 CreateThread
• 0x48d33c DuplicateHandle
• 0x48d344 GetCurrentProcess
• 0x48d348 ExitProcess
• 0x48d34c GetModuleHandleExW
• 0x48d350 ExitThread
• 0x48d358 ResumeThread
• 0x48d35c GetCommandLineW
• 0x48d364 HeapSize
• 0x48d368 IsValidCodePage
• 0x48d36c GetACP
• 0x48d370 GetOEMCP
• 0x48d374 GetCPInfo
• 0x48d378 SetLastError
• 0x48d384 TlsAlloc
• 0x48d388 TlsGetValue
• 0x48d38c TlsSetValue
• 0x48d390 TlsFree
• 0x48d394 GetStartupInfoW
• 0x48d398 GetStringTypeW
• 0x48d39c SetStdHandle
• 0x48d3a0 GetFileType
• 0x48d3a4 GetConsoleCP
• 0x48d3a8 GetConsoleMode
• 0x48d3ac RtlUnwind
• 0x48d3b0 ReadConsoleW
• 0x48d3b4 SetFilePointer
• 0x48d3bc GetDateFormatW
• 0x48d3c0 GetTimeFormatW
• 0x48d3c4 LCMapStringW
• 0x48d3d0 HeapReAlloc
• 0x48d3d4 WriteConsoleW
• 0x48d3d8 SetEndOfFile
• 0x48d3dc DeleteFileW
Library USER32.dll:
• 0x48d4b4 SetWindowPos
• 0x48d4b8 GetCursorInfo
• 0x48d4bc RegisterHotKey
• 0x48d4c0 ClientToScreen
• 0x48d4c8 IsCharAlphaW
• 0x48d4cc IsCharAlphaNumericW
• 0x48d4d0 IsCharLowerW
• 0x48d4d4 IsCharUpperW
• 0x48d4d8 GetMenuStringW
• 0x48d4dc GetSubMenu
• 0x48d4e0 GetCaretPos
• 0x48d4e4 IsZoomed
• 0x48d4e8 MonitorFromPoint
• 0x48d4ec GetMonitorInfoW
• 0x48d4f0 SetWindowLongW
• 0x48d4f8 FlashWindow
• 0x48d4fc GetClassLongW
• 0x48d504 IsDialogMessageW
• 0x48d508 GetSysColor
• 0x48d50c InflateRect
• 0x48d510 DrawFocusRect
• 0x48d514 DrawTextW
• 0x48d518 FrameRect
• 0x48d51c DrawFrameControl
• 0x48d520 FillRect
• 0x48d524 PtInRect
• 0x48d530 SetCursor
• 0x48d534 GetWindowDC
• 0x48d538 GetSystemMetrics
• 0x48d53c DrawMenuBar
• 0x48d540 GetActiveWindow
• 0x48d544 CharNextW
• 0x48d548 wsprintfW
• 0x48d54c RedrawWindow
• 0x48d550 DestroyMenu
• 0x48d554 SetMenu
• 0x48d55c CreateMenu
• 0x48d560 IsDlgButtonChecked
• 0x48d564 DefDlgProcW
• 0x48d568 CallWindowProcW
• 0x48d56c ReleaseCapture
• 0x48d570 SetCapture
• 0x48d574 MonitorFromRect
• 0x48d578 LoadImageW
• 0x48d580 mouse_event
• 0x48d584 ExitWindowsEx
• 0x48d588 SetActiveWindow
• 0x48d58c FindWindowExW
• 0x48d590 EnumThreadWindows
• 0x48d594 SetMenuDefaultItem
• 0x48d598 InsertMenuItemW
• 0x48d59c IsMenu
• 0x48d5a0 TrackPopupMenuEx
• 0x48d5a4 GetCursorPos
• 0x48d5a8 CopyImage
• 0x48d5ac CheckMenuRadioItem
• 0x48d5b0 GetMenuItemID
• 0x48d5b4 GetMenuItemCount
• 0x48d5b8 SetMenuItemInfoW
• 0x48d5bc GetMenuItemInfoW
• 0x48d5c0 SetForegroundWindow
• 0x48d5c4 IsIconic
• 0x48d5c8 FindWindowW
• 0x48d5cc UnregisterHotKey
• 0x48d5d0 keybd_event
• 0x48d5d4 SendInput
• 0x48d5d8 GetAsyncKeyState
• 0x48d5dc SetKeyboardState
• 0x48d5e0 GetKeyboardState
• 0x48d5e4 GetKeyState
• 0x48d5e8 VkKeyScanW
• 0x48d5ec LoadStringW
• 0x48d5f0 DialogBoxParamW
• 0x48d5f4 MessageBeep
• 0x48d5f8 EndDialog
• 0x48d5fc SendDlgItemMessageW
• 0x48d600 GetDlgItem
• 0x48d604 SetWindowTextW
• 0x48d608 CopyRect
• 0x48d60c ReleaseDC
• 0x48d610 GetDC
• 0x48d614 EndPaint
• 0x48d618 BeginPaint
• 0x48d61c GetClientRect
• 0x48d620 GetMenu
• 0x48d624 DestroyWindow
• 0x48d628 EnumWindows
• 0x48d62c GetDesktopWindow
• 0x48d630 IsWindow
• 0x48d634 IsWindowEnabled
• 0x48d638 IsWindowVisible
• 0x48d63c EnableWindow
• 0x48d640 InvalidateRect
• 0x48d644 GetWindowLongW
• 0x48d64c AttachThreadInput
• 0x48d650 GetFocus
• 0x48d654 ScreenToClient
• 0x48d658 SendMessageTimeoutW
• 0x48d65c EnumChildWindows
• 0x48d660 CharUpperBuffW
• 0x48d664 GetClassNameW
• 0x48d668 GetParent
• 0x48d66c GetDlgCtrlID
• 0x48d670 SendMessageW
• 0x48d674 MapVirtualKeyW
• 0x48d678 PostMessageW
• 0x48d67c GetWindowRect
• 0x48d684 CloseDesktop
• 0x48d688 CloseWindowStation
• 0x48d68c OpenDesktopW
• 0x48d698 OpenWindowStationW
• 0x48d6a0 AdjustWindowRectEx
• 0x48d6a4 SetRect
• 0x48d6a8 SetClipboardData
• 0x48d6ac EmptyClipboard
• 0x48d6b4 CloseClipboard
• 0x48d6b8 GetClipboardData
• 0x48d6c0 OpenClipboard
• 0x48d6c4 BlockInput
• 0x48d6c8 GetMessageW
• 0x48d6cc LockWindowUpdate
• 0x48d6d0 DispatchMessageW
• 0x48d6d4 TranslateMessage
• 0x48d6d8 DeleteMenu
• 0x48d6dc PeekMessageW
• 0x48d6e0 MessageBoxW
• 0x48d6e4 DefWindowProcW
• 0x48d6e8 MoveWindow
• 0x48d6ec SetFocus
• 0x48d6f0 PostQuitMessage
• 0x48d6f4 KillTimer
• 0x48d6f8 CreatePopupMenu
• 0x48d700 SetTimer
• 0x48d704 ShowWindow
• 0x48d708 CreateWindowExW
• 0x48d70c RegisterClassExW
• 0x48d710 LoadIconW
• 0x48d714 LoadCursorW
• 0x48d718 GetSysColorBrush
• 0x48d71c GetForegroundWindow
• 0x48d720 MessageBoxA
• 0x48d724 DestroyIcon
• 0x48d72c CharLowerBuffW
• 0x48d730 GetWindowTextW
Library GDI32.dll:
• 0x48d0c4 SetPixel
• 0x48d0c8 DeleteObject
• 0x48d0d0 ExtCreatePen
• 0x48d0d4 StrokeAndFillPath
• 0x48d0d8 StrokePath
• 0x48d0dc GetDeviceCaps
• 0x48d0e0 CloseFigure
• 0x48d0e4 LineTo
• 0x48d0e8 AngleArc
• 0x48d0f0 CreateCompatibleDC
• 0x48d0f4 MoveToEx
• 0x48d0f8 Ellipse
• 0x48d0fc PolyDraw
• 0x48d100 BeginPath
• 0x48d104 SelectObject
• 0x48d108 StretchBlt
• 0x48d10c GetDIBits
• 0x48d110 DeleteDC
• 0x48d114 GetPixel
• 0x48d118 CreateDCW
• 0x48d11c GetStockObject
• 0x48d120 Rectangle
• 0x48d124 SetViewportOrgEx
• 0x48d128 GetObjectW
• 0x48d12c SetBkMode
• 0x48d130 RoundRect
• 0x48d134 SetBkColor
• 0x48d138 CreatePen
• 0x48d13c CreateSolidBrush
• 0x48d140 SetTextColor
• 0x48d144 CreateFontW
• 0x48d148 GetTextFaceW
• 0x48d14c EndPath
Library COMDLG32.dll:
• 0x48d0b8 GetSaveFileNameW
• 0x48d0bc GetOpenFileNameW
Library ADVAPI32.dll:
• 0x48d000 GetAclInformation
• 0x48d004 RegEnumValueW
• 0x48d008 RegDeleteValueW
• 0x48d00c RegDeleteKeyW
• 0x48d010 RegEnumKeyExW
• 0x48d014 RegSetValueExW
• 0x48d018 RegCreateKeyExW
• 0x48d01c GetUserNameW
• 0x48d020 RegOpenKeyExW
• 0x48d024 RegCloseKey
• 0x48d028 RegQueryValueExW
• 0x48d02c RegConnectRegistryW
• 0x48d034 InitializeAcl
• 0x48d03c OpenThreadToken
• 0x48d040 OpenProcessToken
• 0x48d048 DuplicateTokenEx
• 0x48d054 GetLengthSid
• 0x48d058 CopySid
• 0x48d060 LogonUserW
• 0x48d06c FreeSid
• 0x48d070 GetTokenInformation
• 0x48d07c AddAce
• 0x48d080 GetAce
Library SHELL32.dll:
• 0x48d474 DragQueryPoint
• 0x48d478 ShellExecuteExW
• 0x48d47c DragQueryFileW
• 0x48d480 SHEmptyRecycleBinW
• 0x48d488 SHBrowseForFolderW
• 0x48d48c SHCreateShellItem
• 0x48d490 SHGetDesktopFolder
• 0x48d498 SHGetFolderPathW
• 0x48d49c SHFileOperationW
• 0x48d4a0 ExtractIconExW
• 0x48d4a4 Shell_NotifyIconW
• 0x48d4a8 ShellExecuteW
• 0x48d4ac DragFinish
Library ole32.dll:
• 0x48d80c CoTaskMemAlloc
• 0x48d810 CoTaskMemFree
• 0x48d814 CLSIDFromString
• 0x48d818 ProgIDFromCLSID
• 0x48d81c CLSIDFromProgID
• 0x48d824 MkParseDisplayName
• 0x48d82c CoCreateInstance
• 0x48d830 IIDFromString
• 0x48d834 StringFromGUID2
• 0x48d83c CoInitialize
• 0x48d840 CoUninitialize
• 0x48d84c CoGetObject
• 0x48d854 CoCreateInstanceEx
• 0x48d858 CoSetProxyBlanket
Library OLEAUT32.dll:
• 0x48d3fc RegisterTypeLib
• 0x48d400 LoadTypeLibEx
• 0x48d404 VariantCopyInd
• 0x48d408 SysReAllocString
• 0x48d40c SysFreeString
• 0x48d41c SafeArrayAccessData
• 0x48d420 SafeArrayAllocData
• 0x48d424 UnRegisterTypeLib
• 0x48d42c SysAllocString
• 0x48d430 SysStringLen
• 0x48d438 VarR8FromDec
• 0x48d43c SafeArrayGetVartype
• 0x48d440 OleLoadPicture
• 0x48d448 VariantCopy
• 0x48d44c VariantClear
• 0x48d450 CreateDispTypeInfo
• 0x48d454 CreateStdDispatch
• 0x48d458 DispCallFunc
• 0x48d45c VariantChangeType
• 0x48d464 VariantInit

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 51378 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 57236 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 50568 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53210 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.