10.8
0-day
该样本未表现出任何异常！
重新分析
更多

911469f82eeb6864243e9adc93d5c1e75d3c003ffd1ae9dcd2bceb904e0a560f

c35a52d96656a9100a9b7cd22f0f0eac.exe

分析耗时

50s

最近分析

文件大小

13.7MB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
Queries for the computername (31 个事件)
Time & API Arguments Status Return Repeated
1621013374.818
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013375.365
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013375.537
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013375.631
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013376.021
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013376.053
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013376.224
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013376.303
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013376.412
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013376.428
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013376.49
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013376.521
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013376.584
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013376.599
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013376.646
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013376.709
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013376.803
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013376.834
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013378.349
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013379.709
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013380.974
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013379.75625
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013381.89625
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013386.99025
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013387.08425
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013387.11525
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013387.11525
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013387.31825
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013388.80325
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013390.00625
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621013390.28725
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (9 个事件)
Time & API Arguments Status Return Repeated
1621013368.14575
IsDebuggerPresent
failed 0 0
1621013376.67825
IsDebuggerPresent
failed 0 0
1621013376.67825
IsDebuggerPresent
failed 0 0
1621013388.55325
IsDebuggerPresent
failed 0 0
1621013388.66225
IsDebuggerPresent
failed 0 0
1621013388.74025
IsDebuggerPresent
failed 0 0
1621013389.13125
IsDebuggerPresent
failed 0 0
1621013389.38125
IsDebuggerPresent
failed 0 0
1621013389.52125
IsDebuggerPresent
failed 0 0
Uses Windows APIs to generate a cryptographic key (1 个事件)
Time & API Arguments Status Return Repeated
1621013380.50625
CryptExportKey
crypto_handle: 0x00544e90
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
This executable is signed
Tries to locate where the browsers are installed (4 个事件)
file C:\Program Files\Google\Chrome\Application\chrome.exe
registry HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\InstallDate
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1621013374.349
GlobalMemoryStatusEx
success 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)
section .sxdata
The executable uses a known packer (1 个事件)
packer Armadillo v1.71
行为判定
动态指标
HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 个事件)
suspicious_features POST method with no referer header, POST method with no useragent header suspicious_request POST http://flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubStart
suspicious_features POST method with no referer header, POST method with no useragent header suspicious_request POST http://flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubBundleStart
suspicious_features GET method with no useragent header suspicious_request GET https://h2oapi.adaware.com/v1/bundleinfo/73a783c5ab05492cdd4d091d70b71b80898951cf
Performs some HTTP requests (3 个事件)
request POST http://flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubStart
request POST http://flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubBundleStart
request GET https://h2oapi.adaware.com/v1/bundleinfo/73a783c5ab05492cdd4d091d70b71b80898951cf
Sends data using the HTTP POST Method (2 个事件)
request POST http://flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubStart
request POST http://flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubBundleStart
Allocates read-write-execute memory (usually to unpack itself) (50 out of 253 个事件)
Time & API Arguments Status Return Repeated
1621013376.31825
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00250000
success 0 0
1621013376.31825
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00260000
success 0 0
1621013376.49025
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 2228224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02050000
success 0 0
1621013376.49025
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02230000
success 0 0
1621013376.56825
NtProtectVirtualMemory
process_identifier: 2620
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e71000
success 0 0
1621013376.67825
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 1900544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02050000
success 0 0
1621013376.67825
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x021e0000
success 0 0
1621013376.67825
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0047a000
success 0 0
1621013376.67825
NtProtectVirtualMemory
process_identifier: 2620
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e72000
success 0 0
1621013376.67825
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00472000
success 0 0
1621013376.91225
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00482000
success 0 0
1621013377.00625
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004a5000
success 0 0
1621013377.00625
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004ab000
success 0 0
1621013377.00625
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004a7000
success 0 0
1621013377.27125
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00483000
success 0 0
1621013377.34925
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0048c000
success 0 0
1621013377.53725
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00484000
success 0 0
1621013377.56825
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00910000
success 0 0
1621013377.59925
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00485000
success 0 0
1621013377.59925
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00486000
success 0 0
1621013377.61525
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00487000
success 0 0
1621013377.64625
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00488000
success 0 0
1621013377.64625
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00489000
success 0 0
1621013377.69325
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020b0000
success 0 0
1621013377.69325
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020b1000
success 0 0
1621013377.69325
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020b2000
success 0 0
1621013377.69325
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0048d000
success 0 0
1621013377.69325
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020b3000
success 0 0
1621013377.70925
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020b4000
success 0 0
1621013377.70925
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020b5000
success 0 0
1621013377.70925
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020b6000
success 0 0
1621013377.70925
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020b7000
success 0 0
1621013377.70925
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020b8000
success 0 0
1621013377.70925
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0048e000
success 0 0
1621013377.70925
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020b9000
success 0 0
1621013377.70925
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020ba000
success 0 0
1621013377.70925
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020bb000
success 0 0
1621013377.70925
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020bc000
success 0 0
1621013377.70925
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020bd000
success 0 0
1621013377.70925
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020be000
success 0 0
1621013377.70925
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0048f000
success 0 0
1621013377.70925
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020bf000
success 0 0
1621013377.70925
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020c0000
success 0 0
1621013377.70925
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020c1000
success 0 0
1621013377.72425
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020c2000
success 0 0
1621013377.78725
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020c3000
success 0 0
1621013378.19325
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020c4000
success 0 0
1621013378.30325
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020c5000
success 0 0
1621013378.30325
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02220000
success 0 0
1621013378.30325
NtAllocateVirtualMemory
process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020c6000
success 0 0
Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 个事件)
Time & API Arguments Status Return Repeated
1621013390.787
GetDiskFreeSpaceExW
root_path: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568
free_bytes_available: 19443666944
total_number_of_free_bytes: 19443666944
total_number_of_bytes: 34252779520
success 1 0
Creates executable files on the filesystem (23 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\OfferServiceBLL.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\it\DevLib.resources.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\pt\DevLib.resources.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\es\DevLib.resources.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\DevLib.Services.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\H2OSciter.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\DevLib.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\GenericSetup.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\sciter32.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Microsoft.Win32.TaskScheduler.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Shared.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\MyDownloader.Core.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\MyDownloader.Extension.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Newtonsoft.Json.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\installer.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Carrier.EXE
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\OfferServiceSDK.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\ru\DevLib.resources.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\fr\DevLib.resources.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\en\DevLib.resources.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\de\DevLib.resources.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\HtmlAgilityPack.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\GenericSetup.dll
Drops a binary and executes it (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\GenericSetup.exe
Drops an executable to the user AppData folder (23 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\OfferServiceSDK.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\ru\DevLib.resources.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\de\DevLib.resources.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\MyDownloader.Core.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\DevLib.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\DevLib.Services.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\GenericSetup.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\fr\DevLib.resources.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\MyDownloader.Extension.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\it\DevLib.resources.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Microsoft.Win32.TaskScheduler.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Carrier.EXE
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\GenericSetup.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\pt\DevLib.resources.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\installer.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Newtonsoft.Json.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\en\DevLib.resources.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\sciter32.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Shared.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\HtmlAgilityPack.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\OfferServiceBLL.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\H2OSciter.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\es\DevLib.resources.dll
Executes one or more WMI queries (6 个事件)
wmi SELECT * FROM Win32_VideoController
wmi SELECT * FROM Win32_BIOS
wmi SELECT * FROM Win32_DiskDrive
wmi SELECT * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled=True
wmi SELECT * FROM Win32_Processor
wmi SELECT * FROM Win32_BaseBoard
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1621013383.39625
GetAdaptersAddresses
flags: 15
family: 0
failed 111 0
Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)
Time & API Arguments Status Return Repeated
1621013379.36525
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
Expresses interest in specific running processes (1 个事件)
process installer.exe
Queries for potentially installed applications (13 个事件)
Time & API Arguments Status Return Repeated
1621013387.03725
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x000007b0
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
options: 0
success 0 0
1621013387.05325
RegOpenKeyExW
access: 0x00020019
base_handle: 0x000007b0
key_handle: 0x000007d8
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
regkey_r: AddressBook
options: 0
success 0 0
1621013387.05325
RegOpenKeyExW
access: 0x00020019
base_handle: 0x000007b0
key_handle: 0x000007d8
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
regkey_r: Connection Manager
options: 0
success 0 0
1621013387.05325
RegOpenKeyExW
access: 0x00020019
base_handle: 0x000007b0
key_handle: 0x000007d8
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
regkey_r: DirectDrawEx
options: 0
success 0 0
1621013387.05325
RegOpenKeyExW
access: 0x00020019
base_handle: 0x000007b0
key_handle: 0x000007d8
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
regkey_r: Fontcore
options: 0
success 0 0
1621013387.06825
RegOpenKeyExW
access: 0x00020019
base_handle: 0x000007b0
key_handle: 0x000007d8
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Google Chrome
options: 0
success 0 0
1621013387.06825
RegOpenKeyExW
access: 0x00020019
base_handle: 0x000007b0
key_handle: 0x000007d8
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40
regkey_r: IE40
options: 0
success 0 0
1621013387.06825
RegOpenKeyExW
access: 0x00020019
base_handle: 0x000007b0
key_handle: 0x000007d8
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
regkey_r: IE4Data
options: 0
success 0 0
1621013387.06825
RegOpenKeyExW
access: 0x00020019
base_handle: 0x000007b0
key_handle: 0x000007d8
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
regkey_r: IE5BAKEX
options: 0
success 0 0
1621013387.06825
RegOpenKeyExW
access: 0x00020019
base_handle: 0x000007b0
key_handle: 0x000007d8
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData
regkey_r: IEData
options: 0
success 0 0
1621013387.08425
RegOpenKeyExW
access: 0x00020019
base_handle: 0x000007b0
key_handle: 0x000007d8
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
regkey_r: MobileOptionPack
options: 0
success 0 0
1621013387.08425
RegOpenKeyExW
access: 0x00020019
base_handle: 0x000007b0
key_handle: 0x000007d8
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
regkey_r: SchedulingAgent
options: 0
success 0 0
1621013387.08425
RegOpenKeyExW
access: 0x00020019
base_handle: 0x000007b0
key_handle: 0x000007d8
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC
regkey_r: WIC
options: 0
success 0 0
Executes one or more WMI queries which can be used to identify virtual machines (3 个事件)
wmi SELECT * FROM Win32_Processor
wmi SELECT * FROM Win32_BIOS
wmi SELECT * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled=True
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 113.108.239.196
host 172.217.24.14
Attempts to identify installed AV products by registry key (2 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\AVAST Software\Browser\Update
registry HKEY_CURRENT_USER\SOFTWARE\AVAST Software\Browser\Update
Looks for the Windows Idle Time to determine the uptime (1 个事件)
Time & API Arguments Status Return Repeated
1621013387.94325
NtQuerySystemInformation
information_class: 8 (SystemProcessorPerformanceInformation)
success 0 0
Performs 89 file moves indicative of a ransomware file encryption process (50 out of 89 个事件)
Time & API Arguments Status Return Repeated
1621013371.443
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\de\DevLib.resources.dll
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\de\DevLib.resources.dll
success 1 0
1621013371.506
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\de
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\de
success 1 0
1621013371.521
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\en\DevLib.resources.dll
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\en\DevLib.resources.dll
success 1 0
1621013371.553
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\en
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\en
success 1 0
1621013371.568
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\es\DevLib.resources.dll
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\es\DevLib.resources.dll
success 1 0
1621013371.631
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\es
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\es
success 1 0
1621013371.646
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\fr\DevLib.resources.dll
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\fr\DevLib.resources.dll
success 1 0
1621013371.678
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\fr
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\fr
success 1 0
1621013371.693
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\it\DevLib.resources.dll
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\it\DevLib.resources.dll
success 1 0
1621013371.74
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\it
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\it
success 1 0
1621013371.74
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\pt\DevLib.resources.dll
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\pt\DevLib.resources.dll
success 1 0
1621013371.771
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\pt
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\pt
success 1 0
1621013371.787
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\images\loader.gif
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\images\loader.gif
success 1 0
1621013371.818
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\images\warning48x48.png
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\images\warning48x48.png
success 1 0
1621013371.849
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\images
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\images
success 1 0
1621013371.849
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\Config.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\Config.tis
success 1 0
1621013371.881
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\EventHandler.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\EventHandler.tis
success 1 0
1621013371.912
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\Log.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\Log.tis
success 1 0
1621013371.943
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\TranslateOfferTemplate.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\TranslateOfferTemplate.tis
success 1 0
1621013371.99
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\ViewStateLoader.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\ViewStateLoader.tis
success 1 0
1621013372.021
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis
success 1 0
1621013372.037
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\images\loader.gif
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\images\loader.gif
success 1 0
1621013372.053
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\images\warning48x48.png
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\images\warning48x48.png
success 1 0
1621013372.068
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\InstallingPage.html
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\InstallingPage.html
success 1 0
1621013372.099
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\LaunchCarrierPage.html
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\LaunchCarrierPage.html
success 1 0
1621013372.131
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\OfferPage.html
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\OfferPage.html
success 1 0
1621013372.162
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\ScanningPage.html
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\ScanningPage.html
success 1 0
1621013372.193
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\style.css
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\style.css
success 1 0
1621013372.24
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\Config.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\Config.tis
success 1 0
1621013372.256
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\EventHandler.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\EventHandler.tis
success 1 0
1621013372.271
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\Log.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\Log.tis
success 1 0
1621013372.287
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\TranslateOfferTemplate.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\TranslateOfferTemplate.tis
success 1 0
1621013372.303
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\ViewStateLoader.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\ViewStateLoader.tis
success 1 0
1621013372.318
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\WelcomePage.html
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\WelcomePage.html
success 1 0
1621013372.349
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources
success 1 0
1621013372.365
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\images\loader.gif
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\images\loader.gif
success 1 0
1621013372.381
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\images\warning48x48.png
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\images\warning48x48.png
success 1 0
1621013372.396
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\images
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\images
success 1 0
1621013372.412
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\Config.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\Config.tis
success 1 0
1621013372.428
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\EventHandler.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\EventHandler.tis
success 1 0
1621013372.459
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\Log.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\Log.tis
success 1 0
1621013372.474
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\TranslateOfferTemplate.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\TranslateOfferTemplate.tis
success 1 0
1621013372.49
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\ViewStateLoader.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\ViewStateLoader.tis
success 1 0
1621013372.506
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis
success 1 0
1621013372.506
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\ru\DevLib.resources.dll
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\ru\DevLib.resources.dll
success 1 0
1621013372.537
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\ru
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\ru
success 1 0
1621013372.553
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\2021.05.14_18.29.31.490250_installer_pid=2260.txt
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\2021.05.14_18.29.31.490250_installer_pid=2260.txt
success 1 0
1621013372.584
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\app.ico
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\app.ico
success 1 0
1621013372.646
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\BundleConfig.json
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\BundleConfig.json
success 1 0
1621013372.678
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Carrier.EXE
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Carrier.EXE
success 1 0
Appends a new file extension or content to 89 files indicative of a ransomware file encryption process (50 out of 89 个事件)
Time & API Arguments Status Return Repeated
1621013371.443
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\de\DevLib.resources.dll
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\de\DevLib.resources.dll
success 1 0
1621013371.506
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\de
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\de
success 1 0
1621013371.521
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\en\DevLib.resources.dll
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\en\DevLib.resources.dll
success 1 0
1621013371.553
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\en
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\en
success 1 0
1621013371.568
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\es\DevLib.resources.dll
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\es\DevLib.resources.dll
success 1 0
1621013371.631
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\es
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\es
success 1 0
1621013371.646
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\fr\DevLib.resources.dll
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\fr\DevLib.resources.dll
success 1 0
1621013371.678
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\fr
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\fr
success 1 0
1621013371.693
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\it\DevLib.resources.dll
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\it\DevLib.resources.dll
success 1 0
1621013371.74
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\it
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\it
success 1 0
1621013371.74
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\pt\DevLib.resources.dll
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\pt\DevLib.resources.dll
success 1 0
1621013371.771
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\pt
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\pt
success 1 0
1621013371.787
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\images\loader.gif
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\images\loader.gif
success 1 0
1621013371.818
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\images\warning48x48.png
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\images\warning48x48.png
success 1 0
1621013371.849
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\images
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\images
success 1 0
1621013371.849
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\Config.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\Config.tis
success 1 0
1621013371.881
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\EventHandler.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\EventHandler.tis
success 1 0
1621013371.912
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\Log.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\Log.tis
success 1 0
1621013371.943
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\TranslateOfferTemplate.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\TranslateOfferTemplate.tis
success 1 0
1621013371.99
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\ViewStateLoader.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\ViewStateLoader.tis
success 1 0
1621013372.021
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis
success 1 0
1621013372.037
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\images\loader.gif
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\images\loader.gif
success 1 0
1621013372.053
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\images\warning48x48.png
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\images\warning48x48.png
success 1 0
1621013372.068
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\InstallingPage.html
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\InstallingPage.html
success 1 0
1621013372.099
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\LaunchCarrierPage.html
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\LaunchCarrierPage.html
success 1 0
1621013372.131
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\OfferPage.html
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\OfferPage.html
success 1 0
1621013372.162
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\ScanningPage.html
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\ScanningPage.html
success 1 0
1621013372.193
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\style.css
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\style.css
success 1 0
1621013372.24
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\Config.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\Config.tis
success 1 0
1621013372.256
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\EventHandler.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\EventHandler.tis
success 1 0
1621013372.271
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\Log.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\Log.tis
success 1 0
1621013372.287
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\TranslateOfferTemplate.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\TranslateOfferTemplate.tis
success 1 0
1621013372.303
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\ViewStateLoader.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\ViewStateLoader.tis
success 1 0
1621013372.318
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\WelcomePage.html
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\WelcomePage.html
success 1 0
1621013372.349
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources
success 1 0
1621013372.365
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\images\loader.gif
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\images\loader.gif
success 1 0
1621013372.381
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\images\warning48x48.png
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\images\warning48x48.png
success 1 0
1621013372.396
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\images
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\images
success 1 0
1621013372.412
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\Config.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\Config.tis
success 1 0
1621013372.428
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\EventHandler.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\EventHandler.tis
success 1 0
1621013372.459
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\Log.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\Log.tis
success 1 0
1621013372.474
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\TranslateOfferTemplate.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\TranslateOfferTemplate.tis
success 1 0
1621013372.49
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis\ViewStateLoader.tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis\ViewStateLoader.tis
success 1 0
1621013372.506
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Resources\tis
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Resources\tis
success 1 0
1621013372.506
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\ru\DevLib.resources.dll
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\ru\DevLib.resources.dll
success 1 0
1621013372.537
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\ru
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\ru
success 1 0
1621013372.553
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\2021.05.14_18.29.31.490250_installer_pid=2260.txt
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\2021.05.14_18.29.31.490250_installer_pid=2260.txt
success 1 0
1621013372.584
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\app.ico
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\app.ico
success 1 0
1621013372.646
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\BundleConfig.json
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\BundleConfig.json
success 1 0
1621013372.678
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS0E86A568\Carrier.EXE
newfilepath:
newfilepath_r:
flags: 4
oldfilepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7zS0E86A568\Carrier.EXE
success 1 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2260 resumed a thread in remote process 2620
Time & API Arguments Status Return Repeated
1621013375.974
NtResumeThread
thread_handle: 0x0000029c
suspend_count: 1
process_identifier: 2620
success 0 0
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2011-04-19 02:54:06

Imports

Library OLEAUT32.dll:
• 0x41b198 VariantClear
• 0x41b19c SysAllocString
Library USER32.dll:
• 0x41b1ac SendMessageA
• 0x41b1b0 SetTimer
• 0x41b1b4 DialogBoxParamW
• 0x41b1b8 DialogBoxParamA
• 0x41b1bc SetWindowLongA
• 0x41b1c0 GetWindowLongA
• 0x41b1c4 SetWindowTextW
• 0x41b1c8 LoadIconA
• 0x41b1cc LoadStringW
• 0x41b1d0 LoadStringA
• 0x41b1d4 CharUpperW
• 0x41b1d8 CharUpperA
• 0x41b1dc DestroyWindow
• 0x41b1e0 EndDialog
• 0x41b1e4 PostMessageA
• 0x41b1e8 ShowWindow
• 0x41b1ec MessageBoxW
• 0x41b1f0 GetDlgItem
• 0x41b1f4 KillTimer
• 0x41b1f8 SetWindowTextA
Library SHELL32.dll:
• 0x41b1a4 ShellExecuteExA
Library KERNEL32.dll:
• 0x41b004 GetStringTypeW
• 0x41b008 GetStringTypeA
• 0x41b00c LCMapStringW
• 0x41b010 LCMapStringA
• 0x41b01c GetProcAddress
• 0x41b020 GetOEMCP
• 0x41b024 GetACP
• 0x41b028 GetCPInfo
• 0x41b02c IsBadCodePtr
• 0x41b030 IsBadReadPtr
• 0x41b034 GetFileType
• 0x41b038 SetHandleCount
• 0x41b050 HeapSize
• 0x41b054 GetCurrentProcess
• 0x41b058 TerminateProcess
• 0x41b05c IsBadWritePtr
• 0x41b060 HeapCreate
• 0x41b064 HeapDestroy
• 0x41b070 TlsAlloc
• 0x41b074 ExitProcess
• 0x41b078 GetVersion
• 0x41b07c GetCommandLineA
• 0x41b080 GetStartupInfoA
• 0x41b084 GetModuleHandleA
• 0x41b088 WaitForSingleObject
• 0x41b08c CloseHandle
• 0x41b090 CreateProcessA
• 0x41b094 GetCommandLineW
• 0x41b098 GetVersionExA
• 0x41b0a8 MultiByteToWideChar
• 0x41b0ac WideCharToMultiByte
• 0x41b0b0 GetLastError
• 0x41b0b4 LoadLibraryA
• 0x41b0b8 GetModuleFileNameW
• 0x41b0bc GetModuleFileNameA
• 0x41b0c0 LocalFree
• 0x41b0c4 FormatMessageW
• 0x41b0c8 FormatMessageA
• 0x41b0cc SetFileTime
• 0x41b0d0 CreateFileW
• 0x41b0d4 SetLastError
• 0x41b0d8 SetFileAttributesW
• 0x41b0dc SetFileAttributesA
• 0x41b0e0 RemoveDirectoryW
• 0x41b0e4 RemoveDirectoryA
• 0x41b0e8 CreateDirectoryW
• 0x41b0ec CreateDirectoryA
• 0x41b0f0 DeleteFileW
• 0x41b0f4 DeleteFileA
• 0x41b0f8 GetFullPathNameW
• 0x41b0fc GetFullPathNameA
• 0x41b10c GetTempPathW
• 0x41b110 GetTempPathA
• 0x41b114 GetCurrentProcessId
• 0x41b118 GetTickCount
• 0x41b11c GetCurrentThreadId
• 0x41b120 FindClose
• 0x41b124 FindFirstFileW
• 0x41b128 FindFirstFileA
• 0x41b12c FindNextFileW
• 0x41b130 FindNextFileA
• 0x41b134 CreateFileA
• 0x41b138 GetFileSize
• 0x41b13c SetFilePointer
• 0x41b140 ReadFile
• 0x41b144 WriteFile
• 0x41b148 SetEndOfFile
• 0x41b14c GetStdHandle
• 0x41b154 Sleep
• 0x41b158 VirtualAlloc
• 0x41b15c VirtualFree
• 0x41b160 CreateEventA
• 0x41b164 SetEvent
• 0x41b168 ResetEvent
• 0x41b170 RtlUnwind
• 0x41b174 RaiseException
• 0x41b178 HeapAlloc
• 0x41b17c HeapFree
• 0x41b180 HeapReAlloc
• 0x41b184 CreateThread
• 0x41b188 TlsSetValue
• 0x41b18c TlsGetValue
• 0x41b190 ExitThread

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49224 104.16.235.79 h2oapi.adaware.com 443
192.168.56.101 49222 104.18.88.101 flow.lavasoft.com 80
192.168.56.101 49223 104.18.88.101 flow.lavasoft.com 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51378 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 57874 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 53658 239.255.255.250 3702
192.168.56.101 53660 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

URI Data
http://flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubBundleStart 
POST /v1/event-stat?ProductID=IS&Type=StubBundleStart HTTP/1.1
Host: flow.lavasoft.com
Accept: application/json
Content-Type: application/json
charsets: utf-8
Content-Length: 152

{"Data":{"BundleId":"SFT002","MachineId":"a2288c9b-45c8-1668-b277-802b13ff8a29","InstallId":"2934e9c7-7b26-4c3d-896a-6a65c9d6c6fd","InProcess":"true"}}
http://flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubStart 
POST /v1/event-stat?ProductID=IS&Type=StubStart HTTP/1.1
Host: flow.lavasoft.com
Accept: application/json
Content-Type: application/json
charsets: utf-8
Content-Length: 266

{"Data":{"BundleId":"SFT002","MachineId":"a2288c9b-45c8-1668-b277-802b13ff8a29","InstallId":"2934e9c7-7b26-4c3d-896a-6a65c9d6c6fd","OsVersion":"Microsoft Windows 7 Ultimate Edition Service Pack 1 (build 7601), 64-bit","DotNetFramework":"3.5, 4.0 Client, 4.0 Full"}}

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.