12.6
0-day
55 个模型检测该样本为恶意！
重新分析
更多

5d0fe828d087e58c38d1724aeced199e4fb352535621e09ab4875a2f960ddabb

c6e2170e866c52d57f8731d5b9700011.exe

分析耗时

169s

最近分析

文件大小

1011.0KB
静态报毒 动态报毒 @GW@AUOCVCNI AI SCORE=84 AIDETECTVM ALI2000015 CLASSIC CONFIDENCE DAQC DELF DELFINJECT DELPHILESS EMOY EMSE FAREIT GENETIC HIGH CONFIDENCE HOENYX HPLOKI KRYPTIK MALWARE1 MALWARE@#3F6NDMGYZSFYM QVM05 RCEKY SCORE SMBD STATIC AI SUSPICIOUS PE TCCZ TSCOPE TSPY UNSAFE X2094 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FVZ!C6E2170E866C 20201211 6.0.6.653
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
Avast Win32:Trojan-gen 20201210 21.1.5827.0
Baidu 20190318 1.0.0.2
Kingsoft 20201211 2017.9.26.565
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (14 个事件)
Time & API Arguments Status Return Repeated
1619912881.25075
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7400d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hdgfhjeu+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x73ef4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x73ef5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 184
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe06148d
success 0 0
1619912895.609
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7400d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hdgfhjeu+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x73f54b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x73f55d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe2e148d
success 0 0
1619912901.609625
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7400d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hdgfhjeu+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x73fa4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x73fa5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe20148d
success 0 0
1619912902.31275
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7400d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hdgfhjeu+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x73f04b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x73f05d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe2c148d
success 0 0
1619912903.734
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7400d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hdgfhjeu+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x73fa4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x73fa5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe49148d
success 0 0
1619912905.95375
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7400d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hdgfhjeu+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x73f04b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x73f05d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe26148d
success 0 0
1619912907.89
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7400d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hdgfhjeu+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x73fa4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x73fa5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfc69148d
success 0 0
1619912917.875625
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7400d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hdgfhjeu+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x73fa4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x73fa5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe33148d
success 0 0
1619912919.31275
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7400d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hdgfhjeu+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x73fa4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x73fa5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe2f148d
success 0 0
1619912924.156125
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7400d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hdgfhjeu+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x73fa4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x73fa5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfc88148d
success 0 0
1619912925.343375
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7400d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hdgfhjeu+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x73fa4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x73fa5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe16148d
success 0 0
1619912927.000875
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7400d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hdgfhjeu+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x73fa4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x73fa5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe4d148d
success 0 0
1619912934.750625
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7400d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hdgfhjeu+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x73fa4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x73fa5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe22148d
success 0 0
1619912936.87525
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7400d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hdgfhjeu+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x73fa4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x73fa5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfc64148d
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (50 out of 437 个事件)
Time & API Arguments Status Return Repeated
1619912872.3125
NtAllocateVirtualMemory
process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00610000
success 0 0
1619912872.3755
NtProtectVirtualMemory
process_identifier: 2420
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00471000
success 0 0
1619912872.3755
NtAllocateVirtualMemory
process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x024c0000
success 0 0
1619912873.65675
NtAllocateVirtualMemory
process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02420000
success 0 0
1619912873.67175
NtProtectVirtualMemory
process_identifier: 1208
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00471000
success 0 0
1619912873.68775
NtAllocateVirtualMemory
process_identifier: 1208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02500000
success 0 0
1619912875.89075
NtProtectVirtualMemory
process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619912876.20375
NtAllocateVirtualMemory
process_identifier: 3036
region_size: 851968
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01ef0000
success 0 0
1619912876.20375
NtAllocateVirtualMemory
process_identifier: 3036
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f80000
success 0 0
1619912876.20375
NtAllocateVirtualMemory
process_identifier: 3036
region_size: 630784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01fc0000
success 0 0
1619912876.20375
NtProtectVirtualMemory
process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 602112
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fc2000
success 0 0
1619912881.12575
NtProtectVirtualMemory
process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01da2000
success 0 0
1619912881.12575
NtProtectVirtualMemory
process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619912881.12575
NtProtectVirtualMemory
process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01da2000
success 0 0
1619912881.12575
NtProtectVirtualMemory
process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619912881.12575
NtProtectVirtualMemory
process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01da2000
success 0 0
1619912881.12575
NtProtectVirtualMemory
process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619912881.12575
NtProtectVirtualMemory
process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01da2000
success 0 0
1619912881.12575
NtProtectVirtualMemory
process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619912881.12575
NtProtectVirtualMemory
process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01da2000
success 0 0
1619912881.12575
NtProtectVirtualMemory
process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619912881.12575
NtProtectVirtualMemory
process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01da2000
success 0 0
1619912881.12575
NtProtectVirtualMemory
process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619912881.12575
NtProtectVirtualMemory
process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01da2000
success 0 0
1619912881.12575
NtProtectVirtualMemory
process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619912881.12575
NtProtectVirtualMemory
process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01da2000
success 0 0
1619912881.12575
NtProtectVirtualMemory
process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619912881.12575
NtProtectVirtualMemory
process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01da2000
success 0 0
1619912881.12575
NtProtectVirtualMemory
process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619912881.12575
NtProtectVirtualMemory
process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01da2000
success 0 0
1619912881.12575
NtProtectVirtualMemory
process_identifier: 3036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619912875.828375
NtAllocateVirtualMemory
process_identifier: 196
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02420000
success 0 0
1619912875.906375
NtProtectVirtualMemory
process_identifier: 196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00471000
success 0 0
1619912875.906375
NtAllocateVirtualMemory
process_identifier: 196
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02f70000
success 0 0
1619912895.28175
NtAllocateVirtualMemory
process_identifier: 3280
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00700000
success 0 0
1619912895.28175
NtProtectVirtualMemory
process_identifier: 3280
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00471000
success 0 0
1619912895.29675
NtAllocateVirtualMemory
process_identifier: 3280
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x007f0000
success 0 0
1619912895.593
NtProtectVirtualMemory
process_identifier: 3352
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619912895.609
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 1769472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02110000
success 0 0
1619912895.609
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02280000
success 0 0
1619912895.609
NtAllocateVirtualMemory
process_identifier: 3352
region_size: 630784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02030000
success 0 0
1619912895.609
NtProtectVirtualMemory
process_identifier: 3352
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 602112
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02032000
success 0 0
1619912895.609
NtProtectVirtualMemory
process_identifier: 3352
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1619912895.609
NtProtectVirtualMemory
process_identifier: 3352
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619912895.609
NtProtectVirtualMemory
process_identifier: 3352
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1619912895.609
NtProtectVirtualMemory
process_identifier: 3352
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619912895.609
NtProtectVirtualMemory
process_identifier: 3352
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1619912895.609
NtProtectVirtualMemory
process_identifier: 3352
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619912895.609
NtProtectVirtualMemory
process_identifier: 3352
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1619912895.609
NtProtectVirtualMemory
process_identifier: 3352
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\web.vbs
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (50 out of 71 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.4937889961563675 section {'size_of_data': '0x00076800', 'virtual_address': '0x0008c000', 'entropy': 7.4937889961563675, 'name': '.rsrc', 'virtual_size': '0x00076650'} description A section with a high entropy has been found
entropy 0.4693069306930693 description Overall entropy of this PE file is high
Expresses interest in specific running processes (1 个事件)
process hdgfhjeu.exe
Repeatedly searches for a not-found process, you may want to run a web browser during analysis (42 个事件)
Time & API Arguments Status Return Repeated
1619912872.3755
Process32NextW
process_name: conhost.exe
snapshot_handle: 0x00000110
process_identifier: 1272
failed 0 0
1619912873.68775
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000110
process_identifier: 2548
failed 0 0
1619912875.906375
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000110
process_identifier: 2740
failed 0 0
1619912895.046375
Process32NextW
process_name: hdgfhjeu.exe
snapshot_handle: 0x000003d0
process_identifier: 196
failed 0 0
1619912895.29675
Process32NextW
process_name: hdgfhjeu.exe
snapshot_handle: 0x00000110
process_identifier: 3280
failed 0 0
1619912895.640625
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000110
process_identifier: 3504
failed 0 0
1619912899.468625
Process32NextW
process_name: hdgfhjeu.exe
snapshot_handle: 0x000001a0
process_identifier: 3412
failed 0 0
1619912899.625875
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000110
process_identifier: 3572
failed 0 0
1619912901.64025
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000110
process_identifier: 3748
failed 0 0
1619912901.85925
Process32NextW
process_name: hdgfhjeu.exe
snapshot_handle: 0x0000011c
process_identifier: 3656
failed 0 0
1619912902.0315
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000110
process_identifier: 3816
failed 0 0
1619912902.328375
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000110
process_identifier: 3984
failed 0 0
1619912902.984375
Process32NextW
process_name: hdgfhjeu.exe
snapshot_handle: 0x0000012c
process_identifier: 3892
failed 0 0
1619912903.203375
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000110
process_identifier: 4052
failed 0 0
1619912903.765625
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000110
process_identifier: 1832
failed 0 0
1619912904.750625
Process32NextW
process_name: hdgfhjeu.exe
snapshot_handle: 0x00000138
process_identifier: 1824
failed 0 0
1619912904.953375
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000110
process_identifier: 3300
failed 0 0
1619912905.968
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000110
process_identifier: 3508
failed 0 0
1619912907.062
Process32NextW
process_name: hdgfhjeu.exe
snapshot_handle: 0x0000013c
process_identifier: 3372
failed 0 0
1619912907.265875
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000110
process_identifier: 3576
failed 0 0
1619912907.843625
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000110
process_identifier: 3808
failed 0 0
1619912916.812625
Process32NextW
process_name: mscorsvw.exe
snapshot_handle: 0x0000025c
process_identifier: 3880
failed 0 0
1619912917.562375
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000110
process_identifier: 4028
failed 0 0
1619912917.890875
Process32NextW
process_name: is32bit.exe
snapshot_handle: 0x00000110
process_identifier: 2128
failed 0 0
1619912918.656875
Process32NextW
process_name: hdgfhjeu.exe
snapshot_handle: 0x00000130
process_identifier: 3044
failed 0 0
1619912918.84325
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000110
process_identifier: 3176
failed 0 0
1619912919.343
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000114
process_identifier: 3716
failed 0 0
1619912920.328
Process32NextW
process_name: hdgfhjeu.exe
snapshot_handle: 0x0000013c
process_identifier: 3308
failed 0 0
1619912923.843625
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000110
process_identifier: 796
failed 0 0
1619912924.17175
Process32NextW
process_name: is32bit.exe
snapshot_handle: 0x00000110
process_identifier: 4008
failed 0 0
1619912924.82875
Process32NextW
process_name: hdgfhjeu.exe
snapshot_handle: 0x0000012c
process_identifier: 2456
failed 0 0
1619912925.031125
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000110
process_identifier: 4064
failed 0 0
1619912925.359
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000110
process_identifier: 3676
failed 0 0
1619912926.234
Process32NextW
process_name: hdgfhjeu.exe
snapshot_handle: 0x00000134
process_identifier: 3236
failed 0 0
1619912926.3905
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000110
process_identifier: 2260
failed 0 0
1619912927.0155
Process32NextW
process_name: is32bit.exe
snapshot_handle: 0x00000110
process_identifier: 3600
failed 0 0
1619912927.8905
Process32NextW
process_name: hdgfhjeu.exe
snapshot_handle: 0x00000134
process_identifier: 3460
failed 0 0
1619912928.03175
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000110
process_identifier: 3224
failed 0 0
1619912934.23425
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000110
process_identifier: 3824
failed 0 0
1619912935.43725
Process32NextW
process_name: hdgfhjeu.exe
snapshot_handle: 0x00000140
process_identifier: 2184
failed 0 0
1619912935.625875
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000110
process_identifier: 3172
failed 0 0
1619912936.6255
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000110
process_identifier: 360
failed 0 0
网络通信
Communicates with host for which no DNS query was performed (3 个事件)
host 172.217.24.14
host 203.208.41.65
host 203.208.41.98
Creates an Alternate Data Stream (ADS) (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hdgfhjeu.exe:ZoneIdentifier
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619912873.1875
NtAllocateVirtualMemory
process_identifier: 3064
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000118
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
Installs itself for autorun at Windows startup (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\web.vbs
Deletes executed files from disk (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hdgfhjeu.exe
Creates a thread using NtQueueApcThread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2420 created a thread in remote process 3064
Time & API Arguments Status Return Repeated
1619912873.1875
NtQueueApcThread
thread_handle: 0x00000120
process_identifier: 3064
function_address: 0x000b05c0
parameter: 0x000c0000
success 0 0
Potential code injection by writing to the memory of another process (2 个事件)
Time & API Arguments Status Return Repeated
1619912873.1875
WriteProcessMemory
process_identifier: 3064
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000118
base_address: 0x000b0000
success 1 0
1619912873.1875
WriteProcessMemory
process_identifier: 3064
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c6e2170e866c52d57f8731d5b9700011.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hdgfhjeu.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c6e2170e866c52d57f8731d5b9700011.exe" webSEt ztxp = creatEOBJeCt("WscriPT.shell") ztxP.run """%ls""", 0, False
process_handle: 0x00000118
base_address: 0x000c0000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (28 个事件)
Process injection Process 1208 called NtSetContextThread to modify thread in remote process 3036
Process injection Process 3280 called NtSetContextThread to modify thread in remote process 3352
Process injection Process 3516 called NtSetContextThread to modify thread in remote process 3588
Process injection Process 3760 called NtSetContextThread to modify thread in remote process 3832
Process injection Process 3996 called NtSetContextThread to modify thread in remote process 4068
Process injection Process 3140 called NtSetContextThread to modify thread in remote process 2952
Process injection Process 3356 called NtSetContextThread to modify thread in remote process 3620
Process injection Process 3952 called NtSetContextThread to modify thread in remote process 4048
Process injection Process 3296 called NtSetContextThread to modify thread in remote process 3392
Process injection Process 3752 called NtSetContextThread to modify thread in remote process 364
Process injection Process 3060 called NtSetContextThread to modify thread in remote process 3200
Process injection Process 3648 called NtSetContextThread to modify thread in remote process 3852
Process injection Process 2288 called NtSetContextThread to modify thread in remote process 3368
Process injection Process 3184 called NtSetContextThread to modify thread in remote process 2340
Time & API Arguments Status Return Repeated
1619912873.78175
NtSetContextThread
thread_handle: 0x00000120
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503936
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3036
success 0 0
1619912895.37575
NtSetContextThread
thread_handle: 0x00000120
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503936
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3352
success 0 0
1619912899.734875
NtSetContextThread
thread_handle: 0x00000120
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503936
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3588
success 0 0
1619912902.1405
NtSetContextThread
thread_handle: 0x00000120
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503936
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3832
success 0 0
1619912903.390375
NtSetContextThread
thread_handle: 0x00000120
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503936
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 4068
success 0 0
1619912905.234375
NtSetContextThread
thread_handle: 0x00000120
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503936
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2952
success 0 0
1619912907.609875
NtSetContextThread
thread_handle: 0x00000120
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503936
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3620
success 0 0
1619912917.656375
NtSetContextThread
thread_handle: 0x00000120
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503936
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 4048
success 0 0
1619912919.01525
NtSetContextThread
thread_handle: 0x00000120
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503936
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3392
success 0 0
1619912923.968625
NtSetContextThread
thread_handle: 0x00000120
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503936
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 364
success 0 0
1619912925.109125
NtSetContextThread
thread_handle: 0x00000120
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503936
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3200
success 0 0
1619912926.5625
NtSetContextThread
thread_handle: 0x00000120
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503936
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3852
success 0 0
1619912928.71875
NtSetContextThread
thread_handle: 0x00000120
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503936
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3368
success 0 0
1619912935.765875
NtSetContextThread
thread_handle: 0x00000120
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503936
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2340
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (28 个事件)
Process injection Process 1208 resumed a thread in remote process 3036
Process injection Process 3280 resumed a thread in remote process 3352
Process injection Process 3516 resumed a thread in remote process 3588
Process injection Process 3760 resumed a thread in remote process 3832
Process injection Process 3996 resumed a thread in remote process 4068
Process injection Process 3140 resumed a thread in remote process 2952
Process injection Process 3356 resumed a thread in remote process 3620
Process injection Process 3952 resumed a thread in remote process 4048
Process injection Process 3296 resumed a thread in remote process 3392
Process injection Process 3752 resumed a thread in remote process 364
Process injection Process 3060 resumed a thread in remote process 3200
Process injection Process 3648 resumed a thread in remote process 3852
Process injection Process 2288 resumed a thread in remote process 3368
Process injection Process 3184 resumed a thread in remote process 2340
Time & API Arguments Status Return Repeated
1619912875.65675
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 3036
success 0 0
1619912895.43775
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 3352
success 0 0
1619912901.453875
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 3588
success 0 0
1619912902.1565
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 3832
success 0 0
1619912903.546375
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 4068
success 0 0
1619912905.765375
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 2952
success 0 0
1619912907.671875
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 3620
success 0 0
1619912917.703375
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 4048
success 0 0
1619912919.15625
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 3392
success 0 0
1619912924.000625
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 364
success 0 0
1619912925.171125
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 3200
success 0 0
1619912926.8435
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 3852
success 0 0
1619912934.06275
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 3368
success 0 0
1619912936.453875
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 2340
success 0 0
Executed a process and injected code into it, probably while unpacking (50 out of 117 个事件)
Time & API Arguments Status Return Repeated
1619912873.1875
CreateProcessInternalW
thread_identifier: 284
thread_handle: 0x00000120
process_identifier: 3064
current_directory:
filepath: C:\Windows\System32\notepad.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\notepad.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619912873.1875
NtAllocateVirtualMemory
process_identifier: 3064
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000118
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
1619912873.1875
NtAllocateVirtualMemory
process_identifier: 3064
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
process_handle: 0x00000118
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000c0000
success 0 0
1619912873.1875
WriteProcessMemory
process_identifier: 3064
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000118
base_address: 0x000b0000
success 1 0
1619912873.1875
WriteProcessMemory
process_identifier: 3064
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c6e2170e866c52d57f8731d5b9700011.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hdgfhjeu.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c6e2170e866c52d57f8731d5b9700011.exe" webSEt ztxp = creatEOBJeCt("WscriPT.shell") ztxP.run """%ls""", 0, False
process_handle: 0x00000118
base_address: 0x000c0000
success 1 0
1619912873.53125
CreateProcessInternalW
thread_identifier: 2656
thread_handle: 0x000000d0
process_identifier: 1208
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hdgfhjeu.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hdgfhjeu.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000000cc
inherit_handles: 0
success 1 0
1619912873.75075
CreateProcessInternalW
thread_identifier: 2428
thread_handle: 0x00000120
process_identifier: 3036
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hdgfhjeu.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619912873.75075
NtUnmapViewOfSection
process_identifier: 3036
region_size: 4096
process_handle: 0x00000118
base_address: 0x00400000
success 0 0
1619912873.75075
NtMapViewOfSection
section_handle: 0x00000128
process_identifier: 3036
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000118
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619912873.78175
NtGetContextThread
thread_handle: 0x00000120
success 0 0
1619912873.78175
NtSetContextThread
thread_handle: 0x00000120
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503936
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3036
success 0 0
1619912875.65675
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 3036
success 0 0
1619912875.67175
CreateProcessInternalW
thread_identifier: 2032
thread_handle: 0x00000124
process_identifier: 196
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hdgfhjeu.exe" 2 3036 13312906
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000134
inherit_handles: 0
success 1 0
1619912895.078375
CreateProcessInternalW
thread_identifier: 3284
thread_handle: 0x000003d4
process_identifier: 3280
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hdgfhjeu.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hdgfhjeu.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000003d8
inherit_handles: 0
success 1 0
1619912895.34375
CreateProcessInternalW
thread_identifier: 3356
thread_handle: 0x00000120
process_identifier: 3352
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hdgfhjeu.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619912895.34375
NtUnmapViewOfSection
process_identifier: 3352
region_size: 4096
process_handle: 0x00000118
base_address: 0x00400000
success 0 0
1619912895.34375
NtMapViewOfSection
section_handle: 0x00000128
process_identifier: 3352
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000118
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619912895.37575
NtGetContextThread
thread_handle: 0x00000120
success 0 0
1619912895.37575
NtSetContextThread
thread_handle: 0x00000120
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503936
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3352
success 0 0
1619912895.43775
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 3352
success 0 0
1619912895.45375
CreateProcessInternalW
thread_identifier: 3416
thread_handle: 0x00000124
process_identifier: 3412
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hdgfhjeu.exe" 2 3352 13332687
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000134
inherit_handles: 0
success 1 0
1619912899.468625
CreateProcessInternalW
thread_identifier: 3520
thread_handle: 0x000001a4
process_identifier: 3516
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hdgfhjeu.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hdgfhjeu.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000001a8
inherit_handles: 0
success 1 0
1619912899.703875
CreateProcessInternalW
thread_identifier: 3592
thread_handle: 0x00000120
process_identifier: 3588
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hdgfhjeu.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619912899.703875
NtUnmapViewOfSection
process_identifier: 3588
region_size: 4096
process_handle: 0x00000118
base_address: 0x00400000
success 0 0
1619912899.718875
NtMapViewOfSection
section_handle: 0x00000128
process_identifier: 3588
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000118
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619912899.734875
NtGetContextThread
thread_handle: 0x00000120
success 0 0
1619912899.734875
NtSetContextThread
thread_handle: 0x00000120
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503936
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3588
success 0 0
1619912901.453875
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 3588
success 0 0
1619912901.468875
CreateProcessInternalW
thread_identifier: 3660
thread_handle: 0x00000124
process_identifier: 3656
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hdgfhjeu.exe" 2 3588 13338703
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000134
inherit_handles: 0
success 1 0
1619912901.85925
CreateProcessInternalW
thread_identifier: 3764
thread_handle: 0x00000120
process_identifier: 3760
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hdgfhjeu.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hdgfhjeu.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000124
inherit_handles: 0
success 1 0
1619912902.1095
CreateProcessInternalW
thread_identifier: 3836
thread_handle: 0x00000120
process_identifier: 3832
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hdgfhjeu.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619912902.1095
NtUnmapViewOfSection
process_identifier: 3832
region_size: 4096
process_handle: 0x00000118
base_address: 0x00400000
success 0 0
1619912902.1095
NtMapViewOfSection
section_handle: 0x00000128
process_identifier: 3832
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000118
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619912902.1255
NtGetContextThread
thread_handle: 0x00000120
success 0 0
1619912902.1405
NtSetContextThread
thread_handle: 0x00000120
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503936
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3832
success 0 0
1619912902.1565
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 3832
success 0 0
1619912902.1715
CreateProcessInternalW
thread_identifier: 3896
thread_handle: 0x00000124
process_identifier: 3892
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hdgfhjeu.exe" 2 3832 13339406
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000134
inherit_handles: 0
success 1 0
1619912903.031375
CreateProcessInternalW
thread_identifier: 4000
thread_handle: 0x00000130
process_identifier: 3996
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hdgfhjeu.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hdgfhjeu.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000134
inherit_handles: 0
success 1 0
1619912903.281375
CreateProcessInternalW
thread_identifier: 4072
thread_handle: 0x00000120
process_identifier: 4068
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hdgfhjeu.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619912903.281375
NtUnmapViewOfSection
process_identifier: 4068
region_size: 4096
process_handle: 0x00000118
base_address: 0x00400000
success 0 0
1619912903.281375
NtMapViewOfSection
section_handle: 0x00000128
process_identifier: 4068
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000118
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619912903.390375
NtGetContextThread
thread_handle: 0x00000120
success 0 0
1619912903.390375
NtSetContextThread
thread_handle: 0x00000120
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5503936
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 4068
success 0 0
1619912903.546375
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 4068
success 0 0
1619912903.578375
CreateProcessInternalW
thread_identifier: 1868
thread_handle: 0x00000124
process_identifier: 1824
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hdgfhjeu.exe" 2 4068 13340796
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000134
inherit_handles: 0
success 1 0
1619912904.796625
CreateProcessInternalW
thread_identifier: 2948
thread_handle: 0x0000013c
process_identifier: 3140
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hdgfhjeu.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hdgfhjeu.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000140
inherit_handles: 0
success 1 0
1619912905.031375
CreateProcessInternalW
thread_identifier: 2656
thread_handle: 0x00000120
process_identifier: 2952
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\hdgfhjeu.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619912905.031375
NtUnmapViewOfSection
process_identifier: 2952
region_size: 4096
process_handle: 0x00000118
base_address: 0x00400000
success 0 0
1619912905.031375
NtMapViewOfSection
section_handle: 0x00000128
process_identifier: 2952
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000118
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619912905.234375
NtGetContextThread
thread_handle: 0x00000120
success 0 0
File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
DrWeb Trojan.PWS.Stealer.28962
MicroWorld-eScan Trojan.Delf.FareIt.Gen.7
FireEye Generic.mg.c6e2170e866c52d5
Qihoo-360 Generic/HEUR/QVM05.1.B6FB.Malware.Gen
McAfee Fareit-FVZ!C6E2170E866C
Cylance Unsafe
Sangfor Malware
K7AntiVirus Trojan ( 0056aeff1 )
Alibaba Trojan:Win32/DelfInject.ali2000015
K7GW Trojan ( 0056aeff1 )
Cybereason malicious.acc968
Arcabit Trojan.Delf.FareIt.Gen.7
BitDefenderTheta Gen:NN.ZelphiF.34670.@GW@auoCvcni
Cyren W32/Injector.TCCZ-7150
Symantec Trojan.Gen.2
ESET-NOD32 a variant of Win32/Injector.EMSE
APEX Malicious
Avast Win32:Trojan-gen
ClamAV Win.Malware.Daqc-6598201-0
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
BitDefender Trojan.Delf.FareIt.Gen.7
NANO-Antivirus Trojan.Win32.Delf.hoenyx
Paloalto generic.ml
Ad-Aware Trojan.Delf.FareIt.Gen.7
Emsisoft Trojan.Delf.FareIt.Gen.7 (B)
Comodo Malware@#3f6ndmgyzsfym
F-Secure Trojan.TR/Injector.rceky
VIPRE Trojan.Win32.Generic!BT
TrendMicro TSPY_HPLOKI.SMBD
McAfee-GW-Edition BehavesLike.Win32.Fareit.fc
Sophos Mal/Generic-S
SentinelOne Static AI - Suspicious PE
Avira TR/Injector.rceky
Antiy-AVL Trojan/Win32.Kryptik
Microsoft PWS:Win32/Fareit.AQ!MTB
AegisLab Trojan.Win32.FareIt.4!c
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
GData Trojan.Delf.FareIt.Gen.7
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2094
Acronis suspicious
VBA32 TScope.Trojan.Delf
MAX malware (ai score=84)
Malwarebytes Trojan.MalPack.DLF
Zoner Trojan.Win32.91567
TrendMicro-HouseCall TSPY_HPLOKI.SMBD
Rising Trojan.Injector!1.C99D (CLASSIC)
Ikarus Trojan.Inject
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)
dead_host 172.217.24.14:443
dead_host 172.217.160.78:443
dead_host 172.217.27.142:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x47e178 VirtualFree
• 0x47e17c VirtualAlloc
• 0x47e180 LocalFree
• 0x47e184 LocalAlloc
• 0x47e188 GetVersion
• 0x47e18c GetCurrentThreadId
• 0x47e198 VirtualQuery
• 0x47e19c WideCharToMultiByte
• 0x47e1a0 MultiByteToWideChar
• 0x47e1a4 lstrlenA
• 0x47e1a8 lstrcpynA
• 0x47e1ac LoadLibraryExA
• 0x47e1b0 GetThreadLocale
• 0x47e1b4 GetStartupInfoA
• 0x47e1b8 GetProcAddress
• 0x47e1bc GetModuleHandleA
• 0x47e1c0 GetModuleFileNameA
• 0x47e1c4 GetLocaleInfoA
• 0x47e1c8 GetCommandLineA
• 0x47e1cc FreeLibrary
• 0x47e1d0 FindFirstFileA
• 0x47e1d4 FindClose
• 0x47e1d8 ExitProcess
• 0x47e1dc WriteFile
• 0x47e1e4 RtlUnwind
• 0x47e1e8 RaiseException
• 0x47e1ec GetStdHandle
Library user32.dll:
• 0x47e1f4 GetKeyboardType
• 0x47e1f8 LoadStringA
• 0x47e1fc MessageBoxA
• 0x47e200 CharNextA
Library advapi32.dll:
• 0x47e208 RegQueryValueExA
• 0x47e20c RegOpenKeyExA
• 0x47e210 RegCloseKey
Library oleaut32.dll:
• 0x47e218 SysFreeString
• 0x47e21c SysReAllocStringLen
• 0x47e220 SysAllocStringLen
Library kernel32.dll:
• 0x47e228 TlsSetValue
• 0x47e22c TlsGetValue
• 0x47e230 LocalAlloc
• 0x47e234 GetModuleHandleA
Library advapi32.dll:
• 0x47e23c RegQueryValueExA
• 0x47e240 RegOpenKeyExA
• 0x47e244 RegCloseKey
Library kernel32.dll:
• 0x47e24c lstrcpyA
• 0x47e250 WriteFile
• 0x47e254 WaitForSingleObject
• 0x47e258 VirtualQuery
• 0x47e25c VirtualProtect
• 0x47e260 VirtualAlloc
• 0x47e264 Sleep
• 0x47e268 SizeofResource
• 0x47e26c SetThreadLocale
• 0x47e270 SetFilePointer
• 0x47e274 SetEvent
• 0x47e278 SetErrorMode
• 0x47e27c SetEndOfFile
• 0x47e280 ResetEvent
• 0x47e284 ReadFile
• 0x47e288 MultiByteToWideChar
• 0x47e28c MulDiv
• 0x47e290 LockResource
• 0x47e294 LoadResource
• 0x47e298 LoadLibraryA
• 0x47e2a4 GlobalUnlock
• 0x47e2a8 GlobalSize
• 0x47e2ac GlobalReAlloc
• 0x47e2b0 GlobalHandle
• 0x47e2b4 GlobalLock
• 0x47e2b8 GlobalFree
• 0x47e2bc GlobalFindAtomA
• 0x47e2c0 GlobalDeleteAtom
• 0x47e2c4 GlobalAlloc
• 0x47e2c8 GlobalAddAtomA
• 0x47e2cc GetVersionExA
• 0x47e2d0 GetVersion
• 0x47e2d4 GetUserDefaultLCID
• 0x47e2d8 GetTickCount
• 0x47e2dc GetThreadLocale
• 0x47e2e0 GetSystemInfo
• 0x47e2e4 GetStringTypeExA
• 0x47e2e8 GetStdHandle
• 0x47e2ec GetProcAddress
• 0x47e2f0 GetModuleHandleA
• 0x47e2f4 GetModuleFileNameA
• 0x47e2f8 GetLocaleInfoA
• 0x47e2fc GetLocalTime
• 0x47e300 GetLastError
• 0x47e304 GetFullPathNameA
• 0x47e308 GetFileAttributesA
• 0x47e30c GetDiskFreeSpaceA
• 0x47e310 GetDateFormatA
• 0x47e314 GetCurrentThreadId
• 0x47e318 GetCurrentProcessId
• 0x47e31c GetComputerNameA
• 0x47e320 GetCPInfo
• 0x47e324 GetACP
• 0x47e328 FreeResource
• 0x47e32c InterlockedExchange
• 0x47e330 FreeLibrary
• 0x47e334 FormatMessageA
• 0x47e338 FindResourceA
• 0x47e33c FindFirstFileA
• 0x47e340 FindClose
• 0x47e34c EnumCalendarInfoA
• 0x47e358 CreateThread
• 0x47e35c CreateFileA
• 0x47e360 CreateEventA
• 0x47e364 CompareStringA
• 0x47e368 CloseHandle
Library version.dll:
• 0x47e370 VerQueryValueA
• 0x47e378 GetFileVersionInfoA
Library gdi32.dll:
• 0x47e380 UnrealizeObject
• 0x47e384 StretchBlt
• 0x47e388 SetWindowOrgEx
• 0x47e38c SetWinMetaFileBits
• 0x47e390 SetViewportOrgEx
• 0x47e394 SetTextColor
• 0x47e398 SetStretchBltMode
• 0x47e39c SetROP2
• 0x47e3a0 SetPixel
• 0x47e3a4 SetMapMode
• 0x47e3a8 SetEnhMetaFileBits
• 0x47e3ac SetDIBColorTable
• 0x47e3b0 SetBrushOrgEx
• 0x47e3b4 SetBkMode
• 0x47e3b8 SetBkColor
• 0x47e3bc SelectPalette
• 0x47e3c0 SelectObject
• 0x47e3c4 SelectClipRgn
• 0x47e3c8 SaveDC
• 0x47e3cc RestoreDC
• 0x47e3d0 Rectangle
• 0x47e3d4 RectVisible
• 0x47e3d8 RealizePalette
• 0x47e3dc Polyline
• 0x47e3e0 PlayEnhMetaFile
• 0x47e3e4 PatBlt
• 0x47e3e8 MoveToEx
• 0x47e3ec MaskBlt
• 0x47e3f0 LineTo
• 0x47e3f4 LPtoDP
• 0x47e3f8 IntersectClipRect
• 0x47e3fc GetWindowOrgEx
• 0x47e400 GetWinMetaFileBits
• 0x47e404 GetTextMetricsA
• 0x47e410 GetStockObject
• 0x47e414 GetPixel
• 0x47e418 GetPaletteEntries
• 0x47e41c GetObjectA
• 0x47e42c GetEnhMetaFileBits
• 0x47e430 GetDeviceCaps
• 0x47e434 GetDIBits
• 0x47e438 GetDIBColorTable
• 0x47e43c GetDCOrgEx
• 0x47e444 GetClipBox
• 0x47e448 GetBrushOrgEx
• 0x47e44c GetBitmapBits
• 0x47e450 ExcludeClipRect
• 0x47e454 DeleteObject
• 0x47e458 DeleteEnhMetaFile
• 0x47e45c DeleteDC
• 0x47e460 CreateSolidBrush
• 0x47e464 CreatePenIndirect
• 0x47e468 CreatePen
• 0x47e46c CreatePalette
• 0x47e474 CreateFontIndirectA
• 0x47e478 CreateEnhMetaFileA
• 0x47e47c CreateDIBitmap
• 0x47e480 CreateDIBSection
• 0x47e484 CreateCompatibleDC
• 0x47e48c CreateBrushIndirect
• 0x47e490 CreateBitmap
• 0x47e494 CopyEnhMetaFileA
• 0x47e498 CloseEnhMetaFile
• 0x47e49c BitBlt
Library opengl32.dll:
• 0x47e4a4 wglDeleteContext
Library user32.dll:
• 0x47e4ac CreateWindowExA
• 0x47e4b0 WindowFromPoint
• 0x47e4b4 WinHelpA
• 0x47e4b8 WaitMessage
• 0x47e4bc ValidateRect
• 0x47e4c0 UpdateWindow
• 0x47e4c4 UnregisterClassA
• 0x47e4c8 UnhookWindowsHookEx
• 0x47e4cc TranslateMessage
• 0x47e4d4 TrackPopupMenu
• 0x47e4dc ShowWindow
• 0x47e4e0 ShowScrollBar
• 0x47e4e4 ShowOwnedPopups
• 0x47e4e8 ShowCursor
• 0x47e4ec SetWindowsHookExA
• 0x47e4f0 SetWindowTextA
• 0x47e4f4 SetWindowPos
• 0x47e4f8 SetWindowPlacement
• 0x47e4fc SetWindowLongA
• 0x47e500 SetTimer
• 0x47e504 SetScrollRange
• 0x47e508 SetScrollPos
• 0x47e50c SetScrollInfo
• 0x47e510 SetRect
• 0x47e514 SetPropA
• 0x47e518 SetParent
• 0x47e51c SetMenuItemInfoA
• 0x47e520 SetMenu
• 0x47e524 SetForegroundWindow
• 0x47e528 SetFocus
• 0x47e52c SetCursor
• 0x47e530 SetClassLongA
• 0x47e534 SetCapture
• 0x47e538 SetActiveWindow
• 0x47e53c SendMessageA
• 0x47e540 ScrollWindow
• 0x47e544 ScreenToClient
• 0x47e548 RemovePropA
• 0x47e54c RemoveMenu
• 0x47e550 ReleaseDC
• 0x47e554 ReleaseCapture
• 0x47e560 RegisterClassA
• 0x47e564 RedrawWindow
• 0x47e568 PtInRect
• 0x47e56c PostQuitMessage
• 0x47e570 PostMessageA
• 0x47e574 PeekMessageA
• 0x47e578 OffsetRect
• 0x47e57c OemToCharA
• 0x47e580 MessageBoxA
• 0x47e584 MapWindowPoints
• 0x47e588 MapVirtualKeyA
• 0x47e58c LoadStringA
• 0x47e590 LoadKeyboardLayoutA
• 0x47e594 LoadIconA
• 0x47e598 LoadCursorA
• 0x47e59c LoadBitmapA
• 0x47e5a0 KillTimer
• 0x47e5a4 IsZoomed
• 0x47e5a8 IsWindowVisible
• 0x47e5ac IsWindowEnabled
• 0x47e5b0 IsWindow
• 0x47e5b4 IsRectEmpty
• 0x47e5b8 IsIconic
• 0x47e5bc IsDialogMessageA
• 0x47e5c0 IsChild
• 0x47e5c4 InvalidateRect
• 0x47e5c8 IntersectRect
• 0x47e5cc InsertMenuItemA
• 0x47e5d0 InsertMenuA
• 0x47e5d4 InflateRect
• 0x47e5dc GetWindowTextA
• 0x47e5e0 GetWindowRect
• 0x47e5e4 GetWindowPlacement
• 0x47e5e8 GetWindowLongA
• 0x47e5ec GetWindowDC
• 0x47e5f0 GetTopWindow
• 0x47e5f4 GetSystemMetrics
• 0x47e5f8 GetSystemMenu
• 0x47e5fc GetSysColorBrush
• 0x47e600 GetSysColor
• 0x47e604 GetSubMenu
• 0x47e608 GetScrollRange
• 0x47e60c GetScrollPos
• 0x47e610 GetScrollInfo
• 0x47e614 GetPropA
• 0x47e618 GetParent
• 0x47e61c GetWindow
• 0x47e620 GetMessageTime
• 0x47e624 GetMenuStringA
• 0x47e628 GetMenuState
• 0x47e62c GetMenuItemInfoA
• 0x47e630 GetMenuItemID
• 0x47e634 GetMenuItemCount
• 0x47e638 GetMenu
• 0x47e63c GetLastActivePopup
• 0x47e640 GetKeyboardState
• 0x47e648 GetKeyboardLayout
• 0x47e64c GetKeyState
• 0x47e650 GetKeyNameTextA
• 0x47e654 GetIconInfo
• 0x47e658 GetForegroundWindow
• 0x47e65c GetFocus
• 0x47e660 GetDlgItem
• 0x47e664 GetDesktopWindow
• 0x47e668 GetDCEx
• 0x47e66c GetDC
• 0x47e670 GetCursorPos
• 0x47e674 GetCursor
• 0x47e678 GetClipboardData
• 0x47e67c GetClientRect
• 0x47e680 GetClassNameA
• 0x47e684 GetClassInfoA
• 0x47e688 GetCapture
• 0x47e68c GetActiveWindow
• 0x47e690 FrameRect
• 0x47e694 FindWindowA
• 0x47e698 FillRect
• 0x47e69c EqualRect
• 0x47e6a0 EnumWindows
• 0x47e6a4 EnumThreadWindows
• 0x47e6a8 EndPaint
• 0x47e6ac EnableWindow
• 0x47e6b0 EnableScrollBar
• 0x47e6b4 EnableMenuItem
• 0x47e6b8 DrawTextA
• 0x47e6bc DrawMenuBar
• 0x47e6c0 DrawIconEx
• 0x47e6c4 DrawIcon
• 0x47e6c8 DrawFrameControl
• 0x47e6cc DrawEdge
• 0x47e6d0 DispatchMessageA
• 0x47e6d4 DestroyWindow
• 0x47e6d8 DestroyMenu
• 0x47e6dc DestroyIcon
• 0x47e6e0 DestroyCursor
• 0x47e6e4 DeleteMenu
• 0x47e6e8 DefWindowProcA
• 0x47e6ec DefMDIChildProcA
• 0x47e6f0 DefFrameProcA
• 0x47e6f4 CreatePopupMenu
• 0x47e6f8 CreateMenu
• 0x47e6fc CreateIcon
• 0x47e700 ClientToScreen
• 0x47e704 CheckMenuItem
• 0x47e708 CallWindowProcA
• 0x47e70c CallNextHookEx
• 0x47e710 BeginPaint
• 0x47e714 CharNextA
• 0x47e718 CharLowerBuffA
• 0x47e71c CharLowerA
• 0x47e720 CharUpperBuffA
• 0x47e724 CharToOemA
• 0x47e728 AdjustWindowRectEx
Library kernel32.dll:
• 0x47e734 Sleep
Library oleaut32.dll:
• 0x47e73c SafeArrayPtrOfIndex
• 0x47e740 SafeArrayPutElement
• 0x47e744 SafeArrayGetElement
• 0x47e74c SafeArrayAccessData
• 0x47e750 SafeArrayGetUBound
• 0x47e754 SafeArrayGetLBound
• 0x47e758 SafeArrayCreate
• 0x47e75c VariantChangeType
• 0x47e760 VariantCopyInd
• 0x47e764 VariantCopy
• 0x47e768 VariantClear
• 0x47e76c VariantInit
Library ole32.dll:
• 0x47e778 IsAccelerator
• 0x47e77c OleDraw
• 0x47e784 CoTaskMemFree
• 0x47e788 ProgIDFromCLSID
• 0x47e78c StringFromCLSID
• 0x47e790 CoCreateInstance
• 0x47e794 CoGetClassObject
• 0x47e798 CoUninitialize
• 0x47e79c CoInitialize
• 0x47e7a0 IsEqualGUID
Library oleaut32.dll:
• 0x47e7a8 GetErrorInfo
• 0x47e7ac GetActiveObject
• 0x47e7b0 SysFreeString
Library comctl32.dll:
• 0x47e7c0 ImageList_Write
• 0x47e7c4 ImageList_Read
• 0x47e7d4 ImageList_DragMove
• 0x47e7d8 ImageList_DragLeave
• 0x47e7dc ImageList_DragEnter
• 0x47e7e0 ImageList_EndDrag
• 0x47e7e4 ImageList_BeginDrag
• 0x47e7e8 ImageList_Remove
• 0x47e7ec ImageList_DrawEx
• 0x47e7f0 ImageList_Replace
• 0x47e7f4 ImageList_Draw
• 0x47e804 ImageList_Add
• 0x47e80c ImageList_Destroy
• 0x47e810 ImageList_Create
• 0x47e814 InitCommonControls
Library comdlg32.dll:
• 0x47e81c GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 62912 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.