SmartHawk

10.4

0-day

50 个模型检测该样本为恶意！

重新分析

下载样本

009408ca7bf5c48fc1140cbe594f1461defd77206be643e1f9bd548986ad636c

d0701ed7d9f1030611b80bc4a5d375c6.exe

分析耗时

83s

最近分析

文件大小

420.0KB

静态报毒动态报毒 AGENSLA AI SCORE=83 AM0@AIPCQ9RI ATTRIBUTE BSCOPE CLOUD CONFIDENCE EKHYG EMEU EMIQ GENERICRXKZ GENKRYPTIK HIGH CONFIDENCE HIGHCONFIDENCE HW32 INJECT3 KRYPT KRYPTIK MALICIOUS PE MALWAREX MASSLOGGER OCCAMY RAZY SCORE SUSGEN TROJANPSW UNSAFE UPATRE USXVPFA20 WACATAC ZEVBAF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	TrojanPSW:MSIL/Agensla.7fe4cc40	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:MalwareX-gen [Trj]	20200625	18.4.3895.0
Kingsoft		20200625	2013.8.14.323
McAfee	GenericRXKZ-HN!D0701ED7D9F1	20200625	6.0.6.653
Tencent		20200625	1.0.0.1
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

Queries for the computername (4 个事件)

Time & API	Arguments	Status	Return
1619933659.126625 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619933660.017625 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619933661.642625 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619933661.830625 GetComputerNameW	computer_name: OSKAR-PC	success	1

Checks if process is being debugged by a debugger (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619933645.626625 IsDebuggerPresent		failed	0	0
1619933645.626625 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619933645.673625 GlobalMemoryStatusEx		success	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

CUSTOM

One or more processes crashed (50 out of 504 个事件)

Time & API	Arguments	Status
1619910852.543495 __exception__	stacktrace: d0701ed7d9f1030611b80bc4a5d375c6+0x5f5a7 @ 0x45f5a7 EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 d0701ed7d9f1030611b80bc4a5d375c6+0x154a @ 0x40154a RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637168 registers.edi: 1 registers.eax: 4239496 registers.ebp: 1637332 registers.edx: 1637292 registers.ebx: 4925345 registers.esi: 4982740 registers.ecx: 4915200 exception.instruction_r: e5 c5 c3 74 9c e4 7a a4 14 57 59 f2 26 b1 d0 12 exception.instruction: in eax, -0x3b exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x4b278d	success
1619910852.543495 __exception__	stacktrace: registers.esp: 1635360 registers.edi: 0 registers.eax: 16 registers.ebp: 1636044 registers.edx: 2010606285 registers.ebx: 4918209 registers.esi: 0 registers.ecx: 4925345 exception.instruction_r: ec 81 45 59 8f 7b 03 47 6e 49 24 3d 5c 52 3e 0c exception.instruction: in al, dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x4b0b65	success
1619910852.543495 __exception__	stacktrace: registers.esp: 1635348 registers.edi: 0 registers.eax: 0 registers.ebp: 1636044 registers.edx: 1826252433 registers.ebx: 0 registers.esi: 4924854 registers.ecx: 0 exception.instruction_r: 6c 4c 02 dc 9d cb e7 e9 a9 82 99 5d f5 eb 31 5e exception.instruction: insb byte ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x4b24db	success
1619910852.543495 __exception__	stacktrace: registers.esp: 1633536 registers.edi: 4919544 registers.eax: 16 registers.ebp: 1634224 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 4924854 exception.instruction_r: cf 23 74 47 cc 4f 78 67 70 15 f2 1d 4d 9f 2a a3 exception.instruction: iretd exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4b10e6	success
1619910852.543495 __exception__	stacktrace: registers.esp: 1637140 registers.edi: 1 registers.eax: 4239496 registers.ebp: 4921723 registers.edx: 1637292 registers.ebx: 1637316 registers.esi: 4982740 registers.ecx: 4915200 exception.instruction_r: cd 2e e9 d9 f2 ff ff 01 0c 07 5f e9 b6 ec ff ff exception.instruction: int 0x2e exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x4b25e6	success
1619910852.543495 __exception__	stacktrace: d0701ed7d9f1030611b80bc4a5d375c6+0x1336 @ 0x401336 d0701ed7d9f1030611b80bc4a5d375c6+0x1336 @ 0x401336 __vbaBoolErrVar+0x2c1e __vbaExceptHandler-0x139 msvbvm60+0xe46a6 @ 0x72a246a6 CreateIExprSrvObj+0x9f2 _CIexp-0x2058 msvbvm60+0xebcb9 @ 0x72a2bcb9 WinSqmSetIfMaxDWORD+0x35 RtlGetThreadErrorMode-0x23b ntdll+0x71ecd @ 0x77da1ecd registers.esp: 1637132 registers.edi: 1 registers.eax: 4239496 registers.ebp: 1637316 registers.edx: 1637292 registers.ebx: 1637316 registers.esi: 4917297 registers.ecx: 4915200 exception.instruction_r: ec e9 e5 fe ff ff 85 c0 5e 58 59 eb 29 eb 0c e9 exception.instruction: in al, dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x4b04ba	success
1619910852.543495 __exception__	stacktrace: RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x77d76a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7534482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x77d40143 d0701ed7d9f1030611b80bc4a5d375c6+0x1336 @ 0x401336 d0701ed7d9f1030611b80bc4a5d375c6+0x1336 @ 0x401336 __vbaBoolErrVar+0x2c1e __vbaExceptHandler-0x139 msvbvm60+0xe46a6 @ 0x72a246a6 CreateIExprSrvObj+0x9f2 _CIexp-0x2058 msvbvm60+0xebcb9 @ 0x72a2bcb9 WinSqmSetIfMaxDWORD+0x35 RtlGetThreadErrorMode-0x23b ntdll+0x71ecd @ 0x77da1ecd registers.esp: 1635328 registers.edi: 1636008 registers.eax: 16 registers.ebp: 1635392 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 4916833 registers.ecx: 4917297 exception.instruction_r: fa 00 25 e1 7b a0 50 ba b9 93 97 f1 7b c1 17 6f exception.instruction: cli exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x4b06a9	success
1619910852.543495 __exception__	stacktrace: RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x77d76a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7534482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x77d40143 d0701ed7d9f1030611b80bc4a5d375c6+0x1336 @ 0x401336 d0701ed7d9f1030611b80bc4a5d375c6+0x1336 @ 0x401336 __vbaBoolErrVar+0x2c1e __vbaExceptHandler-0x139 msvbvm60+0xe46a6 @ 0x72a246a6 CreateIExprSrvObj+0x9f2 _CIexp-0x2058 msvbvm60+0xebcb9 @ 0x72a2bcb9 WinSqmSetIfMaxDWORD+0x35 RtlGetThreadErrorMode-0x23b ntdll+0x71ecd @ 0x77da1ecd registers.esp: 1635328 registers.edi: 1636008 registers.eax: 4294967112 registers.ebp: 1635392 registers.edx: 2010606285 registers.ebx: 4920931 registers.esi: 0 registers.ecx: 4304 exception.instruction_r: 66 6f 01 04 b2 bb c3 66 20 f5 5a 69 d9 fa d4 05 exception.instruction: outsw dx, word ptr [esi] exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x4b1c82	success
1619910852.543495 __exception__	stacktrace: registers.esp: 1637116 registers.edi: 1 registers.eax: 4239496 registers.ebp: 4921838 registers.edx: 1637292 registers.ebx: 1637316 registers.esi: 1637316 registers.ecx: 4915200 exception.instruction_r: 66 6d e9 ae f4 ff ff 31 c0 e9 94 12 00 00 57 e9 exception.instruction: insw word ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x4b0c2a	success
1619910852.543495 __exception__	stacktrace: registers.esp: 1637136 registers.edi: 1 registers.eax: 4239496 registers.ebp: 4917587 registers.edx: 1637292 registers.ebx: 0 registers.esi: 4915569 registers.ecx: 4915200 exception.instruction_r: ef 78 45 a8 3d e0 8c 60 ec 74 86 b6 8d 2d 6e f6 exception.instruction: out dx, eax exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x4b08da	success
1619910852.543495 __exception__	stacktrace: RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x77d76a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7534482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x77d40143 registers.esp: 1635320 registers.edi: 0 registers.eax: 16 registers.ebp: 1635396 registers.edx: 2010606285 registers.ebx: 1636012 registers.esi: 4926260 registers.ecx: 4917587 exception.instruction_r: f4 fc f5 31 47 89 fb 9f a0 3d 30 65 d1 ac 14 47 exception.instruction: hlt exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x4b2aae	success
1619910852.543495 __exception__	stacktrace: registers.esp: 1637108 registers.edi: 1 registers.eax: 4239496 registers.ebp: 4919611 registers.edx: 1637292 registers.ebx: 4922475 registers.esi: 4915569 registers.ecx: 4915200 exception.instruction_r: ee c6 97 fd d7 5a c8 21 75 0f 28 83 d4 f0 8e 4c exception.instruction: out dx, al exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x4b110e	success
1619910852.543495 __exception__	stacktrace: d0701ed7d9f1030611b80bc4a5d375c6+0x5f5a7 @ 0x45f5a7 EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 d0701ed7d9f1030611b80bc4a5d375c6+0x154a @ 0x40154a RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637136 registers.edi: 1 registers.eax: 4239496 registers.ebp: 1637332 registers.edx: 1637292 registers.ebx: 4922475 registers.esi: 4915569 registers.ecx: 4915200 exception.instruction_r: ed 10 3d ec c6 9c fe 5b 63 24 ef 7d 69 e6 38 6a exception.instruction: in eax, dx exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x4b07eb	success
1619910852.543495 __exception__	stacktrace: d0701ed7d9f1030611b80bc4a5d375c6+0x5f5a7 @ 0x45f5a7 EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 d0701ed7d9f1030611b80bc4a5d375c6+0x154a @ 0x40154a RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637164 registers.edi: 1 registers.eax: 4239496 registers.ebp: 1637332 registers.edx: 1637292 registers.ebx: 0 registers.esi: 4915569 registers.ecx: 4915200 exception.instruction_r: e7 3c 80 ef ab 1d b2 12 ca 96 f9 9e fb 4c 8f cd exception.instruction: out 0x3c, eax exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x4b2a01	success
1619910852.543495 __exception__	stacktrace: registers.esp: 1635360 registers.edi: 0 registers.eax: 0 registers.ebp: 4918109 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 4915569 exception.instruction_r: e6 a9 0e 9e 77 c1 b0 ca 6b d2 62 70 e4 88 20 f9 exception.instruction: out -0x57, al exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x4b01bb	success
1619910852.543495 __exception__	stacktrace: RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x77d76a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7534482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x77d40143 registers.esp: 1633556 registers.edi: 0 registers.eax: 229140544 registers.ebp: 1633620 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 4916381 registers.ecx: 4918109 exception.instruction_r: ee e9 fe f7 ff ff 35 cf bb 4a 3f e9 31 11 00 00 exception.instruction: out dx, al exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x4b0c4c	success
1619910852.543495 __exception__	stacktrace: registers.esp: 1633556 registers.edi: 0 registers.eax: 16 registers.ebp: 1634236 registers.edx: 2010606285 registers.ebx: 4919250 registers.esi: 0 registers.ecx: 6601 exception.instruction_r: f4 e9 a4 06 00 00 e9 b1 ee ff ff e9 70 df ff ff exception.instruction: hlt exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x4b2327	success
1619910852.543495 __exception__	stacktrace: registers.esp: 1631752 registers.edi: 0 registers.eax: 16 registers.ebp: 4925830 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 1632432 registers.ecx: 4919250 exception.instruction_r: 66 6f 2c 10 19 0e af 1d 33 bd 5d a2 d8 c1 b6 73 exception.instruction: outsw dx, word ptr [esi] exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x4b1ddb	success
1619910852.543495 __exception__	stacktrace: RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x77d76a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7534482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x77d40143 d0701ed7d9f1030611b80bc4a5d375c6+0x5f5a7 @ 0x45f5a7 EbLoadRunTime+0x1166 DllFunctionCall-0xb5 msvbvm60+0xa048 @ 0x7294a048 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 d0701ed7d9f1030611b80bc4a5d375c6+0x154a @ 0x40154a RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1635356 registers.edi: 4920854 registers.eax: 16 registers.ebp: 1635424 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 4915569 exception.instruction_r: e6 a2 9f b8 5c 84 47 3b 3b 34 75 61 46 c6 65 6a exception.instruction: out -0x5e, al exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0x4b0e8a	success
1619933645.236625 __exception__	stacktrace: registers.esp: 3602612 registers.edi: 0 registers.eax: 248 registers.ebp: 4517952 registers.edx: 2130566132 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 1912 exception.instruction_r: 6f 89 90 57 97 cd bf 27 32 65 94 78 7a b8 8b 82 exception.instruction: outsd dx, dword ptr [esi] exception.exception_code: 0xc0000096 exception.symbol: regasm+0x4ecde exception.address: 0x44ecde	success
1619933645.236625 __exception__	stacktrace: registers.esp: 3602632 registers.edi: 0 registers.eax: 248 registers.ebp: 0 registers.edx: 2130566132 registers.ebx: 2130567168 registers.esi: 4516817 registers.ecx: 1912 exception.instruction_r: cf 95 bf b5 79 eb 68 1c fb bd 21 1c 03 26 f5 ef exception.instruction: iretd exception.exception_code: 0xc0000005 exception.symbol: regasm+0x4eb9d exception.address: 0x44eb9d	success
1619933645.236625 __exception__	stacktrace: registers.esp: 3600804 registers.edi: 0 registers.eax: 16 registers.ebp: 4515656 registers.edx: 2010606285 registers.ebx: 4514791 registers.esi: 0 registers.ecx: 4294966007 exception.instruction_r: 6d eb 0c 58 5b e9 cc 0a 00 00 e9 bf 07 00 00 c6 exception.instruction: insd dword ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: regasm+0x4e4fe exception.address: 0x44e4fe	success
1619933645.236625 __exception__	stacktrace: RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x77d76a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7534482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x77d40143 registers.esp: 3600828 registers.edi: 0 registers.eax: 16 registers.ebp: 3600892 registers.edx: 2010606285 registers.ebx: 4514791 registers.esi: 0 registers.ecx: 4294966007 exception.instruction_r: e7 d4 6c 98 1f 4f 77 2b 0c 66 c7 9b c4 69 56 f2 exception.instruction: out -0x2c, eax exception.exception_code: 0xc0000096 exception.symbol: regasm+0x4f065 exception.address: 0x44f065	success
1619933645.236625 __exception__	stacktrace: RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x77d76a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7534482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x77d40143 registers.esp: 3600824 registers.edi: 4517594 registers.eax: 16 registers.ebp: 3600892 registers.edx: 2010606285 registers.ebx: 3601508 registers.esi: 0 registers.ecx: 4294966007 exception.instruction_r: fb e9 7d fe ff ff e9 cb fd ff ff e9 19 f4 ff ff exception.instruction: sti exception.exception_code: 0xc0000096 exception.symbol: regasm+0x4f21c exception.address: 0x44f21c	success
1619933645.236625 __exception__	stacktrace: RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x77d76a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7534482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x77d40143 registers.esp: 3600824 registers.edi: 0 registers.eax: 16 registers.ebp: 3600892 registers.edx: 2010606285 registers.ebx: 3601508 registers.esi: 4517558 registers.ecx: 4294966007 exception.instruction_r: e5 4b 1c 7b 06 31 c3 8f 8a 76 63 5b ec c5 a9 82 exception.instruction: in eax, 0x4b exception.exception_code: 0xc0000096 exception.symbol: regasm+0x4e034 exception.address: 0x44e034	success
1619933645.236625 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 9828412 registers.edi: 0 registers.eax: 1912 registers.ebp: 9828496 registers.edx: 4521655 registers.ebx: 1912 registers.esi: 4522754 registers.ecx: 0 exception.instruction_r: e6 8c 8b ec 5b ee b0 18 95 48 ac 92 4b 6f ab f6 exception.instruction: out -0x74, al exception.exception_code: 0xc0000096 exception.symbol: regasm+0x50234 exception.address: 0x450234	success
1619933645.236625 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 9828420 registers.edi: 4519447 registers.eax: 1912 registers.ebp: 9828496 registers.edx: 4521655 registers.ebx: 1912 registers.esi: 0 registers.ecx: 0 exception.instruction_r: cc e9 e4 f4 ff ff 58 81 c1 75 2b 00 00 01 c8 8b exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: regasm+0x500cc exception.address: 0x4500cc	success
1619933645.236625 __exception__	stacktrace: RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x77d76a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7534482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x77d40143 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 9826616 registers.edi: 0 registers.eax: 16 registers.ebp: 9826680 registers.edx: 2010606285 registers.ebx: 9827296 registers.esi: 4519663 registers.ecx: 4294965865 exception.instruction_r: f4 25 62 57 f2 c7 28 c1 a8 a5 b2 ea 4e b7 28 ec exception.instruction: hlt exception.exception_code: 0xc0000096 exception.symbol: regasm+0x4f69e exception.address: 0x44f69e	success
1619933646.236625 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 9828420 registers.edi: 0 registers.eax: 0 registers.ebp: 9828496 registers.edx: 2130553844 registers.ebx: 4522985 registers.esi: 0 registers.ecx: 4518842 exception.instruction_r: 66 6f e9 49 01 00 00 e9 30 f4 ff ff e9 78 f4 ff exception.instruction: outsw dx, word ptr [esi] exception.exception_code: 0xc0000096 exception.symbol: regasm+0x50206 exception.address: 0x450206	success
1619933646.236625 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 9828416 registers.edi: 0 registers.eax: 4531712 registers.ebp: 9828496 registers.edx: 3392206223 registers.ebx: 4526854 registers.esi: 0 registers.ecx: 0 exception.instruction_r: e5 62 e9 57 04 00 00 e9 f3 f8 ff ff b8 29 4d bd exception.instruction: in eax, 0x62 exception.exception_code: 0xc0000096 exception.symbol: regasm+0x50e51 exception.address: 0x450e51	success
1619933646.236625 __exception__	stacktrace: registers.esp: 9826588 registers.edi: 0 registers.eax: 16 registers.ebp: 4526345 registers.edx: 2010606285 registers.ebx: 4523575 registers.esi: 0 registers.ecx: 4526854 exception.instruction_r: a3 00 00 00 00 e9 10 ee ff ff e9 c3 fb ff ff e9 exception.instruction: mov dword ptr [0], eax exception.exception_code: 0xc0000005 exception.symbol: regasm+0x51754 exception.address: 0x451754	success
1619933646.236625 __exception__	stacktrace: RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x77d76a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7534482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x77d40143 registers.esp: 9824784 registers.edi: 9825464 registers.eax: 16 registers.ebp: 9824848 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 4526367 registers.ecx: 4523575 exception.instruction_r: cc fa 30 63 9c d8 49 a7 cb 72 ff 71 e9 9c e9 72 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: regasm+0x513d2 exception.address: 0x4513d2	success
1619933646.236625 __exception__	stacktrace: RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x77d76a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7534482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x77d40143 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x77d76a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7534482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x77d40143 registers.esp: 9822980 registers.edi: 0 registers.eax: 4294967280 registers.ebp: 9823044 registers.edx: 2010606285 registers.ebx: 4524357 registers.esi: 0 registers.ecx: 4526367 exception.instruction_r: e6 8d 54 7a b8 7c 2e 7b ed 48 00 98 8a e9 ab 87 exception.instruction: out -0x73, al exception.exception_code: 0xc0000096 exception.symbol: regasm+0x508d0 exception.address: 0x4508d0	success
1619933646.236625 __exception__	stacktrace: registers.esp: 9826612 registers.edi: 0 registers.eax: 16 registers.ebp: 4526345 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 4526854 exception.instruction_r: 66 6d 0d 61 36 e6 60 bd bb 4e 9c e8 5c 5e f5 75 exception.instruction: insw word ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: regasm+0x510b0 exception.address: 0x4510b0	success
1619933646.236625 __exception__	stacktrace: RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x77d76a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7534482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x77d40143 registers.esp: 9824808 registers.edi: 9825488 registers.eax: 16 registers.ebp: 9824872 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 4527864 registers.ecx: 4526345 exception.instruction_r: e7 2e e9 bc a5 50 d6 72 93 94 5d 2e d6 0c f4 21 exception.instruction: out 0x2e, eax exception.exception_code: 0xc0000096 exception.symbol: regasm+0x5161a exception.address: 0x45161a	success
1619933647.236625 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 9828420 registers.edi: 0 registers.eax: 0 registers.ebp: 9828496 registers.edx: 2130553844 registers.ebx: 4522985 registers.esi: 0 registers.ecx: 4518842 exception.instruction_r: 66 6f e9 49 01 00 00 e9 30 f4 ff ff e9 78 f4 ff exception.instruction: outsw dx, word ptr [esi] exception.exception_code: 0xc0000096 exception.symbol: regasm+0x50206 exception.address: 0x450206	success
1619933647.236625 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 9828416 registers.edi: 0 registers.eax: 4531712 registers.ebp: 9828496 registers.edx: 3392206223 registers.ebx: 4526854 registers.esi: 0 registers.ecx: 0 exception.instruction_r: e5 62 e9 57 04 00 00 e9 f3 f8 ff ff b8 29 4d bd exception.instruction: in eax, 0x62 exception.exception_code: 0xc0000096 exception.symbol: regasm+0x50e51 exception.address: 0x450e51	success
1619933647.236625 __exception__	stacktrace: registers.esp: 9826588 registers.edi: 0 registers.eax: 16 registers.ebp: 4526345 registers.edx: 2010606285 registers.ebx: 4523575 registers.esi: 0 registers.ecx: 4526854 exception.instruction_r: a3 00 00 00 00 e9 10 ee ff ff e9 c3 fb ff ff e9 exception.instruction: mov dword ptr [0], eax exception.exception_code: 0xc0000005 exception.symbol: regasm+0x51754 exception.address: 0x451754	success
1619933647.236625 __exception__	stacktrace: RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x77d76a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7534482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x77d40143 registers.esp: 9824784 registers.edi: 9825464 registers.eax: 16 registers.ebp: 9824848 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 4526367 registers.ecx: 4523575 exception.instruction_r: cc fa 30 63 9c d8 49 a7 cb 72 ff 71 e9 9c e9 72 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: regasm+0x513d2 exception.address: 0x4513d2	success
1619933647.236625 __exception__	stacktrace: RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x77d76a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7534482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x77d40143 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x77d76a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7534482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x77d40143 registers.esp: 9822980 registers.edi: 0 registers.eax: 4294967280 registers.ebp: 9823044 registers.edx: 2010606285 registers.ebx: 4524357 registers.esi: 0 registers.ecx: 4526367 exception.instruction_r: e6 8d 54 7a b8 7c 2e 7b ed 48 00 98 8a e9 ab 87 exception.instruction: out -0x73, al exception.exception_code: 0xc0000096 exception.symbol: regasm+0x508d0 exception.address: 0x4508d0	success
1619933647.236625 __exception__	stacktrace: registers.esp: 9826612 registers.edi: 0 registers.eax: 16 registers.ebp: 4526345 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 4526854 exception.instruction_r: 66 6d 0d 61 36 e6 60 bd bb 4e 9c e8 5c 5e f5 75 exception.instruction: insw word ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: regasm+0x510b0 exception.address: 0x4510b0	success
1619933647.236625 __exception__	stacktrace: RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x77d76a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7534482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x77d40143 registers.esp: 9824808 registers.edi: 9825488 registers.eax: 16 registers.ebp: 9824872 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 4527864 registers.ecx: 4526345 exception.instruction_r: e7 2e e9 bc a5 50 d6 72 93 94 5d 2e d6 0c f4 21 exception.instruction: out 0x2e, eax exception.exception_code: 0xc0000096 exception.symbol: regasm+0x5161a exception.address: 0x45161a	success
1619933648.236625 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 9828420 registers.edi: 0 registers.eax: 0 registers.ebp: 9828496 registers.edx: 2130553844 registers.ebx: 4522985 registers.esi: 0 registers.ecx: 4518842 exception.instruction_r: 66 6f e9 49 01 00 00 e9 30 f4 ff ff e9 78 f4 ff exception.instruction: outsw dx, word ptr [esi] exception.exception_code: 0xc0000096 exception.symbol: regasm+0x50206 exception.address: 0x450206	success
1619933648.236625 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 9828416 registers.edi: 0 registers.eax: 4531712 registers.ebp: 9828496 registers.edx: 3392206223 registers.ebx: 4526854 registers.esi: 0 registers.ecx: 0 exception.instruction_r: e5 62 e9 57 04 00 00 e9 f3 f8 ff ff b8 29 4d bd exception.instruction: in eax, 0x62 exception.exception_code: 0xc0000096 exception.symbol: regasm+0x50e51 exception.address: 0x450e51	success
1619933648.236625 __exception__	stacktrace: registers.esp: 9826588 registers.edi: 0 registers.eax: 16 registers.ebp: 4526345 registers.edx: 2010606285 registers.ebx: 4523575 registers.esi: 0 registers.ecx: 4526854 exception.instruction_r: a3 00 00 00 00 e9 10 ee ff ff e9 c3 fb ff ff e9 exception.instruction: mov dword ptr [0], eax exception.exception_code: 0xc0000005 exception.symbol: regasm+0x51754 exception.address: 0x451754	success
1619933648.236625 __exception__	stacktrace: RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x77d76a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7534482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x77d40143 registers.esp: 9824784 registers.edi: 9825464 registers.eax: 16 registers.ebp: 9824848 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 4526367 registers.ecx: 4523575 exception.instruction_r: cc fa 30 63 9c d8 49 a7 cb 72 ff 71 e9 9c e9 72 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: regasm+0x513d2 exception.address: 0x4513d2	success
1619933648.236625 __exception__	stacktrace: RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x77d76a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7534482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x77d40143 RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x77d76a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7534482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x77d40143 registers.esp: 9822980 registers.edi: 0 registers.eax: 4294967280 registers.ebp: 9823044 registers.edx: 2010606285 registers.ebx: 4524357 registers.esi: 0 registers.ecx: 4526367 exception.instruction_r: e6 8d 54 7a b8 7c 2e 7b ed 48 00 98 8a e9 ab 87 exception.instruction: out -0x73, al exception.exception_code: 0xc0000096 exception.symbol: regasm+0x508d0 exception.address: 0x4508d0	success
1619933648.236625 __exception__	stacktrace: registers.esp: 9826612 registers.edi: 0 registers.eax: 16 registers.ebp: 4526345 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 0 registers.ecx: 4526854 exception.instruction_r: 66 6d 0d 61 36 e6 60 bd bb 4e 9c e8 5c 5e f5 75 exception.instruction: insw word ptr es:[edi], dx exception.exception_code: 0xc0000096 exception.symbol: regasm+0x510b0 exception.address: 0x4510b0	success
1619933648.236625 __exception__	stacktrace: RtlDosSearchPath_Ustr+0xaac RtlCaptureContext-0xa0 ntdll+0x46a8b @ 0x77d76a8b New_ntdll_RtlDispatchException@8+0xf6 New_ntdll_RtlRemoveVectoredContinueHandler@4-0x23 @ 0x7534482b KiUserExceptionDispatcher+0xf KiRaiseUserExceptionDispatcher-0x41 ntdll+0x10143 @ 0x77d40143 registers.esp: 9824808 registers.edi: 9825488 registers.eax: 16 registers.ebp: 9824872 registers.edx: 2010606285 registers.ebx: 0 registers.esi: 4527864 registers.ecx: 4526345 exception.instruction_r: e7 2e e9 bc a5 50 d6 72 93 94 5d 2e d6 0c f4 21 exception.instruction: out 0x2e, eax exception.exception_code: 0xc0000096 exception.symbol: regasm+0x5161a exception.address: 0x45161a	success
1619933649.236625 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 9828420 registers.edi: 0 registers.eax: 0 registers.ebp: 9828496 registers.edx: 2130553844 registers.ebx: 4522985 registers.esi: 0 registers.ecx: 4518842 exception.instruction_r: 66 6f e9 49 01 00 00 e9 30 f4 ff ff e9 78 f4 ff exception.instruction: outsw dx, word ptr [esi] exception.exception_code: 0xc0000096 exception.symbol: regasm+0x50206 exception.address: 0x450206	success

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 188 个事件)

Time & API	Arguments	Status
1619910852.105495 NtAllocateVirtualMemory	process_identifier: 2976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00470000	success
1619910852.105495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d4f000	success
1619910852.355495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0059c000	success
1619910852.355495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x7294a000	success
1619910852.355495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0059c000	success
1619910852.355495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0059c000	success
1619910852.371495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0059c000	success
1619910852.371495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00404000	success
1619910852.371495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x005d5000	success
1619910852.371495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x005d5000	success
1619910852.371495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x005d5000	success
1619910852.371495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00404000	success
1619910852.449495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x005de000	success
1619910852.449495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x005de000	success
1619910852.449495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x005de000	success
1619910852.449495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00404000	success
1619910852.449495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0062b000	success
1619910852.449495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0062b000	success
1619910852.449495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0062b000	success
1619910852.449495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00404000	success
1619910852.449495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0062b000	success
1619910852.449495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0062b000	success
1619910852.449495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0062b000	success
1619910852.449495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00404000	success
1619910852.449495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0062b000	success
1619910852.449495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0062b000	success
1619910852.449495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0062b000	success
1619910852.449495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00404000	success
1619910852.527495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0062b000	success
1619910852.527495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0062b000	success
1619910852.527495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0062b000	success
1619910852.527495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00404000	success
1619910852.527495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0062b000	success
1619910852.527495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0062b000	success
1619910852.527495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0062b000	success
1619910852.527495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00404000	success
1619910852.527495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x005de000	success
1619910852.527495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x005de000	success
1619910852.527495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x005de000	success
1619910852.527495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00404000	success
1619910852.527495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x005de000	success
1619910852.527495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x005de000	success
1619910852.527495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x005de000	success
1619910852.527495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00404000	success
1619910852.527495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x005de000	success
1619910852.527495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x005de000	success
1619910852.527495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x005de000	success
1619910852.527495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00404000	success
1619910852.527495 NtAllocateVirtualMemory	process_identifier: 2976 region_size: 32768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x004b0000	success
1619933645.236625 NtAllocateVirtualMemory	process_identifier: 1176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x004a0000	success

Steals private information from local Internet browsers (7 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619910852.011495 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) process_handle: 0xffffffff base_address: 0x003d0000	success	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.394243370897707

section

{'size_of_data': '0x00060000', 'virtual_address': '0x00001000', 'entropy': 7.394243370897707, 'name': '.text', 'virtual_size': '0x0005f2b8'}

description

A section with a high entropy has been found

entropy

0.9230769230769231

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619933658.689625 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

One or more of the buffers contains an embedded PE file (1 个事件)

buffer

Buffer with sha1: 88e7c330e0a09b8894a540f855ee509336ace184

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

A process attempted to delay the analysis task. (1 个事件)

description

RegAsm.exe tried to sleep 2728321 seconds, actually delayed analysis time by 2728321 seconds

Harvests credentials from local FTP client softwares (5 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FTPGetter\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Ipswitch\WS_FTP\Sites\ws_ftp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\recentservers.xml
registry	HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
registry	HKEY_CURRENT_USER\Software\FTPWare\COREFTP\Sites

Creates a windows hook that monitors keyboard input (keylogger) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619933690.673625 SetWindowsHookExW	thread_identifier: 0 callback_function: 0x00a377a2 module_address: 0x00400000 hook_identifier: 13 (WH_KEYBOARD_LL)	success	327903	0

Harvests credentials from local email clients (5 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Thunderbird\profiles.ini
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
registry	HKEY_CURRENT_USER\Software\RimArts\B2\Settings
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2976 called NtSetContextThread to modify thread in remote process 1176
1619910852.886495 NtSetContextThread	thread_handle: 0x00000144 registers.eip: 4513792 registers.esp: 3602692 registers.edi: 0 registers.eax: 4490094 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 2010382788 process_identifier: 1176	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2976 resumed a thread in remote process 1176
1619910853.074495 NtResumeThread	thread_handle: 0x00000144 suspend_count: 1 process_identifier: 1176	success	0	0

Executed a process and injected code into it, probably while unpacking (14 个事件)

Time & API	Arguments	Status	Return
1619910852.886495 CreateProcessInternalW	thread_identifier: 1912 thread_handle: 0x00000144 process_identifier: 1176 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000148 inherit_handles: 0	success	1
1619910852.886495 NtGetContextThread	thread_handle: 0x00000144	success	0
1619910852.886495 NtUnmapViewOfSection	process_identifier: 1176 region_size: 11796480 process_handle: 0x00000148 base_address: 0x00400000	failed	3221225497
1619910852.886495 NtMapViewOfSection	section_handle: 0x000000d4 process_identifier: 1176 commit_size: 0 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000148 allocation_type: 0 () section_offset: 0 view_size: 339968 base_address: 0x00400000	success	0
1619910852.886495 NtSetContextThread	thread_handle: 0x00000144 registers.eip: 4513792 registers.esp: 3602692 registers.edi: 0 registers.eax: 4490094 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 2010382788 process_identifier: 1176	success	0
1619910853.074495 NtResumeThread	thread_handle: 0x00000144 suspend_count: 1 process_identifier: 1176	success	0
1619933645.626625 NtResumeThread	thread_handle: 0x00000174 suspend_count: 1 process_identifier: 1176	success	0
1619933645.658625 NtResumeThread	thread_handle: 0x000001bc suspend_count: 1 process_identifier: 1176	success	0
1619933645.673625 NtResumeThread	thread_handle: 0x000001fc suspend_count: 1 process_identifier: 1176	success	0
1619933659.876625 NtResumeThread	thread_handle: 0x00000328 suspend_count: 1 process_identifier: 1176	success	0
1619933659.923625 NtResumeThread	thread_handle: 0x00000358 suspend_count: 1 process_identifier: 1176	success	0
1619933661.626625 NtResumeThread	thread_handle: 0x000003b0 suspend_count: 1 process_identifier: 1176	success	0
1619933694.861625 NtResumeThread	thread_handle: 0x0000035c suspend_count: 1 process_identifier: 1176	success	0
1619933694.939625 NtResumeThread	thread_handle: 0x00000468 suspend_count: 1 process_identifier: 1176	success	0

File has been identified by 50 AntiVirus engines on VirusTotal as malicious (50 个事件)

Bkav	HW32.Packed.
MicroWorld-eScan	Gen:Variant.Razy.684192
FireEye	Generic.mg.d0701ed7d9f10306
CAT-QuickHeal	Trojan.Multi
ALYac	Gen:Variant.Razy.684192
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Trojan ( 005686a31 )
Alibaba	TrojanPSW:MSIL/Agensla.7fe4cc40
K7GW	Trojan ( 005686a31 )
Cybereason	malicious.71352b
Arcabit	Trojan.Razy.DA70A0
Invincea	heuristic
BitDefenderTheta	Gen:NN.ZevbaF.34130.Am0@aipCq9ri
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
Kaspersky	Trojan-PSW.MSIL.Agensla.rve
BitDefender	Gen:Variant.Razy.684192
Paloalto	generic.ml
AegisLab	Trojan.Multi.Generic.4!c
Rising	Trojan.Injector!1.C6AF (CLOUD)
Endgame	malicious (high confidence)
Emsisoft	Gen:Variant.Razy.684192 (B)
F-Secure	Trojan.TR/Kryptik.ekhyg
DrWeb	Trojan.Inject3.41731
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Trojan.Win32.WACATAC.USXVPFA20
Trapmine	suspicious.low.ml.score
Sophos	Mal/Generic-S
SentinelOne	DFI - Malicious PE
Avira	TR/Kryptik.ekhyg
MAX	malware (ai score=83)
Antiy-AVL	Trojan[PSW]/MSIL.Agensla
Microsoft	Trojan:Win32/Occamy.C00
ZoneAlarm	Trojan-PSW.MSIL.Agensla.rve
GData	Gen:Variant.Razy.684192
Cynet	Malicious (score: 100)
McAfee	GenericRXKZ-HN!D0701ED7D9F1
VBA32	BScope.TrojanDownloader.Upatre
Malwarebytes	Spyware.MassLogger.Generic
ESET-NOD32	a variant of Win32/Injector.EMIQ
TrendMicro-HouseCall	Trojan.Win32.WACATAC.USXVPFA20
Ikarus	Trojan.Win32.Krypt
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/GenKryptik.EMEU!tr
AVG	Win32:MalwareX-gen [Trj]
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_90% (W)
Qihoo-360	Generic/Trojan.PSW.212

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-06-10 09:35:56

Imports

Library OLE32.DLL:

• 0x401000 CoTaskMemAlloc

Library MSVBVM60.DLL:

• 0x401008 __vbaVarSub

• 0x40100c __vbaVarTstGt

• 0x401010 _CIcos

• 0x401014 _adj_fptan

• 0x401018 __vbaVarMove

• 0x40101c __vbaVarVargNofree

• 0x401020 __vbaAryMove

• 0x401024 __vbaFreeVar

• 0x401028 __vbaStrVarMove

• 0x40102c __vbaLenBstr

• 0x401030 __vbaFreeVarList

• 0x401034 _adj_fdiv_m64

• 0x401038

• 0x40103c __vbaStrErrVarCopy

• 0x401040 _adj_fprem1

• 0x401044 __vbaStrCat

• 0x401048 __vbaVarCmpNe

• 0x40104c __vbaRecDestruct

• 0x401050 __vbaSetSystemError

• 0x401054 __vbaHresultCheckObj

• 0x401058 __vbaLenVar

• 0x40105c _adj_fdiv_m32

• 0x401060 __vbaAryDestruct

• 0x401064 __vbaObjSet

• 0x401068

• 0x40106c _adj_fdiv_m16i

• 0x401070 __vbaObjSetAddref

• 0x401074 _adj_fdivr_m16i

• 0x401078 __vbaBoolVarNull

• 0x40107c _CIsin

• 0x401080 __vbaErase

• 0x401084

• 0x401088 __vbaChkstk

• 0x40108c EVENT_SINK_AddRef

• 0x401090

• 0x401094 __vbaStrCmp

• 0x401098 __vbaAryConstruct2

• 0x40109c __vbaVarTstEq

• 0x4010a0 __vbaVarLikeVar

• 0x4010a4 DllFunctionCall

• 0x4010a8 __vbaVarOr

• 0x4010ac __vbaRedimPreserve

• 0x4010b0 _adj_fpatan

• 0x4010b4 __vbaRedim

• 0x4010b8 EVENT_SINK_Release

• 0x4010bc __vbaNew

• 0x4010c0 _CIsqrt

• 0x4010c4 EVENT_SINK_QueryInterface

• 0x4010c8 __vbaStr2Vec

• 0x4010cc __vbaExceptHandler

• 0x4010d0 _adj_fprem

• 0x4010d4 _adj_fdivr_m64

• 0x4010d8 __vbaVarDiv

• 0x4010dc

• 0x4010e0

• 0x4010e4 __vbaFPException

• 0x4010e8 GetMem4

• 0x4010ec __vbaUbound

• 0x4010f0 __vbaStrVarVal

• 0x4010f4 __vbaVarCat

• 0x4010f8

• 0x4010fc _CIlog

• 0x401100 __vbaVar2Vec

• 0x401104 _adj_fdiv_m32i

• 0x401108 _adj_fdivr_m32i

• 0x40110c __vbaStrCopy

• 0x401110 __vbaFreeStrList

• 0x401114 _adj_fdivr_m32

• 0x401118 _adj_fdiv_r

• 0x40111c

• 0x401120 __vbaI4Var

• 0x401124 __vbaAryLock

• 0x401128 __vbaVarAdd

• 0x40112c __vbaVarDup

• 0x401130 __vbaStrToAnsi

• 0x401134

• 0x401138 _CIatan

• 0x40113c __vbaCastObj

• 0x401140 __vbaStrMove

• 0x401144 _allmul

• 0x401148 _CItan

• 0x40114c

• 0x401150 __vbaAryUnlock

• 0x401154

• 0x401158 _CIexp

• 0x40115c __vbaFreeObj

• 0x401160 __vbaFreeStr

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.