13.2
0-day
60 个模型检测该样本为恶意！
重新分析
更多

4eba9f4975de4fad373ec97aace6605f55249174c4dfc78c87f5567c98557210

e8680b7a890458b72e5118b62a6ab97c.exe

分析耗时

115s

最近分析

文件大小

1.1MB
静态报毒 动态报毒 AGENTTESLA AI SCORE=83 AIDETECTVM AKOU ALI2000015 CLASSIC CONFIDENCE DELF DELFINJECT DELPHILESS EMOP EMOY FAREIT GENETIC HIGH CONFIDENCE HNSACJ HPLOKI IHW@AMKSNKFI KRYPTIK MALWARE2 MALWARE@#1X94W6Z1GATV9 MALWAREX NVHLO OEGP SCORE SMBD STATIC AI SUSGEN SUSPICIOUS PE TSCOPE TSPY UNSAFE X2094 XXPGXAFDNE8 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
Avast Win32:MalwareX-gen [Trj] 20201210 21.1.5827.0
Baidu 20190318 1.0.0.2
Kingsoft 20201211 2017.9.26.565
McAfee Fareit-FVZ!E8680B7A8904 20201211 6.0.6.653
Tencent Win32.Trojan.Kryptik.Akou 20201211 1.0.0.1
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)
resource name None
One or more processes crashed (41 个事件)
Time & API Arguments Status Return Repeated
1619963313.116374
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49217348
registers.edi: 0
registers.eax: 0
registers.ebp: 49217416
registers.edx: 48
registers.ebx: 0
registers.esi: 0
registers.ecx: 116
exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b
exception.symbol: e8680b7a890458b72e5118b62a6ab97c+0x96338
exception.instruction: div eax
exception.module: e8680b7a890458b72e5118b62a6ab97c.exe
exception.exception_code: 0xc0000094
exception.offset: 615224
exception.address: 0x496338
success 0 0
1619963314.335501
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 51314500
registers.edi: 0
registers.eax: 0
registers.ebp: 51314568
registers.edx: 48
registers.ebx: 0
registers.esi: 0
registers.ecx: 335
exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b
exception.symbol: hjiwws+0x96338
exception.instruction: div eax
exception.module: hjiwws.exe
exception.exception_code: 0xc0000094
exception.offset: 615224
exception.address: 0x496338
success 0 0
1619963326.788374
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7452d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hjiwws+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x740e4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x740e5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfcf6147d
success 0 0
1619963315.802999
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34930500
registers.edi: 0
registers.eax: 0
registers.ebp: 34930568
registers.edx: 48
registers.ebx: 0
registers.esi: 0
registers.ecx: 803
exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b
exception.symbol: hjiwws+0x96338
exception.instruction: div eax
exception.module: hjiwws.exe
exception.exception_code: 0xc0000094
exception.offset: 615224
exception.address: 0x496338
success 0 0
1619963327.803249
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34930500
registers.edi: 0
registers.eax: 0
registers.ebp: 34930568
registers.edx: 48
registers.ebx: 0
registers.esi: 0
registers.ecx: 803
exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b
exception.symbol: hjiwws+0x96338
exception.instruction: div eax
exception.module: hjiwws.exe
exception.exception_code: 0xc0000094
exception.offset: 615224
exception.address: 0x496338
success 0 0
1619963328.068999
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7452d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hjiwws+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74194b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74195d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfcf7147d
success 0 0
1619963328.069626
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34144068
registers.edi: 0
registers.eax: 0
registers.ebp: 34144136
registers.edx: 48
registers.ebx: 0
registers.esi: 0
registers.ecx: 69
exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b
exception.symbol: hjiwws+0x96338
exception.instruction: div eax
exception.module: hjiwws.exe
exception.exception_code: 0xc0000094
exception.offset: 615224
exception.address: 0x496338
success 0 0
1619963329.491124
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 35913540
registers.edi: 0
registers.eax: 0
registers.ebp: 35913608
registers.edx: 48
registers.ebx: 0
registers.esi: 0
registers.ecx: 491
exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b
exception.symbol: hjiwws+0x96338
exception.instruction: div eax
exception.module: hjiwws.exe
exception.exception_code: 0xc0000094
exception.offset: 615224
exception.address: 0x496338
success 0 0
1619963329.710876
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7452d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hjiwws+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x740f4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x740f5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfce2147d
success 0 0
1619963329.725501
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34275140
registers.edi: 0
registers.eax: 0
registers.ebp: 34275208
registers.edx: 48
registers.ebx: 0
registers.esi: 0
registers.ecx: 725
exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b
exception.symbol: hjiwws+0x96338
exception.instruction: div eax
exception.module: hjiwws.exe
exception.exception_code: 0xc0000094
exception.offset: 615224
exception.address: 0x496338
success 0 0
1619963332.366751
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49217348
registers.edi: 0
registers.eax: 0
registers.ebp: 49217416
registers.edx: 48
registers.ebx: 0
registers.esi: 0
registers.ecx: 366
exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b
exception.symbol: hjiwws+0x96338
exception.instruction: div eax
exception.module: hjiwws.exe
exception.exception_code: 0xc0000094
exception.offset: 615224
exception.address: 0x496338
success 0 0
1619963332.663751
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7452d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hjiwws+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74144b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74145d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfcba147d
success 0 0
1619963332.631374
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49676100
registers.edi: 0
registers.eax: 0
registers.ebp: 49676168
registers.edx: 48
registers.ebx: 0
registers.esi: 0
registers.ecx: 631
exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b
exception.symbol: hjiwws+0x96338
exception.instruction: div eax
exception.module: hjiwws.exe
exception.exception_code: 0xc0000094
exception.offset: 615224
exception.address: 0x496338
success 0 0
1619963333.256374
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 51052356
registers.edi: 0
registers.eax: 0
registers.ebp: 51052424
registers.edx: 48
registers.ebx: 0
registers.esi: 0
registers.ecx: 256
exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b
exception.symbol: hjiwws+0x96338
exception.instruction: div eax
exception.module: hjiwws.exe
exception.exception_code: 0xc0000094
exception.offset: 615224
exception.address: 0x496338
success 0 0
1619963333.756751
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7452d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hjiwws+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74194b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74195d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe7c147d
success 0 0
1619963333.756374
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34537284
registers.edi: 0
registers.eax: 0
registers.ebp: 34537352
registers.edx: 48
registers.ebx: 0
registers.esi: 0
registers.ecx: 756
exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b
exception.symbol: hjiwws+0x96338
exception.instruction: div eax
exception.module: hjiwws.exe
exception.exception_code: 0xc0000094
exception.offset: 615224
exception.address: 0x496338
success 0 0
1619963338.428249
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34602820
registers.edi: 0
registers.eax: 0
registers.ebp: 34602888
registers.edx: 48
registers.ebx: 0
registers.esi: 0
registers.ecx: 428
exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b
exception.symbol: hjiwws+0x96338
exception.instruction: div eax
exception.module: hjiwws.exe
exception.exception_code: 0xc0000094
exception.offset: 615224
exception.address: 0x496338
success 0 0
1619963338.802999
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7452d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hjiwws+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74144b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74145d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfcbb147d
success 0 0
1619963338.866626
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 35848004
registers.edi: 0
registers.eax: 0
registers.ebp: 35848072
registers.edx: 48
registers.ebx: 0
registers.esi: 0
registers.ecx: 866
exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b
exception.symbol: hjiwws+0x96338
exception.instruction: div eax
exception.module: hjiwws.exe
exception.exception_code: 0xc0000094
exception.offset: 615224
exception.address: 0x496338
success 0 0
1619963339.725876
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 35979076
registers.edi: 0
registers.eax: 0
registers.ebp: 35979144
registers.edx: 48
registers.ebx: 0
registers.esi: 0
registers.ecx: 725
exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b
exception.symbol: hjiwws+0x96338
exception.instruction: div eax
exception.module: hjiwws.exe
exception.exception_code: 0xc0000094
exception.offset: 615224
exception.address: 0x496338
success 0 0
1619963344.803626
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7452d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hjiwws+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74194b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74195d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfce2147d
success 0 0
1619963344.819876
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 50724676
registers.edi: 0
registers.eax: 0
registers.ebp: 50724744
registers.edx: 49
registers.ebx: 0
registers.esi: 0
registers.ecx: 819
exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b
exception.symbol: hjiwws+0x96338
exception.instruction: div eax
exception.module: hjiwws.exe
exception.exception_code: 0xc0000094
exception.offset: 615224
exception.address: 0x496338
success 0 0
1619963345.881751
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34930500
registers.edi: 0
registers.eax: 0
registers.ebp: 34930568
registers.edx: 49
registers.ebx: 0
registers.esi: 0
registers.ecx: 881
exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b
exception.symbol: hjiwws+0x96338
exception.instruction: div eax
exception.module: hjiwws.exe
exception.exception_code: 0xc0000094
exception.offset: 615224
exception.address: 0x496338
success 0 0
1619963346.460249
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7452d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hjiwws+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74144b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74145d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe61147d
success 0 0
1619963346.444876
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 35389252
registers.edi: 0
registers.eax: 0
registers.ebp: 35389320
registers.edx: 49
registers.ebx: 0
registers.esi: 0
registers.ecx: 444
exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b
exception.symbol: hjiwws+0x96338
exception.instruction: div eax
exception.module: hjiwws.exe
exception.exception_code: 0xc0000094
exception.offset: 615224
exception.address: 0x496338
success 0 0
1619963355.028999
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34799428
registers.edi: 0
registers.eax: 0
registers.ebp: 34799496
registers.edx: 49
registers.ebx: 0
registers.esi: 0
registers.ecx: 38
exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b
exception.symbol: hjiwws+0x96338
exception.instruction: div eax
exception.module: hjiwws.exe
exception.exception_code: 0xc0000094
exception.offset: 615224
exception.address: 0x496338
success 0 0
1619963356.368625
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7452d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hjiwws+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74194b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74195d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe7c147d
success 0 0
1619963356.418999
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49348420
registers.edi: 0
registers.eax: 0
registers.ebp: 49348488
registers.edx: 49
registers.ebx: 0
registers.esi: 0
registers.ecx: 430
exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b
exception.symbol: hjiwws+0x96338
exception.instruction: div eax
exception.module: hjiwws.exe
exception.exception_code: 0xc0000094
exception.offset: 615224
exception.address: 0x496338
success 0 0
1619963358.605187
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 48889668
registers.edi: 0
registers.eax: 0
registers.ebp: 48889736
registers.edx: 49
registers.ebx: 0
registers.esi: 0
registers.ecx: 613
exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b
exception.symbol: hjiwws+0x96338
exception.instruction: div eax
exception.module: hjiwws.exe
exception.exception_code: 0xc0000094
exception.offset: 615224
exception.address: 0x496338
success 0 0
1619963361.231499
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7452d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hjiwws+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74144b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74145d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfcde147d
success 0 0
1619963361.217688
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 35389252
registers.edi: 0
registers.eax: 0
registers.ebp: 35389320
registers.edx: 49
registers.ebx: 0
registers.esi: 0
registers.ecx: 225
exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b
exception.symbol: hjiwws+0x96338
exception.instruction: div eax
exception.module: hjiwws.exe
exception.exception_code: 0xc0000094
exception.offset: 615224
exception.address: 0x496338
success 0 0
1619963364.668062
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34799428
registers.edi: 0
registers.eax: 0
registers.ebp: 34799496
registers.edx: 49
registers.ebx: 0
registers.esi: 0
registers.ecx: 667
exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b
exception.symbol: hjiwws+0x96338
exception.instruction: div eax
exception.module: hjiwws.exe
exception.exception_code: 0xc0000094
exception.offset: 615224
exception.address: 0x496338
success 0 0
1619963366.136187
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7452d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hjiwws+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74194b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74195d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe7b147d
success 0 0
1619963365.621437
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 35061572
registers.edi: 0
registers.eax: 0
registers.ebp: 35061640
registers.edx: 49
registers.ebx: 0
registers.esi: 0
registers.ecx: 620
exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b
exception.symbol: hjiwws+0x96338
exception.instruction: div eax
exception.module: hjiwws.exe
exception.exception_code: 0xc0000094
exception.offset: 615224
exception.address: 0x496338
success 0 0
1619963367.449312
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34471748
registers.edi: 0
registers.eax: 0
registers.ebp: 34471816
registers.edx: 49
registers.ebx: 0
registers.esi: 0
registers.ecx: 449
exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b
exception.symbol: hjiwws+0x96338
exception.instruction: div eax
exception.module: hjiwws.exe
exception.exception_code: 0xc0000094
exception.offset: 615224
exception.address: 0x496338
success 0 0
1619963370.496312
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7452d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hjiwws+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74194b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74195d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfcbd147d
success 0 0
1619963369.964937
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34930500
registers.edi: 0
registers.eax: 0
registers.ebp: 34930568
registers.edx: 49
registers.ebx: 0
registers.esi: 0
registers.ecx: 964
exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b
exception.symbol: hjiwws+0x96338
exception.instruction: div eax
exception.module: hjiwws.exe
exception.exception_code: 0xc0000094
exception.offset: 615224
exception.address: 0x496338
success 0 0
1619963371.996187
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49217348
registers.edi: 0
registers.eax: 0
registers.ebp: 49217416
registers.edx: 49
registers.ebx: 0
registers.esi: 0
registers.ecx: 995
exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b
exception.symbol: hjiwws+0x96338
exception.instruction: div eax
exception.module: hjiwws.exe
exception.exception_code: 0xc0000094
exception.offset: 615224
exception.address: 0x496338
success 0 0
1619963373.604937
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7452d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
hjiwws+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74194b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74195d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe5a147d
success 0 0
1619963373.605187
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34799428
registers.edi: 0
registers.eax: 0
registers.ebp: 34799496
registers.edx: 49
registers.ebx: 0
registers.esi: 0
registers.ecx: 589
exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b
exception.symbol: hjiwws+0x96338
exception.instruction: div eax
exception.module: hjiwws.exe
exception.exception_code: 0xc0000094
exception.offset: 615224
exception.address: 0x496338
success 0 0
1619963379.777062
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34733892
registers.edi: 0
registers.eax: 0
registers.ebp: 34733960
registers.edx: 49
registers.ebx: 0
registers.esi: 0
registers.ecx: 777
exception.instruction_r: f7 f0 89 c9 89 c9 33 c0 5a 59 59 64 89 10 e9 9b
exception.symbol: hjiwws+0x96338
exception.instruction: div eax
exception.module: hjiwws.exe
exception.exception_code: 0xc0000094
exception.offset: 615224
exception.address: 0x496338
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (50 out of 409 个事件)
Time & API Arguments Status Return Repeated
1619963312.928374
NtAllocateVirtualMemory
process_identifier: 1804
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619963313.116374
NtProtectVirtualMemory
process_identifier: 1804
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 28672
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00496000
success 0 0
1619963313.131374
NtAllocateVirtualMemory
process_identifier: 1804
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x006a0000
success 0 0
1619963314.256501
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619963314.335501
NtProtectVirtualMemory
process_identifier: 1948
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 28672
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00496000
success 0 0
1619963314.350501
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x005d0000
success 0 0
1619963315.897374
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619963316.163374
NtAllocateVirtualMemory
process_identifier: 920
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01f80000
success 0 0
1619963316.163374
NtAllocateVirtualMemory
process_identifier: 920
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01fe0000
success 0 0
1619963316.163374
NtAllocateVirtualMemory
process_identifier: 920
region_size: 630784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02020000
success 0 0
1619963316.163374
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 602112
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1619963326.741374
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00782000
success 0 0
1619963326.741374
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619963326.741374
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00782000
success 0 0
1619963326.741374
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619963326.741374
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00782000
success 0 0
1619963326.741374
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619963326.741374
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00782000
success 0 0
1619963326.741374
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619963326.741374
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00782000
success 0 0
1619963326.741374
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619963326.741374
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00782000
success 0 0
1619963326.741374
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619963326.741374
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00782000
success 0 0
1619963326.741374
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619963326.741374
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00782000
success 0 0
1619963326.741374
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619963326.741374
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00782000
success 0 0
1619963326.741374
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619963326.741374
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00782000
success 0 0
1619963326.741374
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619963315.787999
NtAllocateVirtualMemory
process_identifier: 1760
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01d30000
success 0 0
1619963315.802999
NtProtectVirtualMemory
process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 28672
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00496000
success 0 0
1619963315.818999
NtAllocateVirtualMemory
process_identifier: 1760
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01fe0000
success 0 0
1619963327.803249
NtAllocateVirtualMemory
process_identifier: 1108
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003d0000
success 0 0
1619963327.803249
NtProtectVirtualMemory
process_identifier: 1108
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 28672
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00496000
success 0 0
1619963327.803249
NtAllocateVirtualMemory
process_identifier: 1108
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00610000
success 0 0
1619963328.021999
NtProtectVirtualMemory
process_identifier: 2668
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619963328.037999
NtAllocateVirtualMemory
process_identifier: 2668
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x003b0000
success 0 0
1619963328.037999
NtAllocateVirtualMemory
process_identifier: 2668
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003c0000
success 0 0
1619963328.037999
NtAllocateVirtualMemory
process_identifier: 2668
region_size: 630784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01ff0000
success 0 0
1619963328.037999
NtProtectVirtualMemory
process_identifier: 2668
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 602112
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ff2000
success 0 0
1619963328.052999
NtProtectVirtualMemory
process_identifier: 2668
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00792000
success 0 0
1619963328.052999
NtProtectVirtualMemory
process_identifier: 2668
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619963328.052999
NtProtectVirtualMemory
process_identifier: 2668
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00792000
success 0 0
1619963328.052999
NtProtectVirtualMemory
process_identifier: 2668
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619963328.052999
NtProtectVirtualMemory
process_identifier: 2668
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00792000
success 0 0
1619963328.052999
NtProtectVirtualMemory
process_identifier: 2668
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619963328.052999
NtProtectVirtualMemory
process_identifier: 2668
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00792000
success 0 0
1619963328.052999
NtProtectVirtualMemory
process_identifier: 2668
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.vbs
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (30 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.410972570819614 section {'size_of_data': '0x00078200', 'virtual_address': '0x000b1000', 'entropy': 7.410972570819614, 'name': '.rsrc', 'virtual_size': '0x00078174'} description A section with a high entropy has been found
entropy 0.41244635193133045 description Overall entropy of this PE file is high
Expresses interest in specific running processes (1 个事件)
process hjiwws.exe
Repeatedly searches for a not-found process, you may want to run a web browser during analysis (41 个事件)
Time & API Arguments Status Return Repeated
1619963313.131374
Process32NextW
process_name: e8680b7a890458b72e5118b62a6ab97c.exe
snapshot_handle: 0x00000100
process_identifier: 1804
failed 0 0
1619963314.350501
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000104
process_identifier: 1824
failed 0 0
1619963315.818999
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000100
process_identifier: 1816
failed 0 0
1619963327.662999
Process32NextW
process_name: hjiwws.exe
snapshot_handle: 0x000002b4
process_identifier: 1760
failed 0 0
1619963327.819249
Process32NextW
process_name: hjiwws.exe
snapshot_handle: 0x00000100
process_identifier: 1108
failed 0 0
1619963328.085626
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000100
process_identifier: 2268
failed 0 0
1619963329.288626
Process32NextW
process_name: hjiwws.exe
snapshot_handle: 0x00000130
process_identifier: 3004
failed 0 0
1619963329.491124
Process32NextW
process_name: hjiwws.exe
snapshot_handle: 0x00000100
process_identifier: 196
failed 0 0
1619963329.725501
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000100
process_identifier: 1324
failed 0 0
1619963330.163501
Process32NextW
process_name: hjiwws.exe
snapshot_handle: 0x00000114
process_identifier: 2404
failed 0 0
1619963332.366751
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000100
process_identifier: 3116
failed 0 0
1619963332.647374
Process32NextW
process_name: hjiwws.exe
snapshot_handle: 0x00000100
process_identifier: 3196
failed 0 0
1619963333.085374
Process32NextW
process_name: hjiwws.exe
snapshot_handle: 0x00000114
process_identifier: 3196
failed 0 0
1619963333.256374
Process32NextW
process_name: hjiwws.exe
snapshot_handle: 0x00000104
process_identifier: 3300
failed 0 0
1619963333.756374
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000100
process_identifier: 3632
failed 0 0
1619963338.256374
Process32NextW
process_name: dllhost.exe
snapshot_handle: 0x000001a8
process_identifier: 3684
failed 0 0
1619963338.428249
Process32NextW
process_name: hjiwws.exe
snapshot_handle: 0x00000100
process_identifier: 3724
failed 0 0
1619963338.866626
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000100
process_identifier: 3948
failed 0 0
1619963339.522626
Process32NextW
process_name: hjiwws.exe
snapshot_handle: 0x0000011c
process_identifier: 3856
failed 0 0
1619963339.725876
Process32NextW
process_name: hjiwws.exe
snapshot_handle: 0x00000100
process_identifier: 3960
failed 0 0
1619963344.819876
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000100
process_identifier: 3208
failed 0 0
1619963345.694876
Process32NextW
process_name: hjiwws.exe
snapshot_handle: 0x00000124
process_identifier: 4092
failed 0 0
1619963345.897751
Process32NextW
process_name: hjiwws.exe
snapshot_handle: 0x00000100
process_identifier: 3232
failed 0 0
1619963346.444876
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000100
process_identifier: 3584
failed 0 0
1619963354.585876
Process32NextW
process_name: hjiwws.exe
snapshot_handle: 0x00000218
process_identifier: 3272
failed 0 0
1619963355.028999
Process32NextW
process_name: hjiwws.exe
snapshot_handle: 0x00000100
process_identifier: 3736
failed 0 0
1619963356.418999
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000100
process_identifier: 3956
failed 0 0
1619963358.246999
Process32NextW
process_name: hjiwws.exe
snapshot_handle: 0x00000134
process_identifier: 3936
failed 0 0
1619963358.605187
Process32NextW
process_name: hjiwws.exe
snapshot_handle: 0x00000100
process_identifier: 3084
failed 0 0
1619963361.232688
Process32NextW
process_name: hjiwws.exe
snapshot_handle: 0x00000100
process_identifier: 3244
failed 0 0
1619963364.248688
Process32NextW
process_name: mscorsvw.exe
snapshot_handle: 0x00000170
process_identifier: 3372
failed 0 0
1619963364.668062
Process32NextW
process_name: hjiwws.exe
snapshot_handle: 0x00000100
process_identifier: 3692
failed 0 0
1619963365.621437
Process32NextW
process_name: hjiwws.exe
snapshot_handle: 0x00000100
process_identifier: 3628
failed 0 0
1619963367.277437
Process32NextW
process_name: hjiwws.exe
snapshot_handle: 0x00000140
process_identifier: 3628
failed 0 0
1619963367.449312
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000100
process_identifier: 772
failed 0 0
1619963369.964937
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000100
process_identifier: 3744
failed 0 0
1619963371.823937
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000148
process_identifier: 3656
failed 0 0
1619963371.996187
Process32NextW
process_name: hjiwws.exe
snapshot_handle: 0x00000100
process_identifier: 1484
failed 0 0
1619963373.605187
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000100
process_identifier: 3940
failed 0 0
1619963379.621187
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000001e0
process_identifier: 3652
failed 0 0
1619963379.793062
Process32NextW
process_name: hjiwws.exe
snapshot_handle: 0x00000100
process_identifier: 3708
failed 0 0
网络通信
Communicates with host for which no DNS query was performed (3 个事件)
host 172.217.24.14
host 203.208.40.34
host 208.95.112.1
Creates an Alternate Data Stream (ADS) (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe:ZoneIdentifier
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619963313.585374
NtAllocateVirtualMemory
process_identifier: 1464
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000108
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
Installs itself for autorun at Windows startup (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win.vbs
Deletes executed files from disk (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe
Manipulates memory of a non-child process indicative of process injection (3 个事件)
Process injection Process 3708 manipulating memory of non-child process 3556
Time & API Arguments Status Return Repeated
1619963380.965062
NtUnmapViewOfSection
process_identifier: 3556
region_size: 4096
process_handle: 0x00000108
base_address: 0x00400000
success 0 0
1619963380.965062
NtMapViewOfSection
section_handle: 0x00000118
process_identifier: 3556
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000108
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
Creates a thread using NtQueueApcThread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 1804 created a thread in remote process 1464
Time & API Arguments Status Return Repeated
1619963313.585374
NtQueueApcThread
thread_handle: 0x00000110
process_identifier: 1464
function_address: 0x000b05c0
parameter: 0x000c0000
success 0 0
Potential code injection by writing to the memory of another process (2 个事件)
Time & API Arguments Status Return Repeated
1619963313.585374
WriteProcessMemory
process_identifier: 1464
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000108
base_address: 0x000b0000
success 1 0
1619963313.585374
WriteProcessMemory
process_identifier: 1464
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\e8680b7a890458b72e5118b62a6ab97c.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\e8680b7a890458b72e5118b62a6ab97c.exe" winset dJLQjvFkiBRO = creaTEobjecT("wScrIpt.sheLl") DjlQjvFkiBrO.Run """%ls""", 0, False
process_handle: 0x00000108
base_address: 0x000c0000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (28 个事件)
Process injection Process 1948 called NtSetContextThread to modify thread in remote process 920
Process injection Process 1108 called NtSetContextThread to modify thread in remote process 2668
Process injection Process 196 called NtSetContextThread to modify thread in remote process 1940
Process injection Process 2616 called NtSetContextThread to modify thread in remote process 3132
Process injection Process 3300 called NtSetContextThread to modify thread in remote process 3476
Process injection Process 3724 called NtSetContextThread to modify thread in remote process 3796
Process injection Process 3960 called NtSetContextThread to modify thread in remote process 4032
Process injection Process 3232 called NtSetContextThread to modify thread in remote process 3312
Process injection Process 3736 called NtSetContextThread to modify thread in remote process 3868
Process injection Process 3084 called NtSetContextThread to modify thread in remote process 3108
Process injection Process 3692 called NtSetContextThread to modify thread in remote process 3772
Process injection Process 3696 called NtSetContextThread to modify thread in remote process 2760
Process injection Process 1484 called NtSetContextThread to modify thread in remote process 3212
Process injection Process 3708 called NtSetContextThread to modify thread in remote process 3556
Time & API Arguments Status Return Repeated
1619963314.569501
NtSetContextThread
thread_handle: 0x00000114
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 920
success 0 0
1619963327.866249
NtSetContextThread
thread_handle: 0x00000110
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2668
success 0 0
1619963329.538124
NtSetContextThread
thread_handle: 0x00000110
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1940
success 0 0
1619963332.428751
NtSetContextThread
thread_handle: 0x00000110
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3132
success 0 0
1619963333.538374
NtSetContextThread
thread_handle: 0x00000114
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3476
success 0 0
1619963338.600249
NtSetContextThread
thread_handle: 0x00000110
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3796
success 0 0
1619963340.428876
NtSetContextThread
thread_handle: 0x00000110
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 4032
success 0 0
1619963346.210751
NtSetContextThread
thread_handle: 0x00000110
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3312
success 0 0
1619963355.778999
NtSetContextThread
thread_handle: 0x00000110
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3868
success 0 0
1619963360.792187
NtSetContextThread
thread_handle: 0x00000110
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3108
success 0 0
1619963365.371062
NtSetContextThread
thread_handle: 0x00000110
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3772
success 0 0
1619963368.418312
NtSetContextThread
thread_handle: 0x00000110
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2760
success 0 0
1619963372.324187
NtSetContextThread
thread_handle: 0x00000110
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3212
success 0 0
1619963380.996062
NtSetContextThread
thread_handle: 0x00000110
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3556
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (26 个事件)
Process injection Process 1948 resumed a thread in remote process 920
Process injection Process 1108 resumed a thread in remote process 2668
Process injection Process 196 resumed a thread in remote process 1940
Process injection Process 2616 resumed a thread in remote process 3132
Process injection Process 3300 resumed a thread in remote process 3476
Process injection Process 3724 resumed a thread in remote process 3796
Process injection Process 3960 resumed a thread in remote process 4032
Process injection Process 3232 resumed a thread in remote process 3312
Process injection Process 3736 resumed a thread in remote process 3868
Process injection Process 3084 resumed a thread in remote process 3108
Process injection Process 3692 resumed a thread in remote process 3772
Process injection Process 3696 resumed a thread in remote process 2760
Process injection Process 1484 resumed a thread in remote process 3212
Time & API Arguments Status Return Repeated
1619963315.616501
NtResumeThread
thread_handle: 0x00000114
suspend_count: 1
process_identifier: 920
success 0 0
1619963327.881249
NtResumeThread
thread_handle: 0x00000110
suspend_count: 1
process_identifier: 2668
success 0 0
1619963329.569124
NtResumeThread
thread_handle: 0x00000110
suspend_count: 1
process_identifier: 1940
success 0 0
1619963332.491751
NtResumeThread
thread_handle: 0x00000110
suspend_count: 1
process_identifier: 3132
success 0 0
1619963333.616374
NtResumeThread
thread_handle: 0x00000114
suspend_count: 1
process_identifier: 3476
success 0 0
1619963338.631249
NtResumeThread
thread_handle: 0x00000110
suspend_count: 1
process_identifier: 3796
success 0 0
1619963340.460876
NtResumeThread
thread_handle: 0x00000110
suspend_count: 1
process_identifier: 4032
success 0 0
1619963346.288751
NtResumeThread
thread_handle: 0x00000110
suspend_count: 1
process_identifier: 3312
success 0 0
1619963356.075999
NtResumeThread
thread_handle: 0x00000110
suspend_count: 1
process_identifier: 3868
success 0 0
1619963360.823187
NtResumeThread
thread_handle: 0x00000110
suspend_count: 1
process_identifier: 3108
success 0 0
1619963365.449062
NtResumeThread
thread_handle: 0x00000110
suspend_count: 1
process_identifier: 3772
success 0 0
1619963369.793312
NtResumeThread
thread_handle: 0x00000110
suspend_count: 1
process_identifier: 2760
success 0 0
1619963373.433187
NtResumeThread
thread_handle: 0x00000110
suspend_count: 1
process_identifier: 3212
success 0 0
Executed a process and injected code into it, probably while unpacking (50 out of 115 个事件)
Time & API Arguments Status Return Repeated
1619963313.585374
CreateProcessInternalW
thread_identifier: 2268
thread_handle: 0x00000110
process_identifier: 1464
current_directory:
filepath: C:\Windows\System32\notepad.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\notepad.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000108
inherit_handles: 0
success 1 0
1619963313.585374
NtAllocateVirtualMemory
process_identifier: 1464
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000108
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
1619963313.585374
NtAllocateVirtualMemory
process_identifier: 1464
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
process_handle: 0x00000108
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000c0000
success 0 0
1619963313.585374
WriteProcessMemory
process_identifier: 1464
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000108
base_address: 0x000b0000
success 1 0
1619963313.585374
WriteProcessMemory
process_identifier: 1464
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\e8680b7a890458b72e5118b62a6ab97c.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\e8680b7a890458b72e5118b62a6ab97c.exe" winset dJLQjvFkiBRO = creaTEobjecT("wScrIpt.sheLl") DjlQjvFkiBrO.Run """%ls""", 0, False
process_handle: 0x00000108
base_address: 0x000c0000
success 1 0
1619963314.069751
CreateProcessInternalW
thread_identifier: 1320
thread_handle: 0x000000d0
process_identifier: 1948
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000000cc
inherit_handles: 0
success 1 0
1619963314.538501
CreateProcessInternalW
thread_identifier: 3004
thread_handle: 0x00000114
process_identifier: 920
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x0000010c
inherit_handles: 0
success 1 0
1619963314.538501
NtUnmapViewOfSection
process_identifier: 920
region_size: 4096
process_handle: 0x0000010c
base_address: 0x00400000
success 0 0
1619963314.538501
NtMapViewOfSection
section_handle: 0x0000011c
process_identifier: 920
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x0000010c
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619963314.569501
NtGetContextThread
thread_handle: 0x00000114
success 0 0
1619963314.569501
NtSetContextThread
thread_handle: 0x00000114
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 920
success 0 0
1619963315.616501
NtResumeThread
thread_handle: 0x00000114
suspend_count: 1
process_identifier: 920
success 0 0
1619963315.647501
CreateProcessInternalW
thread_identifier: 2032
thread_handle: 0x00000118
process_identifier: 1760
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe" 2 920 18100656
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000128
inherit_handles: 0
success 1 0
1619963327.662999
CreateProcessInternalW
thread_identifier: 1404
thread_handle: 0x000002b8
process_identifier: 1108
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000002bc
inherit_handles: 0
success 1 0
1619963327.850249
CreateProcessInternalW
thread_identifier: 2796
thread_handle: 0x00000110
process_identifier: 2668
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000108
inherit_handles: 0
success 1 0
1619963327.850249
NtUnmapViewOfSection
process_identifier: 2668
region_size: 4096
process_handle: 0x00000108
base_address: 0x00400000
success 0 0
1619963327.850249
NtMapViewOfSection
section_handle: 0x00000118
process_identifier: 2668
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000108
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619963327.866249
NtGetContextThread
thread_handle: 0x00000110
success 0 0
1619963327.866249
NtSetContextThread
thread_handle: 0x00000110
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2668
success 0 0
1619963327.881249
NtResumeThread
thread_handle: 0x00000110
suspend_count: 1
process_identifier: 2668
success 0 0
1619963327.897249
CreateProcessInternalW
thread_identifier: 1324
thread_handle: 0x00000114
process_identifier: 3004
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe" 2 2668 18112921
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000124
inherit_handles: 0
success 1 0
1619963329.335626
CreateProcessInternalW
thread_identifier: 2760
thread_handle: 0x00000134
process_identifier: 196
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000138
inherit_handles: 0
success 1 0
1619963329.522124
CreateProcessInternalW
thread_identifier: 1244
thread_handle: 0x00000110
process_identifier: 1940
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000108
inherit_handles: 0
success 1 0
1619963329.522124
NtUnmapViewOfSection
process_identifier: 1940
region_size: 4096
process_handle: 0x00000108
base_address: 0x00400000
success 0 0
1619963329.522124
NtMapViewOfSection
section_handle: 0x00000118
process_identifier: 1940
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000108
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619963329.538124
NtGetContextThread
thread_handle: 0x00000110
success 0 0
1619963329.538124
NtSetContextThread
thread_handle: 0x00000110
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1940
success 0 0
1619963329.569124
NtResumeThread
thread_handle: 0x00000110
suspend_count: 1
process_identifier: 1940
success 0 0
1619963329.585124
CreateProcessInternalW
thread_identifier: 2840
thread_handle: 0x00000114
process_identifier: 2404
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe" 2 1940 18114609
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000124
inherit_handles: 0
success 1 0
1619963330.194501
CreateProcessInternalW
thread_identifier: 2576
thread_handle: 0x00000118
process_identifier: 2616
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000011c
inherit_handles: 0
success 1 0
1619963332.413751
CreateProcessInternalW
thread_identifier: 3136
thread_handle: 0x00000110
process_identifier: 3132
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000108
inherit_handles: 0
success 1 0
1619963332.413751
NtUnmapViewOfSection
process_identifier: 3132
region_size: 4096
process_handle: 0x00000108
base_address: 0x00400000
success 0 0
1619963332.413751
NtMapViewOfSection
section_handle: 0x00000118
process_identifier: 3132
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000108
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619963332.428751
NtGetContextThread
thread_handle: 0x00000110
success 0 0
1619963332.428751
NtSetContextThread
thread_handle: 0x00000110
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3132
success 0 0
1619963332.491751
NtResumeThread
thread_handle: 0x00000110
suspend_count: 1
process_identifier: 3132
success 0 0
1619963332.506751
CreateProcessInternalW
thread_identifier: 3200
thread_handle: 0x00000114
process_identifier: 3196
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe" 2 3132 18117531
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000124
inherit_handles: 0
success 1 0
1619963333.116374
CreateProcessInternalW
thread_identifier: 3304
thread_handle: 0x00000118
process_identifier: 3300
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000011c
inherit_handles: 0
success 1 0
1619963333.366374
CreateProcessInternalW
thread_identifier: 3480
thread_handle: 0x00000114
process_identifier: 3476
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x0000010c
inherit_handles: 0
success 1 0
1619963333.366374
NtUnmapViewOfSection
process_identifier: 3476
region_size: 4096
process_handle: 0x0000010c
base_address: 0x00400000
success 0 0
1619963333.366374
NtMapViewOfSection
section_handle: 0x0000011c
process_identifier: 3476
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x0000010c
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619963333.538374
NtGetContextThread
thread_handle: 0x00000114
success 0 0
1619963333.538374
NtSetContextThread
thread_handle: 0x00000114
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3476
success 0 0
1619963333.616374
NtResumeThread
thread_handle: 0x00000114
suspend_count: 1
process_identifier: 3476
success 0 0
1619963333.616374
CreateProcessInternalW
thread_identifier: 3540
thread_handle: 0x00000118
process_identifier: 3536
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe" 2 3476 18118656
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000128
inherit_handles: 0
success 1 0
1619963338.288374
CreateProcessInternalW
thread_identifier: 3728
thread_handle: 0x000001ac
process_identifier: 3724
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000001b0
inherit_handles: 0
success 1 0
1619963338.553249
CreateProcessInternalW
thread_identifier: 3800
thread_handle: 0x00000110
process_identifier: 3796
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\app\hjiwws.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000108
inherit_handles: 0
success 1 0
1619963338.553249
NtUnmapViewOfSection
process_identifier: 3796
region_size: 4096
process_handle: 0x00000108
base_address: 0x00400000
success 0 0
1619963338.553249
NtMapViewOfSection
section_handle: 0x00000118
process_identifier: 3796
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000108
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619963338.600249
NtGetContextThread
thread_handle: 0x00000110
success 0 0
File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
DrWeb Trojan.PWS.Stealer.28810
MicroWorld-eScan Trojan.Delf.FareIt.Gen.7
FireEye Generic.mg.e8680b7a890458b7
ALYac Trojan.Delf.FareIt.Gen.7
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Malware
K7AntiVirus Trojan ( 0056a36b1 )
Alibaba Trojan:Win32/DelfInject.ali2000015
K7GW Trojan ( 0056a36b1 )
Cybereason malicious.8e9c23
Arcabit Trojan.Delf.FareIt.Gen.7
BitDefenderTheta Gen:NN.ZelphiF.34670.iHW@amKsNkfi
Cyren W32/Injector.OEGP-4909
Symantec Trojan.Gen.2
APEX Malicious
Avast Win32:MalwareX-gen [Trj]
ClamAV Win.Dropper.AgentTesla-8985766-1
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
BitDefender Trojan.Delf.FareIt.Gen.7
NANO-Antivirus Trojan.Win32.Kryptik.hnsacj
Paloalto generic.ml
Rising Trojan.Injector!1.C99D (CLASSIC)
Ad-Aware Trojan.Delf.FareIt.Gen.7
Sophos Mal/Generic-S
Comodo Malware@#1x94w6z1gatv9
F-Secure Trojan.TR/Injector.nvhlo
Zillya Trojan.Kryptik.Win32.2153857
TrendMicro TSPY_HPLOKI.SMBD
McAfee-GW-Edition BehavesLike.Win32.Fareit.tc
Emsisoft Trojan.Delf.FareIt.Gen.7 (B)
SentinelOne Static AI - Suspicious PE
Jiangmin Trojan.Kryptik.bus
Webroot W32.Trojan.Delf.Fareit.Gen
Avira TR/Injector.nvhlo
Antiy-AVL Trojan/Win32.Kryptik
Microsoft PWS:Win32/Fareit.AQ!MTB
AegisLab Trojan.Win32.Kryptik.4!c
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
GData Trojan.Delf.FareIt.Gen.7
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2094
McAfee Fareit-FVZ!E8680B7A8904
MAX malware (ai score=83)
VBA32 TScope.Trojan.Delf
Malwarebytes Trojan.MalPack.DLF
Zoner Trojan.Win32.91516
ESET-NOD32 a variant of Win32/Injector.EMOP
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 172.217.24.14:443
dead_host 172.217.160.110:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x4a0178 VirtualFree
• 0x4a017c VirtualAlloc
• 0x4a0180 LocalFree
• 0x4a0184 LocalAlloc
• 0x4a0188 GetVersion
• 0x4a018c GetCurrentThreadId
• 0x4a0198 VirtualQuery
• 0x4a019c WideCharToMultiByte
• 0x4a01a0 MultiByteToWideChar
• 0x4a01a4 lstrlenA
• 0x4a01a8 lstrcpynA
• 0x4a01ac LoadLibraryExA
• 0x4a01b0 GetThreadLocale
• 0x4a01b4 GetStartupInfoA
• 0x4a01b8 GetProcAddress
• 0x4a01bc GetModuleHandleA
• 0x4a01c0 GetModuleFileNameA
• 0x4a01c4 GetLocaleInfoA
• 0x4a01c8 GetCommandLineA
• 0x4a01cc FreeLibrary
• 0x4a01d0 FindFirstFileA
• 0x4a01d4 FindClose
• 0x4a01d8 ExitProcess
• 0x4a01dc WriteFile
• 0x4a01e4 RtlUnwind
• 0x4a01e8 RaiseException
• 0x4a01ec GetStdHandle
Library user32.dll:
• 0x4a01f4 GetKeyboardType
• 0x4a01f8 LoadStringA
• 0x4a01fc MessageBoxA
• 0x4a0200 CharNextA
Library advapi32.dll:
• 0x4a0208 RegQueryValueExA
• 0x4a020c RegOpenKeyExA
• 0x4a0210 RegCloseKey
Library oleaut32.dll:
• 0x4a0218 SysFreeString
• 0x4a021c SysReAllocStringLen
• 0x4a0220 SysAllocStringLen
Library kernel32.dll:
• 0x4a0228 TlsSetValue
• 0x4a022c TlsGetValue
• 0x4a0230 LocalAlloc
• 0x4a0234 GetModuleHandleA
Library advapi32.dll:
• 0x4a023c RegQueryValueExA
• 0x4a0240 RegOpenKeyExA
• 0x4a0244 RegCloseKey
Library kernel32.dll:
• 0x4a024c lstrcpyA
• 0x4a0250 WriteFile
• 0x4a0254 WideCharToMultiByte
• 0x4a0258 WaitForSingleObject
• 0x4a025c VirtualQuery
• 0x4a0260 VirtualProtectEx
• 0x4a0264 VirtualAlloc
• 0x4a0268 Sleep
• 0x4a026c SizeofResource
• 0x4a0270 SetThreadLocale
• 0x4a0274 SetFilePointer
• 0x4a0278 SetEvent
• 0x4a027c SetErrorMode
• 0x4a0280 SetEndOfFile
• 0x4a0284 ResetEvent
• 0x4a0288 ReadFile
• 0x4a028c MultiByteToWideChar
• 0x4a0290 MulDiv
• 0x4a0294 LockResource
• 0x4a0298 LoadResource
• 0x4a029c LoadLibraryA
• 0x4a02a8 GlobalUnlock
• 0x4a02ac GlobalReAlloc
• 0x4a02b0 GlobalHandle
• 0x4a02b4 GlobalLock
• 0x4a02b8 GlobalFree
• 0x4a02bc GlobalFindAtomA
• 0x4a02c0 GlobalDeleteAtom
• 0x4a02c4 GlobalAlloc
• 0x4a02c8 GlobalAddAtomA
• 0x4a02cc GetVersionExA
• 0x4a02d0 GetVersion
• 0x4a02d4 GetTickCount
• 0x4a02d8 GetThreadLocale
• 0x4a02dc GetSystemInfo
• 0x4a02e0 GetStringTypeExA
• 0x4a02e4 GetStdHandle
• 0x4a02e8 GetProcAddress
• 0x4a02ec GetModuleHandleA
• 0x4a02f0 GetModuleFileNameA
• 0x4a02f4 GetLocaleInfoA
• 0x4a02f8 GetLocalTime
• 0x4a02fc GetLastError
• 0x4a0300 GetFullPathNameA
• 0x4a0304 GetFileAttributesA
• 0x4a0308 GetDiskFreeSpaceA
• 0x4a030c GetDateFormatA
• 0x4a0310 GetCurrentThreadId
• 0x4a0314 GetCurrentProcessId
• 0x4a0318 GetCurrentProcess
• 0x4a031c GetCPInfo
• 0x4a0320 GetACP
• 0x4a0324 FreeResource
• 0x4a0328 InterlockedExchange
• 0x4a032c FreeLibrary
• 0x4a0330 FormatMessageA
• 0x4a0334 FindResourceA
• 0x4a0338 FindFirstFileA
• 0x4a033c FindClose
• 0x4a0348 EnumCalendarInfoA
• 0x4a0354 CreateThread
• 0x4a0358 CreateFileA
• 0x4a035c CreateEventA
• 0x4a0360 CompareStringA
• 0x4a0364 CloseHandle
Library version.dll:
• 0x4a036c VerQueryValueA
• 0x4a0374 GetFileVersionInfoA
Library gdi32.dll:
• 0x4a037c UnrealizeObject
• 0x4a0380 StretchBlt
• 0x4a0384 SetWindowOrgEx
• 0x4a0388 SetWinMetaFileBits
• 0x4a038c SetViewportOrgEx
• 0x4a0390 SetTextColor
• 0x4a0394 SetStretchBltMode
• 0x4a0398 SetROP2
• 0x4a039c SetPixel
• 0x4a03a0 SetEnhMetaFileBits
• 0x4a03a4 SetDIBColorTable
• 0x4a03a8 SetBrushOrgEx
• 0x4a03ac SetBkMode
• 0x4a03b0 SetBkColor
• 0x4a03b4 SelectPalette
• 0x4a03b8 SelectObject
• 0x4a03bc SelectClipPath
• 0x4a03c0 SaveDC
• 0x4a03c4 RestoreDC
• 0x4a03c8 Rectangle
• 0x4a03cc RectVisible
• 0x4a03d0 RealizePalette
• 0x4a03d4 Polyline
• 0x4a03d8 PlayEnhMetaFile
• 0x4a03dc PatBlt
• 0x4a03e0 MoveToEx
• 0x4a03e4 MaskBlt
• 0x4a03e8 LineTo
• 0x4a03ec IntersectClipRect
• 0x4a03f0 GetWindowOrgEx
• 0x4a03f4 GetWinMetaFileBits
• 0x4a03f8 GetTextMetricsA
• 0x4a0404 GetStockObject
• 0x4a0408 GetPixel
• 0x4a040c GetPaletteEntries
• 0x4a0410 GetObjectA
• 0x4a041c GetEnhMetaFileBits
• 0x4a0420 GetDeviceCaps
• 0x4a0424 GetDIBits
• 0x4a0428 GetDIBColorTable
• 0x4a042c GetDCOrgEx
• 0x4a0434 GetClipBox
• 0x4a0438 GetBrushOrgEx
• 0x4a043c GetBitmapBits
• 0x4a0440 ExcludeClipRect
• 0x4a0444 DeleteObject
• 0x4a0448 DeleteEnhMetaFile
• 0x4a044c DeleteDC
• 0x4a0450 CreateSolidBrush
• 0x4a0454 CreatePenIndirect
• 0x4a0458 CreatePen
• 0x4a045c CreatePalette
• 0x4a0464 CreateFontIndirectA
• 0x4a0468 CreateDIBitmap
• 0x4a046c CreateDIBSection
• 0x4a0470 CreateCompatibleDC
• 0x4a0478 CreateBrushIndirect
• 0x4a047c CreateBitmap
• 0x4a0480 CopyEnhMetaFileA
• 0x4a0484 BitBlt
Library user32.dll:
• 0x4a048c CreateWindowExA
• 0x4a0490 WindowFromPoint
• 0x4a0494 WinHelpA
• 0x4a0498 WaitMessage
• 0x4a049c ValidateRect
• 0x4a04a0 UpdateWindow
• 0x4a04a4 UnregisterClassA
• 0x4a04a8 UnhookWindowsHookEx
• 0x4a04ac TranslateMessage
• 0x4a04b4 TrackPopupMenu
• 0x4a04bc ShowWindow
• 0x4a04c0 ShowScrollBar
• 0x4a04c4 ShowOwnedPopups
• 0x4a04c8 ShowCursor
• 0x4a04cc SetWindowsHookExA
• 0x4a04d0 SetWindowPos
• 0x4a04d4 SetWindowPlacement
• 0x4a04d8 SetWindowLongA
• 0x4a04dc SetTimer
• 0x4a04e0 SetScrollRange
• 0x4a04e4 SetScrollPos
• 0x4a04e8 SetScrollInfo
• 0x4a04ec SetRect
• 0x4a04f0 SetPropA
• 0x4a04f4 SetParent
• 0x4a04f8 SetMenuItemInfoA
• 0x4a04fc SetMenu
• 0x4a0500 SetForegroundWindow
• 0x4a0504 SetFocus
• 0x4a0508 SetCursor
• 0x4a050c SetClassLongA
• 0x4a0510 SetCapture
• 0x4a0514 SetActiveWindow
• 0x4a0518 SendMessageA
• 0x4a051c ScrollWindow
• 0x4a0520 ScreenToClient
• 0x4a0524 RemovePropA
• 0x4a0528 RemoveMenu
• 0x4a052c ReleaseDC
• 0x4a0530 ReleaseCapture
• 0x4a053c RegisterClassA
• 0x4a0540 RedrawWindow
• 0x4a0544 PtInRect
• 0x4a0548 PostQuitMessage
• 0x4a054c PostMessageA
• 0x4a0550 PeekMessageA
• 0x4a0554 OffsetRect
• 0x4a0558 OemToCharA
• 0x4a055c MessageBoxA
• 0x4a0560 MapWindowPoints
• 0x4a0564 MapVirtualKeyA
• 0x4a0568 LoadStringA
• 0x4a056c LoadKeyboardLayoutA
• 0x4a0570 LoadIconA
• 0x4a0574 LoadCursorA
• 0x4a0578 LoadBitmapA
• 0x4a057c KillTimer
• 0x4a0580 IsZoomed
• 0x4a0584 IsWindowVisible
• 0x4a0588 IsWindowEnabled
• 0x4a058c IsWindow
• 0x4a0590 IsRectEmpty
• 0x4a0594 IsIconic
• 0x4a0598 IsDialogMessageA
• 0x4a059c IsChild
• 0x4a05a0 InvalidateRect
• 0x4a05a4 IntersectRect
• 0x4a05a8 InsertMenuItemA
• 0x4a05ac InsertMenuA
• 0x4a05b0 InflateRect
• 0x4a05b8 GetWindowTextA
• 0x4a05bc GetWindowRect
• 0x4a05c0 GetWindowPlacement
• 0x4a05c4 GetWindowLongA
• 0x4a05c8 GetWindowDC
• 0x4a05cc GetTopWindow
• 0x4a05d0 GetSystemMetrics
• 0x4a05d4 GetSystemMenu
• 0x4a05d8 GetSysColorBrush
• 0x4a05dc GetSysColor
• 0x4a05e0 GetSubMenu
• 0x4a05e4 GetScrollRange
• 0x4a05e8 GetScrollPos
• 0x4a05ec GetScrollInfo
• 0x4a05f0 GetPropA
• 0x4a05f4 GetParent
• 0x4a05f8 GetWindow
• 0x4a05fc GetMenuStringA
• 0x4a0600 GetMenuState
• 0x4a0604 GetMenuItemInfoA
• 0x4a0608 GetMenuItemID
• 0x4a060c GetMenuItemCount
• 0x4a0610 GetMenu
• 0x4a0614 GetLastActivePopup
• 0x4a0618 GetKeyboardState
• 0x4a0620 GetKeyboardLayout
• 0x4a0624 GetKeyState
• 0x4a0628 GetKeyNameTextA
• 0x4a062c GetIconInfo
• 0x4a0630 GetForegroundWindow
• 0x4a0634 GetFocus
• 0x4a0638 GetDlgItem
• 0x4a063c GetDesktopWindow
• 0x4a0640 GetDCEx
• 0x4a0644 GetDC
• 0x4a0648 GetCursorPos
• 0x4a064c GetCursor
• 0x4a0650 GetClipboardData
• 0x4a0654 GetClientRect
• 0x4a0658 GetClassNameA
• 0x4a065c GetClassInfoA
• 0x4a0660 GetCapture
• 0x4a0664 GetActiveWindow
• 0x4a0668 FrameRect
• 0x4a066c FindWindowA
• 0x4a0670 FillRect
• 0x4a0674 EqualRect
• 0x4a0678 EnumWindows
• 0x4a067c EnumThreadWindows
• 0x4a0680 EndPaint
• 0x4a0684 EnableWindow
• 0x4a0688 EnableScrollBar
• 0x4a068c EnableMenuItem
• 0x4a0690 DrawTextA
• 0x4a0694 DrawMenuBar
• 0x4a0698 DrawIconEx
• 0x4a069c DrawIcon
• 0x4a06a0 DrawFrameControl
• 0x4a06a4 DrawFocusRect
• 0x4a06a8 DrawEdge
• 0x4a06ac DispatchMessageA
• 0x4a06b0 DestroyWindow
• 0x4a06b4 DestroyMenu
• 0x4a06b8 DestroyIcon
• 0x4a06bc DestroyCursor
• 0x4a06c0 DeleteMenu
• 0x4a06c4 DefWindowProcA
• 0x4a06c8 DefMDIChildProcA
• 0x4a06cc DefFrameProcA
• 0x4a06d0 CreatePopupMenu
• 0x4a06d4 CreateMenu
• 0x4a06d8 CreateIcon
• 0x4a06dc ClientToScreen
• 0x4a06e0 CheckMenuItem
• 0x4a06e4 CallWindowProcA
• 0x4a06e8 CallNextHookEx
• 0x4a06ec BeginPaint
• 0x4a06f0 CharNextA
• 0x4a06f4 CharLowerBuffA
• 0x4a06f8 CharLowerA
• 0x4a06fc CharUpperBuffA
• 0x4a0700 CharToOemA
• 0x4a0704 AdjustWindowRectEx
Library kernel32.dll:
• 0x4a0710 Sleep
Library oleaut32.dll:
• 0x4a0718 SafeArrayPtrOfIndex
• 0x4a071c SafeArrayPutElement
• 0x4a0720 SafeArrayGetElement
• 0x4a0728 SafeArrayAccessData
• 0x4a072c SafeArrayGetUBound
• 0x4a0730 SafeArrayGetLBound
• 0x4a0734 SafeArrayRedim
• 0x4a0738 SafeArrayCreate
• 0x4a073c VariantChangeType
• 0x4a0740 VariantCopyInd
• 0x4a0744 VariantCopy
• 0x4a0748 VariantClear
• 0x4a074c VariantInit
Library ole32.dll:
• 0x4a0754 CoCreateInstance
• 0x4a0758 CoGetMalloc
• 0x4a075c CoUninitialize
• 0x4a0760 CoInitialize
Library oleaut32.dll:
• 0x4a0768 GetErrorInfo
• 0x4a076c SysStringLen
• 0x4a0770 SysFreeString
Library comctl32.dll:
• 0x4a0780 ImageList_Write
• 0x4a0784 ImageList_Read
• 0x4a0794 ImageList_DragMove
• 0x4a0798 ImageList_DragLeave
• 0x4a079c ImageList_DragEnter
• 0x4a07a0 ImageList_EndDrag
• 0x4a07a4 ImageList_BeginDrag
• 0x4a07a8 ImageList_Remove
• 0x4a07ac ImageList_DrawEx
• 0x4a07b0 ImageList_Replace
• 0x4a07b4 ImageList_Draw
• 0x4a07c4 ImageList_Add
• 0x4a07cc ImageList_Destroy
• 0x4a07d0 ImageList_Create
• 0x4a07d4 InitCommonControls
Library comdlg32.dll:
• 0x4a07dc GetSaveFileNameA
• 0x4a07e0 GetOpenFileNameA
Library winmm.dll:
• 0x4a07e8 mciSendCommandA
• 0x4a07ec mciGetErrorStringA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 62912 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.