样本3x（VT2+VT4+VT9）

lsop1349987

https://wormhole.app/6YDyrE#9lGu5t8he98ZdpQKfcEX0Q
VirusTotal - File - 965ff7fe6cba31dd148f4aadf945dba464f4f7cba0e8e65aa52debaf4ba1831c
VirusTotal - File - 7008a631e6cf9c9f3c1430ed45632db7f4527436761514b6ac9cf7f892c56593
VirusTotal - File - 9dad64509ee0448efadab1e7a6be977592912a6548801cefb8d137580288dadc

kaba666

卡巴杀一个，剩下俩个双击没反应，其中以个双击关闭了网络，它关闭网络干嘛呢？有必要吗？把自己后路的断了

1073328164

迈克菲扫描 miss all

真小读者

猎鹰2X

莒县小哥

xu126yx

HMPA kill 3x - all heapheapprotect

sample 1, HMPA kill gtzwsqgt.exe
lets_x64.exe -> gtzwsqgt.exe -> u5x.dll, callee allocatevirtualmemory


sample 2, HMPA kill iusb3mon.exe
letslaxxx.exe -> irsetup.exe -> iusb3mon.exe -> eduwebcontainer.dll, callee allocatevirtualmemory


sample 3, HMPA kill wsbridge.exe
meganxxx.exe -> wininit.exe -> services.exe -> svchost.exe -> mmc.exe -> wsbridge.exe(signed) -> nnwrapper.dll(not signed), callee protectvirtualmemory

心醉咖啡

火绒

biue

腾讯电脑管家 3X

吃瓜群众第123位

AhnLab kill 1x