SmartHawk

9.8

极危

26 个模型检测该样本为恶意！

重新分析

下载样本

b1bff2299afee5f15d836cc964605007e18d5e911cdc157981144ac3427ae9e6

31515845b7b5608441739994b2847fc1.exe

分析耗时

115s

最近分析

文件大小

1.6MB

静态报毒动态报毒 CMRTAZQAKBGTO CROSSRIDER CROSSRIDER1 DS@8M1BFT ELDORADO GLRPKQ GRAYWARE HIGH CONFIDENCE MALICIOUS NXWZQLMSJ70O0O PLAYTECH PLAYTECHPMF R300843 RDMK S9225160 SUSPICIOUS PE 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba		20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:PUP-gen [PUP]	20200312	18.4.3895.0
Tencent		20200312	1.0.0.1
Kingsoft		20200312	2013.8.14.323
McAfee	Playtech	20200312	6.0.6.653
CrowdStrike		20190702	1.0

This executable is signed

This executable has a PDB path (1 个事件)

pdb_path

F:\QT_DL_INSTALLER_BUILD\web-installer\WebInstaller\noneAdminRelease\WebInstaller.pdb

Tries to locate where the browsers are installed (3 个事件)

registry	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
registry	HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Mozilla Firefox
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe

The file contains an unknown PE resource name possibly indicative of a packer (3 个事件)

resource name	DATA
resource name	PNG
resource name	None

Performs some HTTP requests (15 个事件)

request	GET http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
request	GET http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
request	GET http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
request	GET http://fallback.playtech-installer.com/playtech_compressed_assets/casino_casinocom/index.7ze
request	GET http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEHSfdSPcp6pyLdnEz5lZ6ec%3D
request	GET http://fallback.playtech-installer.com/playtech_compressed_assets/casino_casinocom/templates/installer/casinocom_new_notif.7ze
request	GET http://cache.download2.casino.com/download/casino/client_update_urls.php
request	GET http://fallback.playtech-installer.com/playtech_cabs/casino_casinocom/casino[zh-cn].cab
request	GET https://c6m7w2m9.ssl.hwcdn.net/playtech_compressed_assets/casino_casinocom/templates/installer/casinocom_new_notif.7ze
request	GET https://c6m7w2m9.ssl.hwcdn.net/playtech_cabs/casino_casinocom/casino[zh-cn].cab
request	GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=SIkJmYDDUnwngtkTwFgaV50IRcWTGFuR7Of3%2FEBe6znssnwdPJ%2FMlljrNjNPuw%2FlpZOFJa78TZAHifenwNiVCoZPH9DRUM5tOxGAhep5%2FPyNzBovPTMjB83mXPeo8KR49uf1KVAcR5sUIBN7gatrZVy%2BdyO37P7NXQ7T7l2963A1cMnh3ldawpJLCRS%2BayG00xmwEyZRH67Fda7bCv2CcIloHTbhYXOdmSVeCaYL%2FsAQgjtv0em39Tcjwqo5R4NRGgwylHP0zkZretYluKS%2BWGijbK4gVsPdbZWDLhogOOR2Fy6iltIblQOr9wTJNUtpTAgaNuowqSe%2BVVphrgue9hw3JqnvzY0%2FAbJ6ZTsNBg0T8EK%2BX6l2in5vNAIPF6O%2B5tAOjAecsIUAV3TOdmSDkEI2SgPruQwSOlfbxyoFNTyoSUbQDlZ3Fig4hi1Z%2B8e0UqDbGCaqQRvlbOFyiMIuc8X%2BZNT17wjoTvm6CB3%2BKysA6CMSz2VguiuVH%2BjXLY6Id9jLV8e7c0qj0VpsXVrkLe%2FBHmosqY8zbOT5lV1g6iPCG2XzALR5EAP6cY7rAzMjKJgDSJmv%2BXd%2BElPBAylSIFVqAAsEO1aPmr6mHgEqq4FsBuKT9N3VlHBsV%2FYgL9cAK2IkNrBjdu6r6xW98WeN5Tb0TRgjG%2BiY8klajDhg0dSiq0rS3xmp220Kfzy5oUgHNqcnF3TcxE%2BgJIU5pg%2BFIrIi5om70olxJOusHp9bIw%2B1bnTqH7OBZfUKhoyG%2BBeHNJIWtCvTW0xqBnXPMRcFiff2egi28D%2B7xFIhTxPM7Ulnka1QA0W21tiBGeXZHJeyc9HBcGM2oMh4ptCfCvUZhEjsAT%2FabKSlx%2FU4ZcCnkuLsjgTRzsJPLE%2BDtfLUYv59EVHqynUxpi6Iqwmc2xZzsuF0FJIv3k7xE3jE45j4CDjcOWHe0U4Gxs6LofgdrhE16Q8X%2FZGQpy%2FtYXuOXylNh6Gcr6h1MEGk%2FSSOHcwM8xdJAi7TchNIVdj8Pj85jPZmfQz9qPc4aLo2rVWwwaPECvSlJ0Qd%2FVd0jnwfdfyxnJys0G1rTyaBYX2qfHYI7sRkGQTuz1QxeliDpAq%2F3QKRwGkyONaTedaIPkqWRuSeP3kA1kVySjAf%2FXEGAvAcDZn8FMgRnD%2BiazLjyFLIDlgbFRT36r7uyLbe4B2FCpRjk%2FLjSlm9iF3UXDWjf61xJOVK7CfAOihRINR0zc97mP7iMma3BepzE60EeoJ13e5j3z1kYgxw2YmtTYexfNylkNmXNp%2F24Z9H%2FJOwge%2B6rgnMrpMQv9Rn47iNTNYjC8fHbJnvyF88tyS7xTXtIZqW6VfGlC7ZAC3pNi2C0f3Rc4rPsA%3D%3D
request	GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=W3ako9AP9xfu1zFh9DHYr6BK%2FTvtjCT158mC9Xux91vZVZBinXEqNnAyXZ0lxflgS25lH6Jo8z9SatiN4tVWzah509gQAQepG11oRpCWTDbOSLiiKUJkcGfeJ%2FbNTJ510EbedPW%2BXT9OSNInvYAQczyPDhm2OhKJIaN9dghAMz4J7kHXOMMNUAjYvj2zt%2FS00EDXZ8%2BOph3p3urXEwpSkDPNxqemn1u02UoVSs%2FlGZbbFd52cJH0vDplwFjOQUQEY8H5ykL%2Fw%2B0ceT44Bbgt%2BG%2FKS7S4hOERyLWzgieCyQpmfojbS2Jk%2F8hWgBlonAWhwEULv7V1z4emLPfej%2FRMDMIST6wVOueUWMhFdm4mbZKE7LIu1n5dZTRfI7Hv%2FToKWAzaRulbNW9d2dgos2QBWBUD5oKqEayPOWWEKoasoq4ABw05%2FYHMd1901txx9I6YIdAFjovRYZ9JSOJlMk9grxU9w2zREfSpEZd6Ot%2FAhPfyBuGE7BBiLQZqNdA4EyAU4gO8eJLhUDqVv08a%2BbgznzRC21PrLCxPPmeTVU3EJQTU5nZWvshd5qDv8N72ul8yt%2BIg2JKWYWHbsyLnDoJ5JpZbQPfQc7uxxTnRldpTE9532r34a8DRAeD%2BMImALxbC1qdsfdM88rguGylYgcYzbKgmVB3EF4Tv%2Fqms606pVXBNkBantvivZj8v%2BIdvEu6tTOOU%2BshdHB6mMD8y5RqAJlNfzEI5vBtHyH6rZheZSsBN95X0CoXPw1tPQOvLPZLNgAqOLQ9kYdqk5H6uCZrOTbwU6RJjW%2FvCKH0l%2BiU8eORyHBvKYFVT3J0y48IeUMwzCDkvj83fyF5Qf3N9Z%2FGIZ3uRIkBewrZO%2BytowOHBrvPCLyPlkWWCXSen0qf4LdW4B9DLhUoNGQDE7gxsQJPS0z2r4NpyOnhCfcFBBTHcey%2B5mk4LcfCEn0cxn5PAadf%2F1qZwZMqFjWyfoYNIeOkiV1WQjyJWm4fnK4H4ewlmjk4%2Bbhdtsn9WmmzcajTO59tR4BigQNRYBpWV4TbkB8Tq9wSaGcCcOhYQJQxhyiPd7KIWEi8hKEQmyN%2FFGrF0%2BUVkd18ziVNw%2BmDFZqTyfvMqD4wU%2FgWNgUxqZG1t3P4IixCd1TAVm5TPAa7NMfvdCSpAqd2A3rE0DrMJ2MqnesPooKzH04Fgiix780baY%2Fdl%2B1ZYjHRG8D7D6HX25FXKuiCSHUECUaNhqT9wIeJ4JGN3ronJ3ltKauGxFm6Ss%2BXa7ze%2FJclNEGjJNEqE3WWdl9KYT8hSAu83yL4%2FuevXpw7%2B4YdhuSF4naG8hiJTeiGhytneM2zIQ%2BWT%2B453E0NfcIOd2lSWvY32wahA42j%2FoRuZSA%3D%3D
request	GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=SL0JehZWrbuIUJMnDyQgL4taTjMDDLq5E85%2BOytDD%2F6cJdxbOyyYb0rODpcm9enRf5Ow%2BXZG%2BoI02guRmPxoqGgqvyKNrbbwcpJxnEWMlbWC4eKcIA0WHYb5Chfg25SQxzxq8kfLs%2FWhl4ajGj6Tw7MMxijOP8Gysk%2BBkq16iv6F%2FiPUt%2BfkZ9ftom6%2BS%2B4ANAGDastjhnkHkM1ev591qjS5lur%2ByN%2BVbI6yoMsyVzUnsBf9aetz7OacyZOt0JyL3Col4u3%2FE24obhtRTZmnHacdhM0Jrs9BUZOuoWxzMAMp4XMa7xI9i3orD8Ze02VdeXHiBDU2bdzpoKrSvyh6od%2FqV7VGKFLnRAQSH%2B05oIU2zeFSQ4RMry3%2BkY%2FsDhgQmzs0xb04kkI7DXJpsw65gjGZvFk%2BHe8Zv6wJAwpTofISmSjPH3Pc9PZykc9mGA1pNKB3OqXmUKyR0O9p9fvitNJU%2FD5GWlvcDVRQpwGiXcFysk8DEOHyQdDv8Cit2exOAUDtM%2BpnXfg4cyrcRlQyVOb7sy6uNSlDpHj3iUR8RCoSKQGFTxMQCP59FExndUKZOoX5JIp0N%2FinwcSb276Uvq0F%2F1UgsABQGuSG1p5BT7NXHTkuLschoksxZeRNsaiND9KAlYrH1OXCOtE2vR78ka14aVZ%2BFZBDkMDZ9UjRm5KnYgkwYcCNDCF5T8i4eg3%2FbQUcDEYt6fHXP3f03XFf2dUdKH96hHq6TzvdZFQri2Pi8w0judPmH7gepusOj6LduQoqieOVxzqYk3UTEzOWMHxsbLcYrMEQnQGdCHCaxyeRrYE%2Bj1CDurSCwGLBvR1AmcQUdJqVPNSmuo4IgHkg5U5CgUjVksy7dvghmoQGUP90Qoovm2WBxF4o1%2FJivR1i%2BUjdPuzCcBoAQ1yTkhQydM%2BqqwwfuJ493VEKHdU454ek9zKpDGg6AlxE%2F%2BSDddTg34SOlIISNBLP6YfSCLW7R2DeMqjKuK11y%2FmYRu2xT%2BcutIGly3aOhRZDI1UaaOgQFrt3Mpwn1nkh6c0%2FXUSOlrnlJMLmoS7fnssweOqFeId3Xbk%2BxVKocykThlmnmLoOVNIY8OGmczfCUZmA4lW3r2DeGTFfXSRmdsvkcDtx%2BjCiAbBOoQ2%2BowS%2BuUi%2BuqNBbqpabyTGNKUoJuOOquZT9v5jvx00KeETCaFB3dqzlSSkrpoWbc1B2ZRQU%2BcNktUyYshIrPlWYUoQxUIZifdX%2BXR8p6lBl5fOizE%2F58jfPMTVLKYhbg0eB7Jyt%2BSwsKVJskDnkyInv2WxxGLBZH%2BIp1uhVNgsS28sREIryJ1EDXicVpTf9KqhBAVAs1qdypH2iHzhgIXzhE39SUE4BHydjg%3D%3D
request	GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=rZiBnKHVu12A9Ep0aTFIHH2TfOA4wJo0z%2BOvgqpMh48bGfroC2%2FLOCHstnSqE1RWvTtKvjdukzTqZAPUK1X9MLf92dugGWN5qiOg2prhqUJhYYcSAjvo4B491hBWqpST7EHRYY1hEQQ4RO9aaxlX5aBVSHNz6nzglqnSbTKoczIRxfrLPDFt0jEzADYGNfhTC0kHsZx13nOgp%2Bj%2FY6oDo17cQUFOThmI0fpV01%2B1AE73097Y5i546a0aBLQq5n%2BeM942gcspM8fPhBmFqGbdJ8xcAWxkuz7C9%2Bk9brjqC8jna21tjRGOQHZQS%2B6nOt77t98km5EhdMJiNk5p91QElEtxfEiV6ih94RroJ5zZxVElGC553yRigMLntA3XXs6bBUmqNj37F0XR79sD6EZ0F%2FfiUp%2BGUxjq1UVPhoVmQ4BKqg55THu4AWMdNgSin3my2V1X1uwpHUSXEMDCVbdqu%2FjoRzVoU4TEXRsIccchNyrshoXSCb9nC6xUKrhAmTWaBR0IEPf13ae53DK0N49rcRtg0ITa9SUP4fekgRVuH37uwqsDdXfLraCwkKmTlpKn2KshwXc7zdZBFy2olB4%2Fzt3W3Ignc3P0olyCZxlci%2BaQoQ6jrOvA6rws5HYPvG2rL41LgVDeQcBpRUi%2FqsR953v%2BRvjiAVW%2FcpzuPOkMiZfJmkpw%2FTvexWbWn4feQJfHdfh9UaLqZd%2FUfX%2BGOa%2BcklTOcrpbVDuEN8HdqCJX4nUVEWR3bRVgvVQBxQ6eM4LSrfIthwH2HusmJGZyZuIdz7yY83eSh7iHfM8V1PKRsotmojvzL9mJbza8yHWkHTNXbzzpPNs1DVIYc5jeXeCDCU9i9pcDBcqqSEsRyelLkCwSLkcU6PvfhJ2Uz1n6NwS5l67iNStewJjsCPeBxtTu4UfIKlycSHBP8Yng2EGvA1W0e5vbW1AtXjPiBTDUpSmyk1yH3N8jADw7DeyTWA%2FmYmk4gQxSx0j7qZY%2BgSJpaubA0TaBQRxg7SzvnBJ9lil9bVy8vQ4LmFve75kAO44Kr6Hr%2FM3DhFU4TAnmH6CIAxnYvwotHGxs%2FvjP9LZRyXSNX1d3fELT%2B6kCant24MdZYmwgBbuHnvZA9WxTDbGZWWWcRXVdZvq%2BrQa7qhD7kWoaBuH4isAOHp36XV%2FbW%2FSvLqN8hBDU%2F6yoLpY%2ForO6MkBACqrQvWcMlmrWlKspp2JA6KWIhw72kjwTg7dV0Yvd2LMNFwAjlKD4XM85VxDre320Y4WKtAWTY9jrnK9wcDW8KuuKxNkP6Msx4NntTQ9svPe4S5A4k%2FD7Tvu17g%2FPJPXg%2BiqMy2sP3SSq9RZ9yZipO%2B3i1Ihej4VfoZgrdX08TQ%3D%3D
request	GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=IhDPwsliwiWv7zd5%2B8kMFSaa0ZIx34TC8tHg1AiAoCTswUtNg%2BRS%2BydxU%2B8yjdxDPZjUlZajK6S4wyiHjh6yuIKV3n%2By%2B6vcNNXtb%2BYZi6ar%2BRXJeQf%2FevmGKdiSU%2F7CmEx3%2BWEPwjB9sXL1UX9e1GCJdGGqwzxuS%2BHkLozAI9TBA3r69cIyTBxOPNrz3VCS3SMDOaXJ5cNbX%2BAVPeMvSsguiSCYDEYMVzuecug0bVY7dnXAEwhxcUFe4hSttZBOh5FmXzOEuBnWt4Fp%2F0U%2BjxwFRirDg0WhSSZffpT9R0i5XXYlTtmBaWzAVTEazNnYyALGqfRpCAZFARFA8nYmgJhqpf9HQoORppQn4vBZ7v1cwbIS4mq1vg1WXzJ1GtfS6l7ESj8Kn7FtxFk3xRCObnG4COqu9pohKcYGul9LXPmeAMtH5YhlA8%2B0dglqAKKFJGupqNKCV9uw5EK1N0LoxyVt5%2FRwHJgWWLnNZw4fd8BtFoWAl73dPRYYqYkkzuvdjDcl5p9lLkUQD%2Bxx9CHF4%2FZj%2FxapSIFzhhnaNl3iiVpWHXzrgURxUKoL695i6uSbIWbrvdMdGSvgZ2Z6BgOyxZL7cThRVK6Tzfzb6cyHoBbhIc3edJS8xP4n4%2FCy3v8rt%2FQ9WFBq2PSS6cgRggXXxfcbHbSfFsA7U4%2Fh%2FVNENfYHuez7ViVdPN66JUV6bnJEltk5sR7PjlkYVkh4l%2B8uvaGqz7uZst%2FR9ERkciSZXZViwoJv%2BoDpC389aOHKJrj6cyX3yi8MEDJcetCoiQiH9w%2FpAtOT06ShyIFj%2FMO4e4B9y%2F56BbIvds4FbX1O4uRjYKXmtrdczG8D5X4gz8oOUE4ghA6xlhxwi%2BTIa7IIuMmJqd9O0SgysRTMbHUUcceU62T3j6wOccjAKmnlcCsrQ8bYltDWiG28OPxCcB8sAu9N80iMvdCJkxFjUjiTz5%2FNHIAMsh2lc59othqChoTPUZg4OKkyC392Rq2l0KjtT9SJCCw3wAQlfzD59XTrdtejsLlL6CQFL5EGZjlUEPI3iAu9yCyD7B%2BDPDN%2F5xTerepaFhGu5JmRQVXLKcRSjSsY7Ms9IzDmVtMBMV8mtMJpm3qZ%2FS7%2BgGA4Kjh0SyBfgzVcf%2BX1s2eqFvL6skVcYXa3Y9cP13kIxiwHMj4mvMN8r8znnN4TAYfVRfgHYxdKH3rVHCPJ%2FZ9GPMox%2F27UvPbS605ihIOKt6BAQhWuIZWM4THc4IuDJxjPGiaClI7vDNmOsfnFhhZuhnWKkSG1STxKmxZ8XK13mVlHrQxsNSZIfGhYUlRm3OZfOzy%2BRfqrXWu%2BhrZTtIskwl4rxNhNrxaJw41djAEmNBHBcsz9NJQ6Pw%3D%3D

Allocates read-write-execute memory (usually to unpack itself) (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619345856.494625 NtAllocateVirtualMemory	process_identifier: 1464 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x029a0000	success	0	0
1619345920.33775 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00000000041f0000	success	0	0

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Steals private information from local Internet browsers (2 个事件)

registry	HKEY_LOCAL_MACHINE\Software\Mozilla\Mozilla Firefox
registry	HKEY_CURRENT_USER\Software\Mozilla\Mozilla Firefox

Creates executable files on the filesystem (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\EFC43E913797410A8C8484D9156F9F9B\casinocom_new_notif\js\template.js

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619345856.900625 Process32NextW	process_name: pythonw.exe snapshot_handle: 0x00000370 process_identifier: 2196	success	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619345858.525625 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (4 个事件)

Time & API	Arguments	Status	Return
1619345902.822625 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619345902.822625 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619345902.837625 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619345902.837625 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1

Queries for potentially installed applications (6 个事件)

Time & API	Arguments	Status	Return
1619345854.712625 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000001 key_handle: 0x00000000 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome options: 0	failed	2
1619345854.712625 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x000000e0 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome options: 0	success	0
1619345895.869625 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000001 key_handle: 0x00000000 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome options: 0	failed	2
1619345895.869625 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x0000082c regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome options: 0	success	0
1619345895.884625 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000001 key_handle: 0x00000000 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome options: 0	failed	2
1619345895.884625 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x0000082c regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome options: 0	success	0

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619345895.900625 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Playtech WinClient Downloader/1.0	success	13369348	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Attempts to create or modify system certificates (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (15 个事件)

Time & API	Arguments	Status
1619345861.337625 RegSetValueExA	key_handle: 0x000004d4 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619345861.337625 RegSetValueExA	key_handle: 0x000004d4 value: ÜvX9× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619345861.337625 RegSetValueExA	key_handle: 0x000004d4 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619345861.337625 RegSetValueExW	key_handle: 0x000004d4 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619345861.337625 RegSetValueExA	key_handle: 0x000004ec value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619345861.337625 RegSetValueExA	key_handle: 0x000004ec value: ÜvX9× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619345861.337625 RegSetValueExA	key_handle: 0x000004ec value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619345861.416625 RegSetValueExW	key_handle: 0x000004d0 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success
1619345891.525625 RegSetValueExA	key_handle: 0x0000034c value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619345891.525625 RegSetValueExA	key_handle: 0x0000034c value: P/uj9× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619345891.525625 RegSetValueExA	key_handle: 0x0000034c value: 0 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619345891.525625 RegSetValueExW	key_handle: 0x0000034c value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619345891.525625 RegSetValueExA	key_handle: 0x0000033c value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619345891.525625 RegSetValueExA	key_handle: 0x0000033c value: P/uj9× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619345891.525625 RegSetValueExA	key_handle: 0x0000033c value: 0 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success

Generates some ICMP traffic

File has been identified by 26 AntiVirus engines on VirusTotal as malicious (26 个事件)

CAT-QuickHeal	PUA.PlaytechPMF.S9225160
K7AntiVirus	Adware ( 005295061 )
K7GW	Adware ( 005295061 )
Cyren	W32/PlayTech.C.gen!Eldorado
APEX	Malicious
Avast	Win32:PUP-gen [PUP]
NANO-Antivirus	Trojan.Win32.Crossrider1.glrpkq
Comodo	Application.Win32.Playtech.DS@8m1bft
DrWeb	Trojan.Crossrider1.63459
Invincea	heuristic
McAfee-GW-Edition	Playtech
SentinelOne	DFI - Suspicious PE
F-Prot	W32/PlayTech.C.gen!Eldorado
Antiy-AVL	GrayWare/Win32.PlayTech.FC71
Microsoft	PUA:Win32/Playtech
Endgame	malicious (high confidence)
AhnLab-V3	PUP/Win32.Playtech.R300843
McAfee	Playtech
VBA32	Trojan.Crossrider
ESET-NOD32	a variant of Win32/PlayTech.A potentially unwanted
Rising	PUF.PlayTech!1.B89C (RDMK:cmRtazqAkBGtO/NxwZqLMSj70o0o)
Yandex	Riskware.Agent!
Ikarus	PUA.PlayTech
Fortinet	Riskware/PlayTech.FC71
Webroot	W32.Adware.Gen
AVG	Win32:PUP-gen [PUP]

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)

dead_host	172.217.24.14:443
dead_host	192.168.56.101:49197
dead_host	172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2019-11-13 16:34:35

Imports

Library WININET.dll:

• 0x51a4d8 InternetConnectW

• 0x51a4dc HttpSendRequestW

• 0x51a4e0 InternetSetOptionW

• 0x51a4e4 HttpQueryInfoW

• 0x51a4e8 InternetReadFile

• 0x51a4ec InternetGetLastResponseInfoW

• 0x51a4f0 InternetCloseHandle

• 0x51a4f4 InternetGetConnectedState

• 0x51a4f8 InternetCrackUrlW

• 0x51a4fc InternetQueryOptionW

• 0x51a500 HttpOpenRequestW

• 0x51a504 InternetOpenW

Library VERSION.dll:

• 0x51a4c8 VerQueryValueW

• 0x51a4cc GetFileVersionInfoW

• 0x51a4d0 GetFileVersionInfoSizeW

Library gdiplus.dll:

• 0x51a50c GdiplusStartup

• 0x51a510 GdiplusShutdown

• 0x51a514 GdipCreateBitmapFromStream

• 0x51a518 GdipReleaseDC

• 0x51a51c GdipGetImageWidth

• 0x51a520 GdipCloneImage

• 0x51a524 GdipFillRectangleI

• 0x51a528 GdipCreateFromHDC

• 0x51a52c GdipCreateBitmapFromHBITMAP

• 0x51a530 GdipCreateBitmapFromFile

• 0x51a534 GdipDisposeImage

• 0x51a538 GdipAlloc

• 0x51a53c GdipCreateSolidFill

• 0x51a540 GdipSetSmoothingMode

• 0x51a544 GdipDrawImageRectI

• 0x51a548 GdipDeleteGraphics

• 0x51a54c GdipSetPenMode

• 0x51a550 GdipGetImageHeight

• 0x51a554 GdipDeletePen

• 0x51a558 GdipFree

• 0x51a55c GdipDeleteBrush

• 0x51a560 GdipCreatePen1

Library PSAPI.DLL:

• 0x51a32c GetModuleFileNameExW

Library CRYPT32.dll:

• 0x51a054 CryptMsgClose

• 0x51a058 CertGetNameStringW

• 0x51a05c CertFreeCertificateContext

• 0x51a060 CertFindCertificateInStore

• 0x51a064 CertCloseStore

• 0x51a068 CryptMsgGetParam

• 0x51a06c CryptQueryObject

Library KERNEL32.dll:

• 0x51a0a4 EncodePointer

• 0x51a0a8 ReadConsoleInputA

• 0x51a0ac SetConsoleMode

• 0x51a0b0 IsValidCodePage

• 0x51a0b4 GetACP

• 0x51a0b8 GetOEMCP

• 0x51a0bc DeleteCriticalSection

• 0x51a0c0 InitializeCriticalSectionAndSpinCount

• 0x51a0c4 GetVersionExW

• 0x51a0c8 WriteFile

• 0x51a0cc ReadFile

• 0x51a0d0 GetStdHandle

• 0x51a0d4 GetLastError

• 0x51a0d8 LeaveCriticalSection

• 0x51a0dc EnterCriticalSection

• 0x51a0e0 WaitForMultipleObjects

• 0x51a0e4 WideCharToMultiByte

• 0x51a0e8 MultiByteToWideChar

• 0x51a0ec GetFullPathNameW

• 0x51a0f0 CreateDirectoryW

• 0x51a0f4 SetFileTime

• 0x51a0f8 CreateFileW

• 0x51a0fc lstrlenW

• 0x51a100 RemoveDirectoryW

• 0x51a104 CloseHandle

• 0x51a108 DeleteFileW

• 0x51a10c SetFileAttributesW

• 0x51a110 FindFirstFileW

• 0x51a114 FindClose

• 0x51a118 FindNextFileW

• 0x51a11c GetFileSize

• 0x51a120 SetFilePointer

• 0x51a124 SetEndOfFile

• 0x51a128 GlobalMemoryStatus

• 0x51a12c GetModuleHandleW

• 0x51a130 GetProcAddress

• 0x51a134 GetSystemInfo

• 0x51a138 VirtualFree

• 0x51a13c VirtualAlloc

• 0x51a140 WaitForSingleObject

• 0x51a144 SetEvent

• 0x51a148 InitializeCriticalSection

• 0x51a14c ResetEvent

• 0x51a150 CreateEventW

• 0x51a154 FindResourceExW

• 0x51a158 FindResourceW

• 0x51a15c LoadResource

• 0x51a160 LockResource

• 0x51a164 InterlockedDecrement

• 0x51a168 OutputDebugStringW

• 0x51a16c GetCurrentThreadId

• 0x51a170 GetCurrentProcessId

• 0x51a174 GetSystemDefaultLCID

• 0x51a178 CreateThread

• 0x51a17c CopyFileW

• 0x51a180 GetFileAttributesW

• 0x51a184 lstrlenA

• 0x51a188 GetEnvironmentVariableW

• 0x51a18c FlushFileBuffers

• 0x51a190 GetLongPathNameW

• 0x51a194 GetVersion

• 0x51a198 MapViewOfFile

• 0x51a19c UnmapViewOfFile

• 0x51a1a0 FlushViewOfFile

• 0x51a1a4 Sleep

• 0x51a1a8 GetModuleFileNameW

• 0x51a1ac CreateFileMappingW

• 0x51a1b0 GetCurrentProcess

• 0x51a1b4 OpenProcess

• 0x51a1b8 TerminateProcess

• 0x51a1bc Process32FirstW

• 0x51a1c0 Process32NextW

• 0x51a1c4 CreateToolhelp32Snapshot

• 0x51a1c8 HeapAlloc

• 0x51a1cc HeapFree

• 0x51a1d0 GetProcessHeap

• 0x51a1d4 GetTickCount

• 0x51a1d8 GetExitCodeProcess

• 0x51a1dc EnumSystemLanguageGroupsW

• 0x51a1e0 GetProcessId

• 0x51a1e4 LocalAlloc

• 0x51a1e8 LocalFree

• 0x51a1ec InterlockedIncrement

• 0x51a1f0 GlobalLock

• 0x51a1f4 GlobalAlloc

• 0x51a1f8 MulDiv

• 0x51a1fc lstrcmpW

• 0x51a200 GlobalUnlock

• 0x51a204 FlushInstructionCache

• 0x51a208 RaiseException

• 0x51a20c SetLastError

• 0x51a210 GlobalFree

• 0x51a214 GlobalHandle

• 0x51a218 FreeLibrary

• 0x51a21c LoadLibraryExW

• 0x51a220 lstrcmpiW

• 0x51a224 GetModuleHandleA

• 0x51a228 GetFileType

• 0x51a22c QueryPerformanceCounter

• 0x51a230 LoadLibraryA

• 0x51a234 GetVersionExA

• 0x51a238 FlushConsoleInputBuffer

• 0x51a23c UnhandledExceptionFilter

• 0x51a240 SetUnhandledExceptionFilter

• 0x51a244 TlsAlloc

• 0x51a248 TlsGetValue

• 0x51a24c TlsSetValue

• 0x51a250 TlsFree

• 0x51a254 GetStartupInfoW

• 0x51a258 HeapSize

• 0x51a25c RtlUnwind

• 0x51a260 GetConsoleCP

• 0x51a264 SetFilePointerEx

• 0x51a268 GetStringTypeW

• 0x51a26c LoadLibraryW

• 0x51a270 GetEnvironmentStringsW

• 0x51a274 FreeEnvironmentStringsW

• 0x51a278 ReadConsoleW

• 0x51a27c IsDebuggerPresent

• 0x51a280 IsProcessorFeaturePresent

• 0x51a284 HeapReAlloc

• 0x51a288 ExitThread

• 0x51a28c GetSystemTimeAsFileTime

• 0x51a290 GetLocalTime

• 0x51a294 GetTimeZoneInformation

• 0x51a298 GetCPInfo

• 0x51a29c GetModuleHandleExW

• 0x51a2a0 WriteConsoleW

• 0x51a2a4 GetCommandLineW

• 0x51a2a8 ExitProcess

• 0x51a2ac AreFileApisANSI

• 0x51a2b0 SetConsoleCtrlHandler

• 0x51a2b4 GetConsoleMode

• 0x51a2b8 SetStdHandle

• 0x51a2bc GetLocaleInfoW

• 0x51a2c0 IsValidLocale

• 0x51a2c4 GetUserDefaultLCID

• 0x51a2c8 EnumSystemLocalesW

• 0x51a2cc CompareStringW

• 0x51a2d0 LCMapStringW

• 0x51a2d4 SetEnvironmentVariableA

• 0x51a2d8 HeapDestroy

• 0x51a2dc InterlockedCompareExchange

• 0x51a2e0 InitializeSListHead

• 0x51a2e4 InterlockedPopEntrySList

• 0x51a2e8 InterlockedPushEntrySList

• 0x51a2ec SizeofResource

• 0x51a2f0 DecodePointer

Library USER32.dll:

• 0x51a368 EndPaint

• 0x51a36c GetMessageW

• 0x51a370 GetUserObjectInformationW

• 0x51a374 GetProcessWindowStation

• 0x51a378 MessageBoxA

• 0x51a37c CallNextHookEx

• 0x51a380 GetClientRect

• 0x51a384 CreateAcceleratorTableW

• 0x51a388 SetFocus

• 0x51a38c GetMenuItemInfoW

• 0x51a390 BeginPaint

• 0x51a394 GetClassInfoExW

• 0x51a398 TranslateMessage

• 0x51a39c SetWindowContextHelpId

• 0x51a3a0 IsDialogMessageW

• 0x51a3a4 RegisterClassExW

• 0x51a3a8 GetWindowPlacement

• 0x51a3ac CreateDialogIndirectParamW

• 0x51a3b0 CheckMenuRadioItem

• 0x51a3b4 GetWindowTextW

• 0x51a3b8 PeekMessageW

• 0x51a3bc GetClassNameW

• 0x51a3c0 ReleaseDC

• 0x51a3c4 GetDlgItem

• 0x51a3c8 SetWindowLongW

• 0x51a3cc EndDialog

• 0x51a3d0 RedrawWindow

• 0x51a3d4 SendDlgItemMessageW

• 0x51a3d8 GetSysColor

• 0x51a3dc IsWindow

• 0x51a3e0 SetMenuDefaultItem

• 0x51a3e4 SetWindowsHookExW

• 0x51a3e8 UnhookWindowsHookEx

• 0x51a3ec ReleaseCapture

• 0x51a3f0 ClientToScreen

• 0x51a3f4 GetParent

• 0x51a3f8 EnableWindow

• 0x51a3fc SetWindowTextW

• 0x51a400 SetMenuItemInfoW

• 0x51a404 CallWindowProcW

• 0x51a408 DestroyWindow

• 0x51a40c GetWindowTextLengthW

• 0x51a410 DestroyAcceleratorTable

• 0x51a414 SetTimer

• 0x51a418 ScreenToClient

• 0x51a41c MapDialogRect

• 0x51a420 CharNextW

• 0x51a424 RegisterWindowMessageW

• 0x51a428 FillRect

• 0x51a42c IsChild

• 0x51a430 GetWindow

• 0x51a434 MoveWindow

• 0x51a438 DispatchMessageW

• 0x51a43c KillTimer

• 0x51a440 InvalidateRect

• 0x51a444 GetWindowLongW

• 0x51a448 GetDesktopWindow

• 0x51a44c GetLastInputInfo

• 0x51a450 SetLayeredWindowAttributes

• 0x51a454 GetSystemMetrics

• 0x51a458 SwitchToThisWindow

• 0x51a45c UpdateLayeredWindow

• 0x51a460 GetWindowRect

• 0x51a464 PostQuitMessage

• 0x51a468 UnregisterClassW

• 0x51a46c LoadCursorW

• 0x51a470 GetDC

• 0x51a474 LoadIconW

• 0x51a478 SystemParametersInfoW

• 0x51a47c SetWindowPos

• 0x51a480 ShowWindow

• 0x51a484 FindWindowExW

• 0x51a488 CreateWindowExW

• 0x51a48c MessageBoxW

• 0x51a490 RegisterClassW

• 0x51a494 ValidateRect

• 0x51a498 DefWindowProcW

• 0x51a49c PostMessageW

• 0x51a4a0 EnumWindows

• 0x51a4a4 GetWindowThreadProcessId

• 0x51a4a8 SetCapture

• 0x51a4ac GetFocus

• 0x51a4b0 SetDlgItemTextW

• 0x51a4b4 AnimateWindow

• 0x51a4b8 CharUpperW

• 0x51a4bc SendMessageW

• 0x51a4c0 InvalidateRgn

Library GDI32.dll:

• 0x51a074 BitBlt

• 0x51a078 DeleteDC

• 0x51a07c CreateDIBSection

• 0x51a080 CreateSolidBrush

• 0x51a084 SelectObject

• 0x51a088 CreateCompatibleBitmap

• 0x51a08c GetStockObject

• 0x51a090 GetObjectW

• 0x51a094 GetDeviceCaps

• 0x51a098 CreateCompatibleDC

• 0x51a09c DeleteObject

Library ADVAPI32.dll:

• 0x51a000 OpenProcessToken

• 0x51a004 RegOpenKeyExW

• 0x51a008 RegCloseKey

• 0x51a00c LookupPrivilegeValueW

• 0x51a010 AdjustTokenPrivileges

• 0x51a014 GetTokenInformation

• 0x51a018 RegSetValueW

• 0x51a01c RegDeleteKeyW

• 0x51a020 LookupAccountSidW

• 0x51a024 RegEnumKeyExW

• 0x51a028 RegCreateKeyExW

• 0x51a02c RegDeleteValueW

• 0x51a030 RegSetValueExW

• 0x51a034 RegQueryInfoKeyW

• 0x51a038 DeregisterEventSource

• 0x51a03c ReportEventA

• 0x51a040 RegisterEventSourceA

• 0x51a044 RegQueryValueExW

Library SHELL32.dll:

• 0x51a334 ExtractIconW

• 0x51a338 SHFileOperationW

• 0x51a33c ShellExecuteW

• 0x51a340 ShellExecuteExW

• 0x51a344 SHCreateDirectoryExW

• 0x51a348 SHGetPathFromIDListW

• 0x51a34c SHBrowseForFolderW

• 0x51a350 SHGetDesktopFolder

Library ole32.dll:

• 0x51a568 CoCreateInstance

• 0x51a56c CoCreateGuid

• 0x51a570 OleLockRunning

• 0x51a574 CLSIDFromProgID

• 0x51a578 CLSIDFromString

• 0x51a57c CreateStreamOnHGlobal

• 0x51a580 StringFromGUID2

• 0x51a584 OleInitialize

• 0x51a588 OleUninitialize

• 0x51a58c CoTaskMemFree

• 0x51a590 CoGetClassObject

• 0x51a594 CoTaskMemAlloc

• 0x51a598 CoUninitialize

• 0x51a59c CoTaskMemRealloc

• 0x51a5a0 CoInitialize

Library OLEAUT32.dll:

• 0x51a2f8 SysFreeString

• 0x51a2fc VariantClear

• 0x51a300 VariantCopy

• 0x51a304 SysStringLen

• 0x51a308 VariantInit

• 0x51a30c SysAllocStringLen

• 0x51a310 DispCallFunc

• 0x51a314 LoadTypeLib

• 0x51a318 OleCreateFontIndirect

• 0x51a31c LoadRegTypeLib

• 0x51a320 VarUI4FromStr

• 0x51a324 SysAllocString

Library SHLWAPI.dll:

• 0x51a358

• 0x51a35c UrlEscapeW

• 0x51a360 PathIsDirectoryEmptyW

Library COMCTL32.dll:

• 0x51a04c InitCommonControlsEx

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
cache.download2.casino.com	CNAME cache.download2.casino.com.cdnga.net A 14.0.41.202 A 14.0.41.244	14.0.41.202
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
ocsp.sectigo.com	A 151.139.128.14	151.139.128.14
ocsp.comodoca.com	A 151.139.128.14	151.139.128.14
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
t8u4n6u7.ssl.hwcdn.net	A 205.185.208.154	205.185.208.154
c6m7w2m9.ssl.hwcdn.net	A 205.185.208.154	205.185.208.154
geo.web-installer-assets.com
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com	172.217.160.78
ocsp.usertrust.com	A 151.139.128.14	151.139.128.14
www.download.windowsupdate.com	A 124.225.105.97 CNAME 2-01-3cf7-0009.cdx.cedexis.net CNAME www.download.windowsupdate.com.cdn.dnsv1.com CNAME windowsupdate.sched.s11.tdnsv5.com CNAME 3573033.pack.cdntip.com CNAME wu-fg-shim.trafficmanager.net	59.36.203.35
fallback.playtech-installer.com	A 52.218.28.228 CNAME s3-website-eu-west-1.amazonaws.com CNAME pt-installer.s3-website-eu-west-1.amazonaws.com	52.218.26.148
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49180	124.225.105.97 www.download.windowsupdate.com	80
192.168.56.101	49181	124.225.105.97 www.download.windowsupdate.com	80
192.168.56.101	49197	14.0.41.202 cache.download2.casino.com	80
192.168.56.101	49184	151.139.128.14 ocsp.usertrust.com	80
192.168.56.101	49185	151.139.128.14 ocsp.usertrust.com	80
192.168.56.101	49186	151.139.128.14 ocsp.usertrust.com	80
192.168.56.101	49187	151.139.128.14 ocsp.usertrust.com	80
192.168.56.101	49192	151.139.128.14 ocsp.usertrust.com	80
192.168.56.101	49193	151.139.128.14 ocsp.usertrust.com	80
192.168.56.101	49178	205.185.208.154 c6m7w2m9.ssl.hwcdn.net	443
192.168.56.101	49179	205.185.208.154 c6m7w2m9.ssl.hwcdn.net	443
192.168.56.101	49189	205.185.208.154 c6m7w2m9.ssl.hwcdn.net	443
192.168.56.101	49195	205.185.208.154 c6m7w2m9.ssl.hwcdn.net	443
192.168.56.101	49196	205.185.208.154 c6m7w2m9.ssl.hwcdn.net	443
192.168.56.101	49198	205.185.208.154 c6m7w2m9.ssl.hwcdn.net	443
192.168.56.101	49199	205.185.208.154 c6m7w2m9.ssl.hwcdn.net	443
192.168.56.101	49201	205.185.208.154 c6m7w2m9.ssl.hwcdn.net	443
192.168.56.101	49202	205.185.208.154 c6m7w2m9.ssl.hwcdn.net	443
192.168.56.101	49203	205.185.208.154 c6m7w2m9.ssl.hwcdn.net	443
192.168.56.101	49204	205.185.208.154 c6m7w2m9.ssl.hwcdn.net	443

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50047	114.114.114.114	53
192.168.56.101	50849	114.114.114.114	53
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53380	114.114.114.114	53
192.168.56.101	55331	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	56743	114.114.114.114	53
192.168.56.101	57739	114.114.114.114	53
192.168.56.101	58070	114.114.114.114	53
192.168.56.101	59251	114.114.114.114	53
192.168.56.101	59291	114.114.114.114	53
192.168.56.101	60966	114.114.114.114	53
192.168.56.101	61680	114.114.114.114	53
192.168.56.101	62912	114.114.114.114	53
192.168.56.101	65209	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123

HTTP & HTTPS Requests

URI	Data
http://cache.download2.casino.com/download/casino/client_update_urls.php	GET /download/casino/client_update_urls.php HTTP/1.1 Accept: / User-Agent: Playtech WinClient Downloader/1.0 Host: cache.download2.casino.com Connection: Keep-Alive Cache-Control: no-cache
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D	GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.usertrust.com
http://fallback.playtech-installer.com/playtech_compressed_assets/casino_casinocom/index.7ze	GET /playtech_compressed_assets/casino_casinocom/index.7ze HTTP/1.1 Accept: / C: \Users\Administrator.Oskar-PC\AppData\Local\Temp\EFC43E913797410A8C8484D9156F9F9B\index.7ze User-Agent: Playtech WinClient Downloader/1.0 Host: fallback.playtech-installer.com Connection: Keep-Alive Cache-Control: no-cache
http://fallback.playtech-installer.com/playtech_compressed_assets/casino_casinocom/templates/installer/casinocom_new_notif.7ze	GET /playtech_compressed_assets/casino_casinocom/templates/installer/casinocom_new_notif.7ze HTTP/1.1 Accept: / C: \Users\Administrator.Oskar-PC\AppData\Local\Temp\EFC43E913797410A8C8484D9156F9F9B\casinocom_new_notif (1).7z User-Agent: Playtech WinClient Downloader/1.0 Host: fallback.playtech-installer.com Connection: Keep-Alive Cache-Control: no-cache
http://fallback.playtech-installer.com/playtech_cabs/casino_casinocom/casino[zh-cn].cab	GET /playtech_cabs/casino_casinocom/casino[zh-cn].cab HTTP/1.1 Accept: / C: \Users\Administrator.Oskar-PC\AppData\Local\Temp\EFC43E913797410A8C8484D9156F9F9B\pack (2).cab User-Agent: Playtech WinClient Downloader/1.0 Host: fallback.playtech-installer.com Connection: Keep-Alive Cache-Control: no-cache
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D	GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.comodoca.com
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEHSfdSPcp6pyLdnEz5lZ6ec%3D	GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEHSfdSPcp6pyLdnEz5lZ6ec%3D HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.sectigo.com
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab	GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1 Cache-Control: max-age = 3600 Connection: Keep-Alive Accept: / If-Modified-Since: Wed, 03 Mar 2021 06:32:16 GMT If-None-Match: "0d8f4f3f6fd71:0" User-Agent: Microsoft-CryptoAPI/6.1 Host: www.download.windowsupdate.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.