8.6
极危
58 个模型检测该样本为恶意！
重新分析
更多

d77d7298cf6f8d15655ced4042c5057b12ca79fed15052bca1573ea5ad084bdf

36e4f86747592cdf2136a226cedd2fcb.exe

分析耗时

24s

最近分析

文件大小

725.0KB
静态报毒 动态报毒 AGEN AGENTTESLA AI SCORE=82 AIDETECTVM AUTO AVSARHER BTOMTW CLASSIC CONFIDENCE DELF DELPHILESS ELZG EMHU FAREIT GENERICKD GENETIC HIGH CONFIDENCE HLAPTX JABL KCLOUD KRYPT KRYPTIK LOKIBOT MALWARE2 NETWIREDRC SCORE SUSGEN TGW@AKTSPZBI TSCOPE UNSAFE X2066 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/Obfuscator.8e1faa10 20190527 0.3.0.5
Avast Win32:Trojan-gen 20201210 21.1.5827.0
Baidu 20190318 1.0.0.2
Kingsoft Win32.Troj.Undef.(kcloud) 20201211 2017.9.26.565
McAfee Fareit-FTB!36E4F8674759 20201211 6.0.6.653
Tencent Win32.Trojan.Inject.Auto 20201211 1.0.0.1
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619345036.953886
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 33619776
registers.edi: 0
registers.eax: 0
registers.ebp: 33619848
registers.edx: 2130553844
registers.ebx: 1983206444
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 fa 8e 00 00 e9
exception.symbol: 36e4f86747592cdf2136a226cedd2fcb+0x5fd0d
exception.instruction: div eax
exception.module: 36e4f86747592cdf2136a226cedd2fcb.exe
exception.exception_code: 0xc0000094
exception.offset: 392461
exception.address: 0x45fd0d
success 0 0
1619373563.574125
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x750ae97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x750aea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x750ab25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x750ab4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x750aac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x750aaed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x750a5511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x750a559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75117f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75114de3
36e4f86747592cdf2136a226cedd2fcb+0x5aa4d @ 0x45aa4d
36e4f86747592cdf2136a226cedd2fcb+0x53254 @ 0x453254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff4a14ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619345036.781886
NtAllocateVirtualMemory
process_identifier: 368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003d0000
success 0 0
1619345036.953886
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0045f000
success 0 0
1619345036.969886
NtAllocateVirtualMemory
process_identifier: 368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x020b0000
success 0 0
1619373562.074125
NtProtectVirtualMemory
process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619373562.152125
NtAllocateVirtualMemory
process_identifier: 2364
region_size: 720896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01e20000
success 0 0
1619373562.152125
NtAllocateVirtualMemory
process_identifier: 2364
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01e90000
success 0 0
1619373562.152125
NtAllocateVirtualMemory
process_identifier: 2364
region_size: 335872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01d90000
success 0 0
1619373562.152125
NtProtectVirtualMemory
process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 307200
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d92000
success 0 0
1619373562.667125
NtAllocateVirtualMemory
process_identifier: 2364
region_size: 2162688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02030000
success 0 0
1619373562.667125
NtAllocateVirtualMemory
process_identifier: 2364
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02200000
success 0 0
1619373563.558125
NtProtectVirtualMemory
process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f42000
success 0 0
1619373563.558125
NtProtectVirtualMemory
process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619373563.558125
NtProtectVirtualMemory
process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f42000
success 0 0
1619373563.558125
NtProtectVirtualMemory
process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619373563.558125
NtProtectVirtualMemory
process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f42000
success 0 0
1619373563.558125
NtProtectVirtualMemory
process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619373563.558125
NtProtectVirtualMemory
process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f42000
success 0 0
1619373563.558125
NtProtectVirtualMemory
process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619373563.558125
NtProtectVirtualMemory
process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f42000
success 0 0
1619373563.558125
NtProtectVirtualMemory
process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619373563.558125
NtProtectVirtualMemory
process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f42000
success 0 0
1619373563.558125
NtProtectVirtualMemory
process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619373563.558125
NtProtectVirtualMemory
process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f42000
success 0 0
1619373563.558125
NtProtectVirtualMemory
process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619373563.558125
NtProtectVirtualMemory
process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f42000
success 0 0
1619373563.558125
NtProtectVirtualMemory
process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619373563.558125
NtProtectVirtualMemory
process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f42000
success 0 0
1619373563.558125
NtProtectVirtualMemory
process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619373563.558125
NtProtectVirtualMemory
process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f42000
success 0 0
1619373563.558125
NtProtectVirtualMemory
process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.vbs
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.341031078629928 section {'size_of_data': '0x00042600', 'virtual_address': '0x00078000', 'entropy': 7.341031078629928, 'name': '.rsrc', 'virtual_size': '0x00042588'} description A section with a high entropy has been found
entropy 0.36671270718232046 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619345037.594886
NtAllocateVirtualMemory
process_identifier: 1108
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000100
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000e0000
success 0 0
Installs itself for autorun at Windows startup (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.vbs
Creates a thread using NtQueueApcThread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 368 created a thread in remote process 1108
Time & API Arguments Status Return Repeated
1619345037.640886
NtQueueApcThread
thread_handle: 0x000000fc
process_identifier: 1108
function_address: 0x000e05c0
parameter: 0x000f0000
success 0 0
Potential code injection by writing to the memory of another process (2 个事件)
Time & API Arguments Status Return Repeated
1619345037.594886
WriteProcessMemory
process_identifier: 1108
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000100
base_address: 0x000e0000
success 1 0
1619345037.594886
WriteProcessMemory
process_identifier: 1108
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\36e4f86747592cdf2136a226cedd2fcb.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\36e4f86747592cdf2136a226cedd2fcb.exe" appSET dPhdpCxOUpAaEE = CrEAteobject("wscript.shEll") DPHDPCXouPaAEe.rUn """%ls""", 0, False
process_handle: 0x00000100
base_address: 0x000f0000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 368 called NtSetContextThread to modify thread in remote process 2364
Time & API Arguments Status Return Repeated
1619345037.797886
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4910272
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2364
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 368 resumed a thread in remote process 2364
Time & API Arguments Status Return Repeated
1619345038.109886
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 2364
success 0 0
Executed a process and injected code into it, probably while unpacking (11 个事件)
Time & API Arguments Status Return Repeated
1619345037.594886
CreateProcessInternalW
thread_identifier: 784
thread_handle: 0x000000fc
process_identifier: 1108
current_directory:
filepath: C:\Windows\System32\notepad.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\notepad.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619345037.594886
NtAllocateVirtualMemory
process_identifier: 1108
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000100
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000e0000
success 0 0
1619345037.594886
NtAllocateVirtualMemory
process_identifier: 1108
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
process_handle: 0x00000100
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000f0000
success 0 0
1619345037.594886
WriteProcessMemory
process_identifier: 1108
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000100
base_address: 0x000e0000
success 1 0
1619345037.594886
WriteProcessMemory
process_identifier: 1108
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\36e4f86747592cdf2136a226cedd2fcb.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\36e4f86747592cdf2136a226cedd2fcb.exe" appSET dPhdpCxOUpAaEE = CrEAteobject("wscript.shEll") DPHDPCXouPaAEe.rUn """%ls""", 0, False
process_handle: 0x00000100
base_address: 0x000f0000
success 1 0
1619345037.765886
CreateProcessInternalW
thread_identifier: 1632
thread_handle: 0x00000108
process_identifier: 2364
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\36e4f86747592cdf2136a226cedd2fcb.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000104
inherit_handles: 0
success 1 0
1619345037.765886
NtUnmapViewOfSection
process_identifier: 2364
region_size: 4096
process_handle: 0x00000104
base_address: 0x00400000
success 0 0
1619345037.765886
NtMapViewOfSection
section_handle: 0x00000110
process_identifier: 2364
commit_size: 720896
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000104
allocation_type: 0 ()
section_offset: 0
view_size: 720896
base_address: 0x00400000
success 0 0
1619345037.797886
NtGetContextThread
thread_handle: 0x00000108
success 0 0
1619345037.797886
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4910272
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2364
success 0 0
1619345038.109886
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 2364
success 0 0
File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.34002610
FireEye Generic.mg.36e4f86747592cdf
ALYac Trojan.GenericKD.34002610
Cylance Unsafe
Zillya Trojan.Injector.Win32.741373
Sangfor Malware
K7AntiVirus Trojan ( 005687561 )
Alibaba Trojan:Win32/Obfuscator.8e1faa10
K7GW Trojan ( 005687561 )
Cybereason malicious.cd36f9
Arcabit Trojan.Generic.D206D6B2
BitDefenderTheta Gen:NN.ZelphiF.34670.TGW@aKTspzbi
Cyren W32/Trojan.JABL-7817
Symantec Infostealer.Lokibot!43
APEX Malicious
Avast Win32:Trojan-gen
ClamAV Win.Malware.AgentTesla-8016172-1
Kaspersky HEUR:Trojan.Win32.Crypt.gen
BitDefender Trojan.GenericKD.34002610
NANO-Antivirus Trojan.Win32.Stealer.hlaptx
Paloalto generic.ml
Rising Trojan.Injector!1.C77F (CLASSIC)
Ad-Aware Trojan.GenericKD.34002610
Emsisoft Trojan.GenericKD.34002610 (B)
F-Secure Heuristic.HEUR/AGEN.1133569
DrWeb Trojan.PWS.Stealer.1932
VIPRE Trojan.Win32.Generic!BT
McAfee-GW-Edition BehavesLike.Win32.Fareit.bc
Sophos Mal/Generic-S
Jiangmin Backdoor.NetWiredRC.bmf
Avira HEUR/AGEN.1133569
Antiy-AVL Trojan/Win32.Crypt
Kingsoft Win32.Troj.Undef.(kcloud)
Gridinsoft Trojan.Win32.Kryptik.dd!i
Microsoft Trojan:Win32/Obfuscator.KI!MTB
AegisLab Trojan.Multi.Generic.4!c
ZoneAlarm HEUR:Trojan.Win32.Crypt.gen
GData Trojan.GenericKD.34002610
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2066
Acronis suspicious
McAfee Fareit-FTB!36E4F8674759
MAX malware (ai score=82)
VBA32 TScope.Trojan.Delf
Malwarebytes Trojan.MalPack.DLF
Zoner Trojan.Win32.91381
ESET-NOD32 a variant of Win32/Injector.EMHU
Tencent Win32.Trojan.Inject.Auto
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x46c150 VirtualFree
• 0x46c154 VirtualAlloc
• 0x46c158 LocalFree
• 0x46c15c LocalAlloc
• 0x46c160 GetVersion
• 0x46c164 GetCurrentThreadId
• 0x46c170 VirtualQuery
• 0x46c174 WideCharToMultiByte
• 0x46c178 MultiByteToWideChar
• 0x46c17c lstrlenA
• 0x46c180 lstrcpynA
• 0x46c184 LoadLibraryExA
• 0x46c188 GetThreadLocale
• 0x46c18c GetStartupInfoA
• 0x46c190 GetProcAddress
• 0x46c194 GetModuleHandleA
• 0x46c198 GetModuleFileNameA
• 0x46c19c GetLocaleInfoA
• 0x46c1a0 GetCommandLineA
• 0x46c1a4 FreeLibrary
• 0x46c1a8 FindFirstFileA
• 0x46c1ac FindClose
• 0x46c1b0 ExitProcess
• 0x46c1b4 WriteFile
• 0x46c1bc RtlUnwind
• 0x46c1c0 RaiseException
• 0x46c1c4 GetStdHandle
Library user32.dll:
• 0x46c1cc GetKeyboardType
• 0x46c1d0 LoadStringA
• 0x46c1d4 MessageBoxA
• 0x46c1d8 CharNextA
Library advapi32.dll:
• 0x46c1e0 RegQueryValueExA
• 0x46c1e4 RegOpenKeyExA
• 0x46c1e8 RegCloseKey
Library oleaut32.dll:
• 0x46c1f0 SysFreeString
• 0x46c1f4 SysReAllocStringLen
• 0x46c1f8 SysAllocStringLen
Library kernel32.dll:
• 0x46c200 TlsSetValue
• 0x46c204 TlsGetValue
• 0x46c208 LocalAlloc
• 0x46c20c GetModuleHandleA
Library advapi32.dll:
• 0x46c214 RegQueryValueExA
• 0x46c218 RegOpenKeyExA
• 0x46c21c RegCloseKey
Library kernel32.dll:
• 0x46c224 lstrcpyA
• 0x46c228 lstrcmpA
• 0x46c22c WriteFile
• 0x46c234 WaitForSingleObject
• 0x46c238 VirtualQuery
• 0x46c23c VirtualAlloc
• 0x46c240 Sleep
• 0x46c244 SizeofResource
• 0x46c248 SetThreadLocale
• 0x46c24c SetFilePointer
• 0x46c250 SetEvent
• 0x46c254 SetErrorMode
• 0x46c258 SetEndOfFile
• 0x46c25c ResetEvent
• 0x46c260 ReadFile
• 0x46c264 MulDiv
• 0x46c268 LockResource
• 0x46c26c LoadResource
• 0x46c270 LoadLibraryA
• 0x46c27c GlobalUnlock
• 0x46c280 GlobalReAlloc
• 0x46c284 GlobalHandle
• 0x46c288 GlobalLock
• 0x46c28c GlobalFree
• 0x46c290 GlobalFindAtomA
• 0x46c294 GlobalDeleteAtom
• 0x46c298 GlobalAlloc
• 0x46c29c GlobalAddAtomA
• 0x46c2a0 GetVersionExA
• 0x46c2a4 GetVersion
• 0x46c2a8 GetTickCount
• 0x46c2ac GetThreadLocale
• 0x46c2b4 GetSystemTime
• 0x46c2b8 GetSystemInfo
• 0x46c2bc GetStringTypeExA
• 0x46c2c0 GetStdHandle
• 0x46c2c4 GetProcAddress
• 0x46c2c8 GetModuleHandleA
• 0x46c2cc GetModuleFileNameA
• 0x46c2d0 GetLocaleInfoA
• 0x46c2d4 GetLocalTime
• 0x46c2d8 GetLastError
• 0x46c2dc GetFullPathNameA
• 0x46c2e0 GetFileAttributesA
• 0x46c2e4 GetDiskFreeSpaceA
• 0x46c2e8 GetDateFormatA
• 0x46c2ec GetCurrentThreadId
• 0x46c2f0 GetCurrentProcessId
• 0x46c2f4 GetCPInfo
• 0x46c2f8 GetACP
• 0x46c2fc FreeResource
• 0x46c300 InterlockedExchange
• 0x46c304 FreeLibrary
• 0x46c308 FormatMessageA
• 0x46c30c FindResourceA
• 0x46c310 FindFirstFileA
• 0x46c314 FindClose
• 0x46c320 ExitThread
• 0x46c324 EnumCalendarInfoA
• 0x46c330 CreateThread
• 0x46c334 CreateFileA
• 0x46c338 CreateEventA
• 0x46c33c CopyFileA
• 0x46c340 CompareStringA
• 0x46c344 CloseHandle
Library version.dll:
• 0x46c34c VerQueryValueA
• 0x46c354 GetFileVersionInfoA
Library gdi32.dll:
• 0x46c35c UnrealizeObject
• 0x46c360 StretchBlt
• 0x46c364 SetWindowOrgEx
• 0x46c368 SetWinMetaFileBits
• 0x46c36c SetViewportOrgEx
• 0x46c370 SetTextColor
• 0x46c374 SetStretchBltMode
• 0x46c378 SetROP2
• 0x46c37c SetPixel
• 0x46c380 SetEnhMetaFileBits
• 0x46c384 SetDIBColorTable
• 0x46c388 SetBrushOrgEx
• 0x46c38c SetBkMode
• 0x46c390 SetBkColor
• 0x46c394 SelectPalette
• 0x46c398 SelectObject
• 0x46c39c SaveDC
• 0x46c3a0 RestoreDC
• 0x46c3a4 Rectangle
• 0x46c3a8 RectVisible
• 0x46c3ac RealizePalette
• 0x46c3b0 Polyline
• 0x46c3b4 PlayEnhMetaFile
• 0x46c3b8 PatBlt
• 0x46c3bc MoveToEx
• 0x46c3c0 MaskBlt
• 0x46c3c4 LineTo
• 0x46c3c8 IntersectClipRect
• 0x46c3cc GetWindowOrgEx
• 0x46c3d0 GetWinMetaFileBits
• 0x46c3d4 GetTextMetricsA
• 0x46c3e0 GetStockObject
• 0x46c3e4 GetPixel
• 0x46c3e8 GetPaletteEntries
• 0x46c3ec GetObjectA
• 0x46c3f8 GetEnhMetaFileBits
• 0x46c3fc GetDeviceCaps
• 0x46c400 GetDIBits
• 0x46c404 GetDIBColorTable
• 0x46c408 GetDCOrgEx
• 0x46c410 GetClipBox
• 0x46c414 GetBrushOrgEx
• 0x46c418 GetBitmapBits
• 0x46c41c ExcludeClipRect
• 0x46c420 DeleteObject
• 0x46c424 DeleteEnhMetaFile
• 0x46c428 DeleteDC
• 0x46c42c CreateSolidBrush
• 0x46c430 CreatePenIndirect
• 0x46c434 CreatePen
• 0x46c438 CreatePalette
• 0x46c440 CreateFontIndirectA
• 0x46c444 CreateDIBitmap
• 0x46c448 CreateDIBSection
• 0x46c44c CreateCompatibleDC
• 0x46c454 CreateBrushIndirect
• 0x46c458 CreateBitmap
• 0x46c45c CopyEnhMetaFileA
• 0x46c460 BitBlt
Library user32.dll:
• 0x46c468 CreateWindowExA
• 0x46c46c WindowFromPoint
• 0x46c470 WinHelpA
• 0x46c474 WaitMessage
• 0x46c478 ValidateRect
• 0x46c47c UpdateWindow
• 0x46c480 UnregisterClassA
• 0x46c484 UnhookWindowsHookEx
• 0x46c488 TranslateMessage
• 0x46c490 TrackPopupMenu
• 0x46c498 ShowWindow
• 0x46c49c ShowScrollBar
• 0x46c4a0 ShowOwnedPopups
• 0x46c4a4 ShowCursor
• 0x46c4a8 SetWindowsHookExA
• 0x46c4ac SetWindowTextA
• 0x46c4b0 SetWindowPos
• 0x46c4b4 SetWindowPlacement
• 0x46c4b8 SetWindowLongA
• 0x46c4bc SetTimer
• 0x46c4c0 SetScrollRange
• 0x46c4c4 SetScrollPos
• 0x46c4c8 SetScrollInfo
• 0x46c4cc SetRect
• 0x46c4d0 SetPropA
• 0x46c4d4 SetParent
• 0x46c4d8 SetMenuItemInfoA
• 0x46c4dc SetMenu
• 0x46c4e0 SetForegroundWindow
• 0x46c4e4 SetFocus
• 0x46c4e8 SetCursor
• 0x46c4ec SetClassLongA
• 0x46c4f0 SetCapture
• 0x46c4f4 SetActiveWindow
• 0x46c4f8 SendMessageA
• 0x46c4fc ScrollWindow
• 0x46c500 ScreenToClient
• 0x46c504 RemovePropA
• 0x46c508 RemoveMenu
• 0x46c50c ReleaseDC
• 0x46c510 ReleaseCapture
• 0x46c51c RegisterClassA
• 0x46c520 RedrawWindow
• 0x46c524 PtInRect
• 0x46c528 PostQuitMessage
• 0x46c52c PostMessageA
• 0x46c530 PeekMessageA
• 0x46c534 OffsetRect
• 0x46c538 OemToCharA
• 0x46c53c MessageBoxA
• 0x46c540 MapWindowPoints
• 0x46c544 MapVirtualKeyA
• 0x46c548 LoadStringA
• 0x46c54c LoadKeyboardLayoutA
• 0x46c550 LoadIconA
• 0x46c554 LoadCursorA
• 0x46c558 LoadBitmapA
• 0x46c55c KillTimer
• 0x46c560 IsZoomed
• 0x46c564 IsWindowVisible
• 0x46c568 IsWindowEnabled
• 0x46c56c IsWindow
• 0x46c570 IsRectEmpty
• 0x46c574 IsIconic
• 0x46c578 IsDialogMessageA
• 0x46c57c IsChild
• 0x46c580 InvalidateRect
• 0x46c584 IntersectRect
• 0x46c588 InsertMenuItemA
• 0x46c58c InsertMenuA
• 0x46c590 InflateRect
• 0x46c598 GetWindowTextA
• 0x46c59c GetWindowRect
• 0x46c5a0 GetWindowPlacement
• 0x46c5a4 GetWindowLongA
• 0x46c5a8 GetWindowDC
• 0x46c5ac GetTopWindow
• 0x46c5b0 GetSystemMetrics
• 0x46c5b4 GetSystemMenu
• 0x46c5b8 GetSysColorBrush
• 0x46c5bc GetSysColor
• 0x46c5c0 GetSubMenu
• 0x46c5c4 GetScrollRange
• 0x46c5c8 GetScrollPos
• 0x46c5cc GetScrollInfo
• 0x46c5d0 GetPropA
• 0x46c5d4 GetParent
• 0x46c5d8 GetWindow
• 0x46c5dc GetMenuStringA
• 0x46c5e0 GetMenuState
• 0x46c5e4 GetMenuItemInfoA
• 0x46c5e8 GetMenuItemID
• 0x46c5ec GetMenuItemCount
• 0x46c5f0 GetMenu
• 0x46c5f4 GetLastActivePopup
• 0x46c5f8 GetKeyboardState
• 0x46c600 GetKeyboardLayout
• 0x46c604 GetKeyState
• 0x46c608 GetKeyNameTextA
• 0x46c60c GetIconInfo
• 0x46c610 GetForegroundWindow
• 0x46c614 GetFocus
• 0x46c618 GetDlgItem
• 0x46c61c GetDesktopWindow
• 0x46c620 GetDCEx
• 0x46c624 GetDC
• 0x46c628 GetCursorPos
• 0x46c62c GetCursor
• 0x46c630 GetClipboardData
• 0x46c634 GetClientRect
• 0x46c638 GetClassNameA
• 0x46c63c GetClassInfoA
• 0x46c640 GetCapture
• 0x46c644 GetActiveWindow
• 0x46c648 FrameRect
• 0x46c64c FindWindowA
• 0x46c650 FillRect
• 0x46c654 EqualRect
• 0x46c658 EnumWindows
• 0x46c65c EnumThreadWindows
• 0x46c660 EndPaint
• 0x46c664 EnableWindow
• 0x46c668 EnableScrollBar
• 0x46c66c EnableMenuItem
• 0x46c670 DrawTextA
• 0x46c674 DrawMenuBar
• 0x46c678 DrawIconEx
• 0x46c67c DrawIcon
• 0x46c680 DrawFrameControl
• 0x46c684 DrawEdge
• 0x46c688 DispatchMessageA
• 0x46c68c DestroyWindow
• 0x46c690 DestroyMenu
• 0x46c694 DestroyIcon
• 0x46c698 DestroyCursor
• 0x46c69c DeleteMenu
• 0x46c6a0 DefWindowProcA
• 0x46c6a4 DefMDIChildProcA
• 0x46c6a8 DefFrameProcA
• 0x46c6ac CreatePopupMenu
• 0x46c6b0 CreateMenu
• 0x46c6b4 CreateIcon
• 0x46c6b8 ClientToScreen
• 0x46c6bc CheckMenuItem
• 0x46c6c0 CallWindowProcA
• 0x46c6c4 CallNextHookEx
• 0x46c6c8 BeginPaint
• 0x46c6cc CharNextA
• 0x46c6d0 CharLowerBuffA
• 0x46c6d4 CharLowerA
• 0x46c6d8 CharToOemA
• 0x46c6dc AdjustWindowRectEx
Library kernel32.dll:
• 0x46c6e8 Sleep
Library oleaut32.dll:
• 0x46c6f0 SafeArrayPtrOfIndex
• 0x46c6f4 SafeArrayGetUBound
• 0x46c6f8 SafeArrayGetLBound
• 0x46c6fc SafeArrayCreate
• 0x46c700 VariantChangeType
• 0x46c704 VariantCopy
• 0x46c708 VariantClear
• 0x46c70c VariantInit
Library ole32.dll:
• 0x46c714 CoTaskMemAlloc
• 0x46c718 CoCreateInstance
• 0x46c71c CoUninitialize
• 0x46c720 CoInitialize
Library comctl32.dll:
• 0x46c730 ImageList_Write
• 0x46c734 ImageList_Read
• 0x46c744 ImageList_DragMove
• 0x46c748 ImageList_DragLeave
• 0x46c74c ImageList_DragEnter
• 0x46c750 ImageList_EndDrag
• 0x46c754 ImageList_BeginDrag
• 0x46c758 ImageList_Remove
• 0x46c75c ImageList_DrawEx
• 0x46c760 ImageList_Replace
• 0x46c764 ImageList_Draw
• 0x46c774 ImageList_Add
• 0x46c77c ImageList_Destroy
• 0x46c780 ImageList_Create
• 0x46c784 InitCommonControls
Library comdlg32.dll:
• 0x46c78c GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.