9.6
极危
50 个模型检测该样本为恶意！
重新分析
更多

eaa03d69da6202cd94f69392d119cde2de18bcc70ea88cb17f32b983b8b695ac

45e55dddf00780af03a75df7e804d155.exe

分析耗时

44s

最近分析

文件大小

705.0KB
静态报毒 动态报毒 100% AI SCORE=80 AIDETECTVM ANDROM CLASSIC CONFIDENCE DELF DELPHILESS EMZL ENCG FAREIT HIGH CONFIDENCE HRKFYW KRYPTIK MALWARE1 MALWARE@#2N754Z29YEBL8 PEZT SCORE SGW@A0SF7OJI SIGGEN10 SUSGEN SUSPICIOUS PE TSCOPE UNSAFE X2094 ZELPHIF ZZLXJ 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FPQ!45E55DDDF007 20201023 6.0.6.653
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Alibaba Trojan:Win32/Androm.f0364a31 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20201023 18.4.3895.0
Kingsoft 20201023 2013.8.14.323
Tencent Win32.Trojan.Kryptik.Pezt 20201023 1.0.0.1
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619525236.008375
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
45e55dddf00780af03a75df7e804d155+0x623f8 @ 0x4623f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74104b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74105d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe5e14ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (28 个事件)
Time & API Arguments Status Return Repeated
1619464090.719
NtAllocateVirtualMemory
process_identifier: 1804
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003f0000
success 0 0
1619464090.813
NtProtectVirtualMemory
process_identifier: 1804
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 73728
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00457000
success 0 0
1619464090.828
NtAllocateVirtualMemory
process_identifier: 1804
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f10000
success 0 0
1619525232.055375
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619525232.102375
NtAllocateVirtualMemory
process_identifier: 1880
region_size: 262144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01d70000
success 0 0
1619525232.102375
NtAllocateVirtualMemory
process_identifier: 1880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01d70000
success 0 0
1619525232.102375
NtAllocateVirtualMemory
process_identifier: 1880
region_size: 368640
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01dd0000
success 0 0
1619525232.102375
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 339968
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01dd2000
success 0 0
1619525235.961375
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01dc2000
success 0 0
1619525235.961375
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619525235.961375
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01dc2000
success 0 0
1619525235.961375
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619525235.961375
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01dc2000
success 0 0
1619525235.961375
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619525235.961375
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01dc2000
success 0 0
1619525235.961375
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619525235.961375
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01dc2000
success 0 0
1619525235.961375
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619525235.961375
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01dc2000
success 0 0
1619525235.961375
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619525235.961375
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01dc2000
success 0 0
1619525235.961375
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619525235.961375
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01dc2000
success 0 0
1619525235.961375
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619525235.961375
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01dc2000
success 0 0
1619525235.961375
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619525235.961375
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01dc2000
success 0 0
1619525235.961375
NtProtectVirtualMemory
process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LDR T's and C's July 2020.Delive敳⁴噐䱪煑卶煋灬㴠䌠敲瑡潥䩢捥⡔圢䍳楲瑰献敨汬⤢਍癐汊共卶煫偬刮乕∠∢氥≳∢‬ⰰ䘠污敳.vbs
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.7107670768374845 section {'size_of_data': '0x0003e400', 'virtual_address': '0x00078000', 'entropy': 7.7107670768374845, 'name': '.rsrc', 'virtual_size': '0x0003e388'} description A section with a high entropy has been found
entropy 0.3536931818181818 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619464091.547
NtAllocateVirtualMemory
process_identifier: 1712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000000fc
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
Installs itself for autorun at Windows startup (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LDR T's and C's July 2020.Delive敳⁴噐䱪煑卶煋灬㴠䌠敲瑡潥䩢捥⡔圢䍳楲瑰献敨汬⤢਍癐汊共卶煫偬刮乕∠∢氥≳∢‬ⰰ䘠污敳.vbs
Creates a thread using NtQueueApcThread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 1804 created a thread in remote process 1712
Time & API Arguments Status Return Repeated
1619464091.547
NtQueueApcThread
thread_handle: 0x000000f8
process_identifier: 1712
function_address: 0x000b05c0
parameter: 0x000c0000
success 0 0
Potential code injection by writing to the memory of another process (2 个事件)
Time & API Arguments Status Return Repeated
1619464091.547
WriteProcessMemory
process_identifier: 1712
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x000000fc
base_address: 0x000b0000
success 1 0
1619464091.547
WriteProcessMemory
process_identifier: 1712
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\45e55dddf00780af03a75df7e804d155.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\45e55dddf00780af03a75df7e804d155.exe" LDR T's and C's July 2020.Deliveset PVjLQqvSKqlp = CreateobJecT("WsCript.shell") PvJlqQvSkqlP.RUN """%ls""", 0, False
process_handle: 0x000000fc
base_address: 0x000c0000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 1804 called NtSetContextThread to modify thread in remote process 1880
Time & API Arguments Status Return Repeated
1619464091.578
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4973520
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1880
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 1804 resumed a thread in remote process 1880
Time & API Arguments Status Return Repeated
1619464091.641
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 1880
success 0 0
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.24.14:443
Executed a process and injected code into it, probably while unpacking (11 个事件)
Time & API Arguments Status Return Repeated
1619464091.547
CreateProcessInternalW
thread_identifier: 1056
thread_handle: 0x000000f8
process_identifier: 1712
current_directory:
filepath: C:\Windows\System32\notepad.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\notepad.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619464091.547
NtAllocateVirtualMemory
process_identifier: 1712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000000fc
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
1619464091.547
NtAllocateVirtualMemory
process_identifier: 1712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
process_handle: 0x000000fc
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000c0000
success 0 0
1619464091.547
WriteProcessMemory
process_identifier: 1712
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x000000fc
base_address: 0x000b0000
success 1 0
1619464091.547
WriteProcessMemory
process_identifier: 1712
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\45e55dddf00780af03a75df7e804d155.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\45e55dddf00780af03a75df7e804d155.exe" LDR T's and C's July 2020.Deliveset PVjLQqvSKqlp = CreateobJecT("WsCript.shell") PvJlqQvSkqlP.RUN """%ls""", 0, False
process_handle: 0x000000fc
base_address: 0x000c0000
success 1 0
1619464091.563
CreateProcessInternalW
thread_identifier: 1948
thread_handle: 0x00000104
process_identifier: 1880
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\45e55dddf00780af03a75df7e804d155.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619464091.563
NtUnmapViewOfSection
process_identifier: 1880
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619464091.563
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 1880
commit_size: 786432
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 786432
base_address: 0x00400000
success 0 0
1619464091.578
NtGetContextThread
thread_handle: 0x00000104
success 0 0
1619464091.578
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4973520
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1880
success 0 0
1619464091.641
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 1880
success 0 0
File has been identified by 50 AntiVirus engines on VirusTotal as malicious (50 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Delf.FareIt.Gen.12
McAfee Fareit-FPQ!45E55DDDF007
Cylance Unsafe
Sangfor Malware
CrowdStrike win/malicious_confidence_100% (W)
Alibaba Trojan:Win32/Androm.f0364a31
K7GW Trojan ( 0056c22d1 )
K7AntiVirus Trojan ( 0056c22d1 )
Arcabit Trojan.Delf.FareIt.Gen.12
Symantec Trojan.Gen.MBT
APEX Malicious
Avast Win32:Trojan-gen
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
BitDefender Trojan.Delf.FareIt.Gen.12
NANO-Antivirus Trojan.Win32.Kryptik.hrkfyw
Paloalto generic.ml
AegisLab Trojan.Win32.Kryptik.4!c
Rising Trojan.Injector!1.CA50 (CLASSIC)
Ad-Aware Trojan.Delf.FareIt.Gen.12
Emsisoft Trojan.Delf.FareIt.Gen.12 (B)
Comodo Malware@#2n754z29yebl8
DrWeb Trojan.Siggen10.5244
VIPRE Trojan.Win32.Generic!BT
Invincea Mal/Generic-S
McAfee-GW-Edition BehavesLike.Win32.Fareit.bc
FireEye Generic.mg.45e55dddf00780af
Sophos Mal/Generic-S
Ikarus Trojan.Inject
Jiangmin Trojan.Kryptik.cax
Avira TR/Injector.zzlxj
eGambit Unsafe.AI_Score_99%
Microsoft Trojan:Win32/Androm.VD!MTB
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
GData Trojan.Delf.FareIt.Gen.12
AhnLab-V3 Suspicious/Win.Delphiless.X2094
BitDefenderTheta Gen:NN.ZelphiF.34570.SGW@a0sf7Oji
ALYac Trojan.Delf.FareIt.Gen.12
MAX malware (ai score=80)
VBA32 TScope.Trojan.Delf
ESET-NOD32 a variant of Win32/Injector.ENCG
Tencent Win32.Trojan.Kryptik.Pezt
SentinelOne DFI - Suspicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Injector.EMZL!tr
AVG Win32:Trojan-gen
Cybereason malicious.2409bc
Panda Trj/CI.A
Qihoo-360 Win32/Trojan.469
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x46c150 VirtualFree
• 0x46c154 VirtualAlloc
• 0x46c158 LocalFree
• 0x46c15c LocalAlloc
• 0x46c160 GetVersion
• 0x46c164 GetCurrentThreadId
• 0x46c170 VirtualQuery
• 0x46c174 WideCharToMultiByte
• 0x46c178 MultiByteToWideChar
• 0x46c17c lstrlenA
• 0x46c180 lstrcpynA
• 0x46c184 LoadLibraryExA
• 0x46c188 GetThreadLocale
• 0x46c18c GetStartupInfoA
• 0x46c190 GetProcAddress
• 0x46c194 GetModuleHandleA
• 0x46c198 GetModuleFileNameA
• 0x46c19c GetLocaleInfoA
• 0x46c1a0 GetCommandLineA
• 0x46c1a4 FreeLibrary
• 0x46c1a8 FindFirstFileA
• 0x46c1ac FindClose
• 0x46c1b0 ExitProcess
• 0x46c1b4 WriteFile
• 0x46c1bc RtlUnwind
• 0x46c1c0 RaiseException
• 0x46c1c4 GetStdHandle
Library user32.dll:
• 0x46c1cc GetKeyboardType
• 0x46c1d0 LoadStringA
• 0x46c1d4 MessageBoxA
• 0x46c1d8 CharNextA
Library advapi32.dll:
• 0x46c1e0 RegQueryValueExA
• 0x46c1e4 RegOpenKeyExA
• 0x46c1e8 RegCloseKey
Library oleaut32.dll:
• 0x46c1f0 SysFreeString
• 0x46c1f4 SysReAllocStringLen
• 0x46c1f8 SysAllocStringLen
Library kernel32.dll:
• 0x46c200 TlsSetValue
• 0x46c204 TlsGetValue
• 0x46c208 LocalAlloc
• 0x46c20c GetModuleHandleA
Library advapi32.dll:
• 0x46c214 RegQueryValueExA
• 0x46c218 RegOpenKeyExA
• 0x46c21c RegCloseKey
Library kernel32.dll:
• 0x46c224 lstrcpyA
• 0x46c228 WriteFile
• 0x46c22c WinExec
• 0x46c230 WaitForSingleObject
• 0x46c234 VirtualQuery
• 0x46c238 VirtualProtect
• 0x46c23c VirtualAlloc
• 0x46c240 Sleep
• 0x46c244 SizeofResource
• 0x46c248 SetThreadLocale
• 0x46c24c SetFilePointer
• 0x46c250 SetEvent
• 0x46c254 SetErrorMode
• 0x46c258 SetEndOfFile
• 0x46c25c ResetEvent
• 0x46c260 ReadFile
• 0x46c264 MulDiv
• 0x46c268 LockResource
• 0x46c26c LoadResource
• 0x46c270 LoadLibraryA
• 0x46c27c GlobalUnlock
• 0x46c280 GlobalReAlloc
• 0x46c284 GlobalHandle
• 0x46c288 GlobalLock
• 0x46c28c GlobalFree
• 0x46c290 GlobalFindAtomA
• 0x46c294 GlobalDeleteAtom
• 0x46c298 GlobalAlloc
• 0x46c29c GlobalAddAtomA
• 0x46c2a0 GetVersionExA
• 0x46c2a4 GetVersion
• 0x46c2a8 GetTickCount
• 0x46c2ac GetThreadLocale
• 0x46c2b4 GetSystemInfo
• 0x46c2b8 GetStringTypeExA
• 0x46c2bc GetStdHandle
• 0x46c2c0 GetProcAddress
• 0x46c2c4 GetModuleHandleA
• 0x46c2c8 GetModuleFileNameA
• 0x46c2cc GetLocaleInfoA
• 0x46c2d0 GetLocalTime
• 0x46c2d4 GetLastError
• 0x46c2d8 GetFullPathNameA
• 0x46c2dc GetDiskFreeSpaceA
• 0x46c2e0 GetDateFormatA
• 0x46c2e4 GetCurrentThreadId
• 0x46c2e8 GetCurrentProcessId
• 0x46c2ec GetCPInfo
• 0x46c2f0 GetACP
• 0x46c2f4 FreeResource
• 0x46c2f8 InterlockedExchange
• 0x46c2fc FreeLibrary
• 0x46c300 FormatMessageA
• 0x46c304 FindResourceA
• 0x46c30c EnumCalendarInfoA
• 0x46c318 CreateThread
• 0x46c31c CreateFileA
• 0x46c320 CreateEventA
• 0x46c324 CompareStringA
• 0x46c328 CloseHandle
Library version.dll:
• 0x46c330 VerQueryValueA
• 0x46c338 GetFileVersionInfoA
Library gdi32.dll:
• 0x46c340 UnrealizeObject
• 0x46c344 StretchBlt
• 0x46c348 SetWindowOrgEx
• 0x46c34c SetViewportOrgEx
• 0x46c350 SetTextColor
• 0x46c354 SetStretchBltMode
• 0x46c358 SetROP2
• 0x46c35c SetPixel
• 0x46c360 SetDIBColorTable
• 0x46c364 SetBrushOrgEx
• 0x46c368 SetBkMode
• 0x46c36c SetBkColor
• 0x46c370 SelectPalette
• 0x46c374 SelectObject
• 0x46c378 SaveDC
• 0x46c37c RestoreDC
• 0x46c380 RectVisible
• 0x46c384 RealizePalette
• 0x46c388 PatBlt
• 0x46c38c MoveToEx
• 0x46c390 MaskBlt
• 0x46c394 LineTo
• 0x46c398 IntersectClipRect
• 0x46c39c GetWindowOrgEx
• 0x46c3a0 GetTextMetricsA
• 0x46c3ac GetStockObject
• 0x46c3b0 GetPixel
• 0x46c3b4 GetPaletteEntries
• 0x46c3b8 GetObjectA
• 0x46c3bc GetDeviceCaps
• 0x46c3c0 GetDIBits
• 0x46c3c4 GetDIBColorTable
• 0x46c3c8 GetDCOrgEx
• 0x46c3d0 GetClipBox
• 0x46c3d4 GetBrushOrgEx
• 0x46c3d8 GetBitmapBits
• 0x46c3dc ExtTextOutA
• 0x46c3e0 ExcludeClipRect
• 0x46c3e4 DeleteObject
• 0x46c3e8 DeleteDC
• 0x46c3ec CreateSolidBrush
• 0x46c3f0 CreatePenIndirect
• 0x46c3f4 CreatePalette
• 0x46c3fc CreateFontIndirectA
• 0x46c400 CreateDIBitmap
• 0x46c404 CreateDIBSection
• 0x46c408 CreateCompatibleDC
• 0x46c410 CreateBrushIndirect
• 0x46c414 CreateBitmap
• 0x46c418 BitBlt
Library user32.dll:
• 0x46c420 CreateWindowExA
• 0x46c424 WindowFromPoint
• 0x46c428 WinHelpA
• 0x46c42c WaitMessage
• 0x46c430 UpdateWindow
• 0x46c434 UnregisterClassA
• 0x46c438 UnhookWindowsHookEx
• 0x46c43c TranslateMessage
• 0x46c444 TrackPopupMenu
• 0x46c44c ShowWindow
• 0x46c450 ShowScrollBar
• 0x46c454 ShowOwnedPopups
• 0x46c458 ShowCursor
• 0x46c45c SetWindowsHookExA
• 0x46c460 SetWindowTextA
• 0x46c464 SetWindowPos
• 0x46c468 SetWindowPlacement
• 0x46c46c SetWindowLongA
• 0x46c470 SetTimer
• 0x46c474 SetScrollRange
• 0x46c478 SetScrollPos
• 0x46c47c SetScrollInfo
• 0x46c480 SetRect
• 0x46c484 SetPropA
• 0x46c488 SetParent
• 0x46c48c SetMenuItemInfoA
• 0x46c490 SetMenu
• 0x46c494 SetForegroundWindow
• 0x46c498 SetFocus
• 0x46c49c SetCursor
• 0x46c4a0 SetClassLongA
• 0x46c4a4 SetCapture
• 0x46c4a8 SetActiveWindow
• 0x46c4ac SendMessageA
• 0x46c4b0 ScrollWindow
• 0x46c4b4 ScreenToClient
• 0x46c4b8 RemovePropA
• 0x46c4bc RemoveMenu
• 0x46c4c0 ReleaseDC
• 0x46c4c4 ReleaseCapture
• 0x46c4d0 RegisterClassA
• 0x46c4d4 RedrawWindow
• 0x46c4d8 PtInRect
• 0x46c4dc PostQuitMessage
• 0x46c4e0 PostMessageA
• 0x46c4e4 PeekMessageA
• 0x46c4e8 OffsetRect
• 0x46c4ec OemToCharA
• 0x46c4f0 MessageBoxA
• 0x46c4f4 MapWindowPoints
• 0x46c4f8 MapVirtualKeyA
• 0x46c4fc LoadStringA
• 0x46c500 LoadKeyboardLayoutA
• 0x46c504 LoadIconA
• 0x46c508 LoadCursorA
• 0x46c50c LoadBitmapA
• 0x46c510 KillTimer
• 0x46c514 IsZoomed
• 0x46c518 IsWindowVisible
• 0x46c51c IsWindowEnabled
• 0x46c520 IsWindow
• 0x46c524 IsRectEmpty
• 0x46c528 IsIconic
• 0x46c52c IsDialogMessageA
• 0x46c530 IsChild
• 0x46c534 InvalidateRect
• 0x46c538 IntersectRect
• 0x46c53c InsertMenuItemA
• 0x46c540 InsertMenuA
• 0x46c544 InflateRect
• 0x46c54c GetWindowTextA
• 0x46c550 GetWindowRect
• 0x46c554 GetWindowPlacement
• 0x46c558 GetWindowLongA
• 0x46c55c GetWindowDC
• 0x46c560 GetTopWindow
• 0x46c564 GetSystemMetrics
• 0x46c568 GetSystemMenu
• 0x46c56c GetSysColorBrush
• 0x46c570 GetSysColor
• 0x46c574 GetSubMenu
• 0x46c578 GetScrollRange
• 0x46c57c GetScrollPos
• 0x46c580 GetScrollInfo
• 0x46c584 GetPropA
• 0x46c588 GetParent
• 0x46c58c GetWindow
• 0x46c590 GetMessageTime
• 0x46c594 GetMenuStringA
• 0x46c598 GetMenuState
• 0x46c59c GetMenuItemInfoA
• 0x46c5a0 GetMenuItemID
• 0x46c5a4 GetMenuItemCount
• 0x46c5a8 GetMenu
• 0x46c5ac GetLastActivePopup
• 0x46c5b0 GetKeyboardState
• 0x46c5b8 GetKeyboardLayout
• 0x46c5bc GetKeyState
• 0x46c5c0 GetKeyNameTextA
• 0x46c5c4 GetIconInfo
• 0x46c5c8 GetForegroundWindow
• 0x46c5cc GetFocus
• 0x46c5d0 GetDlgItem
• 0x46c5d4 GetDesktopWindow
• 0x46c5d8 GetDCEx
• 0x46c5dc GetDC
• 0x46c5e0 GetCursorPos
• 0x46c5e4 GetCursor
• 0x46c5e8 GetClientRect
• 0x46c5ec GetClassNameA
• 0x46c5f0 GetClassInfoA
• 0x46c5f4 GetCapture
• 0x46c5f8 GetActiveWindow
• 0x46c5fc FrameRect
• 0x46c600 FindWindowA
• 0x46c604 FillRect
• 0x46c608 EqualRect
• 0x46c60c EnumWindows
• 0x46c610 EnumThreadWindows
• 0x46c614 EndPaint
• 0x46c618 EnableWindow
• 0x46c61c EnableScrollBar
• 0x46c620 EnableMenuItem
• 0x46c624 DrawTextA
• 0x46c628 DrawMenuBar
• 0x46c62c DrawIconEx
• 0x46c630 DrawIcon
• 0x46c634 DrawFrameControl
• 0x46c638 DrawFocusRect
• 0x46c63c DrawEdge
• 0x46c640 DispatchMessageA
• 0x46c644 DestroyWindow
• 0x46c648 DestroyMenu
• 0x46c64c DestroyIcon
• 0x46c650 DestroyCursor
• 0x46c654 DeleteMenu
• 0x46c658 DefWindowProcA
• 0x46c65c DefMDIChildProcA
• 0x46c660 DefFrameProcA
• 0x46c664 CreatePopupMenu
• 0x46c668 CreateMenu
• 0x46c66c CreateIcon
• 0x46c670 ClientToScreen
• 0x46c674 CheckMenuItem
• 0x46c678 CallWindowProcA
• 0x46c67c CallNextHookEx
• 0x46c680 BeginPaint
• 0x46c684 CharNextA
• 0x46c688 CharLowerA
• 0x46c68c CharToOemA
• 0x46c690 AdjustWindowRectEx
Library kernel32.dll:
• 0x46c69c Sleep
Library oleaut32.dll:
• 0x46c6a4 SafeArrayPtrOfIndex
• 0x46c6a8 SafeArrayGetUBound
• 0x46c6ac SafeArrayGetLBound
• 0x46c6b0 SafeArrayCreate
• 0x46c6b4 VariantChangeType
• 0x46c6b8 VariantCopy
• 0x46c6bc VariantClear
• 0x46c6c0 VariantInit
Library comctl32.dll:
• 0x46c6d0 ImageList_Write
• 0x46c6d4 ImageList_Read
• 0x46c6e4 ImageList_DragMove
• 0x46c6e8 ImageList_DragLeave
• 0x46c6ec ImageList_DragEnter
• 0x46c6f0 ImageList_EndDrag
• 0x46c6f4 ImageList_BeginDrag
• 0x46c6f8 ImageList_Remove
• 0x46c6fc ImageList_DrawEx
• 0x46c700 ImageList_Draw
• 0x46c710 ImageList_Add
• 0x46c718 ImageList_Destroy
• 0x46c71c ImageList_Create
Library comdlg32.dll:
• 0x46c724 GetOpenFileNameA
Library user32.dll:
• 0x46c72c DdeCmpStringHandles
• 0x46c730 DdeFreeStringHandle
• 0x46c734 DdeQueryStringA
• 0x46c73c DdeGetLastError
• 0x46c740 DdeFreeDataHandle
• 0x46c744 DdeUnaccessData
• 0x46c748 DdeAccessData
• 0x46c74c DdeCreateDataHandle
• 0x46c754 DdeNameService
• 0x46c758 DdePostAdvise
• 0x46c75c DdeSetUserHandle
• 0x46c760 DdeQueryConvInfo
• 0x46c764 DdeDisconnect
• 0x46c768 DdeConnect
• 0x46c76c DdeUninitialize
• 0x46c770 DdeInitializeA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50568 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.