10.0
0-day
61 个模型检测该样本为恶意！
重新分析
更多

3a50e52732ad555ed6f785c81ab6b0aa11c4360a4a6a5c7daab07286b376a259

4c8573e83ca9ebca9f84a7ceaae8c2bf.exe

分析耗时

62s

最近分析

文件大小

705.0KB
静态报毒 动态报毒 100% AGEN AGENSLA AGENTTESLA AI SCORE=85 AIDETECTVM AMTV CLASSIC CONFIDENCE DELF DELPHILESS ELZG ELZY EREJ FAREIT GENETIC HIGH CONFIDENCE HKIATG HPLOKI LOKIBOT MALWARE2 MALWARE@#NIGHG8RX3JV6 PFJP QQPASS QQROB R + MAL SCORE SGW@AOYXAPJI SMBD SPYBOTNET STATIC AI SUSGEN SUSPICIOUS PE TROJANPSW TSCOPE TSPY UNSAFE UPATRE X2066 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FTB!4C8573E83CA9 20201211 6.0.6.653
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Alibaba TrojanPSW:Win32/Lokibot.4b8da3ec 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20201210 21.1.5827.0
Kingsoft 20201211 2017.9.26.565
Tencent Win32.Trojan-qqpass.Qqrob.Pfjp 20201211 1.0.0.1
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619515109.319498
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73a4e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73a4ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73a4b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73a4b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73a4ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73a4aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73a45511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73a4559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74107f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74104de3
4c8573e83ca9ebca9f84a7ceaae8c2bf+0x5aa4d @ 0x45aa4d
4c8573e83ca9ebca9f84a7ceaae8c2bf+0x53254 @ 0x453254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe6c14ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619515094.022373
NtAllocateVirtualMemory
process_identifier: 2064
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003f0000
success 0 0
1619515094.084373
NtProtectVirtualMemory
process_identifier: 2064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 28672
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0045a000
success 0 0
1619515094.084373
NtAllocateVirtualMemory
process_identifier: 2064
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02e20000
success 0 0
1619515103.303498
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619515104.084498
NtAllocateVirtualMemory
process_identifier: 368
region_size: 1966080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01eb0000
success 0 0
1619515104.084498
NtAllocateVirtualMemory
process_identifier: 368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02050000
success 0 0
1619515104.084498
NtAllocateVirtualMemory
process_identifier: 368
region_size: 335872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01d80000
success 0 0
1619515104.084498
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 307200
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d82000
success 0 0
1619515107.819498
NtAllocateVirtualMemory
process_identifier: 368
region_size: 917504
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01eb0000
success 0 0
1619515107.819498
NtAllocateVirtualMemory
process_identifier: 368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f50000
success 0 0
1619515109.256498
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ea2000
success 0 0
1619515109.256498
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619515109.256498
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ea2000
success 0 0
1619515109.256498
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619515109.256498
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ea2000
success 0 0
1619515109.256498
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619515109.256498
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ea2000
success 0 0
1619515109.256498
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619515109.256498
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ea2000
success 0 0
1619515109.256498
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619515109.256498
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ea2000
success 0 0
1619515109.256498
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619515109.256498
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ea2000
success 0 0
1619515109.256498
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619515109.256498
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ea2000
success 0 0
1619515109.256498
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619515109.256498
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ea2000
success 0 0
1619515109.256498
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619515109.256498
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ea2000
success 0 0
1619515109.256498
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.vbs
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.353399611966721 section {'size_of_data': '0x00045a00', 'virtual_address': '0x00070000', 'entropy': 7.353399611966721, 'name': '.rsrc', 'virtual_size': '0x00045998'} description A section with a high entropy has been found
entropy 0.3955965909090909 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619515094.725373
NtAllocateVirtualMemory
process_identifier: 1816
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000100
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
Installs itself for autorun at Windows startup (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.vbs
Creates a thread using NtQueueApcThread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2064 created a thread in remote process 1816
Time & API Arguments Status Return Repeated
1619515094.725373
NtQueueApcThread
thread_handle: 0x000000fc
process_identifier: 1816
function_address: 0x000b05c0
parameter: 0x000c0000
success 0 0
Potential code injection by writing to the memory of another process (2 个事件)
Time & API Arguments Status Return Repeated
1619515094.725373
WriteProcessMemory
process_identifier: 1816
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000100
base_address: 0x000b0000
success 1 0
1619515094.725373
WriteProcessMemory
process_identifier: 1816
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4c8573e83ca9ebca9f84a7ceaae8c2bf.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4c8573e83ca9ebca9f84a7ceaae8c2bf.exe" appSeT NHQFkV = cREateObjECT("wSCripT.sHeLl") NHQfKV.Run """%ls""", 0, False
process_handle: 0x00000100
base_address: 0x000c0000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2064 called NtSetContextThread to modify thread in remote process 368
Time & API Arguments Status Return Repeated
1619515094.928373
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907072
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 368
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2064 resumed a thread in remote process 368
Time & API Arguments Status Return Repeated
1619515103.084373
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 368
success 0 0
Executed a process and injected code into it, probably while unpacking (11 个事件)
Time & API Arguments Status Return Repeated
1619515094.725373
CreateProcessInternalW
thread_identifier: 2340
thread_handle: 0x000000fc
process_identifier: 1816
current_directory:
filepath: C:\Windows\System32\notepad.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\notepad.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619515094.725373
NtAllocateVirtualMemory
process_identifier: 1816
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000100
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
1619515094.725373
NtAllocateVirtualMemory
process_identifier: 1816
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
process_handle: 0x00000100
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000c0000
success 0 0
1619515094.725373
WriteProcessMemory
process_identifier: 1816
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000100
base_address: 0x000b0000
success 1 0
1619515094.725373
WriteProcessMemory
process_identifier: 1816
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4c8573e83ca9ebca9f84a7ceaae8c2bf.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4c8573e83ca9ebca9f84a7ceaae8c2bf.exe" appSeT NHQFkV = cREateObjECT("wSCripT.sHeLl") NHQfKV.Run """%ls""", 0, False
process_handle: 0x00000100
base_address: 0x000c0000
success 1 0
1619515094.912373
CreateProcessInternalW
thread_identifier: 2260
thread_handle: 0x00000108
process_identifier: 368
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4c8573e83ca9ebca9f84a7ceaae8c2bf.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000104
inherit_handles: 0
success 1 0
1619515094.912373
NtUnmapViewOfSection
process_identifier: 368
region_size: 4096
process_handle: 0x00000104
base_address: 0x00400000
success 0 0
1619515094.912373
NtMapViewOfSection
section_handle: 0x00000110
process_identifier: 368
commit_size: 720896
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000104
allocation_type: 0 ()
section_offset: 0
view_size: 720896
base_address: 0x00400000
success 0 0
1619515094.928373
NtGetContextThread
thread_handle: 0x00000108
success 0 0
1619515094.928373
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907072
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 368
success 0 0
1619515103.084373
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 368
success 0 0
File has been identified by 61 AntiVirus engines on VirusTotal as malicious (50 out of 61 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Agent.EREJ
FireEye Generic.mg.4c8573e83ca9ebca
McAfee Fareit-FTB!4C8573E83CA9
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Malware
CrowdStrike win/malicious_confidence_100% (W)
Alibaba TrojanPSW:Win32/Lokibot.4b8da3ec
K7GW Trojan ( 00566fcc1 )
K7AntiVirus Trojan ( 00566fcc1 )
Arcabit Trojan.Agent.EREJ
Cyren W32/Trojan.AMTV-2294
Symantec Trojan.Gen.MBT
APEX Malicious
Avast Win32:Trojan-gen
ClamAV Win.Malware.Generic-7839353-0
Kaspersky HEUR:Trojan-PSW.Win32.Agensla.gen
BitDefender Trojan.Agent.EREJ
NANO-Antivirus Trojan.Win32.SpyBotNET.hkiatg
Paloalto generic.ml
Rising Trojan.Injector!1.C6B6 (CLASSIC)
Ad-Aware Trojan.Agent.EREJ
Emsisoft Trojan.Agent.EREJ (B)
Comodo Malware@#nighg8rx3jv6
F-Secure Heuristic.HEUR/AGEN.1136311
DrWeb BackDoor.SpyBotNET.17
Zillya Trojan.Agensla.Win32.2198
TrendMicro TSPY_HPLOKI.SMBD
McAfee-GW-Edition BehavesLike.Win32.Fareit.bc
Sophos Mal/Generic-R + Mal/Fareit-AA
SentinelOne Static AI - Suspicious PE
Jiangmin Trojan.PSW.Agensla.hy
Avira HEUR/AGEN.1136311
Antiy-AVL Trojan[PSW]/Win32.Agensla
Gridinsoft Trojan.Win32.Agent.ba!s1
Microsoft TrojanDownloader:Win32/Upatre
AegisLab Trojan.Win32.Agensla.i!c
ZoneAlarm HEUR:Trojan-PSW.Win32.Agensla.gen
GData Trojan.Agent.EREJ
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2066
Acronis suspicious
BitDefenderTheta Gen:NN.ZelphiF.34670.SGW@aOyXaPji
ALYac Trojan.Agent.EREJ
MAX malware (ai score=85)
VBA32 TScope.Trojan.Delf
Malwarebytes Spyware.AgentTesla
Zoner Trojan.Win32.91130
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 172.217.24.14:443
dead_host 172.217.160.110:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x46413c VirtualFree
• 0x464140 VirtualAlloc
• 0x464144 LocalFree
• 0x464148 LocalAlloc
• 0x46414c GetVersion
• 0x464150 GetCurrentThreadId
• 0x46415c VirtualQuery
• 0x464160 WideCharToMultiByte
• 0x464168 MultiByteToWideChar
• 0x46416c lstrlenA
• 0x464170 lstrcpynA
• 0x464174 LoadLibraryExA
• 0x464178 GetThreadLocale
• 0x46417c GetStartupInfoA
• 0x464180 GetProcAddress
• 0x464184 GetModuleHandleA
• 0x464188 GetModuleFileNameA
• 0x46418c GetLocaleInfoA
• 0x464190 GetLastError
• 0x464198 GetCommandLineA
• 0x46419c FreeLibrary
• 0x4641a0 FindFirstFileA
• 0x4641a4 FindClose
• 0x4641a8 ExitProcess
• 0x4641ac WriteFile
• 0x4641b4 RtlUnwind
• 0x4641b8 RaiseException
• 0x4641bc GetStdHandle
Library user32.dll:
• 0x4641c4 GetKeyboardType
• 0x4641c8 LoadStringA
• 0x4641cc MessageBoxA
• 0x4641d0 CharNextA
Library advapi32.dll:
• 0x4641d8 RegQueryValueExA
• 0x4641dc RegOpenKeyExA
• 0x4641e0 RegCloseKey
Library oleaut32.dll:
• 0x4641e8 SysFreeString
• 0x4641ec SysReAllocStringLen
• 0x4641f0 SysAllocStringLen
Library kernel32.dll:
• 0x4641f8 TlsSetValue
• 0x4641fc TlsGetValue
• 0x464200 LocalAlloc
• 0x464204 GetModuleHandleA
Library advapi32.dll:
• 0x46420c RegQueryValueExA
• 0x464210 RegOpenKeyExA
• 0x464214 RegCloseKey
Library kernel32.dll:
• 0x46421c lstrcpyA
• 0x464220 WriteFile
• 0x464224 WaitForSingleObject
• 0x464228 VirtualQuery
• 0x46422c VirtualProtectEx
• 0x464230 VirtualAlloc
• 0x464234 Sleep
• 0x464238 SizeofResource
• 0x46423c SetThreadLocale
• 0x464240 SetFilePointer
• 0x464244 SetEvent
• 0x464248 SetErrorMode
• 0x46424c SetEndOfFile
• 0x464250 ResetEvent
• 0x464254 ReadFile
• 0x464258 MulDiv
• 0x46425c LockResource
• 0x464260 LoadResource
• 0x464264 LoadLibraryA
• 0x464270 GlobalUnlock
• 0x464274 GlobalReAlloc
• 0x464278 GlobalHandle
• 0x46427c GlobalLock
• 0x464280 GlobalFree
• 0x464284 GlobalFindAtomA
• 0x464288 GlobalDeleteAtom
• 0x46428c GlobalAlloc
• 0x464290 GlobalAddAtomA
• 0x464298 GetVersionExA
• 0x46429c GetVersion
• 0x4642a0 GetTickCount
• 0x4642a4 GetThreadLocale
• 0x4642a8 GetTempPathA
• 0x4642b0 GetSystemInfo
• 0x4642b4 GetStringTypeExA
• 0x4642b8 GetStdHandle
• 0x4642bc GetProcAddress
• 0x4642c0 GetModuleHandleA
• 0x4642c4 GetModuleFileNameA
• 0x4642c8 GetLocaleInfoA
• 0x4642cc GetLocalTime
• 0x4642d0 GetLastError
• 0x4642d4 GetFullPathNameA
• 0x4642d8 GetFileSize
• 0x4642dc GetFileAttributesA
• 0x4642e0 GetDiskFreeSpaceA
• 0x4642e4 GetDateFormatA
• 0x4642e8 GetCurrentThreadId
• 0x4642ec GetCurrentProcessId
• 0x4642f0 GetCurrentProcess
• 0x4642f4 GetCPInfo
• 0x4642f8 GetACP
• 0x4642fc FreeResource
• 0x464300 InterlockedExchange
• 0x464304 FreeLibrary
• 0x464308 FormatMessageA
• 0x46430c FindResourceA
• 0x464310 FindNextFileA
• 0x464314 FindFirstFileA
• 0x464318 FindClose
• 0x464328 ExitThread
• 0x46432c EnumCalendarInfoA
• 0x464338 CreateThread
• 0x46433c CreateFileA
• 0x464340 CreateEventA
• 0x464344 CompareStringA
• 0x464348 CloseHandle
Library version.dll:
• 0x464350 VerQueryValueA
• 0x464358 GetFileVersionInfoA
Library gdi32.dll:
• 0x464360 UnrealizeObject
• 0x464364 StretchBlt
• 0x464368 SetWindowOrgEx
• 0x46436c SetViewportOrgEx
• 0x464370 SetTextColor
• 0x464374 SetStretchBltMode
• 0x464378 SetROP2
• 0x46437c SetPixel
• 0x464380 SetDIBColorTable
• 0x464384 SetBrushOrgEx
• 0x464388 SetBkMode
• 0x46438c SetBkColor
• 0x464390 SelectPalette
• 0x464394 SelectObject
• 0x464398 SaveDC
• 0x46439c RestoreDC
• 0x4643a0 RectVisible
• 0x4643a4 RealizePalette
• 0x4643a8 PatBlt
• 0x4643ac MoveToEx
• 0x4643b0 MaskBlt
• 0x4643b4 LineTo
• 0x4643b8 IntersectClipRect
• 0x4643bc GetWindowOrgEx
• 0x4643c0 GetTextMetricsA
• 0x4643cc GetStockObject
• 0x4643d0 GetPixel
• 0x4643d4 GetPaletteEntries
• 0x4643d8 GetObjectA
• 0x4643dc GetDeviceCaps
• 0x4643e0 GetDIBits
• 0x4643e4 GetDIBColorTable
• 0x4643e8 GetDCOrgEx
• 0x4643f0 GetClipBox
• 0x4643f4 GetBrushOrgEx
• 0x4643f8 GetBitmapBits
• 0x4643fc ExtTextOutA
• 0x464400 ExcludeClipRect
• 0x464404 DeleteObject
• 0x464408 DeleteDC
• 0x46440c CreateSolidBrush
• 0x464410 CreatePenIndirect
• 0x464414 CreatePalette
• 0x46441c CreateFontIndirectA
• 0x464420 CreateDIBitmap
• 0x464424 CreateDIBSection
• 0x464428 CreateCompatibleDC
• 0x464430 CreateBrushIndirect
• 0x464434 CreateBitmap
• 0x464438 BitBlt
Library user32.dll:
• 0x464440 CreateWindowExA
• 0x464444 WindowFromPoint
• 0x464448 WinHelpA
• 0x46444c WaitMessage
• 0x464450 UpdateWindow
• 0x464454 UnregisterClassA
• 0x464458 UnhookWindowsHookEx
• 0x46445c TranslateMessage
• 0x464464 TrackPopupMenu
• 0x46446c ShowWindow
• 0x464470 ShowScrollBar
• 0x464474 ShowOwnedPopups
• 0x464478 ShowCursor
• 0x46447c SetWindowsHookExA
• 0x464480 SetWindowTextA
• 0x464484 SetWindowPos
• 0x464488 SetWindowPlacement
• 0x46448c SetWindowLongA
• 0x464490 SetTimer
• 0x464494 SetScrollRange
• 0x464498 SetScrollPos
• 0x46449c SetScrollInfo
• 0x4644a0 SetRect
• 0x4644a4 SetPropA
• 0x4644a8 SetParent
• 0x4644ac SetMenuItemInfoA
• 0x4644b0 SetMenu
• 0x4644b4 SetForegroundWindow
• 0x4644b8 SetFocus
• 0x4644bc SetCursor
• 0x4644c0 SetClassLongA
• 0x4644c4 SetCapture
• 0x4644c8 SetActiveWindow
• 0x4644cc SendMessageA
• 0x4644d0 ScrollWindow
• 0x4644d4 ScreenToClient
• 0x4644d8 RemovePropA
• 0x4644dc RemoveMenu
• 0x4644e0 ReleaseDC
• 0x4644e4 ReleaseCapture
• 0x4644f0 RegisterClassA
• 0x4644f4 RedrawWindow
• 0x4644f8 PtInRect
• 0x4644fc PostQuitMessage
• 0x464500 PostMessageA
• 0x464504 PeekMessageA
• 0x464508 OffsetRect
• 0x46450c OemToCharA
• 0x464510 MessageBoxA
• 0x464514 MapWindowPoints
• 0x464518 MapVirtualKeyA
• 0x46451c LoadStringA
• 0x464520 LoadKeyboardLayoutA
• 0x464524 LoadIconA
• 0x464528 LoadCursorA
• 0x46452c LoadBitmapA
• 0x464530 KillTimer
• 0x464534 IsZoomed
• 0x464538 IsWindowVisible
• 0x46453c IsWindowEnabled
• 0x464540 IsWindow
• 0x464544 IsRectEmpty
• 0x464548 IsIconic
• 0x46454c IsDialogMessageA
• 0x464550 IsChild
• 0x464554 InvalidateRect
• 0x464558 IntersectRect
• 0x46455c InsertMenuItemA
• 0x464560 InsertMenuA
• 0x464564 InflateRect
• 0x46456c GetWindowTextA
• 0x464570 GetWindowRect
• 0x464574 GetWindowPlacement
• 0x464578 GetWindowLongA
• 0x46457c GetWindowDC
• 0x464580 GetTopWindow
• 0x464584 GetSystemMetrics
• 0x464588 GetSystemMenu
• 0x46458c GetSysColorBrush
• 0x464590 GetSysColor
• 0x464594 GetSubMenu
• 0x464598 GetScrollRange
• 0x46459c GetScrollPos
• 0x4645a0 GetScrollInfo
• 0x4645a4 GetPropA
• 0x4645a8 GetParent
• 0x4645ac GetWindow
• 0x4645b0 GetMenuStringA
• 0x4645b4 GetMenuState
• 0x4645b8 GetMenuItemInfoA
• 0x4645bc GetMenuItemID
• 0x4645c0 GetMenuItemCount
• 0x4645c4 GetMenu
• 0x4645c8 GetLastActivePopup
• 0x4645cc GetKeyboardState
• 0x4645d4 GetKeyboardLayout
• 0x4645d8 GetKeyState
• 0x4645dc GetKeyNameTextA
• 0x4645e0 GetIconInfo
• 0x4645e4 GetForegroundWindow
• 0x4645e8 GetFocus
• 0x4645ec GetDlgItem
• 0x4645f0 GetDesktopWindow
• 0x4645f4 GetDCEx
• 0x4645f8 GetDC
• 0x4645fc GetCursorPos
• 0x464600 GetCursor
• 0x464604 GetClientRect
• 0x464608 GetClassNameA
• 0x46460c GetClassInfoA
• 0x464610 GetCapture
• 0x464614 GetActiveWindow
• 0x464618 FrameRect
• 0x46461c FindWindowA
• 0x464620 FillRect
• 0x464624 EqualRect
• 0x464628 EnumWindows
• 0x46462c EnumThreadWindows
• 0x464630 EndPaint
• 0x464634 EnableWindow
• 0x464638 EnableScrollBar
• 0x46463c EnableMenuItem
• 0x464640 DrawTextA
• 0x464644 DrawMenuBar
• 0x464648 DrawIconEx
• 0x46464c DrawIcon
• 0x464650 DrawFrameControl
• 0x464654 DrawFocusRect
• 0x464658 DrawEdge
• 0x46465c DispatchMessageA
• 0x464660 DestroyWindow
• 0x464664 DestroyMenu
• 0x464668 DestroyIcon
• 0x46466c DestroyCursor
• 0x464670 DeleteMenu
• 0x464674 DefWindowProcA
• 0x464678 DefMDIChildProcA
• 0x46467c DefFrameProcA
• 0x464680 CreatePopupMenu
• 0x464684 CreateMenu
• 0x464688 CreateIcon
• 0x46468c ClientToScreen
• 0x464690 CheckMenuItem
• 0x464694 CallWindowProcA
• 0x464698 CallNextHookEx
• 0x46469c BeginPaint
• 0x4646a0 CharNextA
• 0x4646a4 CharLowerBuffA
• 0x4646a8 CharLowerA
• 0x4646ac CharToOemA
• 0x4646b0 AdjustWindowRectEx
Library kernel32.dll:
• 0x4646bc Sleep
Library oleaut32.dll:
• 0x4646c4 SafeArrayPtrOfIndex
• 0x4646c8 SafeArrayGetUBound
• 0x4646cc SafeArrayGetLBound
• 0x4646d0 SafeArrayCreate
• 0x4646d4 VariantChangeType
• 0x4646d8 VariantCopy
• 0x4646dc VariantClear
• 0x4646e0 VariantInit
Library comctl32.dll:
• 0x4646f0 ImageList_Write
• 0x4646f4 ImageList_Read
• 0x464704 ImageList_DragMove
• 0x464708 ImageList_DragLeave
• 0x46470c ImageList_DragEnter
• 0x464710 ImageList_EndDrag
• 0x464714 ImageList_BeginDrag
• 0x464718 ImageList_Remove
• 0x46471c ImageList_DrawEx
• 0x464720 ImageList_Draw
• 0x464730 ImageList_Add
• 0x464738 ImageList_Destroy
• 0x46473c ImageList_Create
Library comdlg32.dll:
• 0x464744 GetSaveFileNameA
• 0x464748 GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.