12.8
0-day
51 个模型检测该样本为恶意！
重新分析
更多

3d9c66589409dbd885e007520427ae5c6a97a1cd71608513292f5105a0b31dc5

4db8f581e1ee2a060f2b32cd7cb51256.exe

分析耗时

220s

最近分析

文件大小

559.0KB
静态报毒 动态报毒 100% AERQ AGENSLA AGENTTESLA AI SCORE=83 AVSARHER BSK66A CONFIDENCE ELDORADO GDSDA GENCIRC GENERICKDZ GENERICRXKL HIGH CONFIDENCE IM0@AQ1 KRYPTIK MALWARE@#1PER16WQNVRE4 NGRMH PASSWORDSTEALER R066C0DIK20 RATX SCORE SIGGEN9 SUSGEN TROJANPSW TSCOPE UNSAFE YAKBEEXMSIL ZEMSILF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba TrojanPSW:MSIL/AgentTesla.84e5e189 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:RATX-gen [Trj] 20201228 21.1.5827.0
Kingsoft 20201228 2017.9.26.565
McAfee GenericRXKL-BJ!4DB8F581E1EE 20201228 6.0.6.653
Tencent Malware.Win32.Gencirc.116e4d67 20201228 1.0.0.1
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
Queries for the computername (7 个事件)
Time & API Arguments Status Return Repeated
1619484931.864626
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619484931.879626
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619484931.879626
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619484931.910626
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619484940.270626
GetComputerNameA
computer_name: OSKAR-PC
success 1 0
1619484940.270626
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619484954.551374
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (5 个事件)
Time & API Arguments Status Return Repeated
1619484898.379751
IsDebuggerPresent
failed 0 0
1619484898.379751
IsDebuggerPresent
failed 0 0
1619484932.785626
IsDebuggerPresent
failed 0 0
1619484960.676751
IsDebuggerPresent
failed 0 0
1619484960.692751
IsDebuggerPresent
failed 0 0
Command line console output was observed (1 个事件)
Time & API Arguments Status Return Repeated
1619484958.817374
WriteConsoleW
buffer: 成功: 成功创建计划任务 "Updates\lVhlBdAjHQuE"。
console_handle: 0x00000007
success 1 0
Uses Windows APIs to generate a cryptographic key (50 out of 64 个事件)
Time & API Arguments Status Return Repeated
1619484934.098626
CryptExportKey
crypto_handle: 0x002d72c8
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484934.879626
CryptExportKey
crypto_handle: 0x002d7188
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484934.879626
CryptExportKey
crypto_handle: 0x002d7188
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484934.879626
CryptExportKey
crypto_handle: 0x002d7188
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484934.989626
CryptExportKey
crypto_handle: 0x002d7188
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484934.989626
CryptExportKey
crypto_handle: 0x002d7188
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484934.989626
CryptExportKey
crypto_handle: 0x002d7188
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484935.035626
CryptExportKey
crypto_handle: 0x002d7188
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484935.145626
CryptExportKey
crypto_handle: 0x002d66c8
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484935.145626
CryptExportKey
crypto_handle: 0x002d66c8
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484935.192626
CryptExportKey
crypto_handle: 0x002d66c8
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484935.192626
CryptExportKey
crypto_handle: 0x002d66c8
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484935.192626
CryptExportKey
crypto_handle: 0x002d66c8
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484935.192626
CryptExportKey
crypto_handle: 0x002d66c8
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484935.645626
CryptExportKey
crypto_handle: 0x002d6c08
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484935.645626
CryptExportKey
crypto_handle: 0x002d6c08
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484935.645626
CryptExportKey
crypto_handle: 0x002d6c08
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484935.645626
CryptExportKey
crypto_handle: 0x002d6c08
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484935.645626
CryptExportKey
crypto_handle: 0x002d6c08
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484935.645626
CryptExportKey
crypto_handle: 0x002d6c08
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484935.676626
CryptExportKey
crypto_handle: 0x002d6c08
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484938.942626
CryptExportKey
crypto_handle: 0x002d6fc8
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484938.942626
CryptExportKey
crypto_handle: 0x002d6fc8
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484938.942626
CryptExportKey
crypto_handle: 0x002d6fc8
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484938.957626
CryptExportKey
crypto_handle: 0x002d6b08
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484939.004626
CryptExportKey
crypto_handle: 0x002d6fc8
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484939.004626
CryptExportKey
crypto_handle: 0x002d6fc8
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484939.004626
CryptExportKey
crypto_handle: 0x002d6fc8
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484939.004626
CryptExportKey
crypto_handle: 0x002d6fc8
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484939.082626
CryptExportKey
crypto_handle: 0x002d6fc8
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484939.145626
CryptExportKey
crypto_handle: 0x002d6fc8
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484939.145626
CryptExportKey
crypto_handle: 0x002d6fc8
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484939.848626
CryptExportKey
crypto_handle: 0x002d6fc8
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484939.848626
CryptExportKey
crypto_handle: 0x002d6fc8
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484940.067626
CryptExportKey
crypto_handle: 0x002d6f08
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484940.067626
CryptExportKey
crypto_handle: 0x002d6f08
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484940.082626
CryptExportKey
crypto_handle: 0x002d6f08
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484940.082626
CryptExportKey
crypto_handle: 0x002d6f08
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484940.082626
CryptExportKey
crypto_handle: 0x002d6f08
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484940.082626
CryptExportKey
crypto_handle: 0x002d6f08
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484940.098626
CryptExportKey
crypto_handle: 0x002d6f08
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484940.176626
CryptExportKey
crypto_handle: 0x002d6588
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484940.176626
CryptExportKey
crypto_handle: 0x002d6588
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484941.379626
CryptExportKey
crypto_handle: 0x002d6588
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484941.379626
CryptExportKey
crypto_handle: 0x002d6588
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484941.395626
CryptExportKey
crypto_handle: 0x002d6588
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484941.395626
CryptExportKey
crypto_handle: 0x002d6588
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484941.395626
CryptExportKey
crypto_handle: 0x002d6588
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484941.410626
CryptExportKey
crypto_handle: 0x002d6588
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
1619484941.410626
CryptExportKey
crypto_handle: 0x002d6588
crypto_export_handle: 0x00000000
buffer: <INVALID POINTER>
blob_type: 6
flags: 0
success 1 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619484898.395751
GlobalMemoryStatusEx
success 1 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (50 out of 233 个事件)
Time & API Arguments Status Return Repeated
1619484897.364751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 917504
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x005c0000
success 0 0
1619484897.364751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00660000
success 0 0
1619484898.160751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 1507328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00a90000
success 0 0
1619484898.160751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00bc0000
success 0 0
1619484898.223751
NtProtectVirtualMemory
process_identifier: 1320
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73b91000
success 0 0
1619484898.379751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 262144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x005c0000
success 0 0
1619484898.379751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005c0000
success 0 0
1619484898.379751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0043a000
success 0 0
1619484898.379751
NtProtectVirtualMemory
process_identifier: 1320
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73b92000
success 0 0
1619484898.379751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00432000
success 0 0
1619484898.895751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00442000
success 0 0
1619484909.504751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00465000
success 0 0
1619484909.598751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0046b000
success 0 0
1619484909.598751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00467000
success 0 0
1619484910.614751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00443000
success 0 0
1619484910.801751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00444000
success 0 0
1619484910.910751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0044c000
success 0 0
1619484917.004751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00445000
success 0 0
1619484917.067751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00446000
success 0 0
1619484919.442751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00447000
success 0 0
1619484919.660751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00ab0000
success 0 0
1619484920.285751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0045a000
success 0 0
1619484920.285751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00457000
success 0 0
1619484922.879751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00456000
success 0 0
1619484923.301751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005c1000
success 0 0
1619484923.332751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005c2000
success 0 0
1619484923.364751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005c3000
success 0 0
1619484923.473751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00ab1000
success 0 0
1619484923.520751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00448000
success 0 0
1619484923.739751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005c4000
success 0 0
1619484923.739751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005c5000
success 0 0
1619484923.785751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00ab2000
success 0 0
1619484923.832751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005c6000
success 0 0
1619484923.832751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 69632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005ca000
success 0 0
1619484924.004751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00ab3000
success 0 0
1619484924.379751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00449000
success 0 0
1619484925.082751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00c40000
success 0 0
1619484925.614751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00bc1000
success 0 0
1619484926.364751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00c41000
success 0 0
1619484926.535751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00ab4000
success 0 0
1619484926.614751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00c42000
success 0 0
1619484926.707751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00c43000
success 0 0
1619484926.723751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00ab5000
success 0 0
1619484926.817751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00ab8000
success 0 0
1619484926.817751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0044d000
success 0 0
1619484926.817751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005db000
success 0 0
1619484926.817751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005dc000
success 0 0
1619484926.864751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005dd000
success 0 0
1619484926.864751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005de000
success 0 0
1619484926.864751
NtAllocateVirtualMemory
process_identifier: 1320
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005df000
success 0 0
Creates a shortcut to an executable file (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
Creates a suspicious process (3 个事件)
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lVhlBdAjHQuE" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp6642.tmp"
cmdline "powershell" Get-MpPreference -verbose
cmdline schtasks.exe /Create /TN "Updates\lVhlBdAjHQuE" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp6642.tmp"
A process created a hidden window (2 个事件)
Time & API Arguments Status Return Repeated
1619484928.473751
CreateProcessInternalW
thread_identifier: 176
thread_handle: 0x00000234
process_identifier: 1664
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath:
track: 1
command_line: "powershell" Get-MpPreference -verbose
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
process_handle: 0x00000240
inherit_handles: 1
success 1 0
1619484954.160751
ShellExecuteExW
parameters: /Create /TN "Updates\lVhlBdAjHQuE" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp6642.tmp"
filepath: schtasks.exe
filepath_r: schtasks.exe
show_type: 0
success 1 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.654902674495759 section {'size_of_data': '0x0008b000', 'virtual_address': '0x00002000', 'entropy': 7.654902674495759, 'name': '.text', 'virtual_size': '0x0008afa8'} description A section with a high entropy has been found
entropy 0.9955237242614146 description Overall entropy of this PE file is high
Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 个事件)
Time & API Arguments Status Return Repeated
1619484933.926626
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619484961.614751
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
Terminates another process (2 个事件)
Time & API Arguments Status Return Repeated
1619485050.379751
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 1320
process_handle: 0x00000230
failed 0 0
1619485050.379751
NtTerminateProcess
status_code: 0xffffffff
process_identifier: 1320
process_handle: 0x00000230
failed 3221225738 0
Uses Windows utilities for basic Windows functionality (2 个事件)
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lVhlBdAjHQuE" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp6642.tmp"
cmdline schtasks.exe /Create /TN "Updates\lVhlBdAjHQuE" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp6642.tmp"
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 203.208.41.65
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619484960.098751
NtAllocateVirtualMemory
process_identifier: 884
region_size: 319488
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000003ac
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
Potential code injection by writing to the memory of another process (4 个事件)
Time & API Arguments Status Return Repeated
1619484960.098751
WriteProcessMemory
process_identifier: 884
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÿ ˜^à zn˜  @ à@…˜W øÀ  H.texttx z `.rsrcø |@@.reloc À€@B
process_handle: 0x000003ac
base_address: 0x00400000
success 1 0
1619484960.098751
WriteProcessMemory
process_identifier: 884
buffer: €0€HX œœ4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°üStringFileInfoØ000004b0,FileDescription 0FileVersion0.0.0.0d!InternalNametncATKmeBuUdDnpDaJCoQaVbAoOw.exe(LegalCopyright l!OriginalFilenametncATKmeBuUdDnpDaJCoQaVbAoOw.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0
process_handle: 0x000003ac
base_address: 0x0044a000
success 1 0
1619484960.098751
WriteProcessMemory
process_identifier: 884
buffer:  p8
process_handle: 0x000003ac
base_address: 0x0044c000
success 1 0
1619484960.098751
WriteProcessMemory
process_identifier: 884
buffer: @
process_handle: 0x000003ac
base_address: 0x7efde008
success 1 0
Code injection by writing an executable or DLL to the memory of another process (1 个事件)
Time & API Arguments Status Return Repeated
1619484960.098751
WriteProcessMemory
process_identifier: 884
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÿ ˜^à zn˜  @ à@…˜W øÀ  H.texttx z `.rsrcø |@@.reloc À€@B
process_handle: 0x000003ac
base_address: 0x00400000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 1320 called NtSetContextThread to modify thread in remote process 884
Time & API Arguments Status Return Repeated
1619484960.098751
NtSetContextThread
thread_handle: 0x00000358
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4495470
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 884
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 1320 resumed a thread in remote process 884
Time & API Arguments Status Return Repeated
1619484960.520751
NtResumeThread
thread_handle: 0x00000358
suspend_count: 1
process_identifier: 884
success 0 0
Disables Windows Security features (4 个事件)
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable
description attempts to modify windows defender policies registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection
Executed a process and injected code into it, probably while unpacking (22 个事件)
Time & API Arguments Status Return Repeated
1619484898.379751
NtResumeThread
thread_handle: 0x000000d8
suspend_count: 1
process_identifier: 1320
success 0 0
1619484898.395751
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 1320
success 0 0
1619484898.395751
NtResumeThread
thread_handle: 0x00000168
suspend_count: 1
process_identifier: 1320
success 0 0
1619484928.473751
CreateProcessInternalW
thread_identifier: 176
thread_handle: 0x00000234
process_identifier: 1664
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath:
track: 1
command_line: "powershell" Get-MpPreference -verbose
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
process_handle: 0x00000240
inherit_handles: 1
success 1 0
1619484954.160751
CreateProcessInternalW
thread_identifier: 1416
thread_handle: 0x00000364
process_identifier: 2476
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lVhlBdAjHQuE" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp6642.tmp"
filepath_r: C:\Windows\System32\schtasks.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x0000039c
inherit_handles: 0
success 1 0
1619484960.098751
CreateProcessInternalW
thread_identifier: 1304
thread_handle: 0x00000358
process_identifier: 884
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4db8f581e1ee2a060f2b32cd7cb51256.exe
track: 1
command_line: "{path}"
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4db8f581e1ee2a060f2b32cd7cb51256.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000003ac
inherit_handles: 0
success 1 0
1619484960.098751
NtGetContextThread
thread_handle: 0x00000358
success 0 0
1619484960.098751
NtAllocateVirtualMemory
process_identifier: 884
region_size: 319488
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000003ac
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1619484960.098751
WriteProcessMemory
process_identifier: 884
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PELÿ ˜^à zn˜  @ à@…˜W øÀ  H.texttx z `.rsrcø |@@.reloc À€@B
process_handle: 0x000003ac
base_address: 0x00400000
success 1 0
1619484960.098751
WriteProcessMemory
process_identifier: 884
buffer:
process_handle: 0x000003ac
base_address: 0x00402000
success 1 0
1619484960.098751
WriteProcessMemory
process_identifier: 884
buffer: €0€HX œœ4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°üStringFileInfoØ000004b0,FileDescription 0FileVersion0.0.0.0d!InternalNametncATKmeBuUdDnpDaJCoQaVbAoOw.exe(LegalCopyright l!OriginalFilenametncATKmeBuUdDnpDaJCoQaVbAoOw.exe4ProductVersion0.0.0.08Assembly Version0.0.0.0
process_handle: 0x000003ac
base_address: 0x0044a000
success 1 0
1619484960.098751
WriteProcessMemory
process_identifier: 884
buffer:  p8
process_handle: 0x000003ac
base_address: 0x0044c000
success 1 0
1619484960.098751
WriteProcessMemory
process_identifier: 884
buffer: @
process_handle: 0x000003ac
base_address: 0x7efde008
success 1 0
1619484960.098751
NtSetContextThread
thread_handle: 0x00000358
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4495470
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 884
success 0 0
1619484960.520751
NtResumeThread
thread_handle: 0x00000358
suspend_count: 1
process_identifier: 884
success 0 0
1619484932.785626
NtResumeThread
thread_handle: 0x000002a0
suspend_count: 1
process_identifier: 1664
success 0 0
1619484932.801626
NtResumeThread
thread_handle: 0x000002f4
suspend_count: 1
process_identifier: 1664
success 0 0
1619484941.926626
NtResumeThread
thread_handle: 0x000003b4
suspend_count: 1
process_identifier: 1664
success 0 0
1619484942.442626
NtResumeThread
thread_handle: 0x00000450
suspend_count: 1
process_identifier: 1664
success 0 0
1619484960.692751
NtResumeThread
thread_handle: 0x000000d8
suspend_count: 1
process_identifier: 884
success 0 0
1619484960.692751
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 884
success 0 0
1619484960.739751
NtResumeThread
thread_handle: 0x000001a4
suspend_count: 1
process_identifier: 884
success 0 0
File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKDZ.66904
CAT-QuickHeal Trojan.YakbeexMSIL.ZZ4
ALYac Spyware.AgentTesla
Cylance Unsafe
K7AntiVirus Trojan ( 0056069a1 )
Alibaba TrojanPSW:MSIL/AgentTesla.84e5e189
K7GW Trojan ( 0056069a1 )
Cybereason malicious.1e1ee2
Arcabit Trojan.Generic.D10558
BitDefenderTheta Gen:NN.ZemsilF.34700.Im0@aq1!NLk
Cyren W32/MSIL_Kryptik.AQI.gen!Eldorado
Symantec Trojan Horse
APEX Malicious
Avast Win32:RATX-gen [Trj]
Kaspersky HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender Trojan.GenericKDZ.66904
Paloalto generic.ml
Ad-Aware Trojan.GenericKDZ.66904
Emsisoft Trojan.GenericKDZ.66904 (B)
Comodo Malware@#1per16wqnvre4
F-Secure Trojan.TR/AD.AgentTesla.ngrmh
DrWeb Trojan.Siggen9.43686
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R066C0DIK20
McAfee-GW-Edition BehavesLike.Win32.Generic.hc
FireEye Generic.mg.4db8f581e1ee2a06
Sophos Mal/Generic-S
Jiangmin Trojan.PSW.MSIL.aerq
MaxSecure Trojan.Malware.74499699.susgen
Avira TR/AD.AgentTesla.ngrmh
MAX malware (ai score=83)
Microsoft Trojan:MSIL/AgentTesla.SD!MTB
AegisLab Trojan.MSIL.Agensla.i!c
ZoneAlarm HEUR:Trojan-PSW.MSIL.Agensla.gen
GData Trojan.GenericKDZ.66904
Cynet Malicious (score: 100)
AhnLab-V3 Malware/Win32.RL_Generic.C4085694
McAfee GenericRXKL-BJ!4DB8F581E1EE
VBA32 TScope.Trojan.MSIL
Malwarebytes Spyware.PasswordStealer
ESET-NOD32 MSIL/Autorun.Spy.Agent.DF
TrendMicro-HouseCall TROJ_GEN.R066C0DIK20
Tencent Malware.Win32.Gencirc.116e4d67
Yandex Trojan.AvsArher.bSK66A
Ikarus Trojan.Inject
Fortinet MSIL/Kryptik.VRU!tr
AVG Win32:RATX-gen [Trj]
Panda Trj/GdSda.A
CrowdStrike win/malicious_confidence_100% (W)
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 172.217.24.14:443
dead_host 172.217.160.110:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-05-01 13:29:11

Imports

Library mscoree.dll:
• 0x402000 _CorExeMain

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49217 203.208.41.98 update.googleapis.com 443
203.208.41.65 80 192.168.56.101 49194

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 54260 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 57236 114.114.114.114 53
192.168.56.101 57874 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 62912 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53210 224.0.0.252 5355
192.168.56.101 54178 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.