9.0
极危
61 个模型检测该样本为恶意！
重新分析
更多

d7f723006bca775ea723bcb6af0415357efe543e37791d2997b5100f4c775708

5404e7a2a261dde6b556c56a6afdb0ff.exe

分析耗时

22s

最近分析

文件大小

1.0MB
静态报毒 动态报毒 AGEN AGENTTESLA AI SCORE=89 AIDETECTVM ALI2000015 ANDROM AUTO AWTI CLASSIC CONFIDENCE DELF DELFINJECT DELPHILESS DHW@A0RENLLI DHW@H0RENLLI ELDORADO EMOY FAREIT GDSDA HIGH CONFIDENCE HNCNSH HPLOKI KCLOUD MALWARE1 MALWARE@#3TWFFDMU6O0N0 MZMGXTNBEK0 SCORE SIGGEN2 SMBD STATIC AI SUSGEN SUSPICIOUS PE TSCOPE TSPY UNSAFE X2085 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Malware-gen 20210126 21.1.5827.0
Tencent Win32.Trojan.Inject.Auto 20210126 1.0.0.1
Kingsoft Win32.Hack.Undef.(kcloud) 20210126 2017.9.26.565
McAfee Fareit-FVZ!5404E7A2A261 20210126 6.0.6.653
CrowdStrike win/malicious_confidence_80% (W) 20210106 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619426980.617988
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 35520324
registers.edi: 0
registers.eax: 0
registers.ebp: 35520392
registers.edx: 0
registers.ebx: 0
registers.esi: 0
registers.ecx: 6
exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10
exception.symbol: 5404e7a2a261dde6b556c56a6afdb0ff+0x5e00e
exception.instruction: div eax
exception.module: 5404e7a2a261dde6b556c56a6afdb0ff.exe
exception.exception_code: 0xc0000094
exception.offset: 385038
exception.address: 0x45e00e
success 0 0
1619435724.491751
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7524d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
5404e7a2a261dde6b556c56a6afdb0ff+0xb03f8 @ 0x4b03f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75114b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75115d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdb414ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (28 个事件)
Time & API Arguments Status Return Repeated
1619426980.477988
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003d0000
success 0 0
1619426980.617988
NtProtectVirtualMemory
process_identifier: 2136
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 36864
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0045e000
success 0 0
1619426980.617988
NtAllocateVirtualMemory
process_identifier: 2136
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01e30000
success 0 0
1619435723.897751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619435723.944751
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 1441792
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01ff0000
success 0 0
1619435723.944751
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02110000
success 0 0
1619435723.944751
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 688128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01ee0000
success 0 0
1619435723.944751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 659456
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ee2000
success 0 0
1619435724.475751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00642000
success 0 0
1619435724.475751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619435724.475751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00642000
success 0 0
1619435724.475751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619435724.475751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00642000
success 0 0
1619435724.475751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619435724.475751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00642000
success 0 0
1619435724.475751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619435724.475751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00642000
success 0 0
1619435724.475751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619435724.475751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00642000
success 0 0
1619435724.475751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619435724.475751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00642000
success 0 0
1619435724.475751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619435724.475751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00642000
success 0 0
1619435724.475751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619435724.475751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00642000
success 0 0
1619435724.475751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619435724.475751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00642000
success 0 0
1619435724.475751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ccccccccccc.vbs
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (3 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.6974678983657325 section {'size_of_data': '0x0009b600', 'virtual_address': '0x00078000', 'entropy': 7.6974678983657325, 'name': '.rsrc', 'virtual_size': '0x0009b514'} description A section with a high entropy has been found
entropy 0.5792171481826655 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619426982.820988
NtAllocateVirtualMemory
process_identifier: 368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000010c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
Installs itself for autorun at Windows startup (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ccccccccccc.vbs
Creates a thread using NtQueueApcThread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2136 created a thread in remote process 368
Time & API Arguments Status Return Repeated
1619426982.820988
NtQueueApcThread
thread_handle: 0x00000108
process_identifier: 368
function_address: 0x000b05c0
parameter: 0x000c0000
success 0 0
Potential code injection by writing to the memory of another process (2 个事件)
Time & API Arguments Status Return Repeated
1619426982.820988
WriteProcessMemory
process_identifier: 368
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x0000010c
base_address: 0x000b0000
success 1 0
1619426982.820988
WriteProcessMemory
process_identifier: 368
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5404e7a2a261dde6b556c56a6afdb0ff.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5404e7a2a261dde6b556c56a6afdb0ff.exe" cccccccccccSEt izA = creaTeobject("Wscript.SheLL") iza.rUn """%ls""", 0, False
process_handle: 0x0000010c
base_address: 0x000c0000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2136 called NtSetContextThread to modify thread in remote process 2224
Time & API Arguments Status Return Repeated
1619426982.992988
NtSetContextThread
thread_handle: 0x00000114
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5644416
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2224
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2136 resumed a thread in remote process 2224
Time & API Arguments Status Return Repeated
1619426983.367988
NtResumeThread
thread_handle: 0x00000114
suspend_count: 1
process_identifier: 2224
success 0 0
Executed a process and injected code into it, probably while unpacking (11 个事件)
Time & API Arguments Status Return Repeated
1619426982.820988
CreateProcessInternalW
thread_identifier: 392
thread_handle: 0x00000108
process_identifier: 368
current_directory:
filepath: C:\Windows\System32\notepad.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\notepad.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x0000010c
inherit_handles: 0
success 1 0
1619426982.820988
NtAllocateVirtualMemory
process_identifier: 368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000010c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
1619426982.820988
NtAllocateVirtualMemory
process_identifier: 368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
process_handle: 0x0000010c
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000c0000
success 0 0
1619426982.820988
WriteProcessMemory
process_identifier: 368
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x0000010c
base_address: 0x000b0000
success 1 0
1619426982.820988
WriteProcessMemory
process_identifier: 368
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5404e7a2a261dde6b556c56a6afdb0ff.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5404e7a2a261dde6b556c56a6afdb0ff.exe" cccccccccccSEt izA = creaTeobject("Wscript.SheLL") iza.rUn """%ls""", 0, False
process_handle: 0x0000010c
base_address: 0x000c0000
success 1 0
1619426982.930988
CreateProcessInternalW
thread_identifier: 376
thread_handle: 0x00000114
process_identifier: 2224
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5404e7a2a261dde6b556c56a6afdb0ff.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000110
inherit_handles: 0
success 1 0
1619426982.930988
NtUnmapViewOfSection
process_identifier: 2224
region_size: 4096
process_handle: 0x00000110
base_address: 0x00400000
success 0 0
1619426982.945988
NtMapViewOfSection
section_handle: 0x0000011c
process_identifier: 2224
commit_size: 1458176
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000110
allocation_type: 0 ()
section_offset: 0
view_size: 1458176
base_address: 0x00400000
success 0 0
1619426982.992988
NtGetContextThread
thread_handle: 0x00000114
success 0 0
1619426982.992988
NtSetContextThread
thread_handle: 0x00000114
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5644416
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2224
success 0 0
1619426983.367988
NtResumeThread
thread_handle: 0x00000114
suspend_count: 1
process_identifier: 2224
success 0 0
File has been identified by 61 AntiVirus engines on VirusTotal as malicious (50 out of 61 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Delf.FareIt.Gen.dHW@h0rENLli
FireEye Generic.mg.5404e7a2a261dde6
Qihoo-360 Win32/Backdoor.650
ALYac Trojan.Delf.FareIt.Gen.dHW@h0rENLli
Cylance Unsafe
Sangfor Malware
K7AntiVirus Riskware ( 0040eff71 )
Alibaba Trojan:Win32/DelfInject.ali2000015
K7GW Riskware ( 0040eff71 )
Cybereason malicious.2a261d
Arcabit Trojan.Delf.FareIt.Gen.EF349C
Cyren W32/Injector.ABY.gen!Eldorado
Symantec Trojan.Gen.MBT
APEX Malicious
Avast Win32:Malware-gen
ClamAV Win.Malware.Fareit-8701980-0
Kaspersky HEUR:Backdoor.Win32.Androm.gen
BitDefender Trojan.Delf.FareIt.Gen.dHW@h0rENLli
NANO-Antivirus Trojan.Win32.Androm.hncnsh
Paloalto generic.ml
Tencent Win32.Trojan.Inject.Auto
Ad-Aware Trojan.Delf.FareIt.Gen.dHW@h0rENLli
Sophos Mal/Generic-S
Comodo Malware@#3twffdmu6o0n0
F-Secure Heuristic.HEUR/AGEN.1136559
DrWeb Trojan.PWS.Siggen2.51485
VIPRE Trojan.Win32.Generic!BT
TrendMicro TSPY_HPLOKI.SMBD
McAfee-GW-Edition BehavesLike.Win32.Fareit.tc
Emsisoft Trojan.Delf.FareIt.Gen.dHW@h0rENLli (B)
Ikarus Trojan.Inject
Jiangmin Backdoor.Androm.awti
Webroot W32.Trojan.Gen
Avira HEUR/AGEN.1136559
Antiy-AVL Trojan[Backdoor]/Win32.Androm
Kingsoft Win32.Hack.Undef.(kcloud)
Microsoft PWS:Win32/Fareit.AN!MTB
ZoneAlarm HEUR:Backdoor.Win32.Androm.gen
GData Trojan.Delf.FareIt.Gen.dHW@h0rENLli
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2085
Acronis suspicious
McAfee Fareit-FVZ!5404E7A2A261
MAX malware (ai score=89)
VBA32 TScope.Trojan.Delf
Malwarebytes Spyware.AgentTesla
Zoner Trojan.Win32.91490
ESET-NOD32 a variant of Win32/Injector.EMOY
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x46b164 VirtualFree
• 0x46b168 VirtualAlloc
• 0x46b16c LocalFree
• 0x46b170 LocalAlloc
• 0x46b174 GetVersion
• 0x46b178 GetCurrentThreadId
• 0x46b184 VirtualQuery
• 0x46b188 WideCharToMultiByte
• 0x46b18c MultiByteToWideChar
• 0x46b190 lstrlenA
• 0x46b194 lstrcpynA
• 0x46b198 LoadLibraryExA
• 0x46b19c GetThreadLocale
• 0x46b1a0 GetStartupInfoA
• 0x46b1a4 GetProcAddress
• 0x46b1a8 GetModuleHandleA
• 0x46b1ac GetModuleFileNameA
• 0x46b1b0 GetLocaleInfoA
• 0x46b1b4 GetCommandLineA
• 0x46b1b8 FreeLibrary
• 0x46b1bc FindFirstFileA
• 0x46b1c0 FindClose
• 0x46b1c4 ExitProcess
• 0x46b1c8 WriteFile
• 0x46b1d0 RtlUnwind
• 0x46b1d4 RaiseException
• 0x46b1d8 GetStdHandle
Library user32.dll:
• 0x46b1e0 GetKeyboardType
• 0x46b1e4 LoadStringA
• 0x46b1e8 MessageBoxA
• 0x46b1ec CharNextA
Library advapi32.dll:
• 0x46b1f4 RegQueryValueExA
• 0x46b1f8 RegOpenKeyExA
• 0x46b1fc RegCloseKey
Library oleaut32.dll:
• 0x46b204 SysFreeString
• 0x46b208 SysReAllocStringLen
• 0x46b20c SysAllocStringLen
Library kernel32.dll:
• 0x46b214 TlsSetValue
• 0x46b218 TlsGetValue
• 0x46b21c LocalAlloc
• 0x46b220 GetModuleHandleA
Library advapi32.dll:
• 0x46b228 RegQueryValueExA
• 0x46b22c RegOpenKeyExA
• 0x46b230 RegCloseKey
Library kernel32.dll:
• 0x46b238 lstrcpyA
• 0x46b23c lstrcmpA
• 0x46b240 WriteFile
• 0x46b244 WaitForSingleObject
• 0x46b248 VirtualQuery
• 0x46b24c VirtualProtectEx
• 0x46b250 VirtualAlloc
• 0x46b254 Sleep
• 0x46b258 SizeofResource
• 0x46b25c SetThreadLocale
• 0x46b260 SetFilePointer
• 0x46b264 SetEvent
• 0x46b268 SetErrorMode
• 0x46b26c SetEndOfFile
• 0x46b270 ResetEvent
• 0x46b274 ReadFile
• 0x46b278 MulDiv
• 0x46b27c LockResource
• 0x46b280 LoadResource
• 0x46b284 LoadLibraryA
• 0x46b290 GlobalUnlock
• 0x46b294 GlobalSize
• 0x46b298 GlobalReAlloc
• 0x46b29c GlobalHandle
• 0x46b2a0 GlobalLock
• 0x46b2a4 GlobalFree
• 0x46b2a8 GlobalFindAtomA
• 0x46b2ac GlobalDeleteAtom
• 0x46b2b0 GlobalAlloc
• 0x46b2b4 GlobalAddAtomA
• 0x46b2b8 GetVersionExA
• 0x46b2bc GetVersion
• 0x46b2c0 GetTickCount
• 0x46b2c4 GetThreadLocale
• 0x46b2c8 GetSystemInfo
• 0x46b2cc GetStringTypeExA
• 0x46b2d0 GetStdHandle
• 0x46b2d4 GetProfileStringA
• 0x46b2d8 GetProcAddress
• 0x46b2dc GetModuleHandleA
• 0x46b2e0 GetModuleFileNameA
• 0x46b2e4 GetLocaleInfoA
• 0x46b2e8 GetLocalTime
• 0x46b2ec GetLastError
• 0x46b2f0 GetFullPathNameA
• 0x46b2f4 GetDiskFreeSpaceA
• 0x46b2f8 GetDateFormatA
• 0x46b2fc GetCurrentThreadId
• 0x46b300 GetCurrentProcessId
• 0x46b304 GetCurrentProcess
• 0x46b308 GetCPInfo
• 0x46b30c GetACP
• 0x46b310 FreeResource
• 0x46b314 InterlockedExchange
• 0x46b318 FreeLibrary
• 0x46b31c FormatMessageA
• 0x46b320 FindResourceA
• 0x46b324 EnumCalendarInfoA
• 0x46b330 CreateThread
• 0x46b334 CreateFileA
• 0x46b338 CreateEventA
• 0x46b33c CompareStringA
• 0x46b340 CloseHandle
Library version.dll:
• 0x46b348 VerQueryValueA
• 0x46b350 GetFileVersionInfoA
Library gdi32.dll:
• 0x46b358 UnrealizeObject
• 0x46b35c StretchBlt
• 0x46b360 SetWindowOrgEx
• 0x46b364 SetViewportOrgEx
• 0x46b368 SetTextColor
• 0x46b36c SetStretchBltMode
• 0x46b370 SetROP2
• 0x46b374 SetPixel
• 0x46b378 SetDIBColorTable
• 0x46b37c SetBrushOrgEx
• 0x46b380 SetBkMode
• 0x46b384 SetBkColor
• 0x46b388 SelectPalette
• 0x46b38c SelectObject
• 0x46b390 SelectClipRgn
• 0x46b394 SaveDC
• 0x46b398 RestoreDC
• 0x46b39c Rectangle
• 0x46b3a0 RectVisible
• 0x46b3a4 RealizePalette
• 0x46b3a8 Polyline
• 0x46b3ac PatBlt
• 0x46b3b0 MoveToEx
• 0x46b3b4 MaskBlt
• 0x46b3b8 LineTo
• 0x46b3bc IntersectClipRect
• 0x46b3c0 GetWindowOrgEx
• 0x46b3c4 GetTextMetricsA
• 0x46b3d0 GetStockObject
• 0x46b3d4 GetPixel
• 0x46b3d8 GetPaletteEntries
• 0x46b3dc GetObjectA
• 0x46b3e0 GetDeviceCaps
• 0x46b3e4 GetDIBits
• 0x46b3e8 GetDIBColorTable
• 0x46b3ec GetDCOrgEx
• 0x46b3f4 GetClipBox
• 0x46b3f8 GetBrushOrgEx
• 0x46b3fc GetBitmapBits
• 0x46b400 ExcludeClipRect
• 0x46b404 EndPath
• 0x46b408 EndPage
• 0x46b40c EndDoc
• 0x46b410 DeleteObject
• 0x46b414 DeleteDC
• 0x46b418 CreateSolidBrush
• 0x46b41c CreatePenIndirect
• 0x46b420 CreatePen
• 0x46b424 CreatePalette
• 0x46b428 CreateICA
• 0x46b430 CreateFontIndirectA
• 0x46b434 CreateDIBitmap
• 0x46b438 CreateDIBSection
• 0x46b43c CreateDCA
• 0x46b440 CreateCompatibleDC
• 0x46b448 CreateBrushIndirect
• 0x46b44c CreateBitmap
• 0x46b450 BitBlt
Library user32.dll:
• 0x46b458 CreateWindowExA
• 0x46b45c WindowFromPoint
• 0x46b460 WinHelpA
• 0x46b464 WaitMessage
• 0x46b468 ValidateRect
• 0x46b46c UpdateWindow
• 0x46b470 UnregisterClassA
• 0x46b474 UnhookWindowsHookEx
• 0x46b478 TranslateMessage
• 0x46b480 TrackPopupMenu
• 0x46b488 ShowWindow
• 0x46b48c ShowScrollBar
• 0x46b490 ShowOwnedPopups
• 0x46b494 ShowCursor
• 0x46b498 SetWindowsHookExA
• 0x46b49c SetWindowTextA
• 0x46b4a0 SetWindowPos
• 0x46b4a4 SetWindowPlacement
• 0x46b4a8 SetWindowLongA
• 0x46b4ac SetTimer
• 0x46b4b0 SetScrollRange
• 0x46b4b4 SetScrollPos
• 0x46b4b8 SetScrollInfo
• 0x46b4bc SetRect
• 0x46b4c0 SetPropA
• 0x46b4c4 SetParent
• 0x46b4c8 SetMenuItemInfoA
• 0x46b4cc SetMenu
• 0x46b4d0 SetForegroundWindow
• 0x46b4d4 SetFocus
• 0x46b4d8 SetCursor
• 0x46b4dc SetClassLongA
• 0x46b4e0 SetCapture
• 0x46b4e4 SetActiveWindow
• 0x46b4e8 SendMessageA
• 0x46b4ec ScrollWindow
• 0x46b4f0 ScreenToClient
• 0x46b4f4 RemovePropA
• 0x46b4f8 RemoveMenu
• 0x46b4fc ReleaseDC
• 0x46b500 ReleaseCapture
• 0x46b50c RegisterClassA
• 0x46b510 RedrawWindow
• 0x46b514 PtInRect
• 0x46b518 PostQuitMessage
• 0x46b51c PostMessageA
• 0x46b520 PeekMessageA
• 0x46b524 OffsetRect
• 0x46b528 OemToCharA
• 0x46b52c MessageBoxA
• 0x46b530 MapWindowPoints
• 0x46b534 MapVirtualKeyA
• 0x46b538 LoadStringA
• 0x46b53c LoadKeyboardLayoutA
• 0x46b540 LoadIconA
• 0x46b544 LoadCursorA
• 0x46b548 LoadBitmapA
• 0x46b54c KillTimer
• 0x46b550 IsZoomed
• 0x46b554 IsWindowVisible
• 0x46b558 IsWindowEnabled
• 0x46b55c IsWindow
• 0x46b560 IsRectEmpty
• 0x46b564 IsIconic
• 0x46b568 IsDialogMessageA
• 0x46b56c IsChild
• 0x46b570 InvalidateRect
• 0x46b574 IntersectRect
• 0x46b578 InsertMenuItemA
• 0x46b57c InsertMenuA
• 0x46b580 InflateRect
• 0x46b588 GetWindowTextA
• 0x46b58c GetWindowRect
• 0x46b590 GetWindowPlacement
• 0x46b594 GetWindowLongA
• 0x46b598 GetWindowDC
• 0x46b59c GetTopWindow
• 0x46b5a0 GetSystemMetrics
• 0x46b5a4 GetSystemMenu
• 0x46b5a8 GetSysColorBrush
• 0x46b5ac GetSysColor
• 0x46b5b0 GetSubMenu
• 0x46b5b4 GetScrollRange
• 0x46b5b8 GetScrollPos
• 0x46b5bc GetScrollInfo
• 0x46b5c0 GetPropA
• 0x46b5c4 GetParent
• 0x46b5c8 GetWindow
• 0x46b5cc GetMenuStringA
• 0x46b5d0 GetMenuState
• 0x46b5d4 GetMenuItemInfoA
• 0x46b5d8 GetMenuItemID
• 0x46b5dc GetMenuItemCount
• 0x46b5e0 GetMenu
• 0x46b5e4 GetLastActivePopup
• 0x46b5e8 GetKeyboardState
• 0x46b5f0 GetKeyboardLayout
• 0x46b5f4 GetKeyState
• 0x46b5f8 GetKeyNameTextA
• 0x46b5fc GetIconInfo
• 0x46b600 GetForegroundWindow
• 0x46b604 GetFocus
• 0x46b608 GetDesktopWindow
• 0x46b60c GetDCEx
• 0x46b610 GetDC
• 0x46b614 GetCursorPos
• 0x46b618 GetCursor
• 0x46b61c GetClientRect
• 0x46b620 GetClassNameA
• 0x46b624 GetClassInfoA
• 0x46b628 GetCapture
• 0x46b62c GetActiveWindow
• 0x46b630 FrameRect
• 0x46b634 FindWindowA
• 0x46b638 FillRect
• 0x46b63c EqualRect
• 0x46b640 EnumWindows
• 0x46b644 EnumThreadWindows
• 0x46b648 EndPaint
• 0x46b64c EndDeferWindowPos
• 0x46b650 EnableWindow
• 0x46b654 EnableScrollBar
• 0x46b658 EnableMenuItem
• 0x46b65c DrawTextA
• 0x46b660 DrawMenuBar
• 0x46b664 DrawIconEx
• 0x46b668 DrawIcon
• 0x46b66c DrawFrameControl
• 0x46b670 DrawEdge
• 0x46b674 DispatchMessageA
• 0x46b678 DestroyWindow
• 0x46b67c DestroyMenu
• 0x46b680 DestroyIcon
• 0x46b684 DestroyCursor
• 0x46b688 DeleteMenu
• 0x46b68c DeferWindowPos
• 0x46b690 DefWindowProcA
• 0x46b694 DefMDIChildProcA
• 0x46b698 DefFrameProcA
• 0x46b69c CreatePopupMenu
• 0x46b6a0 CreateMenu
• 0x46b6a4 CreateIcon
• 0x46b6a8 ClientToScreen
• 0x46b6ac CheckMenuItem
• 0x46b6b0 CallWindowProcA
• 0x46b6b4 CallNextHookEx
• 0x46b6b8 BeginPaint
• 0x46b6bc BeginDeferWindowPos
• 0x46b6c0 CharNextA
• 0x46b6c4 CharLowerA
• 0x46b6c8 CharToOemA
• 0x46b6cc AdjustWindowRectEx
Library kernel32.dll:
• 0x46b6d8 Sleep
Library oleaut32.dll:
• 0x46b6e0 SafeArrayPtrOfIndex
• 0x46b6e4 SafeArrayGetUBound
• 0x46b6e8 SafeArrayGetLBound
• 0x46b6ec SafeArrayCreate
• 0x46b6f0 VariantChangeType
• 0x46b6f4 VariantCopy
• 0x46b6f8 VariantClear
• 0x46b6fc VariantInit
Library ole32.dll:
• 0x46b704 CoTaskMemAlloc
• 0x46b708 CoCreateInstance
• 0x46b70c CoUninitialize
• 0x46b710 CoInitialize
Library comctl32.dll:
• 0x46b720 ImageList_Write
• 0x46b724 ImageList_Read
• 0x46b734 ImageList_DragMove
• 0x46b738 ImageList_DragLeave
• 0x46b73c ImageList_DragEnter
• 0x46b740 ImageList_EndDrag
• 0x46b744 ImageList_BeginDrag
• 0x46b748 ImageList_Remove
• 0x46b74c ImageList_DrawEx
• 0x46b750 ImageList_Draw
• 0x46b760 ImageList_Add
• 0x46b768 ImageList_Destroy
• 0x46b76c ImageList_Create
• 0x46b770 InitCommonControls
Library winspool.drv:
• 0x46b778 OpenPrinterA
• 0x46b77c EnumPrintersA
• 0x46b780 DocumentPropertiesA
• 0x46b784 ClosePrinter
Library comdlg32.dll:
• 0x46b78c PrintDlgA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 50537 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 62192 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.