8.6
极危
58 个模型检测该样本为恶意！
重新分析
更多

89581b13e744458c0f64ed2f07f464428f28153862ce5594ed875e3d20b43c23

594b9626d4f3b388d460cb50ed402194.exe

分析耗时

23s

最近分析

文件大小

766.5KB
静态报毒 动态报毒 100% AGEN AI SCORE=80 AIDETECTVM AVSARHER BTOMTW CEEINJECT CLASSIC CONFIDENCE CRYPTINJECTOR DELF DELPHILESS ELZG EMHC ESNZ FAREIT HIGH CONFIDENCE HMPGUA KRYPTIK LOKI LOKIBOT MALICIOUS PE MALWARE2 MALWARE@#128K8DWHS8WKX POWERSHELL RUAJ SCORE SELFDELETE SIGGEN2 SMTHG STATIC AI SUSGEN SVRN TSCOPE UNSAFE VGW@AWKFOKII X2066 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FTB!594B9626D4F3 20201211 6.0.6.653
Alibaba VirTool:Win32/CeeInject.8db0556f 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Malware-gen 20201210 21.1.5827.0
Kingsoft 20201211 2017.9.26.565
Tencent Win32.Trojan.Kryptik.Svrn 20201211 1.0.0.1
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619534398.295875
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7484e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7484ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7484b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7484b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7484ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7484aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x74845511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7484559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75097f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75094de3
594b9626d4f3b388d460cb50ed402194+0x5aa4d @ 0x45aa4d
594b9626d4f3b388d460cb50ed402194+0x53254 @ 0x453254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff2414ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619513305.754598
NtAllocateVirtualMemory
process_identifier: 2528
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619513305.926598
NtAllocateVirtualMemory
process_identifier: 2528
region_size: 32768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00560000
success 0 0
1619513305.942598
NtAllocateVirtualMemory
process_identifier: 2528
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f90000
success 0 0
1619534396.842875
NtProtectVirtualMemory
process_identifier: 1060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619534396.920875
NtAllocateVirtualMemory
process_identifier: 1060
region_size: 262144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01ce0000
success 0 0
1619534396.920875
NtAllocateVirtualMemory
process_identifier: 1060
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01ce0000
success 0 0
1619534396.920875
NtAllocateVirtualMemory
process_identifier: 1060
region_size: 335872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01d90000
success 0 0
1619534396.920875
NtProtectVirtualMemory
process_identifier: 1060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 307200
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d92000
success 0 0
1619534397.357875
NtAllocateVirtualMemory
process_identifier: 1060
region_size: 2162688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x020a0000
success 0 0
1619534397.357875
NtAllocateVirtualMemory
process_identifier: 1060
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02270000
success 0 0
1619534398.217875
NtProtectVirtualMemory
process_identifier: 1060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d22000
success 0 0
1619534398.217875
NtProtectVirtualMemory
process_identifier: 1060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619534398.217875
NtProtectVirtualMemory
process_identifier: 1060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d22000
success 0 0
1619534398.217875
NtProtectVirtualMemory
process_identifier: 1060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619534398.217875
NtProtectVirtualMemory
process_identifier: 1060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d22000
success 0 0
1619534398.217875
NtProtectVirtualMemory
process_identifier: 1060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619534398.217875
NtProtectVirtualMemory
process_identifier: 1060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d22000
success 0 0
1619534398.217875
NtProtectVirtualMemory
process_identifier: 1060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619534398.217875
NtProtectVirtualMemory
process_identifier: 1060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d22000
success 0 0
1619534398.217875
NtProtectVirtualMemory
process_identifier: 1060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619534398.217875
NtProtectVirtualMemory
process_identifier: 1060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d22000
success 0 0
1619534398.217875
NtProtectVirtualMemory
process_identifier: 1060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619534398.217875
NtProtectVirtualMemory
process_identifier: 1060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d22000
success 0 0
1619534398.217875
NtProtectVirtualMemory
process_identifier: 1060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619534398.217875
NtProtectVirtualMemory
process_identifier: 1060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d22000
success 0 0
1619534398.217875
NtProtectVirtualMemory
process_identifier: 1060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619534398.217875
NtProtectVirtualMemory
process_identifier: 1060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d22000
success 0 0
1619534398.217875
NtProtectVirtualMemory
process_identifier: 1060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619534398.217875
NtProtectVirtualMemory
process_identifier: 1060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d22000
success 0 0
1619534398.217875
NtProtectVirtualMemory
process_identifier: 1060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.vbs
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.357659771023637 section {'size_of_data': '0x00040c00', 'virtual_address': '0x00084000', 'entropy': 7.357659771023637, 'name': '.rsrc', 'virtual_size': '0x00040bc4'} description A section with a high entropy has been found
entropy 0.33834095362508165 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619513306.613598
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000108
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000f0000
success 0 0
Installs itself for autorun at Windows startup (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.vbs
Creates a thread using NtQueueApcThread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2528 created a thread in remote process 648
Time & API Arguments Status Return Repeated
1619513306.613598
NtQueueApcThread
thread_handle: 0x00000104
process_identifier: 648
function_address: 0x000f05c0
parameter: 0x00100000
success 0 0
Potential code injection by writing to the memory of another process (2 个事件)
Time & API Arguments Status Return Repeated
1619513306.613598
WriteProcessMemory
process_identifier: 648
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000108
base_address: 0x000f0000
success 1 0
1619513306.613598
WriteProcessMemory
process_identifier: 648
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\594b9626d4f3b388d460cb50ed402194.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\594b9626d4f3b388d460cb50ed402194.exe" appSet LZnhsnO = createobject("WsCRIpT.SheLl") LznhSnO.ruN """%ls""", 0, False
process_handle: 0x00000108
base_address: 0x00100000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2528 called NtSetContextThread to modify thread in remote process 1060
Time & API Arguments Status Return Repeated
1619513306.848598
NtSetContextThread
thread_handle: 0x00000110
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907408
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1060
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2528 resumed a thread in remote process 1060
Time & API Arguments Status Return Repeated
1619513307.145598
NtResumeThread
thread_handle: 0x00000110
suspend_count: 1
process_identifier: 1060
success 0 0
Executed a process and injected code into it, probably while unpacking (11 个事件)
Time & API Arguments Status Return Repeated
1619513306.613598
CreateProcessInternalW
thread_identifier: 732
thread_handle: 0x00000104
process_identifier: 648
current_directory:
filepath: C:\Windows\System32\notepad.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\notepad.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000108
inherit_handles: 0
success 1 0
1619513306.613598
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000108
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000f0000
success 0 0
1619513306.613598
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
process_handle: 0x00000108
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00100000
success 0 0
1619513306.613598
WriteProcessMemory
process_identifier: 648
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000108
base_address: 0x000f0000
success 1 0
1619513306.613598
WriteProcessMemory
process_identifier: 648
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\594b9626d4f3b388d460cb50ed402194.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\594b9626d4f3b388d460cb50ed402194.exe" appSet LZnhsnO = createobject("WsCRIpT.SheLl") LznhSnO.ruN """%ls""", 0, False
process_handle: 0x00000108
base_address: 0x00100000
success 1 0
1619513306.785598
CreateProcessInternalW
thread_identifier: 520
thread_handle: 0x00000110
process_identifier: 1060
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\594b9626d4f3b388d460cb50ed402194.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x0000010c
inherit_handles: 0
success 1 0
1619513306.785598
NtUnmapViewOfSection
process_identifier: 1060
region_size: 4096
process_handle: 0x0000010c
base_address: 0x00400000
success 0 0
1619513306.801598
NtMapViewOfSection
section_handle: 0x00000118
process_identifier: 1060
commit_size: 720896
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x0000010c
allocation_type: 0 ()
section_offset: 0
view_size: 720896
base_address: 0x00400000
success 0 0
1619513306.848598
NtGetContextThread
thread_handle: 0x00000110
success 0 0
1619513306.848598
NtSetContextThread
thread_handle: 0x00000110
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907408
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1060
success 0 0
1619513307.145598
NtResumeThread
thread_handle: 0x00000110
suspend_count: 1
process_identifier: 1060
success 0 0
File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Agent.ESNZ
FireEye Generic.mg.594b9626d4f3b388
McAfee Fareit-FTB!594B9626D4F3
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Malware
K7AntiVirus Trojan ( 005680341 )
Alibaba VirTool:Win32/CeeInject.8db0556f
K7GW Trojan ( 005680341 )
Cybereason malicious.ba0ffe
Arcabit Trojan.Agent.ESNZ
Cyren W32/Injector.RUAJ-7477
Symantec Trojan.Gen.2
APEX Malicious
Avast Win32:Malware-gen
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
BitDefender Trojan.Agent.ESNZ
NANO-Antivirus Trojan.Win32.Kryptik.hmpgua
Paloalto generic.ml
Rising Trojan.Injector!1.CB27 (CLASSIC)
Ad-Aware Trojan.Agent.ESNZ
Sophos Mal/Generic-S
Comodo Malware@#128k8dwhs8wkx
F-Secure Heuristic.HEUR/AGEN.1137421
DrWeb Trojan.PWS.Siggen2.50645
Zillya Trojan.Injector.Win32.742154
TrendMicro TrojanSpy.Win32.LOKI.SMTHG
McAfee-GW-Edition BehavesLike.Win32.Fareit.bc
Emsisoft Trojan.Agent.ESNZ (B)
SentinelOne Static AI - Malicious PE
Jiangmin Trojan.Kryptik.blv
Avira HEUR/AGEN.1137421
Antiy-AVL Trojan/Win32.Kryptik
Microsoft Trojan:Win32/CryptInjector.F!MTB
AegisLab Trojan.Win32.Kryptik.4!c
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
GData Trojan.Agent.ESNZ
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2066
Acronis suspicious
BitDefenderTheta Gen:NN.ZelphiF.34670.VGW@aWKfOkii
MAX malware (ai score=80)
VBA32 TScope.Trojan.Delf
Malwarebytes Trojan.SelfDelete.Powershell
ESET-NOD32 a variant of Win32/Injector.EMHC
TrendMicro-HouseCall TrojanSpy.Win32.LOKI.SMTHG
Tencent Win32.Trojan.Kryptik.Svrn
Yandex Trojan.AvsArher.bTOmTw
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x477178 VirtualFree
• 0x47717c VirtualAlloc
• 0x477180 LocalFree
• 0x477184 LocalAlloc
• 0x477188 GetVersion
• 0x47718c GetCurrentThreadId
• 0x477198 VirtualQuery
• 0x47719c WideCharToMultiByte
• 0x4771a0 MultiByteToWideChar
• 0x4771a4 lstrlenA
• 0x4771a8 lstrcpynA
• 0x4771ac LoadLibraryExA
• 0x4771b0 GetThreadLocale
• 0x4771b4 GetStartupInfoA
• 0x4771b8 GetProcAddress
• 0x4771bc GetModuleHandleA
• 0x4771c0 GetModuleFileNameA
• 0x4771c4 GetLocaleInfoA
• 0x4771c8 GetCommandLineA
• 0x4771cc FreeLibrary
• 0x4771d0 FindFirstFileA
• 0x4771d4 FindClose
• 0x4771d8 ExitProcess
• 0x4771dc WriteFile
• 0x4771e4 RtlUnwind
• 0x4771e8 RaiseException
• 0x4771ec GetStdHandle
Library user32.dll:
• 0x4771f4 GetKeyboardType
• 0x4771f8 LoadStringA
• 0x4771fc MessageBoxA
• 0x477200 CharNextA
Library advapi32.dll:
• 0x477208 RegQueryValueExA
• 0x47720c RegOpenKeyExA
• 0x477210 RegCloseKey
Library oleaut32.dll:
• 0x477218 SysFreeString
• 0x47721c SysReAllocStringLen
• 0x477220 SysAllocStringLen
Library kernel32.dll:
• 0x477228 TlsSetValue
• 0x47722c TlsGetValue
• 0x477230 LocalAlloc
• 0x477234 GetModuleHandleA
Library advapi32.dll:
• 0x47723c RegQueryValueExA
• 0x477240 RegOpenKeyExA
• 0x477244 RegCloseKey
Library kernel32.dll:
• 0x47724c lstrcpyA
• 0x477250 WriteFile
• 0x477258 WaitForSingleObject
• 0x47725c VirtualQuery
• 0x477260 VirtualAlloc
• 0x477264 Sleep
• 0x477268 SizeofResource
• 0x47726c SetThreadLocale
• 0x477270 SetFilePointer
• 0x477274 SetEvent
• 0x477278 SetErrorMode
• 0x47727c SetEndOfFile
• 0x477280 ResetEvent
• 0x477284 ReadFile
• 0x477288 MultiByteToWideChar
• 0x47728c MulDiv
• 0x477290 LockResource
• 0x477294 LoadResource
• 0x477298 LoadLibraryA
• 0x4772a4 GlobalUnlock
• 0x4772a8 GlobalReAlloc
• 0x4772ac GlobalHandle
• 0x4772b0 GlobalLock
• 0x4772b4 GlobalFree
• 0x4772b8 GlobalFindAtomA
• 0x4772bc GlobalDeleteAtom
• 0x4772c0 GlobalAlloc
• 0x4772c4 GlobalAddAtomA
• 0x4772c8 GetVersionExA
• 0x4772cc GetVersion
• 0x4772d0 GetTickCount
• 0x4772d4 GetThreadLocale
• 0x4772dc GetSystemTime
• 0x4772e0 GetSystemInfo
• 0x4772e4 GetStringTypeExA
• 0x4772e8 GetStdHandle
• 0x4772ec GetProcAddress
• 0x4772f0 GetModuleHandleA
• 0x4772f4 GetModuleFileNameA
• 0x4772f8 GetLocaleInfoA
• 0x4772fc GetLocalTime
• 0x477300 GetLastError
• 0x477304 GetFullPathNameA
• 0x477308 GetFileAttributesA
• 0x47730c GetDiskFreeSpaceA
• 0x477310 GetDateFormatA
• 0x477314 GetCurrentThreadId
• 0x477318 GetCurrentProcessId
• 0x47731c GetCPInfo
• 0x477320 GetACP
• 0x477324 FreeResource
• 0x477328 InterlockedExchange
• 0x47732c FreeLibrary
• 0x477330 FormatMessageA
• 0x477334 FindResourceA
• 0x477338 FindFirstFileA
• 0x47733c FindClose
• 0x477348 ExitThread
• 0x47734c EnumCalendarInfoA
• 0x477358 CreateThread
• 0x47735c CreateFileA
• 0x477360 CreateEventA
• 0x477364 CompareStringA
• 0x477368 CloseHandle
Library version.dll:
• 0x477370 VerQueryValueA
• 0x477378 GetFileVersionInfoA
Library gdi32.dll:
• 0x477380 UnrealizeObject
• 0x477384 StretchBlt
• 0x477388 SetWindowOrgEx
• 0x47738c SetWinMetaFileBits
• 0x477390 SetViewportOrgEx
• 0x477394 SetTextColor
• 0x477398 SetStretchBltMode
• 0x47739c SetROP2
• 0x4773a0 SetPixel
• 0x4773a4 SetEnhMetaFileBits
• 0x4773a8 SetDIBColorTable
• 0x4773ac SetBrushOrgEx
• 0x4773b0 SetBkMode
• 0x4773b4 SetBkColor
• 0x4773b8 SelectPalette
• 0x4773bc SelectObject
• 0x4773c0 SaveDC
• 0x4773c4 RestoreDC
• 0x4773c8 Rectangle
• 0x4773cc RectVisible
• 0x4773d0 RealizePalette
• 0x4773d4 Polyline
• 0x4773d8 PlayEnhMetaFile
• 0x4773dc PatBlt
• 0x4773e0 MoveToEx
• 0x4773e4 MaskBlt
• 0x4773e8 LineTo
• 0x4773ec IntersectClipRect
• 0x4773f0 GetWindowOrgEx
• 0x4773f4 GetWinMetaFileBits
• 0x4773f8 GetTextMetricsA
• 0x477404 GetStockObject
• 0x477408 GetPixel
• 0x47740c GetPaletteEntries
• 0x477410 GetObjectA
• 0x47741c GetEnhMetaFileBits
• 0x477420 GetDeviceCaps
• 0x477424 GetDIBits
• 0x477428 GetDIBColorTable
• 0x47742c GetDCOrgEx
• 0x477434 GetClipBox
• 0x477438 GetBrushOrgEx
• 0x47743c GetBitmapBits
• 0x477440 ExcludeClipRect
• 0x477444 DeleteObject
• 0x477448 DeleteEnhMetaFile
• 0x47744c DeleteDC
• 0x477450 CreateSolidBrush
• 0x477454 CreatePenIndirect
• 0x477458 CreatePalette
• 0x477460 CreateFontIndirectA
• 0x477464 CreateDIBitmap
• 0x477468 CreateDIBSection
• 0x47746c CreateCompatibleDC
• 0x477474 CreateBrushIndirect
• 0x477478 CreateBitmap
• 0x47747c CopyEnhMetaFileA
• 0x477480 BitBlt
Library user32.dll:
• 0x477488 CreateWindowExA
• 0x47748c WindowFromPoint
• 0x477490 WinHelpA
• 0x477494 WaitMessage
• 0x477498 UpdateWindow
• 0x47749c UnregisterClassA
• 0x4774a0 UnhookWindowsHookEx
• 0x4774a4 TranslateMessage
• 0x4774ac TrackPopupMenu
• 0x4774b4 ShowWindow
• 0x4774b8 ShowScrollBar
• 0x4774bc ShowOwnedPopups
• 0x4774c0 ShowCursor
• 0x4774c4 SetWindowsHookExA
• 0x4774c8 SetWindowTextA
• 0x4774cc SetWindowPos
• 0x4774d0 SetWindowPlacement
• 0x4774d4 SetWindowLongA
• 0x4774d8 SetTimer
• 0x4774dc SetScrollRange
• 0x4774e0 SetScrollPos
• 0x4774e4 SetScrollInfo
• 0x4774e8 SetRect
• 0x4774ec SetPropA
• 0x4774f0 SetParent
• 0x4774f4 SetMenuItemInfoA
• 0x4774f8 SetMenu
• 0x4774fc SetForegroundWindow
• 0x477500 SetFocus
• 0x477504 SetCursor
• 0x477508 SetClassLongA
• 0x47750c SetCapture
• 0x477510 SetActiveWindow
• 0x477514 SendMessageA
• 0x477518 ScrollWindow
• 0x47751c ScreenToClient
• 0x477520 RemovePropA
• 0x477524 RemoveMenu
• 0x477528 ReleaseDC
• 0x47752c ReleaseCapture
• 0x477538 RegisterClassA
• 0x47753c RedrawWindow
• 0x477540 PtInRect
• 0x477544 PostQuitMessage
• 0x477548 PostMessageA
• 0x47754c PeekMessageA
• 0x477550 OffsetRect
• 0x477554 OemToCharA
• 0x477558 MessageBoxA
• 0x47755c MapWindowPoints
• 0x477560 MapVirtualKeyA
• 0x477564 LoadStringA
• 0x477568 LoadKeyboardLayoutA
• 0x47756c LoadIconA
• 0x477570 LoadCursorA
• 0x477574 LoadBitmapA
• 0x477578 KillTimer
• 0x47757c IsZoomed
• 0x477580 IsWindowVisible
• 0x477584 IsWindowEnabled
• 0x477588 IsWindow
• 0x47758c IsRectEmpty
• 0x477590 IsIconic
• 0x477594 IsDialogMessageA
• 0x477598 IsChild
• 0x47759c InvalidateRect
• 0x4775a0 IntersectRect
• 0x4775a4 InsertMenuItemA
• 0x4775a8 InsertMenuA
• 0x4775ac InflateRect
• 0x4775b4 GetWindowTextA
• 0x4775b8 GetWindowRect
• 0x4775bc GetWindowPlacement
• 0x4775c0 GetWindowLongA
• 0x4775c4 GetWindowDC
• 0x4775c8 GetTopWindow
• 0x4775cc GetSystemMetrics
• 0x4775d0 GetSystemMenu
• 0x4775d4 GetSysColorBrush
• 0x4775d8 GetSysColor
• 0x4775dc GetSubMenu
• 0x4775e0 GetScrollRange
• 0x4775e4 GetScrollPos
• 0x4775e8 GetScrollInfo
• 0x4775ec GetPropA
• 0x4775f0 GetParent
• 0x4775f4 GetWindow
• 0x4775f8 GetMenuStringA
• 0x4775fc GetMenuState
• 0x477600 GetMenuItemInfoA
• 0x477604 GetMenuItemID
• 0x477608 GetMenuItemCount
• 0x47760c GetMenu
• 0x477610 GetLastActivePopup
• 0x477614 GetKeyboardState
• 0x47761c GetKeyboardLayout
• 0x477620 GetKeyState
• 0x477624 GetKeyNameTextA
• 0x477628 GetIconInfo
• 0x47762c GetForegroundWindow
• 0x477630 GetFocus
• 0x477634 GetDlgItem
• 0x477638 GetDesktopWindow
• 0x47763c GetDCEx
• 0x477640 GetDC
• 0x477644 GetCursorPos
• 0x477648 GetCursor
• 0x47764c GetClipboardData
• 0x477650 GetClientRect
• 0x477654 GetClassNameA
• 0x477658 GetClassInfoA
• 0x47765c GetCapture
• 0x477660 GetActiveWindow
• 0x477664 FrameRect
• 0x477668 FindWindowA
• 0x47766c FillRect
• 0x477670 EqualRect
• 0x477674 EnumWindows
• 0x477678 EnumThreadWindows
• 0x47767c EndPaint
• 0x477680 EnableWindow
• 0x477684 EnableScrollBar
• 0x477688 EnableMenuItem
• 0x47768c DrawTextA
• 0x477690 DrawMenuBar
• 0x477694 DrawIconEx
• 0x477698 DrawIcon
• 0x47769c DrawFrameControl
• 0x4776a0 DrawFocusRect
• 0x4776a4 DrawEdge
• 0x4776a8 DispatchMessageA
• 0x4776ac DestroyWindow
• 0x4776b0 DestroyMenu
• 0x4776b4 DestroyIcon
• 0x4776b8 DestroyCursor
• 0x4776bc DeleteMenu
• 0x4776c0 DefWindowProcA
• 0x4776c4 DefMDIChildProcA
• 0x4776c8 DefFrameProcA
• 0x4776cc CreatePopupMenu
• 0x4776d0 CreateMenu
• 0x4776d4 CreateIcon
• 0x4776d8 ClientToScreen
• 0x4776dc CheckMenuItem
• 0x4776e0 CallWindowProcA
• 0x4776e4 CallNextHookEx
• 0x4776e8 BeginPaint
• 0x4776ec CharNextA
• 0x4776f0 CharLowerBuffA
• 0x4776f4 CharLowerA
• 0x4776f8 CharUpperBuffA
• 0x4776fc CharToOemA
• 0x477700 AdjustWindowRectEx
Library kernel32.dll:
• 0x47770c Sleep
Library oleaut32.dll:
• 0x477714 SafeArrayPtrOfIndex
• 0x477718 SafeArrayPutElement
• 0x47771c SafeArrayGetElement
• 0x477724 SafeArrayAccessData
• 0x477728 SafeArrayGetUBound
• 0x47772c SafeArrayGetLBound
• 0x477730 SafeArrayCreate
• 0x477734 VariantChangeType
• 0x477738 VariantCopyInd
• 0x47773c VariantCopy
• 0x477740 VariantClear
• 0x477744 VariantInit
Library ole32.dll:
• 0x47774c CoUninitialize
• 0x477750 CoInitialize
• 0x477754 IsEqualGUID
Library oleaut32.dll:
• 0x47775c CreateErrorInfo
• 0x477760 GetErrorInfo
• 0x477764 SetErrorInfo
• 0x477768 SysFreeString
Library comctl32.dll:
• 0x477778 ImageList_Write
• 0x47777c ImageList_Read
• 0x47778c ImageList_DragMove
• 0x477790 ImageList_DragLeave
• 0x477794 ImageList_DragEnter
• 0x477798 ImageList_EndDrag
• 0x47779c ImageList_BeginDrag
• 0x4777a0 ImageList_Remove
• 0x4777a4 ImageList_DrawEx
• 0x4777a8 ImageList_Replace
• 0x4777ac ImageList_Draw
• 0x4777bc ImageList_Add
• 0x4777c4 ImageList_Destroy
• 0x4777c8 ImageList_Create
Library comdlg32.dll:
• 0x4777d0 GetOpenFileNameA
Library winmm.dll:
• 0x4777d8 mciSendCommandA
• 0x4777dc mciGetErrorStringA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 51809 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.