11.0
0-day
56 个模型检测该样本为恶意！
重新分析
更多

f7df41bb2f648ae746c4663406c0422d1e1cc3668915b127fd7da2b81794f377

5a93bf319a3a7b471bc75fb02a82118a.exe

分析耗时

107s

最近分析

文件大小

917.0KB
静态报毒 动态报毒 0DPIWQ 100% 5GW@AWCCMXPI AI SCORE=84 AIDETECTVM ALI2000015 BCNIH CLASSIC CONFIDENCE DATASTEALER DELF DELFINJECT DELPHILESS EMTN EMVB FAREIT HIGH CONFIDENCE HPVIUA HQRZ KCLOUD KRYPTIK MALWARE2 MALWARE@#2MVP2TJLUD8UL NANOCORE SCORE SXYH TSCOPE UBLH UNSAFE X2094 ZELPHIF ZUSY 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Avast Win32:Malware-gen 20201210 21.1.5827.0
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Kingsoft Win32.Troj.Undef.(kcloud) 20201211 2017.9.26.565
McAfee Fareit-FPQ!5A93BF319A3A 20201211 6.0.6.653
Tencent Win32.Trojan.Kryptik.Sxyh 20201211 1.0.0.1
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (13 个事件)
Time & API Arguments Status Return Repeated
1619535803.87375
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
mssfsfself+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75114b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75115d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdc0148d
success 0 0
1619535812.342875
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
mssfsfself+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdb8148d
success 0 0
1619535816.8265
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
mssfsfself+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75124b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75125d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff52148d
success 0 0
1619535822.702125
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
mssfsfself+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdea148d
success 0 0
1619535828.73325
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
mssfsfself+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75124b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75125d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff60148d
success 0 0
1619535833.998502
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
mssfsfself+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdbc148d
success 0 0
1619535839.84275
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
mssfsfself+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75124b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75125d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff60148d
success 0 0
1619535844.623625
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
mssfsfself+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdbb148d
success 0 0
1619535849.32725
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
mssfsfself+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x751c4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x751c5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff4b148d
success 0 0
1619535855.124
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
mssfsfself+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75124b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75125d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff33148d
success 0 0
1619535859.295875
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
mssfsfself+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x751c4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x751c5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff35148d
success 0 0
1619535863.76425
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
mssfsfself+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x751c4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x751c5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfd89148d
success 0 0
1619535870.3265
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
mssfsfself+0xa23f8 @ 0x4a23f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x751c4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x751c5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff57148d
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (50 out of 406 个事件)
Time & API Arguments Status Return Repeated
1619513305.9714
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003f0000
success 0 0
1619513306.1434
NtAllocateVirtualMemory
process_identifier: 472
region_size: 69632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00510000
success 0 0
1619513306.1434
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00540000
success 0 0
1619535802.452125
NtAllocateVirtualMemory
process_identifier: 192
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003f0000
success 0 0
1619535802.483125
NtAllocateVirtualMemory
process_identifier: 192
region_size: 69632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00510000
success 0 0
1619535802.483125
NtAllocateVirtualMemory
process_identifier: 192
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00540000
success 0 0
1619535803.46775
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619535803.48275
NtAllocateVirtualMemory
process_identifier: 368
region_size: 2162688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01fe0000
success 0 0
1619535803.48275
NtAllocateVirtualMemory
process_identifier: 368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x021b0000
success 0 0
1619535803.48275
NtAllocateVirtualMemory
process_identifier: 368
region_size: 630784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f10000
success 0 0
1619535803.48275
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 602112
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f12000
success 0 0
1619535803.85775
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x006a2000
success 0 0
1619535803.85775
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619535803.85775
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x006a2000
success 0 0
1619535803.85775
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619535803.85775
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x006a2000
success 0 0
1619535803.85775
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619535803.85775
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x006a2000
success 0 0
1619535803.85775
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619535803.85775
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x006a2000
success 0 0
1619535803.85775
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619535803.85775
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x006a2000
success 0 0
1619535803.85775
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619535803.85775
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x006a2000
success 0 0
1619535803.85775
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619535803.85775
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x006a2000
success 0 0
1619535803.85775
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619535803.85775
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x006a2000
success 0 0
1619535803.85775
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619535803.85775
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x006a2000
success 0 0
1619535803.85775
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619535803.857375
NtAllocateVirtualMemory
process_identifier: 2988
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003f0000
success 0 0
1619535803.873375
NtAllocateVirtualMemory
process_identifier: 2988
region_size: 69632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00610000
success 0 0
1619535803.873375
NtAllocateVirtualMemory
process_identifier: 2988
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00640000
success 0 0
1619535810.48275
NtAllocateVirtualMemory
process_identifier: 3144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003d0000
success 0 0
1619535810.52975
NtAllocateVirtualMemory
process_identifier: 3144
region_size: 69632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00890000
success 0 0
1619535810.54575
NtAllocateVirtualMemory
process_identifier: 3144
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x008b0000
success 0 0
1619535812.154875
NtProtectVirtualMemory
process_identifier: 3212
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619535812.154875
NtAllocateVirtualMemory
process_identifier: 3212
region_size: 2097152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01ff0000
success 0 0
1619535812.154875
NtAllocateVirtualMemory
process_identifier: 3212
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x021b0000
success 0 0
1619535812.154875
NtAllocateVirtualMemory
process_identifier: 3212
region_size: 630784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01ff0000
success 0 0
1619535812.170875
NtProtectVirtualMemory
process_identifier: 3212
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 602112
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ff2000
success 0 0
1619535812.279875
NtProtectVirtualMemory
process_identifier: 3212
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00622000
success 0 0
1619535812.279875
NtProtectVirtualMemory
process_identifier: 3212
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619535812.279875
NtProtectVirtualMemory
process_identifier: 3212
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00622000
success 0 0
1619535812.279875
NtProtectVirtualMemory
process_identifier: 3212
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619535812.279875
NtProtectVirtualMemory
process_identifier: 3212
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00622000
success 0 0
1619535812.279875
NtProtectVirtualMemory
process_identifier: 3212
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619535812.279875
NtProtectVirtualMemory
process_identifier: 3212
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00622000
success 0 0
1619535812.279875
NtProtectVirtualMemory
process_identifier: 3212
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\web.vbs
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (45 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.694671858371902 section {'size_of_data': '0x0006f400', 'virtual_address': '0x0007b000', 'entropy': 7.694671858371902, 'name': '.rsrc', 'virtual_size': '0x0006f28c'} description A section with a high entropy has been found
entropy 0.48580786026200873 description Overall entropy of this PE file is high
Expresses interest in specific running processes (1 个事件)
process mssfsfself.exe
Repeatedly searches for a not-found process, you may want to run a web browser during analysis (39 个事件)
Time & API Arguments Status Return Repeated
1619513306.1434
Process32NextW
process_name: 5a93bf319a3a7b471bc75fb02a82118a.exe
snapshot_handle: 0x000000f4
process_identifier: 472
failed 0 0
1619535802.483125
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 2240
failed 0 0
1619535803.888375
Process32NextW
process_name: is32bit.exe
snapshot_handle: 0x000000f4
process_identifier: 3096
failed 0 0
1619535809.967375
Process32NextW
process_name: mssfsfself.exe
snapshot_handle: 0x0000018c
process_identifier: 2988
failed 0 0
1619535810.57675
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3200
failed 0 0
1619535812.81075
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3372
failed 0 0
1619535814.15475
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000118
process_identifier: 3372
failed 0 0
1619535815.310375
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3440
failed 0 0
1619535817.982625
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3612
failed 0 0
1619535819.545625
Process32NextW
process_name: mssfsfself.exe
snapshot_handle: 0x0000011c
process_identifier: 3520
failed 0 0
1619535820.748875
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3688
failed 0 0
1619535823.279375
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3836
failed 0 0
1619535825.217375
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x0000012c
process_identifier: 3860
failed 0 0
1619535826.03
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3932
failed 0 0
1619535829.498625
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 4088
failed 0 0
1619535831.092625
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000118
process_identifier: 3104
failed 0 0
1619535832.202125
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 624
failed 0 0
1619535835.092502
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3376
failed 0 0
1619535836.795502
Process32NextW
process_name: dllhost.exe
snapshot_handle: 0x0000011c
process_identifier: 3432
failed 0 0
1619535838.499
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3584
failed 0 0
1619535840.576502
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 2796
failed 0 0
1619535842.295502
Process32NextW
process_name: mssfsfself.exe
snapshot_handle: 0x00000114
process_identifier: 3648
failed 0 0
1619535843.482375
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 1124
failed 0 0
1619535844.936125
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 4036
failed 0 0
1619535847.358125
Process32NextW
process_name: mssfsfself.exe
snapshot_handle: 0x00000134
process_identifier: 2412
failed 0 0
1619535848.076502
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3116
failed 0 0
1619535850.029875
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3068
failed 0 0
1619535850.935875
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x00000110
process_identifier: 3352
failed 0 0
1619535852.763875
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 2632
failed 0 0
1619535855.310375
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 1740
failed 0 0
1619535857.420375
Process32NextW
process_name: mssfsfself.exe
snapshot_handle: 0x00000128
process_identifier: 3712
failed 0 0
1619535858.107375
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3840
failed 0 0
1619535859.88875
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 1888
failed 0 0
1619535861.77975
Process32NextW
process_name: mscorsvw.exe
snapshot_handle: 0x00000124
process_identifier: 1056
failed 0 0
1619535862.263875
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 1932
failed 0 0
1619535864.513375
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 3616
failed 0 0
1619535865.951375
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x0000011c
process_identifier: 3992
failed 0 0
1619535867.280125
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 772
failed 0 0
1619535872.3735
Process32NextW
process_name: inject-x86.exe
snapshot_handle: 0x000000f4
process_identifier: 2168
failed 0 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Creates an Alternate Data Stream (ADS) (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\mssfsfself.exe:ZoneIdentifier
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619513306.6434
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000000fc
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000f0000
success 0 0
Installs itself for autorun at Windows startup (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\web.vbs
Deletes executed files from disk (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\mssfsfself.exe
Creates a thread using NtQueueApcThread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 472 created a thread in remote process 2200
Time & API Arguments Status Return Repeated
1619513306.6434
NtQueueApcThread
thread_handle: 0x00000104
process_identifier: 2200
function_address: 0x000f05c0
parameter: 0x00100000
success 0 0
Potential code injection by writing to the memory of another process (2 个事件)
Time & API Arguments Status Return Repeated
1619513306.6434
WriteProcessMemory
process_identifier: 2200
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x000000fc
base_address: 0x000f0000
success 1 0
1619513306.6434
WriteProcessMemory
process_identifier: 2200
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5a93bf319a3a7b471bc75fb02a82118a.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\mssfsfself.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5a93bf319a3a7b471bc75fb02a82118a.exe" webset FCX = cReaTeobject("WscRiPt.ShelL") FCx.RUn """%ls""", 0, False
process_handle: 0x000000fc
base_address: 0x00100000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (26 个事件)
Process injection Process 192 called NtSetContextThread to modify thread in remote process 368
Process injection Process 3144 called NtSetContextThread to modify thread in remote process 3212
Process injection Process 3384 called NtSetContextThread to modify thread in remote process 3452
Process injection Process 3632 called NtSetContextThread to modify thread in remote process 3700
Process injection Process 3868 called NtSetContextThread to modify thread in remote process 3944
Process injection Process 2668 called NtSetContextThread to modify thread in remote process 708
Process injection Process 3132 called NtSetContextThread to modify thread in remote process 3592
Process injection Process 2548 called NtSetContextThread to modify thread in remote process 3844
Process injection Process 3856 called NtSetContextThread to modify thread in remote process 1880
Process injection Process 2188 called NtSetContextThread to modify thread in remote process 2956
Process injection Process 1036 called NtSetContextThread to modify thread in remote process 3972
Process injection Process 2544 called NtSetContextThread to modify thread in remote process 3480
Process injection Process 4032 called NtSetContextThread to modify thread in remote process 580
Time & API Arguments Status Return Repeated
1619535802.655125
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502784
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 368
success 0 0
1619535810.99875
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502784
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3212
success 0 0
1619535815.560375
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502784
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3452
success 0 0
1619535821.513875
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502784
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3700
success 0 0
1619535827.218
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502784
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3944
success 0 0
1619535832.749125
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502784
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 708
success 0 0
1619535838.764
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502784
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3592
success 0 0
1619535843.779375
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502784
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3844
success 0 0
1619535848.295502
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502784
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1880
success 0 0
1619535853.951875
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502784
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2956
success 0 0
1619535858.295375
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502784
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3972
success 0 0
1619535862.607875
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502784
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3480
success 0 0
1619535868.749125
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502784
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 580
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (26 个事件)
Process injection Process 192 resumed a thread in remote process 368
Process injection Process 3144 resumed a thread in remote process 3212
Process injection Process 3384 resumed a thread in remote process 3452
Process injection Process 3632 resumed a thread in remote process 3700
Process injection Process 3868 resumed a thread in remote process 3944
Process injection Process 2668 resumed a thread in remote process 708
Process injection Process 3132 resumed a thread in remote process 3592
Process injection Process 2548 resumed a thread in remote process 3844
Process injection Process 3856 resumed a thread in remote process 1880
Process injection Process 2188 resumed a thread in remote process 2956
Process injection Process 1036 resumed a thread in remote process 3972
Process injection Process 2544 resumed a thread in remote process 3480
Process injection Process 4032 resumed a thread in remote process 580
Time & API Arguments Status Return Repeated
1619535803.171125
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 368
success 0 0
1619535811.90475
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3212
success 0 0
1619535816.310375
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3452
success 0 0
1619535821.998875
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3700
success 0 0
1619535828.218
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3944
success 0 0
1619535833.405125
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 708
success 0 0
1619535839.436
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3592
success 0 0
1619535844.045375
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3844
success 0 0
1619535848.763502
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 1880
success 0 0
1619535854.623875
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 2956
success 0 0
1619535858.638375
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3972
success 0 0
1619535862.935875
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3480
success 0 0
1619535870.077125
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 580
success 0 0
Executed a process and injected code into it, probably while unpacking (50 out of 109 个事件)
Time & API Arguments Status Return Repeated
1619513306.6434
CreateProcessInternalW
thread_identifier: 2760
thread_handle: 0x00000104
process_identifier: 2200
current_directory:
filepath: C:\Windows\System32\notepad.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\notepad.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619513306.6434
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x000000fc
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000f0000
success 0 0
1619513306.6434
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
process_handle: 0x000000fc
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00100000
success 0 0
1619513306.6434
WriteProcessMemory
process_identifier: 2200
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x000000fc
base_address: 0x000f0000
success 1 0
1619513306.6434
WriteProcessMemory
process_identifier: 2200
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5a93bf319a3a7b471bc75fb02a82118a.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\mssfsfself.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\5a93bf319a3a7b471bc75fb02a82118a.exe" webset FCX = cReaTeobject("WscRiPt.ShelL") FCx.RUn """%ls""", 0, False
process_handle: 0x000000fc
base_address: 0x00100000
success 1 0
1619535802.21775
CreateProcessInternalW
thread_identifier: 2264
thread_handle: 0x000000d0
process_identifier: 192
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\mssfsfself.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\mssfsfself.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000000cc
inherit_handles: 0
success 1 0
1619535802.593125
CreateProcessInternalW
thread_identifier: 428
thread_handle: 0x00000104
process_identifier: 368
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\mssfsfself.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619535802.593125
NtUnmapViewOfSection
process_identifier: 368
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1619535802.608125
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 368
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619535802.655125
NtGetContextThread
thread_handle: 0x00000104
success 0 0
1619535802.655125
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502784
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 368
success 0 0
1619535803.171125
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 368
success 0 0
1619535803.499125
CreateProcessInternalW
thread_identifier: 2252
thread_handle: 0x00000108
process_identifier: 2988
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\mssfsfself.exe" 2 368 21689203
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619535810.248375
CreateProcessInternalW
thread_identifier: 3148
thread_handle: 0x00000190
process_identifier: 3144
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\mssfsfself.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\mssfsfself.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000194
inherit_handles: 0
success 1 0
1619535810.87375
CreateProcessInternalW
thread_identifier: 3216
thread_handle: 0x00000104
process_identifier: 3212
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\mssfsfself.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619535810.87375
NtUnmapViewOfSection
process_identifier: 3212
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1619535810.90475
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 3212
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619535810.98275
NtGetContextThread
thread_handle: 0x00000104
success 0 0
1619535810.99875
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502784
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3212
success 0 0
1619535811.90475
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3212
success 0 0
1619535812.35775
CreateProcessInternalW
thread_identifier: 3280
thread_handle: 0x00000108
process_identifier: 3276
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\mssfsfself.exe" 2 3212 21697937
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619535814.48275
CreateProcessInternalW
thread_identifier: 3388
thread_handle: 0x0000011c
process_identifier: 3384
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\mssfsfself.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\mssfsfself.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000120
inherit_handles: 0
success 1 0
1619535815.467375
CreateProcessInternalW
thread_identifier: 3456
thread_handle: 0x00000104
process_identifier: 3452
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\mssfsfself.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619535815.467375
NtUnmapViewOfSection
process_identifier: 3452
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1619535815.498375
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 3452
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619535815.545375
NtGetContextThread
thread_handle: 0x00000104
success 0 0
1619535815.560375
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502784
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3452
success 0 0
1619535816.310375
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3452
success 0 0
1619535817.185375
CreateProcessInternalW
thread_identifier: 3524
thread_handle: 0x00000108
process_identifier: 3520
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\mssfsfself.exe" 2 3452 21702343
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619535820.326625
CreateProcessInternalW
thread_identifier: 3636
thread_handle: 0x00000120
process_identifier: 3632
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\mssfsfself.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\mssfsfself.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000124
inherit_handles: 0
success 1 0
1619535821.420875
CreateProcessInternalW
thread_identifier: 3704
thread_handle: 0x00000104
process_identifier: 3700
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\mssfsfself.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619535821.420875
NtUnmapViewOfSection
process_identifier: 3700
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1619535821.435875
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 3700
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619535821.513875
NtGetContextThread
thread_handle: 0x00000104
success 0 0
1619535821.513875
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502784
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3700
success 0 0
1619535821.998875
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3700
success 0 0
1619535822.873875
CreateProcessInternalW
thread_identifier: 3772
thread_handle: 0x00000108
process_identifier: 3768
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\mssfsfself.exe" 2 3700 21708031
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619535825.467375
CreateProcessInternalW
thread_identifier: 3872
thread_handle: 0x00000130
process_identifier: 3868
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\mssfsfself.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\mssfsfself.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000134
inherit_handles: 0
success 1 0
1619535826.968
CreateProcessInternalW
thread_identifier: 3948
thread_handle: 0x00000104
process_identifier: 3944
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\mssfsfself.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619535826.968
NtUnmapViewOfSection
process_identifier: 3944
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1619535826.983
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 3944
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619535827.218
NtGetContextThread
thread_handle: 0x00000104
success 0 0
1619535827.218
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5502784
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3944
success 0 0
1619535828.218
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 3944
success 0 0
1619535828.764
CreateProcessInternalW
thread_identifier: 4024
thread_handle: 0x00000108
process_identifier: 4020
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\mssfsfself.exe" 2 3944 21714250
filepath_r:
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619535831.404625
CreateProcessInternalW
thread_identifier: 2632
thread_handle: 0x0000011c
process_identifier: 2668
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\mssfsfself.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\mssfsfself.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000120
inherit_handles: 0
success 1 0
1619535832.593125
CreateProcessInternalW
thread_identifier: 2008
thread_handle: 0x00000104
process_identifier: 708
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\appdata\mssfsfself.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619535832.593125
NtUnmapViewOfSection
process_identifier: 708
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1619535832.608125
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 708
commit_size: 1314816
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 1314816
base_address: 0x00400000
success 0 0
1619535832.733125
NtGetContextThread
thread_handle: 0x00000104
success 0 0
File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
DrWeb Trojan.PWS.Stealer.29016
MicroWorld-eScan Gen:Variant.Zusy.310254
FireEye Generic.mg.5a93bf319a3a7b47
ALYac Gen:Variant.Zusy.310254
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
AegisLab Trojan.Multi.Generic.4!c
Sangfor Malware
K7AntiVirus Trojan ( 0056e07d1 )
BitDefender Gen:Variant.Zusy.310254
K7GW Trojan ( 0056e07d1 )
Cybereason malicious.9e7600
BitDefenderTheta Gen:NN.ZelphiF.34670.5GW@aWcCMxpi
Cyren W32/Trojan.UBLH-5467
Symantec Trojan.Gen.2
APEX Malicious
Avast Win32:Malware-gen
ClamAV Win.Dropper.Nanocore-9171472-0
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
Alibaba Trojan:Win32/DelfInject.ali2000015
NANO-Antivirus Trojan.Win32.Kryptik.hpviua
Rising Trojan.Injector!1.C99D (CLASSIC)
Ad-Aware Gen:Variant.Zusy.310254
Sophos Mal/Generic-S
Comodo Malware@#2mvp2tjlud8ul
F-Secure Trojan.TR/Injector.bcnih
Zillya Trojan.Injector.Win32.755343
McAfee-GW-Edition BehavesLike.Win32.Fareit.dc
Emsisoft Gen:Variant.Zusy.310254 (B)
Avira TR/Injector.bcnih
Antiy-AVL Trojan/Win32.Kryptik
Kingsoft Win32.Troj.Undef.(kcloud)
Microsoft Trojan:Win32/DataStealer.VD!MTB
Gridinsoft Trojan.Win32.Kryptik.oa
Arcabit Trojan.Zusy.D4BBEE
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
GData Gen:Variant.Zusy.310254
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2094
Acronis suspicious
McAfee Fareit-FPQ!5A93BF319A3A
MAX malware (ai score=84)
VBA32 TScope.Trojan.Delf
Malwarebytes Trojan.MalPack.DLF
Panda Trj/CI.A
ESET-NOD32 a variant of Win32/Injector.EMVB
Tencent Win32.Trojan.Kryptik.Sxyh
Yandex Trojan.Injector!hqrz/0dPiwQ
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x46f13c VirtualFree
• 0x46f140 VirtualAlloc
• 0x46f144 LocalFree
• 0x46f148 LocalAlloc
• 0x46f14c GetVersion
• 0x46f150 GetCurrentThreadId
• 0x46f15c VirtualQuery
• 0x46f160 WideCharToMultiByte
• 0x46f164 MultiByteToWideChar
• 0x46f168 lstrlenA
• 0x46f16c lstrcpynA
• 0x46f170 LoadLibraryExA
• 0x46f174 GetThreadLocale
• 0x46f178 GetStartupInfoA
• 0x46f17c GetProcAddress
• 0x46f180 GetModuleHandleA
• 0x46f184 GetModuleFileNameA
• 0x46f188 GetLocaleInfoA
• 0x46f18c GetCommandLineA
• 0x46f190 FreeLibrary
• 0x46f194 FindFirstFileA
• 0x46f198 FindClose
• 0x46f19c ExitProcess
• 0x46f1a0 WriteFile
• 0x46f1a8 RtlUnwind
• 0x46f1ac RaiseException
• 0x46f1b0 GetStdHandle
Library user32.dll:
• 0x46f1b8 GetKeyboardType
• 0x46f1bc LoadStringA
• 0x46f1c0 MessageBoxA
• 0x46f1c4 CharNextA
Library advapi32.dll:
• 0x46f1cc RegQueryValueExA
• 0x46f1d0 RegOpenKeyExA
• 0x46f1d4 RegCloseKey
Library oleaut32.dll:
• 0x46f1dc SysFreeString
• 0x46f1e0 SysReAllocStringLen
• 0x46f1e4 SysAllocStringLen
Library kernel32.dll:
• 0x46f1ec TlsSetValue
• 0x46f1f0 TlsGetValue
• 0x46f1f4 LocalAlloc
• 0x46f1f8 GetModuleHandleA
Library advapi32.dll:
• 0x46f200 RegQueryValueExA
• 0x46f204 RegOpenKeyExA
• 0x46f208 RegCloseKey
Library kernel32.dll:
• 0x46f210 lstrcpyA
• 0x46f214 WriteFile
• 0x46f218 WaitForSingleObject
• 0x46f21c VirtualQuery
• 0x46f220 VirtualAlloc
• 0x46f224 Sleep
• 0x46f228 SizeofResource
• 0x46f22c SetThreadLocale
• 0x46f230 SetFilePointer
• 0x46f234 SetEvent
• 0x46f238 SetErrorMode
• 0x46f23c SetEndOfFile
• 0x46f240 ResetEvent
• 0x46f244 ReadFile
• 0x46f248 MulDiv
• 0x46f24c LockResource
• 0x46f250 LoadResource
• 0x46f254 LoadLibraryA
• 0x46f260 GlobalUnlock
• 0x46f264 GlobalReAlloc
• 0x46f268 GlobalHandle
• 0x46f26c GlobalLock
• 0x46f270 GlobalFree
• 0x46f274 GlobalFindAtomA
• 0x46f278 GlobalDeleteAtom
• 0x46f27c GlobalAlloc
• 0x46f280 GlobalAddAtomA
• 0x46f284 GetVersionExA
• 0x46f288 GetVersion
• 0x46f28c GetTickCount
• 0x46f290 GetThreadLocale
• 0x46f294 GetSystemInfo
• 0x46f298 GetStringTypeExA
• 0x46f29c GetStdHandle
• 0x46f2a0 GetProcAddress
• 0x46f2a4 GetModuleHandleA
• 0x46f2a8 GetModuleFileNameA
• 0x46f2ac GetLocaleInfoA
• 0x46f2b0 GetLocalTime
• 0x46f2b4 GetLastError
• 0x46f2b8 GetFullPathNameA
• 0x46f2bc GetDiskFreeSpaceA
• 0x46f2c0 GetDateFormatA
• 0x46f2c4 GetCurrentThreadId
• 0x46f2c8 GetCurrentProcessId
• 0x46f2cc GetCPInfo
• 0x46f2d0 GetACP
• 0x46f2d4 FreeResource
• 0x46f2d8 InterlockedExchange
• 0x46f2dc FreeLibrary
• 0x46f2e0 FormatMessageA
• 0x46f2e4 FindResourceA
• 0x46f2e8 EnumCalendarInfoA
• 0x46f2f4 CreateThread
• 0x46f2f8 CreateFileA
• 0x46f2fc CreateEventA
• 0x46f300 CompareStringA
• 0x46f304 CloseHandle
Library version.dll:
• 0x46f30c VerQueryValueA
• 0x46f314 GetFileVersionInfoA
Library gdi32.dll:
• 0x46f31c UnrealizeObject
• 0x46f320 StretchBlt
• 0x46f324 SetWindowOrgEx
• 0x46f328 SetWinMetaFileBits
• 0x46f32c SetViewportOrgEx
• 0x46f330 SetTextColor
• 0x46f334 SetStretchBltMode
• 0x46f338 SetROP2
• 0x46f33c SetPixel
• 0x46f340 SetEnhMetaFileBits
• 0x46f344 SetDIBColorTable
• 0x46f348 SetBrushOrgEx
• 0x46f34c SetBkMode
• 0x46f350 SetBkColor
• 0x46f354 SelectPalette
• 0x46f358 SelectObject
• 0x46f35c SaveDC
• 0x46f360 RestoreDC
• 0x46f364 RectVisible
• 0x46f368 RealizePalette
• 0x46f36c Polyline
• 0x46f370 PlayEnhMetaFile
• 0x46f374 PatBlt
• 0x46f378 MoveToEx
• 0x46f37c MaskBlt
• 0x46f380 LineTo
• 0x46f384 IntersectClipRect
• 0x46f388 GetWindowOrgEx
• 0x46f38c GetWinMetaFileBits
• 0x46f390 GetTextMetricsA
• 0x46f39c GetStockObject
• 0x46f3a0 GetPixel
• 0x46f3a4 GetPaletteEntries
• 0x46f3a8 GetObjectA
• 0x46f3b4 GetEnhMetaFileBits
• 0x46f3b8 GetDeviceCaps
• 0x46f3bc GetDIBits
• 0x46f3c0 GetDIBColorTable
• 0x46f3c4 GetDCOrgEx
• 0x46f3cc GetClipBox
• 0x46f3d0 GetBrushOrgEx
• 0x46f3d4 GetBitmapBits
• 0x46f3d8 GetArcDirection
• 0x46f3dc ExtTextOutA
• 0x46f3e0 ExcludeClipRect
• 0x46f3e4 DeleteObject
• 0x46f3e8 DeleteEnhMetaFile
• 0x46f3ec DeleteDC
• 0x46f3f0 CreateSolidBrush
• 0x46f3f4 CreatePenIndirect
• 0x46f3f8 CreatePalette
• 0x46f400 CreateFontIndirectA
• 0x46f404 CreateDIBitmap
• 0x46f408 CreateDIBSection
• 0x46f40c CreateCompatibleDC
• 0x46f414 CreateBrushIndirect
• 0x46f418 CreateBitmap
• 0x46f41c CopyEnhMetaFileA
• 0x46f420 BitBlt
Library user32.dll:
• 0x46f428 CreateWindowExA
• 0x46f42c WindowFromPoint
• 0x46f430 WinHelpA
• 0x46f434 WaitMessage
• 0x46f438 UpdateWindow
• 0x46f43c UnregisterClassA
• 0x46f440 UnhookWindowsHookEx
• 0x46f444 TranslateMessage
• 0x46f44c TrackPopupMenu
• 0x46f454 ShowWindow
• 0x46f458 ShowScrollBar
• 0x46f45c ShowOwnedPopups
• 0x46f460 ShowCursor
• 0x46f464 SetWindowsHookExA
• 0x46f468 SetWindowPos
• 0x46f46c SetWindowPlacement
• 0x46f470 SetWindowLongA
• 0x46f474 SetTimer
• 0x46f478 SetScrollRange
• 0x46f47c SetScrollPos
• 0x46f480 SetScrollInfo
• 0x46f484 SetRect
• 0x46f488 SetPropA
• 0x46f48c SetParent
• 0x46f490 SetMenuItemInfoA
• 0x46f494 SetMenu
• 0x46f498 SetForegroundWindow
• 0x46f49c SetFocus
• 0x46f4a0 SetCursor
• 0x46f4a4 SetClassLongA
• 0x46f4a8 SetCapture
• 0x46f4ac SetActiveWindow
• 0x46f4b0 SendMessageA
• 0x46f4b4 ScrollWindow
• 0x46f4b8 ScreenToClient
• 0x46f4bc RemovePropA
• 0x46f4c0 RemoveMenu
• 0x46f4c4 ReleaseDC
• 0x46f4c8 ReleaseCapture
• 0x46f4d4 RegisterClassA
• 0x46f4d8 RedrawWindow
• 0x46f4dc PtInRect
• 0x46f4e0 PostQuitMessage
• 0x46f4e4 PostMessageA
• 0x46f4e8 PeekMessageA
• 0x46f4ec OffsetRect
• 0x46f4f0 OemToCharA
• 0x46f4f4 MessageBoxA
• 0x46f4f8 MapWindowPoints
• 0x46f4fc MapVirtualKeyA
• 0x46f500 LoadStringA
• 0x46f504 LoadKeyboardLayoutA
• 0x46f508 LoadIconA
• 0x46f50c LoadCursorA
• 0x46f510 LoadBitmapA
• 0x46f514 KillTimer
• 0x46f518 IsZoomed
• 0x46f51c IsWindowVisible
• 0x46f520 IsWindowEnabled
• 0x46f524 IsWindow
• 0x46f528 IsRectEmpty
• 0x46f52c IsIconic
• 0x46f530 IsDialogMessageA
• 0x46f534 IsChild
• 0x46f538 InvalidateRect
• 0x46f53c IntersectRect
• 0x46f540 InsertMenuItemA
• 0x46f544 InsertMenuA
• 0x46f548 InflateRect
• 0x46f550 GetWindowTextA
• 0x46f554 GetWindowRect
• 0x46f558 GetWindowPlacement
• 0x46f55c GetWindowLongA
• 0x46f560 GetWindowDC
• 0x46f564 GetTopWindow
• 0x46f568 GetSystemMetrics
• 0x46f56c GetSystemMenu
• 0x46f570 GetSysColorBrush
• 0x46f574 GetSysColor
• 0x46f578 GetSubMenu
• 0x46f57c GetScrollRange
• 0x46f580 GetScrollPos
• 0x46f584 GetScrollInfo
• 0x46f588 GetPropA
• 0x46f58c GetParent
• 0x46f590 GetWindow
• 0x46f594 GetMenuStringA
• 0x46f598 GetMenuState
• 0x46f59c GetMenuItemInfoA
• 0x46f5a0 GetMenuItemID
• 0x46f5a4 GetMenuItemCount
• 0x46f5a8 GetMenu
• 0x46f5ac GetLastActivePopup
• 0x46f5b0 GetKeyboardState
• 0x46f5b8 GetKeyboardLayout
• 0x46f5bc GetKeyState
• 0x46f5c0 GetKeyNameTextA
• 0x46f5c4 GetIconInfo
• 0x46f5c8 GetForegroundWindow
• 0x46f5cc GetFocus
• 0x46f5d0 GetDlgItem
• 0x46f5d4 GetDesktopWindow
• 0x46f5d8 GetDCEx
• 0x46f5dc GetDC
• 0x46f5e0 GetCursorPos
• 0x46f5e4 GetCursor
• 0x46f5e8 GetClipboardData
• 0x46f5ec GetClientRect
• 0x46f5f0 GetClassNameA
• 0x46f5f4 GetClassInfoA
• 0x46f5f8 GetCapture
• 0x46f5fc GetActiveWindow
• 0x46f600 FrameRect
• 0x46f604 FindWindowA
• 0x46f608 FillRect
• 0x46f60c EqualRect
• 0x46f610 EnumWindows
• 0x46f614 EnumThreadWindows
• 0x46f618 EndPaint
• 0x46f61c EnableWindow
• 0x46f620 EnableScrollBar
• 0x46f624 EnableMenuItem
• 0x46f628 DrawTextA
• 0x46f62c DrawMenuBar
• 0x46f630 DrawIconEx
• 0x46f634 DrawIcon
• 0x46f638 DrawFrameControl
• 0x46f63c DrawEdge
• 0x46f640 DispatchMessageA
• 0x46f644 DestroyWindow
• 0x46f648 DestroyMenu
• 0x46f64c DestroyIcon
• 0x46f650 DestroyCursor
• 0x46f654 DeleteMenu
• 0x46f658 DefWindowProcA
• 0x46f65c DefMDIChildProcA
• 0x46f660 DefFrameProcA
• 0x46f664 CreatePopupMenu
• 0x46f668 CreateMenu
• 0x46f66c CreateIcon
• 0x46f670 ClientToScreen
• 0x46f674 CheckMenuItem
• 0x46f678 CallWindowProcA
• 0x46f67c CallNextHookEx
• 0x46f680 BeginPaint
• 0x46f684 CharNextA
• 0x46f688 CharLowerBuffA
• 0x46f68c CharLowerA
• 0x46f690 CharToOemA
• 0x46f694 AdjustWindowRectEx
Library kernel32.dll:
• 0x46f6a0 Sleep
Library oleaut32.dll:
• 0x46f6a8 SafeArrayPtrOfIndex
• 0x46f6ac SafeArrayGetUBound
• 0x46f6b0 SafeArrayGetLBound
• 0x46f6b4 SafeArrayCreate
• 0x46f6b8 VariantChangeType
• 0x46f6bc VariantCopy
• 0x46f6c0 VariantClear
• 0x46f6c4 VariantInit
Library comctl32.dll:
• 0x46f6d4 ImageList_Write
• 0x46f6d8 ImageList_Read
• 0x46f6e8 ImageList_DragMove
• 0x46f6ec ImageList_DragLeave
• 0x46f6f0 ImageList_DragEnter
• 0x46f6f4 ImageList_EndDrag
• 0x46f6f8 ImageList_BeginDrag
• 0x46f6fc ImageList_Remove
• 0x46f700 ImageList_DrawEx
• 0x46f704 ImageList_Draw
• 0x46f714 ImageList_Add
• 0x46f71c ImageList_Destroy
• 0x46f720 ImageList_Create
• 0x46f724 InitCommonControls
Library comdlg32.dll:
• 0x46f72c GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.