11.6
0-day
该样本未表现出任何异常！
重新分析
更多

4775a4d82b4a542e7c6d5b3e34339aff0d3795683b5c1b7e400ceaa47af6f35a

6e4d2fcf67cc728ae7726e6a3f5e26d4.exe

分析耗时

108s

最近分析

文件大小

763.0KB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
Checks if process is being debugged by a debugger (1 个事件)
Time & API Arguments Status Return Repeated
1620792630.484501
IsDebuggerPresent
failed 0 0
This executable is signed
Tries to locate where the browsers are installed (3 个事件)
registry HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
registry HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Mozilla Firefox
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1620792580.578751
GlobalMemoryStatusEx
success 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)
section .ndata
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2?cup2key=10:1251951703&cup2hreq=e0fdfda8c9b6da30dd8d87836799c9b8d86df1ed16aebfc49fc870588cc9ecb6
Performs some HTTP requests (25 个事件)
request GET http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
request GET http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
request GET http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
request GET http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEHSfdSPcp6pyLdnEz5lZ6ec%3D
request GET http://fallback.playtech-installer.com/playtech_compressed_assets/poker_william_hill/index.7ze
request GET http://fallback.playtech-installer.com/playtech_compressed_assets/poker_william_hill/templates/installer/william_hill_new.7ze
request GET http://cachedownload-poker.williamhill.com/download/poker/client_update_urls.php
request GET http://fallback.playtech-installer.com/playtech_cabs/poker_william_hill/casino[en].cab?t=1620768632609
request HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request HEAD http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620763695&mv=m&mvi=1&pl=23&shardbypass=yes
request HEAD http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=6e5781dad328ff0b&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620762975&mv=m&mvi=3
request GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=oOy5RwUjTuWoyQPLAg7V3hwexvMQ3vyCNKDi00C0mgYz%2BR0LMsqWXV%2FDfEInHP%2FuLmdX3O2JLovLcO9U3y%2F5%2FHbBTTcGYEAZuRhIvOFocTiDbXaZ7TOxs%2FI786KhH6KLQykwqYAx1bnqoLEt%2F7dIUj9%2FbAwzwPjONrVBhGmK2BFCw%2BKWSqD%2FGou0u49Y9YtFh3r5HbazX3eVWEG2euMy9g%2FZSe%2F0V7U2viTo8%2FPI6kMT1LE3Lzhx3D4FTWTLkGkfTfgOTuT7QV0zMQyA3XAE50B0doQ6bEXQHJPwnfohwtVKoqU4f9TCI6V0DGoFvkKkDxCOfYdt1li5Pc%2Ftogf99MEdudshyIOzcULCCxmn8dYcpD12BGJ%2Fp2is4TVpz3styDYJaLWZ5U61is0YsJjvM7kj%2BKlWCV6I1wbYB%2BRUIWXouaZOGuQdqPNTx0XtsGsQEJIH8WiHJas%2BwXkuSqTOsAjfbOT8dAvY%2FS9KfPF1hEXGNmi%2BfGws7eu%2B7wacgDnXaWfm%2FagMSg5EgmF3xh8HT9Ei5mULDc%2BPLO2ykHjIoSkQ4Y4bmPjLEc5NQeem4sF%2FNRj94qoNfrpqiBuI0RUgCAST5dNESIFyhbZoCNtyzUv6p8jFoyS7y%2Fv%2FW8gKH%2FC2sdsx1PN71V%2Bgr9F%2BAran8zxrGJlMpEdV422iTCMyUWk%3D
request GET https://c6m7w2m9.ssl.hwcdn.net/playtech_compressed_assets/poker_william_hill/templates/installer/william_hill_new.7ze
request GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=mGHQX%2Fg5N2bBNUvLE57tAkD5gcKDvwZSQDwPTGpmwusb5LsO50ZlWTKPfdnRqi7UWGQ0qnh1T3Eub42R403A%2B%2B3zdN668iok8X64FxgwM6zv6FnuWJdBxueVLQJaorU1LbK%2B4qa44HDB4fM4W8PwEpcp2H8dhoQGbB6DdHpDp2N%2BIQFjT4Wt%2FF38nznNqVSsDTQqnT4HB8F6sGmFhTDwyg9%2B08Pr69rdi2KOgh9yEZsg6iUDOQwVun4nrHGLE8jY%2BbYInSpiXVneblqtRSKuY7%2BNanIKojX1m0VKqjhYSPzXZwdEv0UM3vFZzJaIgyL7Cpkhbbwhy9U3FqBcsltOONm2FeDORLw%2B0HoXmU4tTQ7IpnVckSvyLPNKV2aZYwe5GnO1bOLWthRjPMlxL2cj3Rf32EZlaB282ZTcKcVPmaD5S%2BlzkdJal95XbrZ%2FrtymIcObf4f3Ze3refPGA7LdSroV94zyeJeiiuIxHcPkIMvxbMt2iwvI7n7ctZ426RGHe%2B19C6141CYMWwYj%2FhiirNF4CiM8K4GVa7jayoGTWP3pPi1cWd3MiNZrWfa01jg900uNFgxErvkDWe3F5hfaI%2F%2F27fmbYRpiVOS29XJ42Q%2B4S8t2EZnOnR2ExHLOuS1RbPFij6wKvk7EgEDXSGa%2Fzb49FETDvctao3zs3ucGuI0%3D
request GET https://c6m7w2m9.ssl.hwcdn.net/playtech_cabs/poker_william_hill/casino[en].cab?t=1620768630234
request GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=GiK0eAbL3wjaY0BjgyjJrEGz8H1fPZgPW80rii%2FNMzMjIQd4xhAETPe8qym75ZPFQoVii3xXb40ghstUGgxNp2l7sjVbXsny3KtyEc5MwcwZh8Stks0TEe0cC6NYmkE5hVos6W59w41FKfulI3lFeCCmqVhvtwxSWdXpTo2sQn%2BYUObiIndYcvwmhFxcZ0s7LnvmrHEnPqqiKB%2B0bWWY9TiSUCDYAPvZabE8HK%2FdYuKS1E06URAPjb0Ew8ZZXmL2AfaJRh%2B26Un5A5vOaEKUicaPE%2BIb9RAiSICNZKbw1bFw6zImRn6YhSCP9EO8SzNhwXiVJhoWEulOnoh7Y7GjNISp4287sx4R%2FwuajuLHm%2F3qTy3gKuRrlCjW8NGX3RnNYHKhKARNumUmUdAYJ0lWkmONphUBq4ZpXd3TaWTgZhn1ksJMn%2BGL2fqxRscg9D62pl%2F2OIeXxsdIRtOS1%2BVGjj1tw1SNL4JceQWAQM5BSrz1kMqgPFhq0cy%2FCPNSbtK0BCLBwHKCrbH6YIJ0vNu0W93pqIdYK%2BXNIRJv%2F3G3%2FN5mWLoWgMNAJt%2F%2B2uqxl4hdA21RRydI5MCqJ%2FdybJtONeEo7Pc33drd2slcWRKRwpf9vM0od0qFdvC4WjkKgC2cfOYkg6XZBgOMU7b4vJp%2B%2Bj%2BkJGEX2ph54L16QGxlmBQ%3D
request GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=qZxZd%2BVJqIbtwAEcqTvIVQ1o5PaX37m5Oid9U%2Fap28773hGteSvChLLnYbcjmZzmsZlHp%2FDndDx9AZCuovIXHvXQc9hGnKSMVekCw56%2BLCFptV7kOke5mYj%2F4wx4FlDvXyZcmIowu%2BVo9vjYKZtJ2Z%2F7qwhE1tzKouRbvWHwRfiWeNeULgwMRsHXdpxdrKyoAT%2FV5H16mXWomWbtaqO48yIJ9pk5fxsL9OSElgSpLVb%2FxHTTBjicv03Umn4san047WBC0f%2BpCwAl7Qq7X2G5tW8OF%2FD6BDafgIDOEcesY%2BR9FiYMu4gkof3pfRmwMd2uJTNeavajfXheOZwzmG2EoHoD4qI3gxSIQ641rPk6lHN1L%2F5Hhwg8uoQ2LYdS8KuFKURIxricbkpD3a5KdRnilnpjUrFxcZ%2BKfTofLK0qY%2Fa1Y4EzAzLeW5b7R3Es4sLJHhAkgvYYVq2bUWxWZzxmdJmonnNSw5KukiXxByfRsO%2FCR7%2FnzVPiKn1ZGk1OsIsYT9sMp1EPRrS0veg2JdCp2xW5kgfw9of0DjPhoR%2BRt029PXxwWxtAhwG26O71SKaVbrBfHmtjLueLTXbHKZQpyfyOGoDK6vadKOIgzs31riAhEycIrZ8gqM2BmbEjsIWpUg41xdCmkfUlmqoCkdrjNtP2vEcwM3FdBT0b%2FFOPCpY%3D
request GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=nt6ehF3mJIR%2F2x74Ln%2BXFa26eyC2FW04Zt%2B78Od6bLqYX1YP4o5ke5HdR1bLeuxWILY84v2zKRJpQQMMCGHM2gl6i%2Bi0Cm5dcuPJcbuav02hyLFNYrknvJGJr3Vb2%2FzktRe0Q5C%2BfSU9iPYrK2656mjInNOZ4Mf3Hk6rdcScXb%2BCNqX8U0zNqwD3lcYfUerjhqoGGNjDibxlveQXTknFzIYFIL67WgPuKenA51epjEiob3kENktSDwAuRveCtHd99FidGq3aQWKqMiqODNrKGsQVHb75gJKpVIDK2skVcJE9ji6fNReDVfVU2CVHNeCaQTQVf5HKeyo5B4Wu6tEXTQOUW4RH9FGH9u9cWetObtAg9UBZCaLtCp6vNt0pzFccYKpIr%2B5wb77IBXBKv1m7b9OrYCKTK5C4HC37ZfrKyO1cjZR53Nnoj8e6OWUZqVzSymYkp0p4H3H3TClXAEExyLlLgnSMYNtW%2BwidPOO5ZHlYGtv6BYAGqYYXEecUeVJImiuDSSlMkjbIYcfhwLJrPCecO%2BMt6kj%2FY3V3IteCrHqyM3NWFx8LFY6q%2BH3V3NZYVHGvVN%2B7IkU70yLQxRCCSJd8fuBi8jiZBIHVp82fcLiBF8wscsgxx39hIZUN2F8r%2BIUrun09DK0%2FOR8V5Q2CoK0yJRb0Jn19azWobTfGdK8%3D
request GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=NESHyWbOmfc7Sr0AMP7o63vcZ%2BV8q%2F9TwKTeG70V9nSKdgyS0t8ZyDzSg26qxhjYIzpLoz0yUuzwGXb183DbZraEef4LHJM0YXlBr1nFZmMi3vNtIzfejdmwqwyTMVPw09S5nx82reoDaYjF0xtVLDo%2Bh2S%2FG81PnRtpYB4XACN4dh%2Ftp97F5ICHOk%2FY1RQ7frphsVEHfzJJVyiyc7PwU7HORvPHdz6%2BIhX62rq14TMZctA3emnJWHQpLaqj0TQc5IWNeQ0LtRyby%2B%2FWdJjGWN3ei1nHeYPUWNc7vy0iZP6MoRXAfAbODHhrbSWKy03vI9SjOyKWO3LpEE1q5T%2FDXdNh%2FrNseTwda8AhAm8eg7Q75NV3%2Fapvg2sFSIYlCJ9%2BpMP5LYUxQ9wCxKmABXseOHuOY9ie1wIaF1KIzftuUtGwi%2BqpBW%2F7ZkPmrnHbab8RF4WAo1jA1t6Q%2F4BDZjQTIM74DziPPl8GDDHAtnbHe2l4OlmkvCmCTRoifdCN5IE6jvtDWU0wDQMHgfiPFlO%2BPZN1vVrFnTXNAqkB6g%2Fy7VfO3YRlL6maitMJsh0e4U5Uci82uupeIGLJ66mZ6oOqe%2Bs%2BSefziiLK9u3tS0LDQVcVeBpU%2Bhr%2F8sii6XbWwORz6zh98IsZIJlTVl9E3HJGGwD%2FJz%2BEim1rhEZaB9VOUEqgK6qqz4h%2BVN1t62SnI%2FgaWSsZBbSEqdjem7bzeQkTau%2Fxwor9Ck989zzfyRVoH3buATzjODP%2FrjljbkVbn7CXO2H3vPqeDYTq9yDBYyJDRPYvIX%2FAQlaAGvVPqkZ7snLxZiozFUPIWplEFzyY6J3IMbUxUwa5vDPXGgkh9XRSAHCc0kZ%2BRSnS4D3IzU7xJi42una6fCVSZZFacQo1scTiAenc1OLeR69JyIj98z0JFYjzfran%2BEJkKjK4j%2FBVfswHo5%2BhtZrvF63Cak3rEopldHQDUyJJaPER7QMEvZWdlxIcfHAJpNJ%2B9iQMXcY0AazakjaUgEIz1IOpt%2F4I54w9fxsPhvpMNruChwPyKjRIjLE7mIa3VS%2FOrJTdWdsvEeryLZ2Ss4efYi7DKCq1ERrG36GGKqAqTEBGbawycYsGGgXBV1YG%2FYqxjLR5dv2rsLV5pmqqmdmriukr7F4iFqc8uuE%2B1xW6%2BnsDOolPCJ%2FG8CM6HzcitYbWkJfd2L%2FuY5%2BDxRKqJ2seYtxOIrb0oMbLJq90uCInYkowf%2FSJrRO7GR4fu%2F2uocywNUtphzs191MK908UmhhQMRHTNMVqiKmSQJigfRWIpHbxtkCxLx0ggC0iO9HgAm3oZf5ppFZRGUf%2F2ysjcf9eX4SB4kCQHX2gi1WSGQAF9ziiCnu7GlIqvw%3D%3D
request GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=wULhCFo%2BBnNtjmwLf3jaDR0b%2FitHmOPcR8yDqudrJeAct8pROkBAQOgDOp2BZHNDuwdHKsd2AwK8FTdnzbSBpNKE0bLcn4alfuc9kjomLnavhjLSbWJ%2FYiuI5LVbLnqWZvYsPKKFpyTkf0zkhqFhhSZ4JKOpnbsc55ENYb46kPMNH0f9MsyfsQM6yR%2F%2BNTXMcKuHX4UDw2ctXOxiM3Nct7qu8Oajbt279vAvD%2BvQxzugzgTB2FzsT4aWIXz8VTA9QtD8GtOListe9Vyp8KGTtpX38hilq8NJwSD%2BeP%2B0JL%2BSNFy%2BObEZ5LdxfScz0Ik569AAQd8D4hHzj4SKcm2ArvCQidgyPoOf9tNyRKpCc4eOL%2FZPmTKmJ8NEjEEXblfTuh1IwCq5qi1v09cnLwGELSVKxUhG2gIIJjXF6zc30TDAq%2FiLkxGiW2R%2BWHEa347rUjA%2FeQEzaqZChrLCqiqaVtWyEW3C3HBMuNq2CRXQMMybXRxaA5eEOaxIos%2F%2BXNnqyFvefCNprIn9vzbstPUepWK9wsBDa4ERjBwvYoSIY%2FO1gJbyGeOpUIdyBroP1paf4m1G%2B%2BLnWoMGryBOMIuO28qvwOiOTLiilFS4kNImwM0mhxYUMrtnaQADlFAdte4M5gKSja1cDG9K3tv1%2FBOpHf5fDV8AF4eieUM12vXYiQ4%3D
request GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=WRNVNyVtroaaWauEiQbRn9HMWMFGS%2F6cTO6g6Oy8Ff%2BTnx1uCxb%2F%2BZaA3L6R8yz5RV35bwggzxE4IVmJ%2BTjhNKWX9lMqb6FjSTg6yythvpZOynXpC296A6C5oyIz2nwf02nzB1U3125V9A6UwsDW6nuv7vyI%2BW%2FZb7nfk1LupO%2BtNBE1l1uNGzf5aPPHN6AqVQEM%2Fbp9dkUFuryjy5d7wZTH8neuos3aSmeBuCvt1F03fZ7gUQ9w8XPjTgCYKaGeOUO9yZi88bxNvZz45YJMGCEiPJwmcG3W6Se8perm2g2KZDAef%2F84XE9fdD7cM4AU7wUzFm5K%2BWaFTG0hvLhYD3ElL5Dc2XtDcRop5kUKZ07sQ7jTIishwgQ9cwZDMis5wh5g3urBptvIGdiksN7cAq5b73Z10OQtFrGgeheCncwcLzSxv9l0e%2F70QIG2zuULzi6poVsWV4cWcaJnCEMThMUfhvqv9DerpLHSgUqeSJEP3Cpd6wGLEjpTtvWbpYhfUqVcqFfubSB133t%2BHPqMklbHIfqem4JZNmZzeo%2BNtRiP96JM0uBmr9SV8CAegYW0YnhOpeeRHCRNHQV2osGEMSO2aQ69L5aPTaDYd7ZvrEC8su2%2BUwhv1cJ9uY8k7xiMqxHv5aPHKRn%2BAg6gAIKSg5V0jNQ4CCRtni2SlTv3%2BFA%3D
request GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=0IdciN0op%2Fs8aU7k7FO6%2BBM4u4FlyPbVdK5sNxQOSnjr9R%2BjUTsuIZgAKoF%2Fy8ha8eEqUrR%2FbVvK1Vu8fLB%2FID4Q8gxw0ULgMJJJsr%2FPCSzWjqLrufcMGm6KpfAychA%2FVHiryFT9aHY4wLHEXkeMXIT2H5dQQ72E%2B9%2BBEaM%2BTYV2SrQEq3PMxZmFJwcsUaiZpz3fA8n2r0Z2XbkhhR6jyzFyyMgU5NK2W852yV6riqWzCQZNBy34Ne5lMfzgeE3XEHGKgyeOAqLIOq6Ea696URJBw%2BKBmmTiuKcz2YsuM1UpR%2F%2BqooW8RAQVrK4Xg3Sz%2FVGa5s%2B8chjbypqBvsphElsu3Fm0oeMJTBHLC6nxynqM0vFVmSC8ArkwlcJJbW6DYiB3fewo3AKY8d%2BOI8S8lIljsP85LMVO7PEvG2P6kMIPUrhd%2FZdGe6JnJyOAENZruPMhz8op2xfXEHC6cbLwMTWJC0JqFWgU7Oi76Vt6hkj2rqUG8%2FEUK8iqU916hwrLPekITfHqwbQvTt4EiJL4lwLxL8yilkX6UY431GsvBzVupZjPsD61WXZUUw4QRMsmVgKMdkyhTtBe5H%2BHegJqnGIT3s4p07lSMULNs%2BrwjP9Kgiasi8DKHT1jNQSHXe3jkslWa4AkQh%2B0YNEg3X%2Fok50TS2ep5sWBwDVTttZjhH1m0m8hrC4uxW4Swn2k6wUClhmK2DU83r1CljlTGWZKG1I6siZouw0uPzX5HC7yV5vCX5ODY9Qkl59aishWrf0MYSV%2F3uwrrCBolniJg9ukqmtHxHBnyy%2FjR%2BErJp4MsuN%2F1n89%2BhcSWnyh4PgP3vhEV%2FL7PKv9TYsOIcawq6Dz6psCE%2BoMClj%2FCsmkP8lYs1NBDr49yjvojlV5oybnQhmJqGqHz4yA70laxdkc9NeEAOuFQwpo85eu91LhNXfV%2FF9v%2BJ%2F8WwCgxyYAbsmOPjK1DMVaM9qiEl%2BKKwyvPQ%2FCGQpSsWDtBXs3C1y39JbCbN2U%2FwU994rCbef9yYKKkWF4ongehurU%2BGwfaMwl3Rq4g9Q4S%2BBf5fb3MWaAS3V8rnRUoqDOAkN0kYEar842At3b3PvLoh2GDPDKMl7Lf7%2BBHuRUGYUX0WjRUoy0LZJorBHNq3A1gAhgDaCeDOWTUWmKDCDwr5RDw%2BnN0U040cxDNcEby8X4Ui8qdSwibzi47Y00hubiQBqEWKqBTUMZYqZyWO1%2Bx241X8zKHpvKPji7hBIGqiLbvs%2B2CLcxBmnLXyPA%2BJCWdr7PAJWmLE5CotcwWE68cAHmS%2BiRXKlBlM9DZXoo6nQya1l0x%2FcyZAJcT3NxGsp8dUSj35fPch20Uxym2TfCoT%2Bpg0IhNrIH1e2yBA%3D%3D
request GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=OgTZu2i1QY9qj7D3ah8dVrK4bCnkOlscDTGdctAtwStCQJm8h35KoF9RofVSLIfmqTu2TVZqDD%2B%2FqvDVLLs8R9uSmmMIZIDnM4mlkyR2h5zPCAWxikw2wOE1QeyFV6bu%2Br0HMbOYjl%2F9rYDtBs0GSFKxJvU8540beNyJXVUTaQlwMTta%2BOKrHYcXXQ%2FbaKRpmppR8pdP%2BQrRskZJZB%2BnQZW3DyrhZdAvyyX4%2Bm%2BDk0n3CKi6HvE2EX3Mtstl0ZRWKQxcPsV69AlzGSRJaIqYd6bSsc47qwxZU9hu%2BYUsSqL5fwRuISNrAr4VOs1mmKSN%2BHnHDU53Gfx%2BPtZJ0ivWvtvGWVX1PlLbD6Ou6u%2F%2FFrGck1qwzPljhSaSDQPebUzuN%2FVOeNKBaWgBlEgG6cMw7rFd2YZ3fVtJq9x2uYMjnJJSeuZ1zPaLJy7hnRS5QqcJ5v%2B%2BHB2R4dHoKJ0EM%2B9Q57et9CTWxkiAe9WEyaz0TiQjMYBT0MKyxnWLdN7IWRdIgfVj12xQM9Wxg2RM3hQ4sqtrdlxrDf2fVImxMxHxromO47dfFe6szItchiGU9w%2B9eU%2BNRrrWWzDdFPHY61utMnsvh34nS93Xi%2F%2FDir1UdosC%2BZshfybZqSBYNOiI%2FXiQJe0eZNE3uJ1Xsam3sp07jJaC5NLPbPCpqo8w2R8FnsxEdUvVDzrY%2F8YwySwNCfNozIHDwK%2FnEalSJmLZSpcmQTrXZffwpzoOpZtAD6l7vpgPghgUpAaRD0LsgaB%2B9JRjBvROOuWQdnUDd24mg%2FsGr5aJ%2FTjrl9mvi%2FOi37v51Tx6zwUblllfL5ra0m7ps087cGiqPCJ%2Fo20MShJ25Z5uV1R8SHUUBrdVWk9zV17PP7NDBJHVTjas%2F33DfWg9ESjzyhrlpe0yoR98sTjJagBMvHSkjdqhDFKF8wacdjz9xxDeDrlkplh9XI66cH%2FMBJd3DsxTUANc9H1QyXlg3H7ojHed58TwS0Hq8hN8dITP3khcy0Zm%2Bev8BvhRS4B%2FjNzjWAqB2srnsui8KWZsBEZOVcWQUZHOt0ZPQ08kIeDZCXGVkv%2FJJaRqDd5eX3WFtk5RmGarP6lBgTa4j292Nb4afMVEOBCkDuVN2Nlh3ZlASInOR9IF1ftJLt%2BhyKAf8Gy8w0rqZT2jWaElfPaIbkuEvnI8HB9ZPjv0eyD2nvbirMOdM2rTXlrnIyIj%2B4pvsLgMwZHc1VHJ78sI7ouxe%2BDSu%2FKcWRmhoEd0xYuI5QkpEb5Q8C5tjoIKIcjEvX40bJHkauf%2FmTdgWZrWoTDXMZZWO1RSLAGstPLkG%2BYCImuqwSCerfQsQJ8nxvOPfUnl31%2FQ%2BE9tIpl4e36K8nTCgJ8xUg%3D%3D
request POST https://update.googleapis.com/service/update2?cup2key=10:1251951703&cup2hreq=e0fdfda8c9b6da30dd8d87836799c9b8d86df1ed16aebfc49fc870588cc9ecb6
request GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=cgUsD%2FwPBHuiTdvimsFaMWHnkzrYsdyjSII6R95UsKvng6fdz7qQOSZ7IiUGrdOJPC3eOBL14B6M%2FwBmZ4%2BaIg1rnyy0%2F72EMj0L2SQH8FynyHCLPRig73HchEomO8Ec2XSAazlAvsk97JqfBcYaxGD4%2Fg2jiOwhnnDv6ZahNULJL9ZtF%2BqoIKYYEPQMc4TAhp6vUPFIy%2B03B1%2FwrQbnhnOFVx6k5Gi2YPgITpGBzh%2B%2F%2Fzpwc488tBttS6sHekf%2BOV4E5kQ5lA29BSXx2jI56K%2FUADB1Stx7H0EmK3E0yMKOC5ebj3O0kiuSNBjqIKa3aPneSTwhyi3QVzZqFUlil3A0xat54fYA9IA6VTHBUwgqKDFczlQTVE1nkCo0S9kLOruapnAiivZnqhDQVGfAqrYerGe%2F86yylcqRH1fZ4SeHW%2FsHWt4ozmkYOPqhQrLlfQCnawHS1LkVkg0VhJ3zkOUSt0MMqx26n%2BeEx%2Fe9%2F7LZACYcERcsbU3AT7oRalkdMdQXv6AXc%2FFznmSUuCW0%2FY3khf8nvwv79O64M1mlu1ydLs34lM0vTeCygbJJb%2BBbJYqj9gXInMRZ1GZ9gyihyTnm5q%2FSWSDdYMCKips%2FcoN6ZV7Dm9HyBrh9x%2FKo43q8zWyJupqU76It6dhqkZITibv%2F1yHZYtjah1FD8KoBQSzFHyBwGmlfQK7jVLta9ET0SNELixTR8qAEgS7wPXqILPZdFqcyuPusQsjpjYPLIqkwoFBFRNg9SAizz7CmLPWnHqut03kcxVi%2Fwl1aHrWp5Li%2F1DHjhnnnXFdL6L5XDO2paYSQdceg9Z9FqBJzQX3cKZ%2BuKbj1O%2FOsYM8RUrsJ36F1PLpNyak2itkkNgyPcHr14uxnpwCvGN5D1MX9jY60K81OV1B0%2FNmo7FCxVmwhde4aM6t6y0%2Bs%2BFhtKKfk6mWqHQevo5hj7mfo1kKmWOXyazG4fgEZS14jX6Tr2J0Ug5uHRlEbsTTcia9CeZetWEQNDBuqzWwc9bNkIt7f69uyvSMlW4e5U8mUOmakilE%2F7csOwxGAe%2FfDZv%2B6lVpRANkUfy5MzAW9HHd%2BgQgf9HWkynLqduA594tNFK7M0nTGw6h53W%2F1u91MKE0epjQ3p3R7PGD79Lm212V%2FrxxWd2m5%2F%2FCH%2Bbc9dKbOmfnhQLi0CHUlD8ny33WP1jgbbzEX%2FBADLktsdggDpp1MFq2qOBEWYh0%2F%2BKUdDGe55SaNXJeaU0ElNb8axLbivDJYOeVGfHltYUM8WZgA2ZHdDPOQJWij7zXyRotymrhweW4zdr3I7WKkSUKSnYQErTOfocWdgdnAtlAk73X8rAvlJityODCTq9lFVC1HCRHKrGQCFRgDhg%3D%3D
Sends data using the HTTP POST Method (1 个事件)
request POST https://update.googleapis.com/service/update2?cup2key=10:1251951703&cup2hreq=e0fdfda8c9b6da30dd8d87836799c9b8d86df1ed16aebfc49fc870588cc9ecb6
Allocates read-write-execute memory (usually to unpack itself) (2 个事件)
Time & API Arguments Status Return Repeated
1620792588.969501
NtAllocateVirtualMemory
process_identifier: 2032
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02920000
success 0 0
1620792212.61252
NtAllocateVirtualMemory
process_identifier: 1424
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00000000047f0000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Steals private information from local Internet browsers (2 个事件)
registry HKEY_LOCAL_MACHINE\Software\Mozilla\Mozilla Firefox
registry HKEY_CURRENT_USER\Software\Mozilla\Mozilla Firefox
Creates executable files on the filesystem (2 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nsj88A5.tmp\internal6e4d2fcf67cc728ae7726e6a3f5e26d4.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\6573705EE0094BAAA977A990F78A1E08\william_hill_new\js\template.js
Drops an executable to the user AppData folder (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nsj88A5.tmp\internal6e4d2fcf67cc728ae7726e6a3f5e26d4.exe
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1620792591.250501
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
Checks for the Locally Unique Identifier on the system for a suspicious privilege (4 个事件)
Time & API Arguments Status Return Repeated
1620792629.078501
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1620792629.078501
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1620792629.109501
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1620792629.109501
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
Queries for potentially installed applications (6 个事件)
Time & API Arguments Status Return Repeated
1620792587.391501
RegOpenKeyExW
access: 0x00000001
base_handle: 0x80000001
key_handle: 0x00000000
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
options: 0
failed 2 0
1620792587.391501
RegOpenKeyExW
access: 0x00000001
base_handle: 0x80000002
key_handle: 0x000000e0
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
options: 0
success 0 0
1620792623.656501
RegOpenKeyExW
access: 0x00000001
base_handle: 0x80000001
key_handle: 0x00000000
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
options: 0
failed 2 0
1620792623.656501
RegOpenKeyExW
access: 0x00000001
base_handle: 0x80000002
key_handle: 0x00000848
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
options: 0
success 0 0
1620792623.656501
RegOpenKeyExW
access: 0x00000001
base_handle: 0x80000001
key_handle: 0x00000000
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
options: 0
failed 2 0
1620792623.656501
RegOpenKeyExW
access: 0x00000001
base_handle: 0x80000002
key_handle: 0x00000848
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
options: 0
success 0 0
Reads the systems User Agent and subsequently performs requests (1 个事件)
Time & API Arguments Status Return Repeated
1620792623.687501
InternetOpenW
proxy_bypass:
access_type: 0
proxy_name:
flags: 0
user_agent: Playtech WinClient Downloader/1.0
success 13369348 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Creates a windows hook that monitors keyboard input (keylogger) (1 个事件)
Time & API Arguments Status Return Repeated
1620792212.03452
SetWindowsHookExW
thread_identifier: 0
callback_function: 0x00000000ff35ae10
module_address: 0x00000000ff2b0000
hook_identifier: 13 (WH_KEYBOARD_LL)
success 786911 0
Attempts to create or modify system certificates (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (15 个事件)
Time & API Arguments Status Return Repeated
1620792593.859501
RegSetValueExA
key_handle: 0x00000550
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1620792593.859501
RegSetValueExA
key_handle: 0x00000550
value: 0±>ȬF×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1620792593.859501
RegSetValueExA
key_handle: 0x00000550
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1620792593.859501
RegSetValueExW
key_handle: 0x00000550
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1620792593.875501
RegSetValueExA
key_handle: 0x00000568
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1620792593.875501
RegSetValueExA
key_handle: 0x00000568
value: 0±>ȬF×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1620792593.875501
RegSetValueExA
key_handle: 0x00000568
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1620792593.906501
RegSetValueExW
key_handle: 0x0000054c
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
1620792617.578501
RegSetValueExA
key_handle: 0x000005b0
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1620792617.578501
RegSetValueExA
key_handle: 0x000005b0
value:  ìaÖ¬F×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1620792617.578501
RegSetValueExA
key_handle: 0x000005b0
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1620792617.578501
RegSetValueExW
key_handle: 0x000005b0
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1620792617.578501
RegSetValueExA
key_handle: 0x000007c0
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1620792617.578501
RegSetValueExA
key_handle: 0x000007c0
value:  ìaÖ¬F×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1620792617.578501
RegSetValueExA
key_handle: 0x000007c0
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
Writes a potential ransom message to disk (1 个事件)
Time & API Arguments Status Return Repeated
1620792626.672501
NtWriteFile
file_handle: 0x00000848
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\6573705EE0094BAAA977A990F78A1E08\6573705EE0094BAAA977A990F78A1E08_LogFile.txt
buffer: 05/12/21 05:30:26 (39796) -- ProcessId: 2032, ThreadId: 1476 -- DebugLog -- JSObject -- Invoke -- strJSONArg={"id":39,"params":{"inputFilePath":"C:/Users/Administrator.Oskar-PC/AppData/Local/Temp/6573705EE0094BAAA977A990F78A1E08/william_hill_new (1).7z","outputFolder":"C:/Users/Administrator.Oskar-PC/AppData/Local/Temp/6573705EE0094BAAA977A990F78A1E08","shouldDecrypt":true,"onFinishId":3,"deleteDecrypted":false}}
offset: 0
success 0 0
Generates some ICMP traffic
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (4 个事件)
dead_host 172.217.31.238:443
dead_host 192.168.56.101:49194
dead_host 172.217.24.14:443
dead_host 172.217.160.78:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2012-02-19 23:01:49

Imports

Library ADVAPI32.dll:
• 0x429340 RegCloseKey
• 0x429344 RegCreateKeyExA
• 0x429348 RegDeleteKeyA
• 0x42934c RegDeleteValueA
• 0x429350 RegEnumKeyA
• 0x429354 RegEnumValueA
• 0x429358 RegOpenKeyExA
• 0x42935c RegQueryValueExA
• 0x429360 RegSetValueExA
Library COMCTL32.DLL:
• 0x429368 ImageList_AddMasked
• 0x42936c ImageList_Create
• 0x429370 ImageList_Destroy
• 0x429374 InitCommonControls
Library GDI32.dll:
• 0x42937c CreateBrushIndirect
• 0x429380 CreateFontIndirectA
• 0x429384 DeleteObject
• 0x429388 GetDeviceCaps
• 0x42938c SelectObject
• 0x429390 SetBkColor
• 0x429394 SetBkMode
• 0x429398 SetTextColor
Library KERNEL32.dll:
• 0x4293a0 CloseHandle
• 0x4293a4 CompareFileTime
• 0x4293a8 CopyFileA
• 0x4293ac CreateDirectoryA
• 0x4293b0 CreateFileA
• 0x4293b4 CreateProcessA
• 0x4293b8 CreateThread
• 0x4293bc DeleteFileA
• 0x4293c0 ExitProcess
• 0x4293c8 FindClose
• 0x4293cc FindFirstFileA
• 0x4293d0 FindNextFileA
• 0x4293d4 FreeLibrary
• 0x4293d8 GetCommandLineA
• 0x4293dc GetCurrentProcess
• 0x4293e0 GetDiskFreeSpaceA
• 0x4293e4 GetExitCodeProcess
• 0x4293e8 GetFileAttributesA
• 0x4293ec GetFileSize
• 0x4293f0 GetFullPathNameA
• 0x4293f4 GetLastError
• 0x4293f8 GetModuleFileNameA
• 0x4293fc GetModuleHandleA
• 0x429404 GetProcAddress
• 0x429408 GetShortPathNameA
• 0x42940c GetSystemDirectoryA
• 0x429410 GetTempFileNameA
• 0x429414 GetTempPathA
• 0x429418 GetTickCount
• 0x42941c GetVersion
• 0x429424 GlobalAlloc
• 0x429428 GlobalFree
• 0x42942c GlobalLock
• 0x429430 GlobalUnlock
• 0x429434 LoadLibraryA
• 0x429438 LoadLibraryExA
• 0x42943c MoveFileA
• 0x429440 MulDiv
• 0x429444 MultiByteToWideChar
• 0x429448 ReadFile
• 0x42944c RemoveDirectoryA
• 0x429450 SearchPathA
• 0x429458 SetErrorMode
• 0x42945c SetFileAttributesA
• 0x429460 SetFilePointer
• 0x429464 SetFileTime
• 0x429468 Sleep
• 0x42946c WaitForSingleObject
• 0x429470 WriteFile
• 0x429478 lstrcatA
• 0x42947c lstrcmpA
• 0x429480 lstrcmpiA
• 0x429484 lstrcpynA
• 0x429488 lstrlenA
Library ole32.dll:
• 0x429490 CoCreateInstance
• 0x429494 CoTaskMemFree
• 0x429498 OleInitialize
• 0x42949c OleUninitialize
Library SHELL32.DLL:
• 0x4294a4 SHBrowseForFolderA
• 0x4294a8 SHFileOperationA
• 0x4294ac SHGetFileInfoA
• 0x4294b8 ShellExecuteA
Library USER32.dll:
• 0x4294c0 AppendMenuA
• 0x4294c4 BeginPaint
• 0x4294c8 CallWindowProcA
• 0x4294cc CharNextA
• 0x4294d0 CharPrevA
• 0x4294d4 CheckDlgButton
• 0x4294d8 CloseClipboard
• 0x4294dc CreateDialogParamA
• 0x4294e0 CreatePopupMenu
• 0x4294e4 CreateWindowExA
• 0x4294e8 DefWindowProcA
• 0x4294ec DestroyWindow
• 0x4294f0 DialogBoxParamA
• 0x4294f4 DispatchMessageA
• 0x4294f8 DrawTextA
• 0x4294fc EmptyClipboard
• 0x429500 EnableMenuItem
• 0x429504 EnableWindow
• 0x429508 EndDialog
• 0x42950c EndPaint
• 0x429510 ExitWindowsEx
• 0x429514 FillRect
• 0x429518 FindWindowExA
• 0x42951c GetClassInfoA
• 0x429520 GetClientRect
• 0x429524 GetDC
• 0x429528 GetDlgItem
• 0x42952c GetDlgItemTextA
• 0x429530 GetMessagePos
• 0x429534 GetSysColor
• 0x429538 GetSystemMenu
• 0x42953c GetSystemMetrics
• 0x429540 GetWindowLongA
• 0x429544 GetWindowRect
• 0x429548 InvalidateRect
• 0x42954c IsWindow
• 0x429550 IsWindowEnabled
• 0x429554 IsWindowVisible
• 0x429558 LoadBitmapA
• 0x42955c LoadCursorA
• 0x429560 LoadImageA
• 0x429564 MessageBoxIndirectA
• 0x429568 OpenClipboard
• 0x42956c PeekMessageA
• 0x429570 PostQuitMessage
• 0x429574 RegisterClassA
• 0x429578 ScreenToClient
• 0x42957c SendMessageA
• 0x429580 SendMessageTimeoutA
• 0x429584 SetClassLongA
• 0x429588 SetClipboardData
• 0x42958c SetCursor
• 0x429590 SetDlgItemTextA
• 0x429594 SetForegroundWindow
• 0x429598 SetTimer
• 0x42959c SetWindowLongA
• 0x4295a0 SetWindowPos
• 0x4295a4 SetWindowTextA
• 0x4295a8 ShowWindow
• 0x4295b0 TrackPopupMenu
• 0x4295b4 wsprintfA
Library VERSION.dll:
• 0x4295bc GetFileVersionInfoA
• 0x4295c4 VerQueryValueA

Hosts

No hosts contacted.

DNS

Name Response Post-Analysis Lookup
time.windows.com A 20.189.79.72
CNAME time.microsoft.akadns.net
ocsp.sectigo.com A 151.139.128.14 151.139.128.14
redirector.gvt1.com A 203.208.41.65 58.63.233.97
ocsp.comodoca.com A 151.139.128.14 151.139.128.14
dns.msftncsi.com A 131.107.255.255 131.107.255.255
t8u4n6u7.ssl.hwcdn.net A 205.185.208.154 205.185.208.154
c6m7w2m9.ssl.hwcdn.net A 205.185.208.154 205.185.208.154
fallback.playtech-installer.com CNAME s3-website-eu-west-1.amazonaws.com
A 52.218.117.36
CNAME pt-installer.s3-website-eu-west-1.amazonaws.com 		52.218.89.124
r1---sn-j5o7dn7e.gvt1.com A 113.108.239.194
CNAME r1.sn-j5o7dn7e.gvt1.com 		113.108.239.194
ocsp.usertrust.com A 151.139.128.14 151.139.128.14
www.download.windowsupdate.com A 42.202.152.35
A 42.81.84.35
A 182.140.225.35
A 59.36.203.35
A 14.215.89.35
CNAME 2-01-3cf7-0009.cdx.cedexis.net
A 1.182.48.35
A 36.103.246.35
CNAME download.windowsupdate.com.a.bdydns.com
A 36.103.236.35
CNAME opencdnmsdl.jomodns.com
A 27.148.188.35
CNAME wu-fg-shim.trafficmanager.net
A 49.79.225.35 		59.36.203.35
clients2.google.com A 172.217.160.78
CNAME clients.l.google.com
A 172.217.31.238 		172.217.31.238
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255
update.googleapis.com A 203.208.40.66 113.108.239.162
r3---sn-j5o7dn7e.gvt1.com CNAME r3.sn-j5o7dn7e.gvt1.com
A 113.108.239.196 		113.108.239.196
cachedownload-poker.williamhill.com A 23.210.215.42
CNAME e25755.d.akamaiedge.net
A 23.210.215.35
CNAME cachedownload-poker.williamhill.com.edgekey.net
teredo.ipv6.microsoft.com

TCP

Source Source Port Destination Destination Port
192.168.56.101 49184 1.182.48.35 www.download.windowsupdate.com 80
192.168.56.101 49213 113.108.239.194 r1---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49214 113.108.239.196 r3---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49185 151.139.128.14 ocsp.usertrust.com 80
192.168.56.101 49186 151.139.128.14 ocsp.usertrust.com 80
192.168.56.101 49188 151.139.128.14 ocsp.usertrust.com 80
192.168.56.101 49210 203.208.40.66 update.googleapis.com 443
192.168.56.101 49212 203.208.41.65 redirector.gvt1.com 80
192.168.56.101 49182 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 443
192.168.56.101 49183 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 443
192.168.56.101 49189 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 443
192.168.56.101 49192 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 443
192.168.56.101 49193 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 443
192.168.56.101 49195 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 443
192.168.56.101 49196 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 443
192.168.56.101 49197 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 443
192.168.56.101 49199 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 443
192.168.56.101 49200 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 443
192.168.56.101 49201 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 443
192.168.56.101 49202 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 443

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50047 114.114.114.114 53
192.168.56.101 50849 114.114.114.114 53
192.168.56.101 51137 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 52812 114.114.114.114 53
192.168.56.101 53210 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 57236 114.114.114.114 53
192.168.56.101 58070 114.114.114.114 53
192.168.56.101 58333 114.114.114.114 53
192.168.56.101 59251 114.114.114.114 53
192.168.56.101 59990 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 60761 114.114.114.114 53
192.168.56.101 64874 114.114.114.114 53
192.168.56.101 65209 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138

HTTP & HTTPS Requests

URI Data
http://fallback.playtech-installer.com/playtech_compressed_assets/poker_william_hill/templates/installer/william_hill_new.7ze 
GET /playtech_compressed_assets/poker_william_hill/templates/installer/william_hill_new.7ze HTTP/1.1
Accept: */*
User-Agent: Playtech WinClient Downloader/1.0
Host: fallback.playtech-installer.com
Connection: Keep-Alive
Cache-Control: no-cache
http://fallback.playtech-installer.com/playtech_cabs/poker_william_hill/casino[en].cab?t=1620768632609 
GET /playtech_cabs/poker_william_hill/casino[en].cab?t=1620768632609 HTTP/1.1
Accept: */*
User-Agent: Playtech WinClient Downloader/1.0
Host: fallback.playtech-installer.com
Connection: Keep-Alive
Cache-Control: no-cache
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab 
GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1
Cache-Control: max-age = 3600
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 03 Mar 2021 06:32:16 GMT
If-None-Match: "0d8f4f3f6fd71:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: www.download.windowsupdate.com
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D 
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.usertrust.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=6e5781dad328ff0b&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620762975&mv=m&mvi=3 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=6e5781dad328ff0b&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620762975&mv=m&mvi=3 HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620763695&mv=m&mvi=1&pl=23&shardbypass=yes 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620763695&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r1---sn-j5o7dn7e.gvt1.com
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: redirector.gvt1.com
http://cachedownload-poker.williamhill.com/download/poker/client_update_urls.php 
GET /download/poker/client_update_urls.php HTTP/1.1
Accept: */*
User-Agent: Playtech WinClient Downloader/1.0
Host: cachedownload-poker.williamhill.com
Connection: Keep-Alive
Cache-Control: no-cache
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D 
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.comodoca.com
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEHSfdSPcp6pyLdnEz5lZ6ec%3D 
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEHSfdSPcp6pyLdnEz5lZ6ec%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.sectigo.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.