6.2
高危
53 个模型检测该样本为恶意！
重新分析
更多

b47299de995918d825499c2f49953fb0d8f1cde9c774cd636f06e1eca066cf2c

6eadedb48adb421e83cce9d1562a330d.exe

分析耗时

64s

最近分析

文件大小

3.4MB
静态报毒 动态报毒 1BK8UAZ AI SCORE=81 AIDETECTVM ALI2000015 ANDROM AUTO BSCOPE CLASSIC CONFIDENCE CRYPTIH CUGE DELFINJECT DELPHILESS DYSGXY EMZL EQEG FAREIT FORMBOOK GENERICKD GENKRYPTIK HIGH CONFIDENCE HRLVEZ KRADDARE KRYPTIK MALWARE2 NEGASTEAL QVM05 S15461267 SCORE SPYBOTNET SUSGEN UNSAFE X2091 XJW@AORMPCEI ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FPQ!6EADEDB48ADB 20200830 6.0.6.653
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
Tencent Win32.Trojan.Inject.Auto 20200831 1.0.0.1
Baidu 20190318 1.0.0.2
Kingsoft 20200831 2013.8.14.323
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (4 个事件)
Time & API Arguments Status Return Repeated
1619596031.828375
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 51904324
registers.edi: 0
registers.eax: 0
registers.ebp: 51904392
registers.edx: 0
registers.ebx: 0
registers.esi: 0
registers.ecx: 6
exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64
exception.symbol: 6eadedb48adb421e83cce9d1562a330d+0x915c1
exception.instruction: div eax
exception.module: 6eadedb48adb421e83cce9d1562a330d.exe
exception.exception_code: 0xc0000094
exception.offset: 595393
exception.address: 0x4915c1
success 0 0
1619603457.725875
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 35061572
registers.edi: 0
registers.eax: 0
registers.ebp: 35061640
registers.edx: 0
registers.ebx: 0
registers.esi: 0
registers.ecx: 6
exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10
exception.symbol: 6eadedb48adb421e83cce9d1562a330d+0x65396
exception.instruction: div eax
exception.module: 6eadedb48adb421e83cce9d1562a330d.exe
exception.exception_code: 0xc0000094
exception.offset: 414614
exception.address: 0x465396
success 0 0
1619603461.991
__exception__
stacktrace: 
6eadedb48adb421e83cce9d1562a330d+0x4270 @ 0x404270
6eadedb48adb421e83cce9d1562a330d+0x42d7 @ 0x4042d7
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1638176
registers.edi: 4860028
registers.eax: 0
registers.ebp: 1638212
registers.edx: 6452864
registers.ebx: 0
registers.esi: 84
registers.ecx: 6556248
exception.instruction_r: f7 f0 90 90 90 90 33 c0 5a 59 59 64 89 10 eb 14
exception.symbol: 6eadedb48adb421e83cce9d1562a330d+0xa26f9
exception.instruction: div eax
exception.module: 6eadedb48adb421e83cce9d1562a330d.exe
exception.exception_code: 0xc0000094
exception.offset: 665337
exception.address: 0x4a26f9
success 0 0
1619603483.210625
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75547f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75544de3
6eadedb48adb421e83cce9d1562a330d+0x62a4d @ 0x462a4d
6eadedb48adb421e83cce9d1562a330d+0x5b254 @ 0x45b254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff1d14ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (38 个事件)
Time & API Arguments Status Return Repeated
1619596029.687125
NtAllocateVirtualMemory
process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003d0000
success 0 0
1619596029.844125
NtProtectVirtualMemory
process_identifier: 2616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 81920
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00466000
success 0 0
1619596029.859125
NtAllocateVirtualMemory
process_identifier: 2616
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00a70000
success 0 0
1619596031.797375
NtAllocateVirtualMemory
process_identifier: 2364
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00360000
success 0 0
1619596031.828375
NtProtectVirtualMemory
process_identifier: 2364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 36864
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00491000
success 0 0
1619596031.844375
NtAllocateVirtualMemory
process_identifier: 2364
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00840000
success 0 0
1619603457.569875
NtAllocateVirtualMemory
process_identifier: 2240
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00360000
success 0 0
1619603457.725875
NtProtectVirtualMemory
process_identifier: 2240
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 36864
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00465000
success 0 0
1619603457.803875
NtAllocateVirtualMemory
process_identifier: 2240
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x021b0000
success 0 0
1619603461.803
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619603477.616
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f40000
success 0 0
1619603480.069625
NtProtectVirtualMemory
process_identifier: 1824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619603480.132625
NtAllocateVirtualMemory
process_identifier: 1824
region_size: 851968
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01da0000
success 0 0
1619603480.132625
NtAllocateVirtualMemory
process_identifier: 1824
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01e30000
success 0 0
1619603480.132625
NtAllocateVirtualMemory
process_identifier: 1824
region_size: 368640
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01da0000
success 0 0
1619603480.132625
NtProtectVirtualMemory
process_identifier: 1824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 339968
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01da2000
success 0 0
1619603481.569625
NtAllocateVirtualMemory
process_identifier: 1824
region_size: 1769472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01f20000
success 0 0
1619603481.569625
NtAllocateVirtualMemory
process_identifier: 1824
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02090000
success 0 0
1619603482.757625
NtProtectVirtualMemory
process_identifier: 1824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01cd2000
success 0 0
1619603482.757625
NtProtectVirtualMemory
process_identifier: 1824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619603482.757625
NtProtectVirtualMemory
process_identifier: 1824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01cd2000
success 0 0
1619603482.757625
NtProtectVirtualMemory
process_identifier: 1824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619603482.757625
NtProtectVirtualMemory
process_identifier: 1824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01cd2000
success 0 0
1619603482.757625
NtProtectVirtualMemory
process_identifier: 1824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619603482.757625
NtProtectVirtualMemory
process_identifier: 1824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01cd2000
success 0 0
1619603482.757625
NtProtectVirtualMemory
process_identifier: 1824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619603482.757625
NtProtectVirtualMemory
process_identifier: 1824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01cd2000
success 0 0
1619603482.757625
NtProtectVirtualMemory
process_identifier: 1824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619603482.757625
NtProtectVirtualMemory
process_identifier: 1824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01cd2000
success 0 0
1619603482.757625
NtProtectVirtualMemory
process_identifier: 1824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619603482.757625
NtProtectVirtualMemory
process_identifier: 1824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01cd2000
success 0 0
1619603482.757625
NtProtectVirtualMemory
process_identifier: 1824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619603482.757625
NtProtectVirtualMemory
process_identifier: 1824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01cd2000
success 0 0
1619603482.757625
NtProtectVirtualMemory
process_identifier: 1824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619603482.757625
NtProtectVirtualMemory
process_identifier: 1824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01cd2000
success 0 0
1619603482.757625
NtProtectVirtualMemory
process_identifier: 1824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619603482.757625
NtProtectVirtualMemory
process_identifier: 1824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01cd2000
success 0 0
1619603482.757625
NtProtectVirtualMemory
process_identifier: 1824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.6253037611809695 section {'size_of_data': '0x002db600', 'virtual_address': '0x00089000', 'entropy': 7.6253037611809695, 'name': '.rsrc', 'virtual_size': '0x002db564'} description A section with a high entropy has been found
entropy 0.8477252970153578 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (8 个事件)
Process injection Process 2616 called NtSetContextThread to modify thread in remote process 2364
Process injection Process 2364 called NtSetContextThread to modify thread in remote process 2240
Process injection Process 2240 called NtSetContextThread to modify thread in remote process 3040
Process injection Process 3040 called NtSetContextThread to modify thread in remote process 1824
Time & API Arguments Status Return Repeated
1619596030.734125
NtSetContextThread
thread_handle: 0x000000f8
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4822924
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2364
success 0 0
1619596032.344375
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4646336
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2240
success 0 0
1619603459.741875
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4860700
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3040
success 0 0
1619603479.163
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 2010382788
registers.esp: 1638384
registers.edi: 0
registers.eax: 4973232
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1824
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (8 个事件)
Process injection Process 2616 resumed a thread in remote process 2364
Process injection Process 2364 resumed a thread in remote process 2240
Process injection Process 2240 resumed a thread in remote process 3040
Process injection Process 3040 resumed a thread in remote process 1824
Time & API Arguments Status Return Repeated
1619596031.375125
NtResumeThread
thread_handle: 0x000000f8
suspend_count: 1
process_identifier: 2364
success 0 0
1619596033.031375
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2240
success 0 0
1619603460.725875
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 3040
success 0 0
1619603479.741
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 1824
success 0 0
Executed a process and injected code into it, probably while unpacking (25 个事件)
Time & API Arguments Status Return Repeated
1619596030.578125
CreateProcessInternalW
thread_identifier: 3064
thread_handle: 0x000000f8
process_identifier: 2364
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\6eadedb48adb421e83cce9d1562a330d.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619596030.578125
NtUnmapViewOfSection
process_identifier: 2364
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1619596030.578125
NtMapViewOfSection
section_handle: 0x00000104
process_identifier: 2364
commit_size: 2682880
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 2682880
base_address: 0x00400000
success 0 0
1619596030.734125
NtGetContextThread
thread_handle: 0x000000f8
success 0 0
1619596030.734125
NtSetContextThread
thread_handle: 0x000000f8
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4822924
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2364
success 0 0
1619596031.375125
NtResumeThread
thread_handle: 0x000000f8
suspend_count: 1
process_identifier: 2364
success 0 0
1619596032.172375
CreateProcessInternalW
thread_identifier: 3000
thread_handle: 0x000000fc
process_identifier: 2240
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\6eadedb48adb421e83cce9d1562a330d.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619596032.172375
NtUnmapViewOfSection
process_identifier: 2240
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619596032.203375
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 2240
commit_size: 1777664
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 1777664
base_address: 0x00400000
success 0 0
1619596032.344375
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1619596032.344375
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4646336
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2240
success 0 0
1619596033.031375
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2240
success 0 0
1619603459.632875
CreateProcessInternalW
thread_identifier: 2860
thread_handle: 0x000000fc
process_identifier: 3040
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\6eadedb48adb421e83cce9d1562a330d.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619603459.632875
NtUnmapViewOfSection
process_identifier: 3040
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619603459.647875
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 3040
commit_size: 1110016
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 1110016
base_address: 0x00400000
success 0 0
1619603459.710875
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1619603459.741875
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4860700
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3040
success 0 0
1619603460.725875
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 3040
success 0 0
1619603479.053
CreateProcessInternalW
thread_identifier: 2948
thread_handle: 0x000000fc
process_identifier: 1824
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\6eadedb48adb421e83cce9d1562a330d.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619603479.053
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1619603479.053
NtUnmapViewOfSection
process_identifier: 1824
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619603479.085
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 1824
commit_size: 786432
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 786432
base_address: 0x00400000
success 0 0
1619603479.132
NtMapViewOfSection
section_handle: 0x00000104
process_identifier: 1824
commit_size: 4096
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 4096
base_address: 0x001e0000
success 0 0
1619603479.163
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 2010382788
registers.esp: 1638384
registers.edi: 0
registers.eax: 4973232
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1824
success 0 0
1619603479.741
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 1824
success 0 0
File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
DrWeb BackDoor.SpyBotNET.25
MicroWorld-eScan Trojan.GenericKD.34332335
FireEye Generic.mg.6eadedb48adb421e
CAT-QuickHeal Trojan.CryptIH.S15461267
McAfee Fareit-FPQ!6EADEDB48ADB
Cylance Unsafe
Zillya Trojan.Crypt.Win32.65023
Sangfor Malware
K7AntiVirus Riskware ( 0040eff71 )
Alibaba Trojan:Win32/DelfInject.ali2000015
K7GW Riskware ( 0040eff71 )
Cybereason malicious.da17e2
Arcabit Trojan.Generic.D20BDEAF
TrendMicro TrojanSpy.Win32.NEGASTEAL.DYSGXY
BitDefenderTheta Gen:NN.ZelphiF.34196.xJW@aORmpCei
Cyren W32/Injector.CUGE-8085
Symantec Trojan Horse
ESET-NOD32 a variant of Win32/GenKryptik.EQEG
TrendMicro-HouseCall TrojanSpy.Win32.NEGASTEAL.DYSGXY
Paloalto generic.ml
ClamAV Win.Dropper.Formbook-9257771-0
Kaspersky HEUR:Trojan.Win32.Crypt.gen
BitDefender Trojan.GenericKD.34332335
NANO-Antivirus Trojan.Win32.Crypt.hrlvez
AegisLab Trojan.Win32.Crypt.4!c
Tencent Win32.Trojan.Inject.Auto
Ad-Aware Trojan.GenericKD.34332335
VIPRE Trojan.Win32.Generic!BT
Invincea heuristic
Sophos Mal/Generic-S
Ikarus Trojan.Inject
Jiangmin Trojan.Crypt.dwe
Antiy-AVL Trojan/Win32.Crypt
Microsoft Trojan:Win32/Androm.VD!MTB
ViRobot Trojan.Win32.Z.Injector.3534848
ZoneAlarm HEUR:Trojan.Win32.Crypt.gen
GData Win32.Trojan.PSE.1BK8UAZ
AhnLab-V3 Suspicious/Win.Delphiless.X2091
ALYac Trojan.GenericKD.34332335
MAX malware (ai score=81)
VBA32 BScope.Adware.Kraddare
Malwarebytes Trojan.MalPack.DLF
APEX Malicious
Rising Trojan.Kryptik!1.CA3B (CLASSIC)
eGambit Unsafe.AI_Score_99%
Fortinet W32/Injector.EMZL!tr
MaxSecure Trojan.Malware.300983.susgen
AVG Win32:Trojan-gen
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x47d150 VirtualFree
• 0x47d154 VirtualAlloc
• 0x47d158 LocalFree
• 0x47d15c LocalAlloc
• 0x47d160 GetVersion
• 0x47d164 GetCurrentThreadId
• 0x47d170 VirtualQuery
• 0x47d174 WideCharToMultiByte
• 0x47d17c MultiByteToWideChar
• 0x47d180 lstrlenA
• 0x47d184 lstrcpynA
• 0x47d188 LoadLibraryExA
• 0x47d18c GetThreadLocale
• 0x47d190 GetStartupInfoA
• 0x47d194 GetProcAddress
• 0x47d198 GetModuleHandleA
• 0x47d19c GetModuleFileNameA
• 0x47d1a0 GetLocaleInfoA
• 0x47d1a4 GetLastError
• 0x47d1ac GetCommandLineA
• 0x47d1b0 FreeLibrary
• 0x47d1b4 FindFirstFileA
• 0x47d1b8 FindClose
• 0x47d1bc ExitProcess
• 0x47d1c0 WriteFile
• 0x47d1c8 RtlUnwind
• 0x47d1cc RaiseException
• 0x47d1d0 GetStdHandle
Library user32.dll:
• 0x47d1d8 GetKeyboardType
• 0x47d1dc LoadStringA
• 0x47d1e0 MessageBoxA
• 0x47d1e4 CharNextA
Library advapi32.dll:
• 0x47d1ec RegQueryValueExA
• 0x47d1f0 RegOpenKeyExA
• 0x47d1f4 RegCloseKey
Library oleaut32.dll:
• 0x47d1fc SysFreeString
• 0x47d200 SysReAllocStringLen
• 0x47d204 SysAllocStringLen
Library kernel32.dll:
• 0x47d20c TlsSetValue
• 0x47d210 TlsGetValue
• 0x47d214 LocalAlloc
• 0x47d218 GetModuleHandleA
Library advapi32.dll:
• 0x47d220 RegQueryValueExA
• 0x47d224 RegOpenKeyExA
• 0x47d228 RegCloseKey
Library kernel32.dll:
• 0x47d230 lstrcpyA
• 0x47d234 WriteFile
• 0x47d238 WaitForSingleObject
• 0x47d23c VirtualQuery
• 0x47d240 VirtualProtect
• 0x47d244 VirtualAlloc
• 0x47d248 Sleep
• 0x47d24c SizeofResource
• 0x47d250 SetThreadLocale
• 0x47d254 SetFilePointer
• 0x47d258 SetEvent
• 0x47d25c SetErrorMode
• 0x47d260 SetEndOfFile
• 0x47d264 ResetEvent
• 0x47d268 ReadFile
• 0x47d26c MulDiv
• 0x47d270 LockResource
• 0x47d274 LoadResource
• 0x47d278 LoadLibraryA
• 0x47d284 GlobalUnlock
• 0x47d288 GlobalReAlloc
• 0x47d28c GlobalHandle
• 0x47d290 GlobalLock
• 0x47d294 GlobalFree
• 0x47d298 GlobalFindAtomA
• 0x47d29c GlobalDeleteAtom
• 0x47d2a0 GlobalAlloc
• 0x47d2a4 GlobalAddAtomA
• 0x47d2a8 GetVersionExA
• 0x47d2ac GetVersion
• 0x47d2b0 GetTickCount
• 0x47d2b4 GetThreadLocale
• 0x47d2bc GetSystemInfo
• 0x47d2c0 GetStringTypeExA
• 0x47d2c4 GetStdHandle
• 0x47d2c8 GetProcAddress
• 0x47d2cc GetModuleHandleA
• 0x47d2d0 GetModuleFileNameA
• 0x47d2d4 GetLocaleInfoA
• 0x47d2d8 GetLocalTime
• 0x47d2dc GetLastError
• 0x47d2e0 GetFullPathNameA
• 0x47d2e4 GetFileAttributesA
• 0x47d2e8 GetDiskFreeSpaceA
• 0x47d2ec GetDateFormatA
• 0x47d2f0 GetCurrentThreadId
• 0x47d2f4 GetCurrentProcessId
• 0x47d2f8 GetCPInfo
• 0x47d2fc GetACP
• 0x47d300 FreeResource
• 0x47d304 InterlockedExchange
• 0x47d308 FreeLibrary
• 0x47d30c FormatMessageA
• 0x47d310 FindResourceA
• 0x47d314 FindNextFileA
• 0x47d318 FindFirstFileA
• 0x47d31c FindClose
• 0x47d32c EnumCalendarInfoA
• 0x47d338 CreateThread
• 0x47d33c CreateFileA
• 0x47d340 CreateEventA
• 0x47d344 CompareStringA
• 0x47d348 CloseHandle
Library version.dll:
• 0x47d350 VerQueryValueA
• 0x47d358 GetFileVersionInfoA
Library gdi32.dll:
• 0x47d360 UnrealizeObject
• 0x47d364 StretchBlt
• 0x47d368 SetWindowOrgEx
• 0x47d36c SetWindowExtEx
• 0x47d370 SetWinMetaFileBits
• 0x47d374 SetViewportOrgEx
• 0x47d378 SetViewportExtEx
• 0x47d37c SetTextColor
• 0x47d380 SetStretchBltMode
• 0x47d384 SetROP2
• 0x47d388 SetPixel
• 0x47d38c SetMapMode
• 0x47d390 SetEnhMetaFileBits
• 0x47d394 SetDIBColorTable
• 0x47d398 SetBrushOrgEx
• 0x47d39c SetBkMode
• 0x47d3a0 SetBkColor
• 0x47d3a4 SelectPalette
• 0x47d3a8 SelectObject
• 0x47d3ac SaveDC
• 0x47d3b0 RestoreDC
• 0x47d3b4 Rectangle
• 0x47d3b8 RectVisible
• 0x47d3bc RealizePalette
• 0x47d3c0 Polyline
• 0x47d3c4 PolyPolyline
• 0x47d3c8 PlayEnhMetaFile
• 0x47d3cc PatBlt
• 0x47d3d0 MoveToEx
• 0x47d3d4 MaskBlt
• 0x47d3d8 LineTo
• 0x47d3dc IntersectClipRect
• 0x47d3e0 GetWindowOrgEx
• 0x47d3e4 GetWinMetaFileBits
• 0x47d3e8 GetTextMetricsA
• 0x47d3f4 GetStockObject
• 0x47d3f8 GetPixel
• 0x47d3fc GetPaletteEntries
• 0x47d400 GetObjectA
• 0x47d40c GetEnhMetaFileBits
• 0x47d410 GetDeviceCaps
• 0x47d414 GetDIBits
• 0x47d418 GetDIBColorTable
• 0x47d41c GetDCOrgEx
• 0x47d424 GetClipBox
• 0x47d428 GetBrushOrgEx
• 0x47d42c GetBitmapBits
• 0x47d430 ExtCreatePen
• 0x47d434 ExcludeClipRect
• 0x47d438 DeleteObject
• 0x47d43c DeleteEnhMetaFile
• 0x47d440 DeleteDC
• 0x47d444 CreateSolidBrush
• 0x47d448 CreatePenIndirect
• 0x47d44c CreatePalette
• 0x47d454 CreateFontIndirectA
• 0x47d458 CreateDIBitmap
• 0x47d45c CreateDIBSection
• 0x47d460 CreateCompatibleDC
• 0x47d468 CreateBrushIndirect
• 0x47d46c CreateBitmap
• 0x47d470 CopyEnhMetaFileA
• 0x47d474 BitBlt
Library user32.dll:
• 0x47d47c CreateWindowExA
• 0x47d480 WindowFromPoint
• 0x47d484 WinHelpA
• 0x47d488 WaitMessage
• 0x47d48c ValidateRect
• 0x47d490 UpdateWindow
• 0x47d494 UnregisterClassA
• 0x47d498 UnionRect
• 0x47d49c UnhookWindowsHookEx
• 0x47d4a0 TranslateMessage
• 0x47d4a8 TrackPopupMenu
• 0x47d4b0 ShowWindow
• 0x47d4b4 ShowScrollBar
• 0x47d4b8 ShowOwnedPopups
• 0x47d4bc ShowCursor
• 0x47d4c0 SetWindowsHookExA
• 0x47d4c4 SetWindowTextA
• 0x47d4c8 SetWindowPos
• 0x47d4cc SetWindowPlacement
• 0x47d4d0 SetWindowLongA
• 0x47d4d4 SetTimer
• 0x47d4d8 SetScrollRange
• 0x47d4dc SetScrollPos
• 0x47d4e0 SetScrollInfo
• 0x47d4e4 SetRect
• 0x47d4e8 SetPropA
• 0x47d4ec SetParent
• 0x47d4f0 SetMenuItemInfoA
• 0x47d4f4 SetMenu
• 0x47d4f8 SetKeyboardState
• 0x47d4fc SetForegroundWindow
• 0x47d500 SetFocus
• 0x47d504 SetCursor
• 0x47d508 SetClipboardData
• 0x47d50c SetClassLongA
• 0x47d510 SetCapture
• 0x47d514 SetActiveWindow
• 0x47d518 SendMessageA
• 0x47d51c ScrollWindowEx
• 0x47d520 ScrollWindow
• 0x47d524 ScreenToClient
• 0x47d528 RemovePropA
• 0x47d52c RemoveMenu
• 0x47d530 ReleaseDC
• 0x47d534 ReleaseCapture
• 0x47d540 RegisterClassA
• 0x47d544 RedrawWindow
• 0x47d548 PtInRect
• 0x47d54c PostQuitMessage
• 0x47d550 PostMessageA
• 0x47d554 PeekMessageA
• 0x47d558 OpenClipboard
• 0x47d55c OffsetRect
• 0x47d560 OemToCharA
• 0x47d564 MessageBoxA
• 0x47d568 MessageBeep
• 0x47d56c MapWindowPoints
• 0x47d570 MapVirtualKeyA
• 0x47d574 LoadStringA
• 0x47d578 LoadKeyboardLayoutA
• 0x47d57c LoadIconA
• 0x47d580 LoadCursorA
• 0x47d584 LoadBitmapA
• 0x47d588 KillTimer
• 0x47d58c IsZoomed
• 0x47d590 IsWindowVisible
• 0x47d594 IsWindowEnabled
• 0x47d598 IsWindow
• 0x47d59c IsRectEmpty
• 0x47d5a0 IsIconic
• 0x47d5a4 IsDialogMessageA
• 0x47d5a8 IsChild
• 0x47d5ac IsCharAlphaNumericA
• 0x47d5b0 IsCharAlphaA
• 0x47d5b4 InvalidateRect
• 0x47d5b8 IntersectRect
• 0x47d5bc InsertMenuItemA
• 0x47d5c0 InsertMenuA
• 0x47d5c4 InflateRect
• 0x47d5cc GetWindowTextA
• 0x47d5d0 GetWindowRect
• 0x47d5d4 GetWindowPlacement
• 0x47d5d8 GetWindowLongA
• 0x47d5dc GetWindowDC
• 0x47d5e0 GetTopWindow
• 0x47d5e4 GetSystemMetrics
• 0x47d5e8 GetSystemMenu
• 0x47d5ec GetSysColorBrush
• 0x47d5f0 GetSysColor
• 0x47d5f4 GetSubMenu
• 0x47d5f8 GetScrollRange
• 0x47d5fc GetScrollPos
• 0x47d600 GetScrollInfo
• 0x47d604 GetPropA
• 0x47d608 GetParent
• 0x47d60c GetWindow
• 0x47d610 GetMessageTime
• 0x47d614 GetMenuStringA
• 0x47d618 GetMenuState
• 0x47d61c GetMenuItemInfoA
• 0x47d620 GetMenuItemID
• 0x47d624 GetMenuItemCount
• 0x47d628 GetMenu
• 0x47d62c GetLastActivePopup
• 0x47d630 GetKeyboardState
• 0x47d638 GetKeyboardLayout
• 0x47d63c GetKeyState
• 0x47d640 GetKeyNameTextA
• 0x47d644 GetInputState
• 0x47d648 GetIconInfo
• 0x47d64c GetForegroundWindow
• 0x47d650 GetFocus
• 0x47d654 GetDoubleClickTime
• 0x47d658 GetDlgItem
• 0x47d65c GetDesktopWindow
• 0x47d660 GetDCEx
• 0x47d664 GetDC
• 0x47d668 GetCursorPos
• 0x47d66c GetCursor
• 0x47d670 GetClipboardData
• 0x47d674 GetClientRect
• 0x47d678 GetClassNameA
• 0x47d67c GetClassInfoA
• 0x47d680 GetCaretPos
• 0x47d684 GetCapture
• 0x47d688 GetActiveWindow
• 0x47d68c FrameRect
• 0x47d690 FindWindowA
• 0x47d694 FillRect
• 0x47d698 EqualRect
• 0x47d69c EnumWindows
• 0x47d6a0 EnumThreadWindows
• 0x47d6a8 EndPaint
• 0x47d6ac EnableWindow
• 0x47d6b0 EnableScrollBar
• 0x47d6b4 EnableMenuItem
• 0x47d6b8 EmptyClipboard
• 0x47d6bc DrawTextA
• 0x47d6c0 DrawMenuBar
• 0x47d6c4 DrawIconEx
• 0x47d6c8 DrawIcon
• 0x47d6cc DrawFrameControl
• 0x47d6d0 DrawFocusRect
• 0x47d6d4 DrawEdge
• 0x47d6d8 DispatchMessageA
• 0x47d6dc DestroyWindow
• 0x47d6e0 DestroyMenu
• 0x47d6e4 DestroyIcon
• 0x47d6e8 DestroyCursor
• 0x47d6ec DeleteMenu
• 0x47d6f0 DefWindowProcA
• 0x47d6f4 DefMDIChildProcA
• 0x47d6f8 DefFrameProcA
• 0x47d6fc CreatePopupMenu
• 0x47d700 CreateMenu
• 0x47d704 CreateIcon
• 0x47d708 CloseClipboard
• 0x47d70c ClientToScreen
• 0x47d710 CheckMenuItem
• 0x47d714 CallWindowProcA
• 0x47d718 CallNextHookEx
• 0x47d71c BeginPaint
• 0x47d720 CharNextA
• 0x47d724 CharLowerBuffA
• 0x47d728 CharLowerA
• 0x47d72c CharUpperBuffA
• 0x47d730 CharToOemA
• 0x47d734 AdjustWindowRectEx
Library kernel32.dll:
• 0x47d740 Sleep
Library oleaut32.dll:
• 0x47d748 SafeArrayPtrOfIndex
• 0x47d74c SafeArrayGetUBound
• 0x47d750 SafeArrayGetLBound
• 0x47d754 SafeArrayCreate
• 0x47d758 VariantChangeType
• 0x47d75c VariantCopy
• 0x47d760 VariantClear
• 0x47d764 VariantInit
Library comctl32.dll:
• 0x47d774 ImageList_Write
• 0x47d778 ImageList_Read
• 0x47d788 ImageList_DragMove
• 0x47d78c ImageList_DragLeave
• 0x47d790 ImageList_DragEnter
• 0x47d794 ImageList_EndDrag
• 0x47d798 ImageList_BeginDrag
• 0x47d79c ImageList_Remove
• 0x47d7a0 ImageList_DrawEx
• 0x47d7a4 ImageList_Replace
• 0x47d7a8 ImageList_Draw
• 0x47d7b8 ImageList_Add
• 0x47d7c0 ImageList_Destroy
• 0x47d7c4 ImageList_Create
Library comdlg32.dll:
• 0x47d7cc GetSaveFileNameA
• 0x47d7d0 GetOpenFileNameA
Library kernel32.dll:
• 0x47d7d8 MulDiv

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 51809 239.255.255.250 3702
192.168.56.101 55369 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.