SmartHawk

9.8

极危

36 个模型检测该样本为恶意！

重新分析

下载样本

a63ce6907483799d05dedfe5f07fa6fdfa953e379ef8d2a82d357f4e0aede9c6

72f3b838560469465f661b22c9c0a38e.exe

分析耗时

182s

最近分析

文件大小

929.1KB

静态报毒动态报毒 ADWAREFILETOUR AGEN ARTEMIS CSDI CSDIMONETIZE EOREZO EZDPIZ GENERIC ML PUA GSFYY3 HIGH CONFIDENCE INNOSETUP LGGA MDQE QVM42 R280602 SCORE SUSGEN UNSAFE VIGUA VSNW1AI20 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Artemis!72F3B8385604	20201028	6.0.6.653
Alibaba	AdWare:Win32/Generic.2f0a074c	20190527	0.3.0.5
CrowdStrike		20190702	1.0
Baidu		20190318	1.0.0.2
Avast	Win32:Adware-gen [Adw]	20201028	18.4.3895.0
Kingsoft		20201028	2013.8.14.323

Checks if process is being debugged by a debugger (24 个事件)

Time & API	Arguments	Status	Return	Repeated
1620762763.312625 IsDebuggerPresent		failed	0	0
1620774543.76977 IsDebuggerPresent		failed	0	0
1620774543.92677 IsDebuggerPresent		failed	0	0
1620774558.33277 IsDebuggerPresent		failed	0	0
1620774558.47277 IsDebuggerPresent		failed	0	0
1620774558.51977 IsDebuggerPresent		failed	0	0
1620774558.73877 IsDebuggerPresent		failed	0	0
1620774558.78577 IsDebuggerPresent		failed	0	0
1620774558.80177 IsDebuggerPresent		failed	0	0
1620774558.84777 IsDebuggerPresent		failed	0	0
1620774560.30177 IsDebuggerPresent		failed	0	0
1620774562.76977 IsDebuggerPresent		failed	0	0
1620774567.70777 IsDebuggerPresent		failed	0	0
1620774567.97277 IsDebuggerPresent		failed	0	0
1620774569.66077 IsDebuggerPresent		failed	0	0
1620774572.92677 IsDebuggerPresent		failed	0	0
1620774573.72277 IsDebuggerPresent		failed	0	0
1620774576.84777 IsDebuggerPresent		failed	0	0
1620774580.58277 IsDebuggerPresent		failed	0	0
1620774580.78577 IsDebuggerPresent		failed	0	0
1620774590.00477 IsDebuggerPresent		failed	0	0
1620774541.145395 IsDebuggerPresent		failed	0	0
1620774541.145395 IsDebuggerPresent		failed	0	0
1620774541.177395 IsDebuggerPresent		failed	0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 个事件)

file	C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome.dll

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620774969.173501 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620774592.47277 __exception__	stacktrace: registers.r14: 8550332354048 registers.r9: 0 registers.rcx: 1348 registers.rsi: -6148914691236517206 registers.r10: 0 registers.rbx: 257420496 registers.rdi: 17302540 registers.r11: 257424416 registers.r8: 2009563532 registers.rdx: 1320 registers.rbp: 257420352 registers.r15: 257420856 registers.r12: 257421256 registers.rsp: 257420200 registers.rax: 11021824 registers.r13: 8550333349888 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0	success	0	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)

suspicious_features

POST method with no referer header

suspicious_request

POST https://update.googleapis.com/service/update2?cup2key=10:313186307&cup2hreq=c584302a123f350bb0571ff22c705132088a6b47744f8c501a45b52ba39544fe

Performs some HTTP requests (1 个事件)

request

POST https://update.googleapis.com/service/update2?cup2key=10:313186307&cup2hreq=c584302a123f350bb0571ff22c705132088a6b47744f8c501a45b52ba39544fe

Sends data using the HTTP POST Method (1 个事件)

request

POST https://update.googleapis.com/service/update2?cup2key=10:313186307&cup2hreq=c584302a123f350bb0571ff22c705132088a6b47744f8c501a45b52ba39544fe

Allocates read-write-execute memory (usually to unpack itself) (5 个事件)

Time & API	Arguments	Status
1620762763.281625 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1620762763.281625 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 45056 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00401000	success
1620762763.281625 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00410000	success
1620774968.157501 NtAllocateVirtualMemory	process_identifier: 2040 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00620000	success
1620774603.488895 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0000000004130000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

An application raised an exception which may be indicative of an exploit crash (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Application Crash	Process chrome.exe with pid 1752 crashed
1620774592.47277 __exception__	stacktrace: registers.r14: 8550332354048 registers.r9: 0 registers.rcx: 1348 registers.rsi: -6148914691236517206 registers.r10: 0 registers.rbx: 257420496 registers.rdi: 17302540 registers.r11: 257424416 registers.r8: 2009563532 registers.rdx: 1320 registers.rbp: 257420352 registers.r15: 257420856 registers.r12: 257421256 registers.rsp: 257420200 registers.rax: 11021824 registers.r13: 8550333349888 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0	success	0	0

Steals private information from local Internet browsers (26 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Crashpad\reports
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\BrowserMetrics-spare.pma
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma~RF2023a36.TMP
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\First Run
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_0
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_3
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_2
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\BrowserMetrics
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Crashpad\metadata
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Last Version
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-spare.pma
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-609B2309-6D8.pma
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Crashpad
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Crashpad\reports\202fa645-e2e9-4e30-b138-1106bfa61862.dmp
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Policy\User Policy
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\index
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Preferences

Creates executable files on the filesystem (4 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\is-B8LJO.tmp\_isetup\_isdecmp.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\is-B8LJO.tmp\idp.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\is-B8LJO.tmp\psvince.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\is-B8LJO.tmp\itdownload.dll

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1620774969.235501 Process32NextW	process_name: pythonw.exe snapshot_handle: 0x00000280 process_identifier: 2236	success	1	0
1620774969.235501 Process32NextW	process_name: 72f3b838560469465f661b22c9c0a38e.tmp snapshot_handle: 0x00000280 process_identifier: 2040	success	1	0

Communicates with host for which no DNS query was performed (2 个事件)

host	172.217.24.14
host	203.208.41.33

Creates a windows hook that monitors keyboard input (keylogger) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620774676.097895 SetWindowsHookExW	thread_identifier: 0 callback_function: 0x00000000ff35ae10 module_address: 0x00000000ff2b0000 hook_identifier: 13 (WH_KEYBOARD_LL)	success	721037	0

One or more non-safelisted processes were created (2 个事件)

parent_process	chrome.exe				martian_process	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xb0,0xb4,0xb8,0x84,0xbc,0x7fef2494f50,0x7fef2494f60,0x7fef2494f70
parent_process	chrome.exe				martian_process	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1108,6450110032266676171,5613193708995620305,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1112 /prefetch:2

Resumed a suspended thread in a remote process potentially indicative of process injection (26 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 300 resumed a thread in remote process 1752
1620774602.364395 NtResumeThread	thread_handle: 0x0000000000000140 suspend_count: 2 process_identifier: 1752	success	0	0
1620774602.458395 NtResumeThread	thread_handle: 0x0000000000000140 suspend_count: 2 process_identifier: 1752	success	0	0
1620774602.536395 NtResumeThread	thread_handle: 0x0000000000000140 suspend_count: 2 process_identifier: 1752	success	0	0
1620774602.692395 NtResumeThread	thread_handle: 0x0000000000000140 suspend_count: 2 process_identifier: 1752	success	0	0
1620774602.786395 NtResumeThread	thread_handle: 0x0000000000000140 suspend_count: 2 process_identifier: 1752	success	0	0
1620774602.880395 NtResumeThread	thread_handle: 0x0000000000000140 suspend_count: 2 process_identifier: 1752	success	0	0
1620774603.036395 NtResumeThread	thread_handle: 0x0000000000000140 suspend_count: 2 process_identifier: 1752	success	0	0
1620774603.130395 NtResumeThread	thread_handle: 0x0000000000000140 suspend_count: 2 process_identifier: 1752	success	0	0
1620774603.208395 NtResumeThread	thread_handle: 0x0000000000000140 suspend_count: 2 process_identifier: 1752	success	0	0
1620774605.223395 NtResumeThread	thread_handle: 0x0000000000000140 suspend_count: 2 process_identifier: 1752	success	0	0
1620774611.380395 NtResumeThread	thread_handle: 0x0000000000000140 suspend_count: 2 process_identifier: 1752	success	0	0
1620774616.005395 NtResumeThread	thread_handle: 0x0000000000000140 suspend_count: 2 process_identifier: 1752	success	0	0
1620774620.020395 NtResumeThread	thread_handle: 0x0000000000000140 suspend_count: 2 process_identifier: 1752	success	0	0
1620774622.489395 NtResumeThread	thread_handle: 0x0000000000000140 suspend_count: 2 process_identifier: 1752	success	0	0
1620774625.145395 NtResumeThread	thread_handle: 0x0000000000000140 suspend_count: 2 process_identifier: 1752	success	0	0
1620774629.223395 NtResumeThread	thread_handle: 0x0000000000000140 suspend_count: 2 process_identifier: 1752	success	0	0
1620774632.145395 NtResumeThread	thread_handle: 0x0000000000000140 suspend_count: 2 process_identifier: 1752	success	0	0
1620774634.786395 NtResumeThread	thread_handle: 0x0000000000000140 suspend_count: 2 process_identifier: 1752	success	0	0
1620774638.802395 NtResumeThread	thread_handle: 0x0000000000000140 suspend_count: 2 process_identifier: 1752	success	0	0
1620774640.614395 NtResumeThread	thread_handle: 0x0000000000000140 suspend_count: 2 process_identifier: 1752	success	0	0
1620774642.473395 NtResumeThread	thread_handle: 0x0000000000000140 suspend_count: 2 process_identifier: 1752	success	0	0
1620774646.239395 NtResumeThread	thread_handle: 0x0000000000000140 suspend_count: 2 process_identifier: 1752	success	0	0
1620774650.677395 NtResumeThread	thread_handle: 0x0000000000000140 suspend_count: 2 process_identifier: 1752	success	0	0
1620774655.192395 NtResumeThread	thread_handle: 0x0000000000000140 suspend_count: 2 process_identifier: 1752	success	0	0
1620774658.755395 NtResumeThread	thread_handle: 0x0000000000000140 suspend_count: 2 process_identifier: 1752	success	0	0

File has been identified by 36 AntiVirus engines on VirusTotal as malicious (36 个事件)

Elastic	malicious (high confidence)
McAfee	Artemis!72F3B8385604
Cylance	Unsafe
Zillya	Downloader.Adload.Win32.80003
K7AntiVirus	Adware ( 00519ead1 )
Alibaba	AdWare:Win32/Generic.2f0a074c
K7GW	Adware ( 00519ead1 )
Invincea	Generic ML PUA (PUA)
Cyren	W32/Trojan.LGGA-6979
Symantec	PUA.Gen.2
APEX	Malicious
Paloalto	generic.ml
Kaspersky	not-a-virus:AdWare.MSIL.Csdi.gen
NANO-Antivirus	Trojan.InnoSetup.Dwn.ezdpiz
AegisLab	Adware.MSIL.Csdi.2!c
Avast	Win32:Adware-gen [Adw]
DrWeb	Adware.Eorezo.1011
TrendMicro	TROJ_FRS.VSNW1AI20
McAfee-GW-Edition	BehavesLike.Win32.AdwareFileTour.dc
Jiangmin	AdWare.MSIL.mdqe
Webroot	W32.Adware.Gen
Avira	HEUR/AGEN.1101524
Microsoft	PUA:Win32/Vigua.A
ViRobot	Adware.Agent.951440
ZoneAlarm	not-a-virus:AdWare.MSIL.Csdi.gen
GData	Win32.Trojan.Agent.GSFYY3
Cynet	Malicious (score: 85)
AhnLab-V3	PUP/Win32.RL_Generic.R280602
VBA32	Adware.MSIL.Csdi
Malwarebytes	Adware.Csdimonetize
ESET-NOD32	a variant of Win32/Adware.Agent.NSU
TrendMicro-HouseCall	TROJ_FRS.VSNW1AI20
MaxSecure	Trojan.Malware.74215634.susgen
Fortinet	Adware/Csdi
AVG	Win32:Adware-gen [Adw]
Qihoo-360	Generic/HEUR/QVM42.3.A6A9.Malware.Gen

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443
dead_host	172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x40e0b4 DeleteCriticalSection

• 0x40e0b8 LeaveCriticalSection

• 0x40e0bc EnterCriticalSection

• 0x40e0c0 InitializeCriticalSection

• 0x40e0c4 VirtualFree

• 0x40e0c8 VirtualAlloc

• 0x40e0cc LocalFree

• 0x40e0d0 LocalAlloc

• 0x40e0d4 WideCharToMultiByte

• 0x40e0d8 TlsSetValue

• 0x40e0dc TlsGetValue

• 0x40e0e0 MultiByteToWideChar

• 0x40e0e4 GetModuleHandleA

• 0x40e0e8 GetLastError

• 0x40e0ec GetCommandLineA

• 0x40e0f0 WriteFile

• 0x40e0f4 SetFilePointer

• 0x40e0f8 SetEndOfFile

• 0x40e0fc RtlUnwind

• 0x40e100 ReadFile

• 0x40e104 RaiseException

• 0x40e108 GetStdHandle

• 0x40e10c GetFileSize

• 0x40e110 GetSystemTime

• 0x40e114 GetFileType

• 0x40e118 ExitProcess

• 0x40e11c CreateFileA

• 0x40e120 CloseHandle

Library user32.dll:

• 0x40e128 MessageBoxA

Library oleaut32.dll:

• 0x40e130 VariantChangeTypeEx

• 0x40e134 VariantCopyInd

• 0x40e138 VariantClear

• 0x40e13c SysStringLen

• 0x40e140 SysAllocStringLen

Library advapi32.dll:

• 0x40e148 RegQueryValueExA

• 0x40e14c RegOpenKeyExA

• 0x40e150 RegCloseKey

• 0x40e154 OpenProcessToken

• 0x40e158 LookupPrivilegeValueA

Library kernel32.dll:

• 0x40e160 WriteFile

• 0x40e164 VirtualQuery

• 0x40e168 VirtualProtect

• 0x40e16c VirtualFree

• 0x40e170 VirtualAlloc

• 0x40e174 Sleep

• 0x40e178 SizeofResource

• 0x40e17c SetLastError

• 0x40e180 SetFilePointer

• 0x40e184 SetErrorMode

• 0x40e188 SetEndOfFile

• 0x40e18c RemoveDirectoryA

• 0x40e190 ReadFile

• 0x40e194 LockResource

• 0x40e198 LoadResource

• 0x40e19c LoadLibraryA

• 0x40e1a0 IsDBCSLeadByte

• 0x40e1a4 GetWindowsDirectoryA

• 0x40e1a8 GetVersionExA

• 0x40e1ac GetVersion

• 0x40e1b0 GetUserDefaultLangID

• 0x40e1b4 GetSystemInfo

• 0x40e1b8 GetSystemDirectoryA

• 0x40e1bc GetSystemDefaultLCID

• 0x40e1c0 GetProcAddress

• 0x40e1c4 GetModuleHandleA

• 0x40e1c8 GetModuleFileNameA

• 0x40e1cc GetLocaleInfoA

• 0x40e1d0 GetLastError

• 0x40e1d4 GetFullPathNameA

• 0x40e1d8 GetFileSize

• 0x40e1dc GetFileAttributesA

• 0x40e1e0 GetExitCodeProcess

• 0x40e1e4 GetEnvironmentVariableA

• 0x40e1e8 GetCurrentProcess

• 0x40e1ec GetCommandLineA

• 0x40e1f0 GetACP

• 0x40e1f4 InterlockedExchange

• 0x40e1f8 FormatMessageA

• 0x40e1fc FindResourceA

• 0x40e200 DeleteFileA

• 0x40e204 CreateProcessA

• 0x40e208 CreateFileA

• 0x40e20c CreateDirectoryA

• 0x40e210 CloseHandle

Library user32.dll:

• 0x40e218 TranslateMessage

• 0x40e21c SetWindowLongA

• 0x40e220 PeekMessageA

• 0x40e224 MsgWaitForMultipleObjects

• 0x40e228 MessageBoxA

• 0x40e22c LoadStringA

• 0x40e230 ExitWindowsEx

• 0x40e234 DispatchMessageA

• 0x40e238 DestroyWindow

• 0x40e23c CreateWindowExA

• 0x40e240 CallWindowProcA

• 0x40e244 CharPrevA

Library comctl32.dll:

• 0x40e24c InitCommonControls

Library advapi32.dll:

• 0x40e254 AdjustTokenPrivileges

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com A 216.58.200.46 A 172.217.160.78	216.58.200.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
update.googleapis.com	A 203.208.40.98
teredo.ipv6.microsoft.com

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49191	203.208.40.98 update.googleapis.com	443

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53210	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	54260	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60088	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	58970	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.