16.8
0-day
54 个模型检测该样本为恶意！
重新分析
更多

6d2e1786fd467c2e6015b9a1efe0823457c38127822a1b707aa6da5132a3d04a

79707819022534894896e0c348aaf6f2.exe

分析耗时

95s

最近分析

文件大小

535.0KB
静态报毒 动态报毒 100% AI SCORE=80 AIRW ALI1000123 ATTRIBUTE AZORULT BARYS CLOUD CONFIDENCE ELDORADO FAREIT GDSDA HIGH CONFIDENCE HIGHCONFIDENCE HM0@AKIVAPC HRLSZO JOBCRYPTER KRYPTIK LCZA MALICIOUS PE PACKEDNET QUASAR R002C0WHA20 R348754 RATX RUNNER SCORE SMARTASSEMBLY STIMILINA SUSGEN TFEJX TSCOPE UNCLASSIFIEDMALWARE@0 UNSAFE ZEMSILF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/runner.ali1000123 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Avast Win32:RATX-gen [Trj] 20200825 18.4.3895.0
Tencent Msil.Trojan-spy.Quasar.Airw 20200826 1.0.0.1
Baidu 20190318 1.0.0.2
Kingsoft 20200826 2013.8.14.323
McAfee Fareit-FYD!797078190225 20200825 6.0.6.653
静态指标
Queries for the computername (10 个事件)
Time & API Arguments Status Return Repeated
1619649245.730131
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619649245.745131
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619653899.01975
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619653899.01975
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619653934.7845
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619653936.5035
GetComputerNameA
computer_name: OSKAR-PC
success 1 0
1619653936.5035
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619653906.753375
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619653910.300375
GetComputerNameA
computer_name: OSKAR-PC
success 1 0
1619653910.300375
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (12 个事件)
Time & API Arguments Status Return Repeated
1619649224.824131
IsDebuggerPresent
failed 0 0
1619649224.824131
IsDebuggerPresent
failed 0 0
1619653897.94175
IsDebuggerPresent
failed 0 0
1619653897.94175
IsDebuggerPresent
failed 0 0
1619653900.5035
IsDebuggerPresent
failed 0 0
1619653900.5195
IsDebuggerPresent
failed 0 0
1619653936.2225
IsDebuggerPresent
failed 0 0
1619653936.5665
IsDebuggerPresent
failed 0 0
1619653899.612375
IsDebuggerPresent
failed 0 0
1619653899.612375
IsDebuggerPresent
failed 0 0
1619653910.206375
IsDebuggerPresent
failed 0 0
1619653910.409375
IsDebuggerPresent
failed 0 0
Command line console output was observed (4 个事件)
Time & API Arguments Status Return Repeated
1619653900.597875
WriteConsoleW
buffer: 已复制 1 个文件。
console_handle: 0x00000007
success 1 0
1619653900.90975
WriteConsoleW
buffer: 已复制 1 个文件。
console_handle: 0x00000007
success 1 0
1619653910.5035
WriteConsoleW
buffer: 操作成功完成。
console_handle: 0x00000007
success 1 0
1619653910.4415
WriteConsoleW
buffer: 操作成功完成。
console_handle: 0x00000007
success 1 0
Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619649224.855131
GlobalMemoryStatusEx
success 1 0
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619653898.22275
__exception__
stacktrace: 
0x9c0a4b
0x9c0080
DllUnregisterServerInternal-0x3e21 clr+0x21db @ 0x73e721db
CoUninitializeEE+0x6862 DllRegisterServerInternal-0xc91e clr+0x24a2a @ 0x73e94a2a
CoUninitializeEE+0x6a04 DllRegisterServerInternal-0xc77c clr+0x24bcc @ 0x73e94bcc
CoUninitializeEE+0x6a39 DllRegisterServerInternal-0xc747 clr+0x24c01 @ 0x73e94c01
CoUninitializeEE+0x6a59 DllRegisterServerInternal-0xc727 clr+0x24c21 @ 0x73e94c21
GetCLRFunction+0xc08 GetMetaDataPublicInterfaceFromInternal-0x8a65 clr+0xece82 @ 0x73f5ce82
GetCLRFunction+0xd16 GetMetaDataPublicInterfaceFromInternal-0x8957 clr+0xecf90 @ 0x73f5cf90
GetCLRFunction+0xb2a GetMetaDataPublicInterfaceFromInternal-0x8b43 clr+0xecda4 @ 0x73f5cda4
GetCLRFunction+0xf1f GetMetaDataPublicInterfaceFromInternal-0x874e clr+0xed199 @ 0x73f5d199
GetCLRFunction+0xe20 GetMetaDataPublicInterfaceFromInternal-0x884d clr+0xed09a @ 0x73f5d09a
_CorExeMain+0x1c SetRuntimeInfo-0x181d clr+0x16af00 @ 0x73fdaf00
_CorExeMain+0x38 _CorExeMain2-0x134 mscoreei+0x55ab @ 0x750a55ab
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x754e7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x754e4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1438076
registers.edi: 0
registers.eax: 13
registers.ebp: 1438112
registers.edx: 44069816
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: 8b 53 04 83 c2 01 0f 80 24 01 00 00 b9 5a 43 c1
exception.instruction: mov edx, dword ptr [ebx + 4]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x9c98e6
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (50 out of 395 个事件)
Time & API Arguments Status Return Repeated
1619649224.495131
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x750a1000
success 0 0
1619649224.495131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 2031616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x009a0000
success 0 0
1619649224.495131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00b50000
success 0 0
1619649224.652131
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e71000
success 0 0
1619649224.652131
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74fc1000
success 0 0
1619649224.683131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 983040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00730000
success 0 0
1619649224.683131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007e0000
success 0 0
1619649224.745131
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e71000
success 0 0
1619649224.824131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 2293760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02ac0000
success 0 0
1619649224.824131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02cb0000
success 0 0
1619649224.839131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004da000
success 0 0
1619649224.839131
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e72000
success 0 0
1619649224.839131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004d2000
success 0 0
1619649225.011131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004f2000
success 0 0
1619649225.074131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00715000
success 0 0
1619649225.074131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0071b000
success 0 0
1619649225.074131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00717000
success 0 0
1619649225.120131
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75091000
success 0 0
1619649225.167131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004f3000
success 0 0
1619649225.214131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004fc000
success 0 0
1619649225.245131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004f4000
success 0 0
1619649225.261131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00880000
success 0 0
1619649225.480131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004f5000
success 0 0
1619649225.480131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004f6000
success 0 0
1619649225.511131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004f7000
success 0 0
1619649225.527131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00881000
success 0 0
1619649225.558131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00706000
success 0 0
1619649225.605131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004f8000
success 0 0
1619649225.620131
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74fa1000
success 0 0
1619649225.667131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0070a000
success 0 0
1619649225.667131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00707000
success 0 0
1619649225.683131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00882000
success 0 0
1619649225.683131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00883000
success 0 0
1619649225.745131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00884000
success 0 0
1619649225.792131
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74f81000
success 0 0
1619649225.839131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004f9000
success 0 0
1619649225.995131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00887000
success 0 0
1619649226.027131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00888000
success 0 0
1619649226.199131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00900000
success 0 0
1619649226.230131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0088a000
success 0 0
1619649226.261131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004fd000
success 0 0
1619649226.902131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00901000
success 0 0
1619649226.917131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0088b000
success 0 0
1619649226.949131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0088c000
success 0 0
1619649226.949131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00902000
success 0 0
1619649227.605131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0088d000
success 0 0
1619649227.683131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0088e000
success 0 0
1619649227.714131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0088f000
success 0 0
1619649227.761131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00903000
success 0 0
1619649227.777131
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02ac0000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Creates executable files on the filesystem (3 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\File.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\FolderN\name.exe.lnk
Creates hidden or system file (2 个事件)
Time & API Arguments Status Return Repeated
1619649227.636131
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\FolderN
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\FolderN
success 1 0
1619653899.45675
SetFileAttributesW
file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN)
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\FolderN
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\FolderN
success 1 0
Creates a shortcut to an executable file (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\FolderN\name.exe.lnk
Creates a suspicious process (8 个事件)
cmdline cmd.exe /c copy "C:/Users/Administrator.Oskar-PC/AppData/Local/Temp/File.exe" "%temp%\FolderN\name.exe" /Y
cmdline cmd.exe /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier
cmdline "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier
cmdline "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Administrator.Oskar-PC/AppData/Local/Temp/File.exe" "%temp%\FolderN\name.exe" /Y
cmdline "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Administrator.Oskar-PC/AppData/Local/Temp/79707819022534894896e0c348aaf6f2.exe" "%temp%\FolderN\name.exe" /Y
cmdline "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f
cmdline cmd.exe /c copy "C:/Users/Administrator.Oskar-PC/AppData/Local/Temp/79707819022534894896e0c348aaf6f2.exe" "%temp%\FolderN\name.exe" /Y
cmdline cmd.exe /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f
Drops a binary and executes it (3 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\File.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\svhost.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp.exe
Drops an executable to the user AppData folder (3 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\svhost.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\File.exe
Executes one or more WMI queries (1 个事件)
wmi Select * from Win32_ComputerSystem
A process created a hidden window (6 个事件)
Time & API Arguments Status Return Repeated
1619649228.917131
ShellExecuteExW
parameters: /c copy "C:/Users/Administrator.Oskar-PC/AppData/Local/Temp/79707819022534894896e0c348aaf6f2.exe" "%temp%\FolderN\name.exe" /Y
filepath: cmd.exe
filepath_r: cmd.exe
show_type: 0
success 1 0
1619649237.464131
ShellExecuteExW
parameters: /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f
filepath: cmd.exe
filepath_r: cmd.exe
show_type: 0
success 1 0
1619649246.839131
ShellExecuteExW
parameters: /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier
filepath: cmd.exe
filepath_r: cmd.exe
show_type: 0
success 1 0
1619653900.19175
ShellExecuteExW
parameters: /c copy "C:/Users/Administrator.Oskar-PC/AppData/Local/Temp/File.exe" "%temp%\FolderN\name.exe" /Y
filepath: cmd.exe
filepath_r: cmd.exe
show_type: 0
success 1 0
1619653908.39475
ShellExecuteExW
parameters: /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f
filepath: cmd.exe
filepath_r: cmd.exe
show_type: 0
success 1 0
1619653917.89475
ShellExecuteExW
parameters: /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier
filepath: cmd.exe
filepath_r: cmd.exe
show_type: 0
success 1 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619653900.50375
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.38023345315362 section {'size_of_data': '0x00082c00', 'virtual_address': '0x00002000', 'entropy': 7.38023345315362, 'name': '.text', 'virtual_size': '0x00082a8a'} description A section with a high entropy has been found
entropy 0.9784845650140318 description Overall entropy of this PE file is high
Checks for the Locally Unique Identifier on the system for a suspicious privilege (4 个事件)
Time & API Arguments Status Return Repeated
1619649226.089131
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619653898.22275
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619653929.8945
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1619653904.253375
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
Uses Windows utilities for basic Windows functionality (3 个事件)
cmdline reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\FolderN\name.exe.lnk" /f
cmdline "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f
cmdline cmd.exe /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f
Executes one or more WMI queries which can be used to identify virtual machines (1 个事件)
wmi Select * from Win32_ComputerSystem
Modifies the ZoneTransfer.ZoneID in Zone.Identifier ADS, generally to disable security warnings (2 个事件)
Time & API Arguments Status Return Repeated
1619653918.222125
NtCreateFile
create_disposition: 5 (FILE_OVERWRITE_IF)
file_handle: 0x0000011c
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier
desired_access: 0x40100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE|GENERIC_WRITE)
file_attributes: 128 (FILE_ATTRIBUTE_NORMAL)
filepath_r: \??\C:\Users\ADMINI~1.OSK\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier
create_options: 96 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 2 (FILE_CREATED)
share_access: 1 (FILE_SHARE_READ)
success 0 0
1619653918.222125
NtWriteFile
file_handle: 0x0000011c
filepath:
buffer: [zoneTransfer]ZoneID = 2
offset: 0
success 0 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (2 个事件)
Time & API Arguments Status Return Repeated
1619649227.167131
NtAllocateVirtualMemory
process_identifier: 364
region_size: 131072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000358
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1619653898.94175
NtAllocateVirtualMemory
process_identifier: 2860
region_size: 131072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000344
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
Installs itself for autorun at Windows startup (2 个事件)
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load reg_value C:\Users\ADMINI~1.OSK\AppData\Local\Temp\FolderN\name.exe.lnk
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load reg_value C:\Users\ADMINI~1.OSK\AppData\Local\Temp\FolderN\name.exe.lnk
Potential code injection by writing to the memory of another process (8 个事件)
Time & API Arguments Status Return Repeated
1619649227.167131
WriteProcessMemory
process_identifier: 364
buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*àŽ ”*ø¡°@@ОàXCODE$’” `DATA”°˜@ÀBSS] ÀžÀ.idatažÐž@À.relocXà¦@PÆ@P
process_handle: 0x00000358
base_address: 0x00400000
success 1 0
1619649227.167131
WriteProcessMemory
process_identifier: 364
buffer: @2‹À@@@\@ì @l$@ËÌÈÉ×ÏÈÍÎÛØÚÙÊÜÝÞßàáãäå@Error‹ÀRuntime error at 00000000‹À0123456789ABCDEFÿÿÿÿ<P@‹À‹À@@J7<äºÏ¿}ªiFîµä[Jú-EœÝ]³QçëdÈAÈÈAÇA ÇAÀÈAàÉAüÆAìÈAðÆA„ÈAlÇA`ÈA¤ÆA`ÉAèÉA€ÈA°ÈA ÊA<ÇA”ÇAœÉAdÇAlÆAÈÉAPÈA(ÇAÄÉA¼ÈAìÉA´ÈAÈAœÈApÉAÉA$ÉAÉAÔÇAXÈA ÇA¸ÆA@ÉAÄÈAÇAÊA$ÈA\ÈAÆAÈAŒÉAÊAÀÆAÈA´°AHÈA¨ÈA@ÈA0ÊA|ÈALÉA¼ÉAÔÈAôÇAÜÉAxÉAÇAtÈAÈA°ÉA$ÊA¸ÇA ÉAÄÊA\ÉA|ÉA0ÈAèÈAäÉAˆÈApÈA˜ÈAXÇAøÆAHÉA0ÇAäÈAÌÈA|ÆA<ÈA4ÈAÈAŒÆAŒÈAèÆA|ÇAÇA˜ÇA8ÇAhÉAÌÉAÉADÈAàÈA,ÉA ÈA°ÇAÉA¨ÉA¸°A¸ÈAäÆAüÇA@ÊAÜÇA8ÉA°°AÊA¼ÆAÐÈA(ÊA´ÆA(ÈAdÉAdÆAÄÇALÊAèÇAÉA<ÉAÊAxÈAìÆAÐÉA„ÉAØÈA<ÊAØÇAˆÉA°ÆAÜÈA¬ÉA$ÇA0ÉAÈAdÊAØ°ALÈATÉA ÉAüÈA¼°AÈA˜ÆA ÇA ÊA¬ÈAXÉAôÈAÊA ÈAlÈA”ÉAÇA,ÊA8ÈAÉA4ÉAðÈAÇAœÆA ÆA4ÇAÊA¬ÆALÇAHÊAäÇA ÈA´ÇA¬ÇAˆÆAøÇAtÉA ÉAÉAPÉAHÇA”ÈAôÆAÈÆA@ÇA\ÇA¬°A¼ÊAÀÉADÊAàÇAôÉAÔÉA4ÊA¤ÉAøÉAÇAøÈA,ÈA˜ÉAüÉATÈAðÇA(ÉAlÉADÉAÈAÄÆAœÇA€ÆAhÈA¸ÉAðÉA¤ÈAØÉA8ÊA”ÆA,ÇAÉAhÆA€ÉADÇAPÊAìÇA¼ÇA
process_handle: 0x00000358
base_address: 0x0041b000
success 1 0
1619649227.167131
WriteProcessMemory
process_identifier: 364
buffer: ,ÒÜÐ ÔHÑXÔXјÔhÑàÔxÑÕ€Ñ8ՐѺÖðÑ*× Òp× Ò:ÒRÒjÒ‚ÒžÒ¬Ò¼ÒÈÒÖÒæÒÓÓ$Ó:ÓPÓbÓtӊӜӮӼÓÊÓÖÓòÓþÓÔ,Ô>ÔLÔfÔzÔŠÔ¦Ô¶ÔÌÔîÔÕ Õ.ÕFÕRÕZÕfÕxÕˆÕ˜Õ¦Õ¶ÕÆÕØÕìÕÖÖ.ÖBÖPÖ`ÖrÖ~֌֚֮ÖÄÖÔÖäÖðÖ× ×6×B×V×^×z׊×kernel32.dllDeleteCriticalSectionLeaveCriticalSectionEnterCriticalSectionInitializeCriticalSectionVirtualFreeVirtualAllocLocalFreeLocalAllocGetTickCountQueryPerformanceCounterGetVersionGetCurrentThreadIdWideCharToMultiByteMultiByteToWideCharGetThreadLocaleGetStartupInfoAGetModuleFileNameAGetLocaleInfoAGetCommandLineAFreeLibraryExitProcessWriteFileUnhandledExceptionFilterRtlUnwindRaiseExceptionGetStdHandleuser32.dllGetKeyboardTypeMessageBoxACharNextAadvapi32.dllRegQueryValueExARegOpenKeyExARegCloseKeyoleaut32.dllSysFreeStringSysReAllocStringLenSysAllocStringLenkernel32.dllGetModuleHandleAadvapi32.dllRegOpenKeyExARegEnumKeyAFreeSidkernel32.dllWriteFileSleepLocalFreeLoadLibraryExWLoadLibraryAGlobalUnlockGlobalLockGetTickCountGetSystemInfoGetProcAddressGetModuleHandleAGetModuleFileNameAGetFileAttributesWGetCurrentProcessIdGetCurrentProcessFreeLibraryFindNextFileWFindFirstFileWFindCloseExitProcessDeleteFileWCreateDirectoryWCopyFileWgdi32.dllSelectObjectDeleteObjectDeleteDCCreateCompatibleDCCreateCompatibleBitmapBitBltuser32.dllReleaseDCGetSystemMetricsGetDCCharToOemBuffAole32.dllOleInitializeCoCreateInstance
process_handle: 0x00000358
base_address: 0x0041d000
success 1 0
1619649227.167131
WriteProcessMemory
process_identifier: 364
buffer: @
process_handle: 0x00000358
base_address: 0xfffde008
success 1 0
1619653898.94175
WriteProcessMemory
process_identifier: 2860
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL»Ôz^à 0ŠN© @ `…ü¨OÀ à  H.textT‰ Š `.rsrc ÀŒ@@.reloc à@B
process_handle: 0x00000344
base_address: 0x00400000
success 1 0
1619653898.95675
WriteProcessMemory
process_identifier: 2860
buffer: €0€HXÀHH4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°¨StringFileInfo„000004b06CommentsVideo Player V"CompanyNameFFileDescriptionVideo Player V0FileVersion1.0.0.0<InternalNamePoullight.exeZLegalCopyrightCopyright © Microsoft 2020*LegalTrademarksDOriginalFilenamePoullight.exe"ProductName4ProductVersion1.0.0.08Assembly Version1.0.0.0
process_handle: 0x00000344
base_address: 0x0041c000
success 1 0
1619653898.95675
WriteProcessMemory
process_identifier: 2860
buffer:   P9
process_handle: 0x00000344
base_address: 0x0041e000
success 1 0
1619653898.95675
WriteProcessMemory
process_identifier: 2860
buffer: @
process_handle: 0x00000344
base_address: 0x7efde008
success 1 0
Code injection by writing an executable or DLL to the memory of another process (2 个事件)
Time & API Arguments Status Return Repeated
1619649227.167131
WriteProcessMemory
process_identifier: 364
buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*àŽ ”*ø¡°@@ОàXCODE$’” `DATA”°˜@ÀBSS] ÀžÀ.idatažÐž@À.relocXà¦@PÆ@P
process_handle: 0x00000358
base_address: 0x00400000
success 1 0
1619653898.94175
WriteProcessMemory
process_identifier: 2860
buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL»Ôz^à 0ŠN© @ `…ü¨OÀ à  H.textT‰ Š `.rsrc ÀŒ@@.reloc à@B
process_handle: 0x00000344
base_address: 0x00400000
success 1 0
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)
Time & API Arguments Status Return Repeated
1619653903.20675
RegSetValueExA
key_handle: 0x000003e8
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619653903.20675
RegSetValueExA
key_handle: 0x000003e8
value: `¸<Œ<×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619653903.20675
RegSetValueExA
key_handle: 0x000003e8
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619653903.20675
RegSetValueExW
key_handle: 0x000003e8
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619653903.20675
RegSetValueExA
key_handle: 0x000003fc
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619653903.20675
RegSetValueExA
key_handle: 0x000003fc
value: `¸<Œ<×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619653903.20675
RegSetValueExA
key_handle: 0x000003fc
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1619653903.26975
RegSetValueExW
key_handle: 0x000003e4
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 个事件)
Process injection Process 2856 called NtSetContextThread to modify thread in remote process 364
Process injection Process 2288 called NtSetContextThread to modify thread in remote process 2860
Time & API Arguments Status Return Repeated
1619649227.167131
NtSetContextThread
thread_handle: 0x0000034c
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4301304
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
process_identifier: 364
success 0 0
1619653898.95675
NtSetContextThread
thread_handle: 0x0000035c
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4303182
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2860
success 0 0
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-08-10 10:33:24

Imports

Library mscoree.dll:
• 0x402000 _CorExeMain

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 51378 8.8.8.8 53
192.168.56.101 53657 8.8.8.8 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.