10.4
0-day
56 个模型检测该样本为恶意！
重新分析
更多

5c93e522b96dfd6244f2e82bc06b8b14a8a2505bc05eff035d6acf3e50f69e07

86677577a8796c97d8e0b71b1d4204d1.exe

分析耗时

34s

最近分析

文件大小

674.0KB
静态报毒 动态报毒 100% AI SCORE=89 AIDETECTVM ALI2000015 ASYNC AUTOG AUTOIT BT6FYG CLASSIC CONFIDENCE DELF DELFINJECT DELPHILESS EADJ EMOY EMRA FAREIT HIGH CONFIDENCE HNSUZA IGENT KCLOUD KRYPTIK LOKI MALWARE1 MALWARE@#3Q7JADTV9V6LJ OQPQU PQLC PWSX QGW@AMQKWXBI REMCOS S + TROJ SCORE SMAD1 SPYBOTNET SUBTIRAT SUSGEN TSCOPE UNSAFE X2094 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:PWSX-gen [Trj] 20201226 21.1.5827.0
Tencent Win32.Trojan.Kryptik.Eadj 20201226 1.0.0.1
Kingsoft Win32.Troj.Undef.(kcloud) 20201226 2017.9.26.565
McAfee Fareit-FVZ!86677577A879 20201226 6.0.6.653
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619713142.617751
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
winds+0x1a3f8 @ 0x41a3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74104b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74105d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe5a1495
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (31 个事件)
Time & API Arguments Status Return Repeated
1619685976.749625
NtAllocateVirtualMemory
process_identifier: 2632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00350000
success 0 0
1619685977.093625
NtProtectVirtualMemory
process_identifier: 2632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0045e000
success 0 0
1619685977.093625
NtAllocateVirtualMemory
process_identifier: 2632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f60000
success 0 0
1619713141.978001
NtAllocateVirtualMemory
process_identifier: 3048
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619713141.978001
NtProtectVirtualMemory
process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0045e000
success 0 0
1619713141.978001
NtAllocateVirtualMemory
process_identifier: 3048
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00750000
success 0 0
1619713142.195751
NtProtectVirtualMemory
process_identifier: 1916
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619713142.227751
NtAllocateVirtualMemory
process_identifier: 1916
region_size: 1835008
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01d90000
success 0 0
1619713142.227751
NtAllocateVirtualMemory
process_identifier: 1916
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f10000
success 0 0
1619713142.227751
NtAllocateVirtualMemory
process_identifier: 1916
region_size: 73728
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01c70000
success 0 0
1619713142.227751
NtProtectVirtualMemory
process_identifier: 1916
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 45056
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01c72000
success 0 0
1619713142.617751
NtProtectVirtualMemory
process_identifier: 1916
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d82000
success 0 0
1619713142.617751
NtProtectVirtualMemory
process_identifier: 1916
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619713142.617751
NtProtectVirtualMemory
process_identifier: 1916
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d82000
success 0 0
1619713142.617751
NtProtectVirtualMemory
process_identifier: 1916
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619713142.617751
NtProtectVirtualMemory
process_identifier: 1916
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d82000
success 0 0
1619713142.617751
NtProtectVirtualMemory
process_identifier: 1916
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619713142.617751
NtProtectVirtualMemory
process_identifier: 1916
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d82000
success 0 0
1619713142.617751
NtProtectVirtualMemory
process_identifier: 1916
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619713142.617751
NtProtectVirtualMemory
process_identifier: 1916
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d82000
success 0 0
1619713142.617751
NtProtectVirtualMemory
process_identifier: 1916
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619713142.617751
NtProtectVirtualMemory
process_identifier: 1916
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d82000
success 0 0
1619713142.617751
NtProtectVirtualMemory
process_identifier: 1916
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619713142.617751
NtProtectVirtualMemory
process_identifier: 1916
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d82000
success 0 0
1619713142.617751
NtProtectVirtualMemory
process_identifier: 1916
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619713142.617751
NtProtectVirtualMemory
process_identifier: 1916
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d82000
success 0 0
1619713142.617751
NtProtectVirtualMemory
process_identifier: 1916
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619713142.617751
NtProtectVirtualMemory
process_identifier: 1916
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d82000
success 0 0
1619713142.617751
NtProtectVirtualMemory
process_identifier: 1916
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619713142.617751
NtProtectVirtualMemory
process_identifier: 1916
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d82000
success 0 0
1619713142.617751
NtProtectVirtualMemory
process_identifier: 1916
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winds update.vbs
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Creates an Alternate Data Stream (ADS) (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\winds update.exe\winds.exe:ZoneIdentifier
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619685977.530625
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000108
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000f0000
success 0 0
Installs itself for autorun at Windows startup (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winds update.vbs
Deletes executed files from disk (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\winds update.exe\winds.exe
Creates a thread using NtQueueApcThread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2632 created a thread in remote process 1948
Time & API Arguments Status Return Repeated
1619685977.530625
NtQueueApcThread
thread_handle: 0x00000110
process_identifier: 1948
function_address: 0x000f05c0
parameter: 0x00100000
success 0 0
Potential code injection by writing to the memory of another process (2 个事件)
Time & API Arguments Status Return Repeated
1619685977.530625
WriteProcessMemory
process_identifier: 1948
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000108
base_address: 0x000f0000
success 1 0
1619685977.530625
WriteProcessMemory
process_identifier: 1948
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\86677577a8796c97d8e0b71b1d4204d1.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\winds update.exe\winds.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\86677577a8796c97d8e0b71b1d4204d1.exe" winds updateSeT VrzrSFOeBRwANfrVn = creatEObject("wScriPT.SHell") VRZrsFoeBrwAnFRvN.run """%ls""", 0, False
process_handle: 0x00000108
base_address: 0x00100000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 3048 called NtSetContextThread to modify thread in remote process 1916
Time & API Arguments Status Return Repeated
1619713142.025001
NtSetContextThread
thread_handle: 0x0000010c
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4388704
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1916
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 3048 resumed a thread in remote process 1916
Time & API Arguments Status Return Repeated
1619713142.071001
NtResumeThread
thread_handle: 0x0000010c
suspend_count: 1
process_identifier: 1916
success 0 0
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.24.14:443
Executed a process and injected code into it, probably while unpacking (12 个事件)
Time & API Arguments Status Return Repeated
1619685977.530625
CreateProcessInternalW
thread_identifier: 1880
thread_handle: 0x00000110
process_identifier: 1948
current_directory:
filepath: C:\Windows\System32\notepad.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\notepad.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000108
inherit_handles: 0
success 1 0
1619685977.530625
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000108
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000f0000
success 0 0
1619685977.530625
NtAllocateVirtualMemory
process_identifier: 1948
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
process_handle: 0x00000108
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00100000
success 0 0
1619685977.530625
WriteProcessMemory
process_identifier: 1948
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000108
base_address: 0x000f0000
success 1 0
1619685977.530625
WriteProcessMemory
process_identifier: 1948
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\86677577a8796c97d8e0b71b1d4204d1.exeC:\Users\Administrator.Oskar-PC\AppData\Roaming\winds update.exe\winds.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\86677577a8796c97d8e0b71b1d4204d1.exe" winds updateSeT VrzrSFOeBRwANfrVn = creatEObject("wScriPT.SHell") VRZrsFoeBrwAnFRvN.run """%ls""", 0, False
process_handle: 0x00000108
base_address: 0x00100000
success 1 0
1619685977.93825
CreateProcessInternalW
thread_identifier: 3056
thread_handle: 0x000000d0
process_identifier: 3048
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\winds update.exe\winds.exe
track: 1
command_line:
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\winds update.exe\winds.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x000000cc
inherit_handles: 0
success 1 0
1619713142.009001
CreateProcessInternalW
thread_identifier: 1932
thread_handle: 0x0000010c
process_identifier: 1916
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\winds update.exe\winds.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000104
inherit_handles: 0
success 1 0
1619713142.009001
NtUnmapViewOfSection
process_identifier: 1916
region_size: 4096
process_handle: 0x00000104
base_address: 0x00400000
success 0 0
1619713142.009001
NtMapViewOfSection
section_handle: 0x00000114
process_identifier: 1916
commit_size: 204800
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000104
allocation_type: 0 ()
section_offset: 0
view_size: 204800
base_address: 0x00400000
success 0 0
1619713142.025001
NtGetContextThread
thread_handle: 0x0000010c
success 0 0
1619713142.025001
NtSetContextThread
thread_handle: 0x0000010c
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4388704
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1916
success 0 0
1619713142.071001
NtResumeThread
thread_handle: 0x0000010c
suspend_count: 1
process_identifier: 1916
success 0 0
File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Delf.FareIt.Gen.7
FireEye Generic.mg.86677577a8796c97
Qihoo-360 Win32/Trojan.469
ALYac Backdoor.RAT.Async
Cylance Unsafe
Zillya Trojan.Injector.Win32.750446
Sangfor Malware
K7AntiVirus Trojan ( 0056abbd1 )
Alibaba Trojan:Win32/DelfInject.ali2000015
K7GW Trojan ( 0056abbd1 )
Cybereason malicious.7a8796
Arcabit Trojan.Delf.FareIt.Gen.7
Cyren W32/Delf.PQLC-8763
Symantec Trojan.Gen.MBT
APEX Malicious
ClamAV Win.Dropper.Remcos-9003811-0
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
BitDefender Trojan.Delf.FareIt.Gen.7
NANO-Antivirus Trojan.Win32.Kryptik.hnsuza
Avast Win32:PWSX-gen [Trj]
Tencent Win32.Trojan.Kryptik.Eadj
Ad-Aware Trojan.Delf.FareIt.Gen.7
Emsisoft Trojan.Delf.FareIt.Gen.7 (B)
Comodo Malware@#3q7jadtv9v6lj
F-Secure Trojan.TR/AD.SubtiRAT.oqpqu
DrWeb BackDoor.SpyBotNET.17
VIPRE Trojan.Win32.Generic!BT
TrendMicro TrojanSpy.Win32.LOKI.SMAD1.hp
McAfee-GW-Edition BehavesLike.Win32.Trojan.jh
Sophos Mal/Generic-S + Troj/AutoG-IO
Ikarus Trojan-Dropper.Win32.Autoit
Avira TR/AD.SubtiRAT.oqpqu
Antiy-AVL Trojan/Win32.Kryptik
Kingsoft Win32.Troj.Undef.(kcloud)
Microsoft PWS:Win32/Fareit.AQ!MTB
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
GData Trojan.Delf.FareIt.Gen.7
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2094
McAfee Fareit-FVZ!86677577A879
MAX malware (ai score=89)
VBA32 TScope.Trojan.Delf
Malwarebytes Trojan.MalPack.DLF
Zoner Trojan.Win32.91553
ESET-NOD32 a variant of Win32/Injector.EMRA
TrendMicro-HouseCall TrojanSpy.Win32.LOKI.SMAD1.hp
Rising Trojan.Injector!1.C99D (CLASSIC)
Yandex Trojan.Igent.bT6FYG.6
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x46b164 VirtualFree
• 0x46b168 VirtualAlloc
• 0x46b16c LocalFree
• 0x46b170 LocalAlloc
• 0x46b174 GetVersion
• 0x46b178 GetCurrentThreadId
• 0x46b184 VirtualQuery
• 0x46b188 WideCharToMultiByte
• 0x46b18c MultiByteToWideChar
• 0x46b190 lstrlenA
• 0x46b194 lstrcpynA
• 0x46b198 LoadLibraryExA
• 0x46b19c GetThreadLocale
• 0x46b1a0 GetStartupInfoA
• 0x46b1a4 GetProcAddress
• 0x46b1a8 GetModuleHandleA
• 0x46b1ac GetModuleFileNameA
• 0x46b1b0 GetLocaleInfoA
• 0x46b1b4 GetCommandLineA
• 0x46b1b8 FreeLibrary
• 0x46b1bc FindFirstFileA
• 0x46b1c0 FindClose
• 0x46b1c4 ExitProcess
• 0x46b1c8 WriteFile
• 0x46b1d0 RtlUnwind
• 0x46b1d4 RaiseException
• 0x46b1d8 GetStdHandle
Library user32.dll:
• 0x46b1e0 GetKeyboardType
• 0x46b1e4 LoadStringA
• 0x46b1e8 MessageBoxA
• 0x46b1ec CharNextA
Library advapi32.dll:
• 0x46b1f4 RegQueryValueExA
• 0x46b1f8 RegOpenKeyExA
• 0x46b1fc RegCloseKey
Library oleaut32.dll:
• 0x46b204 SysFreeString
• 0x46b208 SysReAllocStringLen
• 0x46b20c SysAllocStringLen
Library kernel32.dll:
• 0x46b214 TlsSetValue
• 0x46b218 TlsGetValue
• 0x46b21c LocalAlloc
• 0x46b220 GetModuleHandleA
Library advapi32.dll:
• 0x46b228 RegQueryValueExA
• 0x46b22c RegOpenKeyExA
• 0x46b230 RegCloseKey
Library kernel32.dll:
• 0x46b238 lstrcpyA
• 0x46b23c WriteFile
• 0x46b240 WaitForSingleObject
• 0x46b244 VirtualQuery
• 0x46b248 VirtualProtect
• 0x46b24c VirtualAlloc
• 0x46b250 Sleep
• 0x46b254 SizeofResource
• 0x46b258 SetThreadLocale
• 0x46b25c SetFilePointer
• 0x46b260 SetEvent
• 0x46b264 SetErrorMode
• 0x46b268 SetEndOfFile
• 0x46b26c ResetEvent
• 0x46b270 ReadFile
• 0x46b274 MultiByteToWideChar
• 0x46b278 MulDiv
• 0x46b27c LockResource
• 0x46b280 LoadResource
• 0x46b284 LoadLibraryA
• 0x46b290 GlobalUnlock
• 0x46b294 GlobalSize
• 0x46b298 GlobalReAlloc
• 0x46b29c GlobalHandle
• 0x46b2a0 GlobalLock
• 0x46b2a4 GlobalFree
• 0x46b2a8 GlobalFindAtomA
• 0x46b2ac GlobalDeleteAtom
• 0x46b2b0 GlobalAlloc
• 0x46b2b4 GlobalAddAtomA
• 0x46b2b8 GetVersionExA
• 0x46b2bc GetVersion
• 0x46b2c0 GetTickCount
• 0x46b2c4 GetThreadLocale
• 0x46b2c8 GetSystemInfo
• 0x46b2cc GetStringTypeExA
• 0x46b2d0 GetStdHandle
• 0x46b2d4 GetProcAddress
• 0x46b2d8 GetModuleHandleA
• 0x46b2dc GetModuleFileNameA
• 0x46b2e0 GetLocaleInfoA
• 0x46b2e4 GetLocalTime
• 0x46b2e8 GetLastError
• 0x46b2ec GetFullPathNameA
• 0x46b2f0 GetFileType
• 0x46b2f4 GetDiskFreeSpaceA
• 0x46b2f8 GetDateFormatA
• 0x46b2fc GetCurrentThreadId
• 0x46b300 GetCurrentProcessId
• 0x46b304 GetCPInfo
• 0x46b308 GetACP
• 0x46b30c FreeResource
• 0x46b310 InterlockedExchange
• 0x46b314 FreeLibrary
• 0x46b318 FormatMessageA
• 0x46b31c FindResourceA
• 0x46b320 EnumCalendarInfoA
• 0x46b32c CreateThread
• 0x46b330 CreateFileA
• 0x46b334 CreateEventA
• 0x46b338 CompareStringA
• 0x46b33c CloseHandle
Library version.dll:
• 0x46b344 VerQueryValueA
• 0x46b34c GetFileVersionInfoA
Library gdi32.dll:
• 0x46b354 UnrealizeObject
• 0x46b358 StretchBlt
• 0x46b35c SetWindowOrgEx
• 0x46b360 SetViewportOrgEx
• 0x46b364 SetTextColor
• 0x46b368 SetStretchBltMode
• 0x46b36c SetROP2
• 0x46b370 SetPixel
• 0x46b374 SetDIBColorTable
• 0x46b378 SetBrushOrgEx
• 0x46b37c SetBkMode
• 0x46b380 SetBkColor
• 0x46b384 SelectPalette
• 0x46b388 SelectObject
• 0x46b38c SelectClipRgn
• 0x46b390 SaveDC
• 0x46b394 RestoreDC
• 0x46b398 Rectangle
• 0x46b39c RectVisible
• 0x46b3a0 RealizePalette
• 0x46b3a4 PatBlt
• 0x46b3a8 MoveToEx
• 0x46b3ac MaskBlt
• 0x46b3b0 LineTo
• 0x46b3b4 IntersectClipRect
• 0x46b3b8 GetWindowOrgEx
• 0x46b3bc GetTextMetricsA
• 0x46b3c8 GetStockObject
• 0x46b3cc GetPixel
• 0x46b3d0 GetPaletteEntries
• 0x46b3d4 GetObjectA
• 0x46b3d8 GetDeviceCaps
• 0x46b3dc GetDIBits
• 0x46b3e0 GetDIBColorTable
• 0x46b3e4 GetDCOrgEx
• 0x46b3ec GetClipBox
• 0x46b3f0 GetBrushOrgEx
• 0x46b3f4 GetBitmapBits
• 0x46b3f8 ExcludeClipRect
• 0x46b3fc DeleteObject
• 0x46b400 DeleteMetaFile
• 0x46b404 DeleteDC
• 0x46b408 CreateSolidBrush
• 0x46b40c CreatePenIndirect
• 0x46b410 CreatePen
• 0x46b414 CreatePatternBrush
• 0x46b418 CreatePalette
• 0x46b420 CreateFontIndirectA
• 0x46b424 CreateDIBitmap
• 0x46b428 CreateDIBSection
• 0x46b42c CreateCompatibleDC
• 0x46b434 CreateBrushIndirect
• 0x46b438 CreateBitmap
• 0x46b43c BitBlt
Library user32.dll:
• 0x46b444 CreateWindowExA
• 0x46b448 WindowFromPoint
• 0x46b44c WinHelpA
• 0x46b450 WaitMessage
• 0x46b454 ValidateRect
• 0x46b458 UpdateWindow
• 0x46b45c UnregisterClassA
• 0x46b460 UnhookWindowsHookEx
• 0x46b464 TranslateMessage
• 0x46b46c TrackPopupMenu
• 0x46b474 ShowWindow
• 0x46b478 ShowScrollBar
• 0x46b47c ShowOwnedPopups
• 0x46b480 ShowCursor
• 0x46b484 SetWindowsHookExA
• 0x46b488 SetWindowPos
• 0x46b48c SetWindowPlacement
• 0x46b490 SetWindowLongA
• 0x46b494 SetTimer
• 0x46b498 SetScrollRange
• 0x46b49c SetScrollPos
• 0x46b4a0 SetScrollInfo
• 0x46b4a4 SetRect
• 0x46b4a8 SetPropA
• 0x46b4ac SetParent
• 0x46b4b0 SetMenuItemInfoA
• 0x46b4b4 SetMenu
• 0x46b4b8 SetForegroundWindow
• 0x46b4bc SetFocus
• 0x46b4c0 SetCursor
• 0x46b4c4 SetClassLongA
• 0x46b4c8 SetCapture
• 0x46b4cc SetActiveWindow
• 0x46b4d0 SendMessageA
• 0x46b4d4 ScrollWindow
• 0x46b4d8 ScreenToClient
• 0x46b4dc RemovePropA
• 0x46b4e0 RemoveMenu
• 0x46b4e4 ReleaseDC
• 0x46b4e8 ReleaseCapture
• 0x46b4f4 RegisterClassA
• 0x46b4f8 RedrawWindow
• 0x46b4fc PtInRect
• 0x46b500 PostQuitMessage
• 0x46b504 PostMessageA
• 0x46b508 PeekMessageA
• 0x46b50c OffsetRect
• 0x46b510 OemToCharA
• 0x46b514 MessageBoxA
• 0x46b518 MapWindowPoints
• 0x46b51c MapVirtualKeyA
• 0x46b520 LoadStringA
• 0x46b524 LoadKeyboardLayoutA
• 0x46b528 LoadIconA
• 0x46b52c LoadCursorA
• 0x46b530 LoadBitmapA
• 0x46b534 KillTimer
• 0x46b538 IsZoomed
• 0x46b53c IsWindowVisible
• 0x46b540 IsWindowEnabled
• 0x46b544 IsWindow
• 0x46b548 IsRectEmpty
• 0x46b54c IsIconic
• 0x46b550 IsDialogMessageA
• 0x46b554 IsChild
• 0x46b558 InvalidateRect
• 0x46b55c IntersectRect
• 0x46b560 InsertMenuItemA
• 0x46b564 InsertMenuA
• 0x46b568 InflateRect
• 0x46b570 GetWindowTextA
• 0x46b574 GetWindowRect
• 0x46b578 GetWindowPlacement
• 0x46b57c GetWindowLongA
• 0x46b580 GetWindowDC
• 0x46b584 GetUpdateRect
• 0x46b588 GetTopWindow
• 0x46b58c GetSystemMetrics
• 0x46b590 GetSystemMenu
• 0x46b594 GetSysColorBrush
• 0x46b598 GetSysColor
• 0x46b59c GetSubMenu
• 0x46b5a0 GetScrollRange
• 0x46b5a4 GetScrollPos
• 0x46b5a8 GetScrollInfo
• 0x46b5ac GetPropA
• 0x46b5b0 GetParent
• 0x46b5b4 GetWindow
• 0x46b5b8 GetMenuStringA
• 0x46b5bc GetMenuState
• 0x46b5c0 GetMenuItemInfoA
• 0x46b5c4 GetMenuItemID
• 0x46b5c8 GetMenuItemCount
• 0x46b5cc GetMenu
• 0x46b5d0 GetLastActivePopup
• 0x46b5d4 GetKeyboardState
• 0x46b5dc GetKeyboardLayout
• 0x46b5e0 GetKeyState
• 0x46b5e4 GetKeyNameTextA
• 0x46b5e8 GetIconInfo
• 0x46b5ec GetForegroundWindow
• 0x46b5f0 GetFocus
• 0x46b5f4 GetDlgItem
• 0x46b5f8 GetDesktopWindow
• 0x46b5fc GetDCEx
• 0x46b600 GetDC
• 0x46b604 GetCursorPos
• 0x46b608 GetCursor
• 0x46b60c GetClientRect
• 0x46b610 GetClassNameA
• 0x46b614 GetClassInfoA
• 0x46b618 GetCapture
• 0x46b61c GetActiveWindow
• 0x46b620 FrameRect
• 0x46b624 FindWindowA
• 0x46b628 FillRect
• 0x46b62c EqualRect
• 0x46b630 EnumWindows
• 0x46b634 EnumThreadWindows
• 0x46b638 EndPaint
• 0x46b63c EndDeferWindowPos
• 0x46b640 EnableWindow
• 0x46b644 EnableScrollBar
• 0x46b648 EnableMenuItem
• 0x46b64c DrawTextA
• 0x46b650 DrawMenuBar
• 0x46b654 DrawIconEx
• 0x46b658 DrawIcon
• 0x46b65c DrawFrameControl
• 0x46b660 DrawFocusRect
• 0x46b664 DrawEdge
• 0x46b668 DispatchMessageA
• 0x46b66c DestroyWindow
• 0x46b670 DestroyMenu
• 0x46b674 DestroyIcon
• 0x46b678 DestroyCursor
• 0x46b680 DeleteMenu
• 0x46b684 DeferWindowPos
• 0x46b688 DefWindowProcA
• 0x46b68c DefMDIChildProcA
• 0x46b690 DefFrameProcA
• 0x46b694 CreatePopupMenu
• 0x46b698 CreateMenu
• 0x46b69c CreateIcon
• 0x46b6a4 ClientToScreen
• 0x46b6a8 CheckMenuItem
• 0x46b6ac CallWindowProcA
• 0x46b6b0 CallNextHookEx
• 0x46b6b4 BeginPaint
• 0x46b6b8 BeginDeferWindowPos
• 0x46b6bc CharNextA
• 0x46b6c0 CharLowerA
• 0x46b6c4 CharToOemA
• 0x46b6c8 AdjustWindowRectEx
Library kernel32.dll:
• 0x46b6d4 Sleep
Library oleaut32.dll:
• 0x46b6dc SafeArrayPtrOfIndex
• 0x46b6e0 SafeArrayGetUBound
• 0x46b6e4 SafeArrayGetLBound
• 0x46b6e8 SafeArrayCreate
• 0x46b6ec VariantChangeType
• 0x46b6f0 VariantCopy
• 0x46b6f4 VariantClear
• 0x46b6f8 VariantInit
Library ole32.dll:
• 0x46b708 OleGetIconOfClass
• 0x46b70c OleDraw
• 0x46b718 OleSave
• 0x46b71c OleLoad
• 0x46b720 OleUninitialize
• 0x46b724 OleInitialize
• 0x46b730 CoTaskMemFree
• 0x46b734 CoTaskMemAlloc
• 0x46b738 CoUninitialize
• 0x46b73c CoInitialize
• 0x46b740 IsEqualGUID
Library oleaut32.dll:
• 0x46b748 GetErrorInfo
• 0x46b74c SysFreeString
Library comctl32.dll:
• 0x46b75c ImageList_Write
• 0x46b760 ImageList_Read
• 0x46b770 ImageList_DragMove
• 0x46b774 ImageList_DragLeave
• 0x46b778 ImageList_DragEnter
• 0x46b77c ImageList_EndDrag
• 0x46b780 ImageList_BeginDrag
• 0x46b784 ImageList_Remove
• 0x46b788 ImageList_DrawEx
• 0x46b78c ImageList_Draw
• 0x46b79c ImageList_Add
• 0x46b7a4 ImageList_Destroy
• 0x46b7a8 ImageList_Create
• 0x46b7ac InitCommonControls
Library comdlg32.dll:
• 0x46b7b4 GetSaveFileNameA
• 0x46b7b8 GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 51379 239.255.255.250 3702
192.168.56.101 55369 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 62194 239.255.255.250 1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.