8.6
极危
60 个模型检测该样本为恶意！
重新分析
更多

4b3320ca9f9d97b2ec9d833d4e57bed50cdbe7bf406392b97a3a89b20c62441b

8a8dc5d1a5a464514be94477b72c6417.exe

分析耗时

26s

最近分析

文件大小

1012.0KB
静态报毒 动态报毒 100% @GW@AGHUPOKI AGENTTESLA AI SCORE=82 AIDETECTVM AUTO AVSARHER BTTOGF CLOUD CONFIDENCE CRYPTINJECTOR DELF DELPHILESS DOWNLOADER33 DSWP ELZG EMJE FAREIT HIGH CONFIDENCE HLAQAC INJECTORIH KRYPT KRYPTIK LOKI MALWARE1 MALWARE@#3RSLT94J2X758 NVVXS PASSWORDSTEALER S14127210 SCORE SMTHG SUSPICIOUS PE THFAFBO TSCOPE UNSAFE WACATAC X2066 ZELPHIF ZUSY 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FTB!8A8DC5D1A5A4 20200625 6.0.6.653
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20200625 18.4.3895.0
Alibaba Trojan:Win32/CryptInjector.75c8b94e 20190527 0.3.0.5
Tencent Win32.Trojan.Inject.Auto 20200625 1.0.0.1
Kingsoft 20200625 2013.8.14.323
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619700536.637751
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x750ae97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x750aea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x750ab25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x750ab4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x750aac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x750aaed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x750a5511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x750a559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75117f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75114de3
8a8dc5d1a5a464514be94477b72c6417+0x5aa4d @ 0x45aa4d
8a8dc5d1a5a464514be94477b72c6417+0x53254 @ 0x453254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff5214ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619686133.774307
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619686133.946307
NtAllocateVirtualMemory
process_identifier: 392
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01ff0000
success 0 0
1619686133.946307
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02010000
success 0 0
1619700535.231751
NtProtectVirtualMemory
process_identifier: 2476
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619700535.277751
NtAllocateVirtualMemory
process_identifier: 2476
region_size: 1245184
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01e30000
success 0 0
1619700535.277751
NtAllocateVirtualMemory
process_identifier: 2476
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f20000
success 0 0
1619700535.277751
NtAllocateVirtualMemory
process_identifier: 2476
region_size: 335872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00510000
success 0 0
1619700535.277751
NtProtectVirtualMemory
process_identifier: 2476
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 307200
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00512000
success 0 0
1619700535.574751
NtAllocateVirtualMemory
process_identifier: 2476
region_size: 1310720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x021c0000
success 0 0
1619700535.574751
NtAllocateVirtualMemory
process_identifier: 2476
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x022c0000
success 0 0
1619700536.606751
NtProtectVirtualMemory
process_identifier: 2476
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fc2000
success 0 0
1619700536.606751
NtProtectVirtualMemory
process_identifier: 2476
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619700536.606751
NtProtectVirtualMemory
process_identifier: 2476
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fc2000
success 0 0
1619700536.606751
NtProtectVirtualMemory
process_identifier: 2476
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619700536.606751
NtProtectVirtualMemory
process_identifier: 2476
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fc2000
success 0 0
1619700536.606751
NtProtectVirtualMemory
process_identifier: 2476
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619700536.606751
NtProtectVirtualMemory
process_identifier: 2476
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fc2000
success 0 0
1619700536.606751
NtProtectVirtualMemory
process_identifier: 2476
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619700536.606751
NtProtectVirtualMemory
process_identifier: 2476
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fc2000
success 0 0
1619700536.606751
NtProtectVirtualMemory
process_identifier: 2476
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619700536.606751
NtProtectVirtualMemory
process_identifier: 2476
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fc2000
success 0 0
1619700536.606751
NtProtectVirtualMemory
process_identifier: 2476
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619700536.606751
NtProtectVirtualMemory
process_identifier: 2476
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fc2000
success 0 0
1619700536.606751
NtProtectVirtualMemory
process_identifier: 2476
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619700536.606751
NtProtectVirtualMemory
process_identifier: 2476
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fc2000
success 0 0
1619700536.606751
NtProtectVirtualMemory
process_identifier: 2476
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619700536.606751
NtProtectVirtualMemory
process_identifier: 2476
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fc2000
success 0 0
1619700536.606751
NtProtectVirtualMemory
process_identifier: 2476
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619700536.606751
NtProtectVirtualMemory
process_identifier: 2476
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fc2000
success 0 0
1619700536.606751
NtProtectVirtualMemory
process_identifier: 2476
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.vbs
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.2847034279923575 section {'size_of_data': '0x00048e00', 'virtual_address': '0x000ba000', 'entropy': 7.2847034279923575, 'name': '.rsrc', 'virtual_size': '0x00048cec'} description A section with a high entropy has been found
entropy 0.2883283877349159 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619686134.664307
NtAllocateVirtualMemory
process_identifier: 3000
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000100
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
Installs itself for autorun at Windows startup (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.vbs
Creates a thread using NtQueueApcThread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 392 created a thread in remote process 3000
Time & API Arguments Status Return Repeated
1619686134.664307
NtQueueApcThread
thread_handle: 0x000000fc
process_identifier: 3000
function_address: 0x000b05c0
parameter: 0x000c0000
success 0 0
Potential code injection by writing to the memory of another process (2 个事件)
Time & API Arguments Status Return Repeated
1619686134.664307
WriteProcessMemory
process_identifier: 3000
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000100
base_address: 0x000b0000
success 1 0
1619686134.664307
WriteProcessMemory
process_identifier: 3000
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\8a8dc5d1a5a464514be94477b72c6417.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\8a8dc5d1a5a464514be94477b72c6417.exe" appseT Idw = creAteobject("wscriPt.sheLl") idW.run """%ls""", 0, False
process_handle: 0x00000100
base_address: 0x000c0000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 392 called NtSetContextThread to modify thread in remote process 2476
Time & API Arguments Status Return Repeated
1619686134.914307
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4910352
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2476
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 392 resumed a thread in remote process 2476
Time & API Arguments Status Return Repeated
1619686135.352307
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 2476
success 0 0
Executed a process and injected code into it, probably while unpacking (11 个事件)
Time & API Arguments Status Return Repeated
1619686134.664307
CreateProcessInternalW
thread_identifier: 428
thread_handle: 0x000000fc
process_identifier: 3000
current_directory:
filepath: C:\Windows\System32\notepad.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\notepad.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619686134.664307
NtAllocateVirtualMemory
process_identifier: 3000
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000100
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
1619686134.664307
NtAllocateVirtualMemory
process_identifier: 3000
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
process_handle: 0x00000100
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000c0000
success 0 0
1619686134.664307
WriteProcessMemory
process_identifier: 3000
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000100
base_address: 0x000b0000
success 1 0
1619686134.664307
WriteProcessMemory
process_identifier: 3000
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\8a8dc5d1a5a464514be94477b72c6417.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\8a8dc5d1a5a464514be94477b72c6417.exe" appseT Idw = creAteobject("wscriPt.sheLl") idW.run """%ls""", 0, False
process_handle: 0x00000100
base_address: 0x000c0000
success 1 0
1619686134.883307
CreateProcessInternalW
thread_identifier: 2544
thread_handle: 0x00000108
process_identifier: 2476
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\8a8dc5d1a5a464514be94477b72c6417.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000104
inherit_handles: 0
success 1 0
1619686134.883307
NtUnmapViewOfSection
process_identifier: 2476
region_size: 4096
process_handle: 0x00000104
base_address: 0x00400000
success 0 0
1619686134.883307
NtMapViewOfSection
section_handle: 0x00000110
process_identifier: 2476
commit_size: 720896
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000104
allocation_type: 0 ()
section_offset: 0
view_size: 720896
base_address: 0x00400000
success 0 0
1619686134.914307
NtGetContextThread
thread_handle: 0x00000108
success 0 0
1619686134.914307
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4910352
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2476
success 0 0
1619686135.352307
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 2476
success 0 0
File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 个事件)
Bkav W32.AIDetectVM.malware1
MicroWorld-eScan Gen:Variant.Zusy.306132
FireEye Generic.mg.8a8dc5d1a5a46451
CAT-QuickHeal Trojan.InjectorIH.S14127210
McAfee Fareit-FTB!8A8DC5D1A5A4
Cylance Unsafe
Zillya Trojan.Injector.Win32.741646
Sangfor Malware
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Gen:Variant.Zusy.306132
K7GW Trojan ( 005686cb1 )
K7AntiVirus Trojan ( 005686cb1 )
Arcabit Trojan.Zusy.D4ABD4
Invincea heuristic
F-Prot W32/Injector.JEK
Symantec Trojan.Gen.2
APEX Malicious
Avast Win32:Trojan-gen
ClamAV Win.Malware.AgentTesla-8016717-1
Kaspersky HEUR:Trojan.Win32.Crypt.gen
Alibaba Trojan:Win32/CryptInjector.75c8b94e
NANO-Antivirus Trojan.Win32.Dwn.hlaqac
AegisLab Trojan.Multi.Generic.4!c
Tencent Win32.Trojan.Inject.Auto
Endgame malicious (high confidence)
Emsisoft Gen:Variant.Zusy.306132 (B)
Comodo Malware@#3rslt94j2x758
F-Secure Trojan.TR/Kryptik.nvvxs
DrWeb Trojan.DownLoader33.53178
VIPRE Trojan.Win32.Generic!BT
TrendMicro Trojan.Win32.WACATAC.THFAFBO
Fortinet W32/Injector.ELZG!tr
Sophos Mal/Generic-S
Ikarus Trojan.Win32.Krypt
Cyren W32/Injector.DSWP-9395
Jiangmin Trojan.Crypt.diz
Avira TR/Kryptik.nvvxs
MAX malware (ai score=82)
Antiy-AVL Trojan/Win32.Crypt
Microsoft Trojan:Win32/CryptInjector.F!MTB
ZoneAlarm HEUR:Trojan.Win32.Crypt.gen
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2066
VBA32 TScope.Trojan.Delf
ALYac Gen:Variant.Zusy.306132
Ad-Aware Gen:Variant.Zusy.306132
Malwarebytes Spyware.PasswordStealer
Panda Trj/CI.A
ESET-NOD32 a variant of Win32/Injector.EMJE
TrendMicro-HouseCall TrojanSpy.Win32.LOKI.SMTHG
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x4a8164 VirtualFree
• 0x4a8168 VirtualAlloc
• 0x4a816c LocalFree
• 0x4a8170 LocalAlloc
• 0x4a8174 GetVersion
• 0x4a8178 GetCurrentThreadId
• 0x4a8184 VirtualQuery
• 0x4a8188 WideCharToMultiByte
• 0x4a818c MultiByteToWideChar
• 0x4a8190 lstrlenA
• 0x4a8194 lstrcpynA
• 0x4a8198 LoadLibraryExA
• 0x4a819c GetThreadLocale
• 0x4a81a0 GetStartupInfoA
• 0x4a81a4 GetProcAddress
• 0x4a81a8 GetModuleHandleA
• 0x4a81ac GetModuleFileNameA
• 0x4a81b0 GetLocaleInfoA
• 0x4a81b4 GetCommandLineA
• 0x4a81b8 FreeLibrary
• 0x4a81bc FindFirstFileA
• 0x4a81c0 FindClose
• 0x4a81c4 ExitProcess
• 0x4a81c8 WriteFile
• 0x4a81d0 RtlUnwind
• 0x4a81d4 RaiseException
• 0x4a81d8 GetStdHandle
Library user32.dll:
• 0x4a81e0 GetKeyboardType
• 0x4a81e4 LoadStringA
• 0x4a81e8 MessageBoxA
• 0x4a81ec CharNextA
Library advapi32.dll:
• 0x4a81f4 RegQueryValueExA
• 0x4a81f8 RegOpenKeyExA
• 0x4a81fc RegCloseKey
Library oleaut32.dll:
• 0x4a8204 SysFreeString
• 0x4a8208 SysReAllocStringLen
• 0x4a820c SysAllocStringLen
Library kernel32.dll:
• 0x4a8214 TlsSetValue
• 0x4a8218 TlsGetValue
• 0x4a821c LocalAlloc
• 0x4a8220 GetModuleHandleA
Library advapi32.dll:
• 0x4a8228 RegQueryValueExA
• 0x4a822c RegOpenKeyExA
• 0x4a8230 RegCloseKey
Library kernel32.dll:
• 0x4a8238 lstrcpyA
• 0x4a823c WriteFile
• 0x4a8244 WaitForSingleObject
• 0x4a8248 VirtualQuery
• 0x4a824c VirtualAlloc
• 0x4a8250 Sleep
• 0x4a8254 SizeofResource
• 0x4a8258 SetThreadLocale
• 0x4a825c SetFilePointer
• 0x4a8260 SetEvent
• 0x4a8264 SetErrorMode
• 0x4a8268 SetEndOfFile
• 0x4a826c SearchPathA
• 0x4a8270 ResetEvent
• 0x4a8274 ReleaseMutex
• 0x4a8278 ReadFile
• 0x4a827c OpenFileMappingA
• 0x4a8280 MultiByteToWideChar
• 0x4a8284 MulDiv
• 0x4a8288 LockResource
• 0x4a828c LoadResource
• 0x4a8290 LoadLibraryA
• 0x4a8298 IsDBCSLeadByte
• 0x4a82a0 GlobalUnlock
• 0x4a82a4 GlobalReAlloc
• 0x4a82a8 GlobalHandle
• 0x4a82ac GlobalLock
• 0x4a82b0 GlobalFree
• 0x4a82b4 GlobalFindAtomA
• 0x4a82b8 GlobalDeleteAtom
• 0x4a82bc GlobalAlloc
• 0x4a82c0 GlobalAddAtomA
• 0x4a82c4 GetVersionExA
• 0x4a82c8 GetVersion
• 0x4a82cc GetTickCount
• 0x4a82d0 GetThreadLocale
• 0x4a82d4 GetTempPathA
• 0x4a82dc GetSystemTime
• 0x4a82e0 GetSystemInfo
• 0x4a82e4 GetStringTypeExA
• 0x4a82e8 GetStdHandle
• 0x4a82ec GetProcAddress
• 0x4a82f0 GetModuleHandleA
• 0x4a82f4 GetModuleFileNameA
• 0x4a82f8 GetLocaleInfoA
• 0x4a82fc GetLocalTime
• 0x4a8300 GetLastError
• 0x4a8304 GetFullPathNameA
• 0x4a8308 GetFileSize
• 0x4a830c GetFileAttributesA
• 0x4a8310 GetDiskFreeSpaceA
• 0x4a8314 GetDateFormatA
• 0x4a8318 GetCurrentThreadId
• 0x4a831c GetCurrentProcessId
• 0x4a8324 GetCPInfo
• 0x4a8328 GetACP
• 0x4a832c FreeResource
• 0x4a8334 InterlockedExchange
• 0x4a833c FreeLibrary
• 0x4a8340 FormatMessageA
• 0x4a8344 FindResourceA
• 0x4a8348 FindFirstFileA
• 0x4a834c FindClose
• 0x4a8358 FatalAppExitA
• 0x4a835c ExitThread
• 0x4a8360 EnumCalendarInfoA
• 0x4a836c CreateThread
• 0x4a8370 CreateMutexA
• 0x4a8374 CreateFileA
• 0x4a8378 CreateEventA
• 0x4a837c CompareStringA
• 0x4a8380 CloseHandle
Library version.dll:
• 0x4a8388 VerQueryValueA
• 0x4a8390 GetFileVersionInfoA
Library gdi32.dll:
• 0x4a8398 UnrealizeObject
• 0x4a839c StretchBlt
• 0x4a83a0 SetWindowOrgEx
• 0x4a83a4 SetWinMetaFileBits
• 0x4a83a8 SetViewportOrgEx
• 0x4a83ac SetTextColor
• 0x4a83b0 SetStretchBltMode
• 0x4a83b4 SetROP2
• 0x4a83b8 SetPixel
• 0x4a83bc SetEnhMetaFileBits
• 0x4a83c0 SetDIBColorTable
• 0x4a83c4 SetBrushOrgEx
• 0x4a83c8 SetBkMode
• 0x4a83cc SetBkColor
• 0x4a83d0 SelectPalette
• 0x4a83d4 SelectObject
• 0x4a83d8 SaveDC
• 0x4a83dc RestoreDC
• 0x4a83e0 Rectangle
• 0x4a83e4 RectVisible
• 0x4a83e8 RealizePalette
• 0x4a83ec Polyline
• 0x4a83f0 PlayEnhMetaFile
• 0x4a83f4 PatBlt
• 0x4a83f8 MoveToEx
• 0x4a83fc MaskBlt
• 0x4a8400 LineTo
• 0x4a8404 IntersectClipRect
• 0x4a8408 GetWindowOrgEx
• 0x4a840c GetWinMetaFileBits
• 0x4a8410 GetTextMetricsA
• 0x4a841c GetStockObject
• 0x4a8420 GetPixel
• 0x4a8424 GetPaletteEntries
• 0x4a8428 GetObjectA
• 0x4a8434 GetEnhMetaFileBits
• 0x4a8438 GetDeviceCaps
• 0x4a843c GetDIBits
• 0x4a8440 GetDIBColorTable
• 0x4a8444 GetDCOrgEx
• 0x4a844c GetClipBox
• 0x4a8450 GetBrushOrgEx
• 0x4a8454 GetBitmapBits
• 0x4a8458 ExcludeClipRect
• 0x4a845c DeleteObject
• 0x4a8460 DeleteEnhMetaFile
• 0x4a8464 DeleteDC
• 0x4a8468 CreateSolidBrush
• 0x4a846c CreatePenIndirect
• 0x4a8470 CreatePalette
• 0x4a8478 CreateFontIndirectA
• 0x4a847c CreateDIBitmap
• 0x4a8480 CreateDIBSection
• 0x4a8484 CreateCompatibleDC
• 0x4a848c CreateBrushIndirect
• 0x4a8490 CreateBitmap
• 0x4a8494 CopyEnhMetaFileA
• 0x4a8498 BitBlt
Library user32.dll:
• 0x4a84a0 CreateWindowExA
• 0x4a84a4 WindowFromPoint
• 0x4a84a8 WinHelpA
• 0x4a84ac WaitMessage
• 0x4a84b0 UpdateWindow
• 0x4a84b4 UnregisterClassA
• 0x4a84b8 UnhookWindowsHookEx
• 0x4a84bc TranslateMessage
• 0x4a84c4 TrackPopupMenu
• 0x4a84cc ShowWindow
• 0x4a84d0 ShowScrollBar
• 0x4a84d4 ShowOwnedPopups
• 0x4a84d8 ShowCursor
• 0x4a84dc SetWindowsHookExA
• 0x4a84e0 SetWindowPos
• 0x4a84e4 SetWindowPlacement
• 0x4a84e8 SetWindowLongA
• 0x4a84ec SetTimer
• 0x4a84f0 SetScrollRange
• 0x4a84f4 SetScrollPos
• 0x4a84f8 SetScrollInfo
• 0x4a84fc SetRect
• 0x4a8500 SetPropA
• 0x4a8504 SetParent
• 0x4a8508 SetMenuItemInfoA
• 0x4a850c SetMenu
• 0x4a8510 SetForegroundWindow
• 0x4a8514 SetFocus
• 0x4a8518 SetCursor
• 0x4a851c SetClassLongA
• 0x4a8520 SetCapture
• 0x4a8524 SetActiveWindow
• 0x4a8528 SendMessageA
• 0x4a852c ScrollWindow
• 0x4a8530 ScreenToClient
• 0x4a8534 RemovePropA
• 0x4a8538 RemoveMenu
• 0x4a853c ReleaseDC
• 0x4a8540 ReleaseCapture
• 0x4a854c RegisterClassA
• 0x4a8550 RedrawWindow
• 0x4a8554 PtInRect
• 0x4a8558 PostQuitMessage
• 0x4a855c PostMessageA
• 0x4a8560 PeekMessageA
• 0x4a8564 OffsetRect
• 0x4a8568 OemToCharBuffA
• 0x4a856c OemToCharA
• 0x4a8570 MessageBoxA
• 0x4a8574 MapWindowPoints
• 0x4a8578 MapVirtualKeyA
• 0x4a857c LoadStringA
• 0x4a8580 LoadKeyboardLayoutA
• 0x4a8584 LoadIconA
• 0x4a8588 LoadCursorA
• 0x4a858c LoadBitmapA
• 0x4a8590 KillTimer
• 0x4a8594 IsZoomed
• 0x4a8598 IsWindowVisible
• 0x4a859c IsWindowEnabled
• 0x4a85a0 IsWindow
• 0x4a85a4 IsRectEmpty
• 0x4a85a8 IsIconic
• 0x4a85ac IsDialogMessageA
• 0x4a85b0 IsChild
• 0x4a85b4 InvalidateRect
• 0x4a85b8 IntersectRect
• 0x4a85bc InsertMenuItemA
• 0x4a85c0 InsertMenuA
• 0x4a85c4 InflateRect
• 0x4a85cc GetWindowTextA
• 0x4a85d0 GetWindowRect
• 0x4a85d4 GetWindowPlacement
• 0x4a85d8 GetWindowLongA
• 0x4a85dc GetWindowDC
• 0x4a85e0 GetTopWindow
• 0x4a85e4 GetSystemMetrics
• 0x4a85e8 GetSystemMenu
• 0x4a85ec GetSysColorBrush
• 0x4a85f0 GetSysColor
• 0x4a85f4 GetSubMenu
• 0x4a85f8 GetScrollRange
• 0x4a85fc GetScrollPos
• 0x4a8600 GetScrollInfo
• 0x4a8604 GetPropA
• 0x4a8608 GetParent
• 0x4a860c GetWindow
• 0x4a8610 GetMenuStringA
• 0x4a8614 GetMenuState
• 0x4a8618 GetMenuItemInfoA
• 0x4a861c GetMenuItemID
• 0x4a8620 GetMenuItemCount
• 0x4a8624 GetMenu
• 0x4a8628 GetLastActivePopup
• 0x4a862c GetKeyboardState
• 0x4a8634 GetKeyboardLayout
• 0x4a8638 GetKeyState
• 0x4a863c GetKeyNameTextA
• 0x4a8640 GetIconInfo
• 0x4a8644 GetForegroundWindow
• 0x4a8648 GetFocus
• 0x4a864c GetDlgItem
• 0x4a8650 GetDesktopWindow
• 0x4a8654 GetDCEx
• 0x4a8658 GetDC
• 0x4a865c GetCursorPos
• 0x4a8660 GetCursor
• 0x4a8664 GetClipboardData
• 0x4a8668 GetClientRect
• 0x4a866c GetClassNameA
• 0x4a8670 GetClassInfoA
• 0x4a8674 GetCapture
• 0x4a8678 GetActiveWindow
• 0x4a867c FrameRect
• 0x4a8680 FindWindowA
• 0x4a8684 FillRect
• 0x4a8688 EqualRect
• 0x4a868c EnumWindows
• 0x4a8690 EnumThreadWindows
• 0x4a8694 EndPaint
• 0x4a8698 EnableWindow
• 0x4a869c EnableScrollBar
• 0x4a86a0 EnableMenuItem
• 0x4a86a4 DrawTextA
• 0x4a86a8 DrawMenuBar
• 0x4a86ac DrawIconEx
• 0x4a86b0 DrawIcon
• 0x4a86b4 DrawFrameControl
• 0x4a86b8 DrawEdge
• 0x4a86bc DispatchMessageA
• 0x4a86c0 DestroyWindow
• 0x4a86c4 DestroyMenu
• 0x4a86c8 DestroyIcon
• 0x4a86cc DestroyCursor
• 0x4a86d0 DeleteMenu
• 0x4a86d4 DefWindowProcA
• 0x4a86d8 DefMDIChildProcA
• 0x4a86dc DefFrameProcA
• 0x4a86e0 CreatePopupMenu
• 0x4a86e4 CreateMenu
• 0x4a86e8 CreateIcon
• 0x4a86ec ClientToScreen
• 0x4a86f0 CheckMenuItem
• 0x4a86f4 CallWindowProcA
• 0x4a86f8 CallNextHookEx
• 0x4a86fc BeginPaint
• 0x4a8700 CharNextA
• 0x4a8704 CharLowerBuffA
• 0x4a8708 CharLowerA
• 0x4a870c CharUpperBuffA
• 0x4a8710 CharToOemBuffA
• 0x4a8714 CharToOemA
• 0x4a8718 AdjustWindowRectEx
Library kernel32.dll:
• 0x4a8724 Sleep
Library oleaut32.dll:
• 0x4a872c SafeArrayPtrOfIndex
• 0x4a8730 SafeArrayPutElement
• 0x4a8734 SafeArrayGetElement
• 0x4a873c SafeArrayAccessData
• 0x4a8740 SafeArrayGetUBound
• 0x4a8744 SafeArrayGetLBound
• 0x4a8748 SafeArrayCreate
• 0x4a874c VariantChangeType
• 0x4a8750 VariantCopyInd
• 0x4a8754 VariantCopy
• 0x4a8758 VariantClear
• 0x4a875c VariantInit
Library ole32.dll:
• 0x4a8764 CoCreateInstance
• 0x4a8768 CoUninitialize
• 0x4a876c CoInitialize
Library oleaut32.dll:
• 0x4a8774 GetErrorInfo
• 0x4a8778 SysFreeString
Library comctl32.dll:
• 0x4a8788 ImageList_Write
• 0x4a878c ImageList_Read
• 0x4a879c ImageList_DragMove
• 0x4a87a0 ImageList_DragLeave
• 0x4a87a4 ImageList_DragEnter
• 0x4a87a8 ImageList_EndDrag
• 0x4a87ac ImageList_BeginDrag
• 0x4a87b0 ImageList_Remove
• 0x4a87b4 ImageList_DrawEx
• 0x4a87b8 ImageList_Replace
• 0x4a87bc ImageList_Draw
• 0x4a87cc ImageList_Add
• 0x4a87d4 ImageList_Destroy
• 0x4a87d8 ImageList_Create
• 0x4a87dc InitCommonControls
Library comdlg32.dll:
• 0x4a87e4 GetSaveFileNameA
• 0x4a87e8 GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58370 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.