8.0
高危
26 个模型检测该样本为恶意！
重新分析
更多

379a9df4a7e69f41f0f70799fbe617dbe4b86f694fd63b81379572f82ddc152b

974fa94db00abb7964fde74f84b31f89.exe

分析耗时

100s

最近分析

文件大小

1.6MB
静态报毒 动态报毒 CLASSIC CROSSRIDER CROSSRIDER1 DS@8M1BFT ELDORADO GLRPKQ GRAYWARE HIGH CONFIDENCE MALICIOUS PLAYTECH PLAYTECHPMF R300843 S9225160 SUSGEN SUSPICIOUS PE 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Playtech 20200311 6.0.6.653
Alibaba 20190527 0.3.0.5
CrowdStrike 20190702 1.0
Baidu 20190318 1.0.0.2
Avast Win32:PUP-gen [PUP] 20200311 18.4.3895.0
Kingsoft 20200311 2013.8.14.323
Tencent 20200311 1.0.0.1
静态指标
This executable is signed
This executable has a PDB path (1 个事件)
pdb_path F:\QT_DL_INSTALLER_BUILD\web-installer\WebInstaller\noneAdminRelease\WebInstaller.pdb
Tries to locate where the browsers are installed (3 个事件)
registry HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
registry HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Mozilla Firefox
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe
The file contains an unknown PE resource name possibly indicative of a packer (3 个事件)
resource name DATA
resource name PNG
resource name None
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Performs some HTTP requests (8 个事件)
request GET http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
request GET http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
request GET http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
request GET http://fallback.playtech-installer.com/playtech_compressed_assets/casino_casinocom/index.7ze
request GET http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEHSfdSPcp6pyLdnEz5lZ6ec%3D
request GET http://fallback.playtech-installer.com/playtech_compressed_assets/casino_casinocom/templates/installer/casinocom_new_notif.7ze
request GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=lXCmdNkhR4uAakr6heUqneX5PmCTzdkWA%2BXLIZeYE1HaAzam4sOZ98CWv2BAPI0i19dQU4mcaNrG40yOJgfA4IRZNRXnilacu9aoE%2FR8tU5BNmek906p7en%2FhXWXgsXeovjbvfmdvpgsKYg8NPLKopv8O%2BAuxGr9n6YCWDBX5rTX0B%2B1rrsg4UXjMGdLJt2hUudnbrJq%2Fie56EKiR8Wf1L%2FYPVVO%2BfBq3tQzUk5%2FWezQTJNJI10%2FsQp%2BanVRfjBf21mhHCBqvPe7Xf6m5ZHI4KNkaZnEJ6WZBCrW8E2ZyLgy9PrOLEtFmCjSBiDMtCOcMe9ixiDHuz6DXo3SmPltu1CytUMWr43CJi1bkDJ%2FcpM3e0503UJJFaBH1L2PIwjQBsJV9o%2F1pC9ttynreNf%2BiE%2Ffbs8pwcf0%2FgSHuZPiT7C99Rckk%2FRaOGQQvovF2oQe6IfK0mHGFPliuqdJH2g18w4TNQwFNQz2rDMZYYfaPxZeI2t81XdBVED39Z5U8OEzYLlSywEnGPFfd8Sip16NbgG7aJ0%2BS8pwFWtmrh65fo0KVtpoEhWIl4lL%2BCiMOs%2FNRDKNyb3FIOTzleNLiKG4Lx%2Fg3zQvBU7bOhfAfcwm9klXpX3cjcS1eAJGREMuoLeRQAwi8jZPS05hb%2B%2Bw3zKyj%2FVSNatx5KCYz4AnfKV920I%3D
request GET https://c6m7w2m9.ssl.hwcdn.net/playtech_compressed_assets/casino_casinocom/templates/installer/casinocom_new_notif.7ze
Allocates read-write-execute memory (usually to unpack itself) (2 个事件)
Time & API Arguments Status Return Repeated
1620985512.477465
NtAllocateVirtualMemory
process_identifier: 3060
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02810000
success 0 0
1620993412.358249
NtAllocateVirtualMemory
process_identifier: 1424
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0000000004180000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Steals private information from local Internet browsers (2 个事件)
registry HKEY_LOCAL_MACHINE\Software\Mozilla\Mozilla Firefox
registry HKEY_CURRENT_USER\Software\Mozilla\Mozilla Firefox
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (4 个事件)
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1620985514.430465
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
Queries for potentially installed applications (6 个事件)
Time & API Arguments Status Return Repeated
1620985511.570465
RegOpenKeyExW
access: 0x00000001
base_handle: 0x80000001
key_handle: 0x00000000
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
options: 0
failed 2 0
1620985511.570465
RegOpenKeyExW
access: 0x00000001
base_handle: 0x80000002
key_handle: 0x000000e0
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
options: 0
success 0 0
1620985575.664465
RegOpenKeyExW
access: 0x00000001
base_handle: 0x80000001
key_handle: 0x00000000
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
options: 0
failed 2 0
1620985575.664465
RegOpenKeyExW
access: 0x00000001
base_handle: 0x80000002
key_handle: 0x00000818
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
options: 0
success 0 0
1620985575.664465
RegOpenKeyExW
access: 0x00000001
base_handle: 0x80000001
key_handle: 0x00000000
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
options: 0
failed 2 0
1620985575.664465
RegOpenKeyExW
access: 0x00000001
base_handle: 0x80000002
key_handle: 0x00000818
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
options: 0
success 0 0
Reads the systems User Agent and subsequently performs requests (1 个事件)
Time & API Arguments Status Return Repeated
1620985575.789465
InternetOpenW
proxy_bypass:
access_type: 0
proxy_name:
flags: 0
user_agent: Playtech WinClient Downloader/1.0
success 13369348 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 113.108.239.196
Attempts to create or modify system certificates (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (15 个事件)
Time & API Arguments Status Return Repeated
1620985517.008465
RegSetValueExA
key_handle: 0x000004cc
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1620985517.008465
RegSetValueExA
key_handle: 0x000004cc
value: 0ü×DžH×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1620985517.008465
RegSetValueExA
key_handle: 0x000004cc
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1620985517.008465
RegSetValueExW
key_handle: 0x000004cc
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1620985517.024465
RegSetValueExA
key_handle: 0x000004e4
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1620985517.024465
RegSetValueExA
key_handle: 0x000004e4
value: 0ü×DžH×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1620985517.024465
RegSetValueExA
key_handle: 0x000004e4
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1620985517.039465
RegSetValueExW
key_handle: 0x000004c8
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
1620985540.711465
RegSetValueExA
key_handle: 0x00000538
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1620985540.711465
RegSetValueExA
key_handle: 0x00000538
value:  ÆøՅH×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1620985540.711465
RegSetValueExA
key_handle: 0x00000538
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1620985540.711465
RegSetValueExW
key_handle: 0x00000538
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1620985540.727465
RegSetValueExA
key_handle: 0x000006a4
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1620985540.727465
RegSetValueExA
key_handle: 0x000006a4
value:  ÆøՅH×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1620985540.727465
RegSetValueExA
key_handle: 0x000006a4
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
File has been identified by 26 AntiVirus engines on VirusTotal as malicious (26 个事件)
CAT-QuickHeal PUA.PlaytechPMF.S9225160
McAfee Playtech
K7AntiVirus Adware ( 005295061 )
K7GW Adware ( 005295061 )
Invincea heuristic
Cyren W32/PlayTech.C.gen!Eldorado
APEX Malicious
NANO-Antivirus Trojan.Win32.Crossrider1.glrpkq
Avast Win32:PUP-gen [PUP]
Rising PUF.PlayTech!1.B89C (CLASSIC)
Endgame malicious (high confidence)
Comodo Application.Win32.Playtech.DS@8m1bft
DrWeb Trojan.Crossrider1.63459
McAfee-GW-Edition Playtech
SentinelOne DFI - Suspicious PE
F-Prot W32/PlayTech.C.gen!Eldorado
Webroot W32.Adware.Gen
Antiy-AVL GrayWare/Win32.PlayTech.FC71
Microsoft PUA:Win32/Playtech
AhnLab-V3 PUP/Win32.Playtech.R300843
VBA32 Trojan.Crossrider
ESET-NOD32 a variant of Win32/PlayTech.A potentially unwanted
Yandex Riskware.Agent!
Fortinet Riskware/PlayTech.FC71
AVG Win32:PUP-gen [PUP]
MaxSecure Trojan.Malware.121218.susgen
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.24.14:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2019-11-13 16:34:35

Imports

Library WININET.dll:
• 0x51a4d8 InternetConnectW
• 0x51a4dc HttpSendRequestW
• 0x51a4e0 InternetSetOptionW
• 0x51a4e4 HttpQueryInfoW
• 0x51a4e8 InternetReadFile
• 0x51a4f0 InternetCloseHandle
• 0x51a4f8 InternetCrackUrlW
• 0x51a500 HttpOpenRequestW
• 0x51a504 InternetOpenW
Library VERSION.dll:
• 0x51a4c8 VerQueryValueW
• 0x51a4cc GetFileVersionInfoW
Library gdiplus.dll:
• 0x51a50c GdiplusStartup
• 0x51a510 GdiplusShutdown
• 0x51a518 GdipReleaseDC
• 0x51a51c GdipGetImageWidth
• 0x51a520 GdipCloneImage
• 0x51a524 GdipFillRectangleI
• 0x51a528 GdipCreateFromHDC
• 0x51a534 GdipDisposeImage
• 0x51a538 GdipAlloc
• 0x51a53c GdipCreateSolidFill
• 0x51a544 GdipDrawImageRectI
• 0x51a548 GdipDeleteGraphics
• 0x51a54c GdipSetPenMode
• 0x51a550 GdipGetImageHeight
• 0x51a554 GdipDeletePen
• 0x51a558 GdipFree
• 0x51a55c GdipDeleteBrush
• 0x51a560 GdipCreatePen1
Library PSAPI.DLL:
Library CRYPT32.dll:
• 0x51a054 CryptMsgClose
• 0x51a058 CertGetNameStringW
• 0x51a064 CertCloseStore
• 0x51a068 CryptMsgGetParam
• 0x51a06c CryptQueryObject
Library KERNEL32.dll:
• 0x51a0a4 EncodePointer
• 0x51a0a8 ReadConsoleInputA
• 0x51a0ac SetConsoleMode
• 0x51a0b0 IsValidCodePage
• 0x51a0b4 GetACP
• 0x51a0b8 GetOEMCP
• 0x51a0c4 GetVersionExW
• 0x51a0c8 WriteFile
• 0x51a0cc ReadFile
• 0x51a0d0 GetStdHandle
• 0x51a0d4 GetLastError
• 0x51a0e4 WideCharToMultiByte
• 0x51a0e8 MultiByteToWideChar
• 0x51a0ec GetFullPathNameW
• 0x51a0f0 CreateDirectoryW
• 0x51a0f4 SetFileTime
• 0x51a0f8 CreateFileW
• 0x51a0fc lstrlenW
• 0x51a100 RemoveDirectoryW
• 0x51a104 CloseHandle
• 0x51a108 DeleteFileW
• 0x51a10c SetFileAttributesW
• 0x51a110 FindFirstFileW
• 0x51a114 FindClose
• 0x51a118 FindNextFileW
• 0x51a11c GetFileSize
• 0x51a120 SetFilePointer
• 0x51a124 SetEndOfFile
• 0x51a128 GlobalMemoryStatus
• 0x51a12c GetModuleHandleW
• 0x51a130 GetProcAddress
• 0x51a134 GetSystemInfo
• 0x51a138 VirtualFree
• 0x51a13c VirtualAlloc
• 0x51a140 WaitForSingleObject
• 0x51a144 SetEvent
• 0x51a14c ResetEvent
• 0x51a150 CreateEventW
• 0x51a154 FindResourceExW
• 0x51a158 FindResourceW
• 0x51a15c LoadResource
• 0x51a160 LockResource
• 0x51a168 OutputDebugStringW
• 0x51a16c GetCurrentThreadId
• 0x51a170 GetCurrentProcessId
• 0x51a178 CreateThread
• 0x51a17c CopyFileW
• 0x51a180 GetFileAttributesW
• 0x51a184 lstrlenA
• 0x51a18c FlushFileBuffers
• 0x51a190 GetLongPathNameW
• 0x51a194 GetVersion
• 0x51a198 MapViewOfFile
• 0x51a19c UnmapViewOfFile
• 0x51a1a0 FlushViewOfFile
• 0x51a1a4 Sleep
• 0x51a1a8 GetModuleFileNameW
• 0x51a1ac CreateFileMappingW
• 0x51a1b0 GetCurrentProcess
• 0x51a1b4 OpenProcess
• 0x51a1b8 TerminateProcess
• 0x51a1bc Process32FirstW
• 0x51a1c0 Process32NextW
• 0x51a1c8 HeapAlloc
• 0x51a1cc HeapFree
• 0x51a1d0 GetProcessHeap
• 0x51a1d4 GetTickCount
• 0x51a1d8 GetExitCodeProcess
• 0x51a1e0 GetProcessId
• 0x51a1e4 LocalAlloc
• 0x51a1e8 LocalFree
• 0x51a1f0 GlobalLock
• 0x51a1f4 GlobalAlloc
• 0x51a1f8 MulDiv
• 0x51a1fc lstrcmpW
• 0x51a200 GlobalUnlock
• 0x51a208 RaiseException
• 0x51a20c SetLastError
• 0x51a210 GlobalFree
• 0x51a214 GlobalHandle
• 0x51a218 FreeLibrary
• 0x51a21c LoadLibraryExW
• 0x51a220 lstrcmpiW
• 0x51a224 GetModuleHandleA
• 0x51a228 GetFileType
• 0x51a230 LoadLibraryA
• 0x51a234 GetVersionExA
• 0x51a244 TlsAlloc
• 0x51a248 TlsGetValue
• 0x51a24c TlsSetValue
• 0x51a250 TlsFree
• 0x51a254 GetStartupInfoW
• 0x51a258 HeapSize
• 0x51a25c RtlUnwind
• 0x51a260 GetConsoleCP
• 0x51a264 SetFilePointerEx
• 0x51a268 GetStringTypeW
• 0x51a26c LoadLibraryW
• 0x51a278 ReadConsoleW
• 0x51a27c IsDebuggerPresent
• 0x51a284 HeapReAlloc
• 0x51a288 ExitThread
• 0x51a290 GetLocalTime
• 0x51a298 GetCPInfo
• 0x51a29c GetModuleHandleExW
• 0x51a2a0 WriteConsoleW
• 0x51a2a4 GetCommandLineW
• 0x51a2a8 ExitProcess
• 0x51a2ac AreFileApisANSI
• 0x51a2b4 GetConsoleMode
• 0x51a2b8 SetStdHandle
• 0x51a2bc GetLocaleInfoW
• 0x51a2c0 IsValidLocale
• 0x51a2c4 GetUserDefaultLCID
• 0x51a2c8 EnumSystemLocalesW
• 0x51a2cc CompareStringW
• 0x51a2d0 LCMapStringW
• 0x51a2d8 HeapDestroy
• 0x51a2e0 InitializeSListHead
• 0x51a2ec SizeofResource
• 0x51a2f0 DecodePointer
Library USER32.dll:
• 0x51a368 EndPaint
• 0x51a36c GetMessageW
• 0x51a378 MessageBoxA
• 0x51a37c CallNextHookEx
• 0x51a380 GetClientRect
• 0x51a388 SetFocus
• 0x51a38c GetMenuItemInfoW
• 0x51a390 BeginPaint
• 0x51a394 GetClassInfoExW
• 0x51a398 TranslateMessage
• 0x51a3a0 IsDialogMessageW
• 0x51a3a4 RegisterClassExW
• 0x51a3a8 GetWindowPlacement
• 0x51a3b0 CheckMenuRadioItem
• 0x51a3b4 GetWindowTextW
• 0x51a3b8 PeekMessageW
• 0x51a3bc GetClassNameW
• 0x51a3c0 ReleaseDC
• 0x51a3c4 GetDlgItem
• 0x51a3c8 SetWindowLongW
• 0x51a3cc EndDialog
• 0x51a3d0 RedrawWindow
• 0x51a3d4 SendDlgItemMessageW
• 0x51a3d8 GetSysColor
• 0x51a3dc IsWindow
• 0x51a3e0 SetMenuDefaultItem
• 0x51a3e4 SetWindowsHookExW
• 0x51a3e8 UnhookWindowsHookEx
• 0x51a3ec ReleaseCapture
• 0x51a3f0 ClientToScreen
• 0x51a3f4 GetParent
• 0x51a3f8 EnableWindow
• 0x51a3fc SetWindowTextW
• 0x51a400 SetMenuItemInfoW
• 0x51a404 CallWindowProcW
• 0x51a408 DestroyWindow
• 0x51a414 SetTimer
• 0x51a418 ScreenToClient
• 0x51a41c MapDialogRect
• 0x51a420 CharNextW
• 0x51a428 FillRect
• 0x51a42c IsChild
• 0x51a430 GetWindow
• 0x51a434 MoveWindow
• 0x51a438 DispatchMessageW
• 0x51a43c KillTimer
• 0x51a440 InvalidateRect
• 0x51a444 GetWindowLongW
• 0x51a448 GetDesktopWindow
• 0x51a44c GetLastInputInfo
• 0x51a454 GetSystemMetrics
• 0x51a458 SwitchToThisWindow
• 0x51a45c UpdateLayeredWindow
• 0x51a460 GetWindowRect
• 0x51a464 PostQuitMessage
• 0x51a468 UnregisterClassW
• 0x51a46c LoadCursorW
• 0x51a470 GetDC
• 0x51a474 LoadIconW
• 0x51a47c SetWindowPos
• 0x51a480 ShowWindow
• 0x51a484 FindWindowExW
• 0x51a488 CreateWindowExW
• 0x51a48c MessageBoxW
• 0x51a490 RegisterClassW
• 0x51a494 ValidateRect
• 0x51a498 DefWindowProcW
• 0x51a49c PostMessageW
• 0x51a4a0 EnumWindows
• 0x51a4a8 SetCapture
• 0x51a4ac GetFocus
• 0x51a4b0 SetDlgItemTextW
• 0x51a4b4 AnimateWindow
• 0x51a4b8 CharUpperW
• 0x51a4bc SendMessageW
• 0x51a4c0 InvalidateRgn
Library GDI32.dll:
• 0x51a074 BitBlt
• 0x51a078 DeleteDC
• 0x51a07c CreateDIBSection
• 0x51a080 CreateSolidBrush
• 0x51a084 SelectObject
• 0x51a08c GetStockObject
• 0x51a090 GetObjectW
• 0x51a094 GetDeviceCaps
• 0x51a098 CreateCompatibleDC
• 0x51a09c DeleteObject
Library ADVAPI32.dll:
• 0x51a000 OpenProcessToken
• 0x51a004 RegOpenKeyExW
• 0x51a008 RegCloseKey
• 0x51a014 GetTokenInformation
• 0x51a018 RegSetValueW
• 0x51a01c RegDeleteKeyW
• 0x51a020 LookupAccountSidW
• 0x51a024 RegEnumKeyExW
• 0x51a028 RegCreateKeyExW
• 0x51a02c RegDeleteValueW
• 0x51a030 RegSetValueExW
• 0x51a034 RegQueryInfoKeyW
• 0x51a03c ReportEventA
• 0x51a044 RegQueryValueExW
Library SHELL32.dll:
• 0x51a334 ExtractIconW
• 0x51a338 SHFileOperationW
• 0x51a33c ShellExecuteW
• 0x51a340 ShellExecuteExW
• 0x51a34c SHBrowseForFolderW
• 0x51a350 SHGetDesktopFolder
Library ole32.dll:
• 0x51a568 CoCreateInstance
• 0x51a56c CoCreateGuid
• 0x51a570 OleLockRunning
• 0x51a574 CLSIDFromProgID
• 0x51a578 CLSIDFromString
• 0x51a580 StringFromGUID2
• 0x51a584 OleInitialize
• 0x51a588 OleUninitialize
• 0x51a58c CoTaskMemFree
• 0x51a590 CoGetClassObject
• 0x51a594 CoTaskMemAlloc
• 0x51a598 CoUninitialize
• 0x51a59c CoTaskMemRealloc
• 0x51a5a0 CoInitialize
Library OLEAUT32.dll:
• 0x51a2f8 SysFreeString
• 0x51a2fc VariantClear
• 0x51a300 VariantCopy
• 0x51a304 SysStringLen
• 0x51a308 VariantInit
• 0x51a30c SysAllocStringLen
• 0x51a310 DispCallFunc
• 0x51a314 LoadTypeLib
• 0x51a31c LoadRegTypeLib
• 0x51a320 VarUI4FromStr
• 0x51a324 SysAllocString
Library SHLWAPI.dll:
• 0x51a358
• 0x51a35c UrlEscapeW
Library COMCTL32.dll:

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49180 124.225.105.97 www.download.windowsupdate.com 80
192.168.56.101 49181 124.225.105.97 www.download.windowsupdate.com 80
192.168.56.101 49182 151.139.128.14 ocsp.usertrust.com 80
192.168.56.101 49183 151.139.128.14 ocsp.usertrust.com 80
192.168.56.101 49184 151.139.128.14 ocsp.usertrust.com 80
192.168.56.101 49185 151.139.128.14 ocsp.usertrust.com 80
192.168.56.101 49189 151.139.128.14 ocsp.usertrust.com 80
192.168.56.101 49190 151.139.128.14 ocsp.usertrust.com 80
192.168.56.101 49176 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 443
192.168.56.101 49177 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 443
192.168.56.101 49187 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 443
192.168.56.101 49197 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 443
192.168.56.101 49188 52.218.88.236 fallback.playtech-installer.com 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50320 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51378 114.114.114.114 53
192.168.56.101 51660 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 54991 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58070 114.114.114.114 53
192.168.56.101 59789 114.114.114.114 53
192.168.56.101 61680 114.114.114.114 53
192.168.56.101 62912 114.114.114.114 53
192.168.56.101 64214 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 50433 224.0.0.252 5355
192.168.56.101 50568 224.0.0.252 5355
192.168.56.101 50849 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355

HTTP & HTTPS Requests

URI Data
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab 
GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1
Cache-Control: max-age = 3600
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 03 Mar 2021 06:32:16 GMT
If-None-Match: "0d8f4f3f6fd71:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: www.download.windowsupdate.com
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D 
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.usertrust.com
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEHSfdSPcp6pyLdnEz5lZ6ec%3D 
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEHSfdSPcp6pyLdnEz5lZ6ec%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.sectigo.com
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D 
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.comodoca.com
http://fallback.playtech-installer.com/playtech_compressed_assets/casino_casinocom/templates/installer/casinocom_new_notif.7ze 
GET /playtech_compressed_assets/casino_casinocom/templates/installer/casinocom_new_notif.7ze HTTP/1.1
Accept: */*
C: \Users\Administrator.Oskar-PC\AppData\Local\Temp\AE0BD4153C944249B5C548166BE6F8CB\casinocom_new_notif (1).7z
User-Agent: Playtech WinClient Downloader/1.0
Host: fallback.playtech-installer.com
Connection: Keep-Alive
Cache-Control: no-cache
http://fallback.playtech-installer.com/playtech_compressed_assets/casino_casinocom/index.7ze 
GET /playtech_compressed_assets/casino_casinocom/index.7ze HTTP/1.1
Accept: */*
C: \Users\Administrator.Oskar-PC\AppData\Local\Temp\AE0BD4153C944249B5C548166BE6F8CB\index.7ze
User-Agent: Playtech WinClient Downloader/1.0
Host: fallback.playtech-installer.com
Connection: Keep-Alive
Cache-Control: no-cache

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.