10.6
0-day

75f270ad607163c3589a26dbaa6759a44f679baf9b6eec55f594c538a87548c5

aa433651fd6818c7971aebd1b1e8fd89.exe

分析耗时

130s

最近分析

文件大小

861.1KB
静态报毒 动态报毒 CLOUD CONDUIT NCHSOFTWARE SIGADWARE
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee 20200214 6.0.6.653
Alibaba 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast 20200214 18.4.3895.0
Kingsoft 20200214 2013.8.14.323
Tencent 20200214 1.0.0.1
CrowdStrike 20190702 1.0
静态指标
Queries for the computername (26 个事件)
Time & API Arguments Status Return Repeated
1621004438.072124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621004438.712124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621004439.697124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621004441.150124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621004442.041124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621004442.619124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621004444.306124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621004450.494124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621004450.775124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621004450.931124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621004451.166124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621004451.400124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621004451.572124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621004451.744124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621004451.900124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621004452.072124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621004452.244124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621004452.400124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621004452.619124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621004452.884124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621004453.041124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621004453.291124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621004453.416124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621004453.697124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621004453.994124
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1621004015.278145
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
This executable is signed
The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)
resource name None
行为判定
动态指标
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features GET method with no useragent header, HTTP version 1.0 used suspicious_request GET http://audiochannel.net/components/eisetup.exe
Performs some HTTP requests (1 个事件)
request GET http://audiochannel.net/components/eisetup.exe
Allocates read-write-execute memory (usually to unpack itself) (2 个事件)
Time & API Arguments Status Return Repeated
1621004414.212124
NtAllocateVirtualMemory
process_identifier: 2340
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00770000
success 0 0
1621004055.075145
NtAllocateVirtualMemory
process_identifier: 1424
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0000000007b70000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 个事件)
Time & API Arguments Status Return Repeated
1621004020.934145
GetDiskFreeSpaceExW
root_path: C:\Users\Administrator.Oskar-PC\AppData\Local\Microsoft\Windows\Explorer
free_bytes_available: 19604193280
total_number_of_free_bytes: 0
total_number_of_bytes: 0
success 1 0
Creates executable files on the filesystem (39 个事件)
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Video Capture Software.lnk
file C:\Program Files (x86)\NCH Software\ExpressAccounts\paypal.dll
file C:\Program Files (x86)\NCH Software\ExpressAccounts\eway.dll
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Accounts.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\MixPad MultiTrack Mixer.lnk
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\eisetup.exe
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Express Rip CD Ripper.lnk
file C:\ProgramData\NCH Software\ExpressAccounts\Web\cookie.js
file C:\Program Files (x86)\NCH Software\ExpressAccounts\expressaccounts.exe
file C:\ProgramData\NCH Software\ExpressAccounts\Web\pagecookie.js
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Express Dictate Recorder.lnk
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\n1s.exe
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\WavePad Sound Editor.lnk
file C:\Program Files (x86)\NCH Software\ExpressAccounts\uninst.exe
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Switch Sound File Converter.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Graphics File Converter.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\VideoPad Video Editor.lnk
file C:\Users\Administrator.Oskar-PC\Favorites\NCH Software Download Site.lnk
file C:\ProgramData\NCH Software\ExpressAccounts\Web\datepicker.js
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Business Related Programs\Inventory Software.lnk
file C:\ProgramData\NCH Software\ExpressAccounts\Web\combobox.js
file C:\Program Files (x86)\NCH Software\ExpressAccounts\authorize.dll
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Business Related Programs\Time Tracking Software.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Invoicing Software.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Classic FTP Software.lnk
file C:\Program Files (x86)\NCH Software\ExpressAccounts\zlib1.dll
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Business Related Programs\Accounting Software.lnk
file C:\Program Files (x86)\NCH Software\ExpressAccounts\Help\help.js
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Prism Video File Format Converter.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\RecordPad Sound Recorder.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Doxillion Document Converter.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Express Burn CD, DVD or Blu-Ray.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Accounting Software.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Express Talk Softphone.lnk
file C:\Users\Public\Desktop\Express Accounts.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\SoundTap Streaming Recorder.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Business Related Programs\Invoicing Software.lnk
file C:\ProgramData\NCH Software\ExpressAccounts\Web\datetime.js
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Golden Records LP Converter.lnk
Creates a shortcut to an executable file (26 个事件)
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Video Capture Software.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Accounts.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\MixPad MultiTrack Mixer.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\WavePad Sound Editor.lnk
file C:\Users\Administrator.Oskar-PC\Desktop\Express Accounts.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Express Rip CD Ripper.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Express Dictate Recorder.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Switch Sound File Converter.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Graphics File Converter.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\VideoPad Video Editor.lnk
file C:\Users\Administrator.Oskar-PC\Favorites\NCH Software Download Site.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Business Related Programs\Inventory Software.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Business Related Programs\Time Tracking Software.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Invoicing Software.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Classic FTP Software.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Business Related Programs\Accounting Software.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Prism Video File Format Converter.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\RecordPad Sound Recorder.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Doxillion Document Converter.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Express Burn CD, DVD or Blu-Ray.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Accounting Software.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Express Talk Softphone.lnk
file C:\Users\Public\Desktop\Express Accounts.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\SoundTap Streaming Recorder.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Business Related Programs\Invoicing Software.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite\Golden Records LP Converter.lnk
Drops a binary and executes it (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\n1s.exe
Drops an executable to the user AppData folder (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\n1s.exe
A process created a hidden window (1 个事件)
Time & API Arguments Status Return Repeated
1621004458.072124
ShellExecuteExW
parameters: -installrelated 3 -toolbar 0
filepath: C:\Program Files (x86)\NCH Software\ExpressAccounts\expressaccounts.exe
filepath_r: C:\Program Files (x86)\NCH Software\ExpressAccounts\expressaccounts.exe
show_type: 0
success 1 0
File has been identified by 3 AntiVirus engines on VirusTotal as malicious (3 个事件)
ESET-NOD32 a variant of Win32/Toolbar.Conduit.J potentially unwanted
Rising PUA.Conduit!8.122 (CLOUD)
VBA32 SigAdware.NCHSoftware
An executable file was downloaded by the process expressaccounts.exe (1 个事件)
Time & API Arguments Status Return Repeated
1621004460.025124
recv
buffer: MZÿÿ¸@غ´ Í!¸LÍ!This program cannot be run in DOS mode. $Ið ñžs ñžs ñžsÎþÃsñžs ñŸs-ñžs*7ìs ñžs*7âs ñžs*7æs ñžsRich ñžsPEL²Òë_à 2Ô @€ €@Ì&x@´!> @p  ”.textC `.rdataB @@.data0@À.rsrc´!@"@@.reloc:p<@BSWj
received: 1028
socket: 544
success 1028 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.997732811710844 section {'size_of_data': '0x000d5400', 'virtual_address': '0x00003000', 'entropy': 7.997732811710844, 'name': '.rsrc', 'virtual_size': '0x000d5234'} description A section with a high entropy has been found
entropy 0.9976608187134502 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (3 个事件)
host 124.225.105.97
host 151.139.128.14
host 172.217.24.14
Created a service where a service was also not started (1 个事件)
Time & API Arguments Status Return Repeated
1621004440.134124
CreateServiceW
service_start_name:
start_type: 3
service_handle: 0x00847e68
display_name: Express Accounts
error_control: 0
service_name: ExpressAccountsService
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Program Files (x86)\NCH Software\ExpressAccounts\expressaccounts.exe" -service
filepath_r: "C:\Program Files (x86)\NCH Software\ExpressAccounts\expressaccounts.exe" -service
service_manager_handle: 0x00847e40
desired_access: 983551
service_type: 16
password:
success 8683112 0
Deletes executed files from disk (1 个事件)
file
Expresses interest in specific running processes (1 个事件)
process: potential process injection target explorer.exe
Writes a potential ransom message to disk (13 个事件)
Time & API Arguments Status Return Repeated
1621004437.150124
NtWriteFile
file_handle: 0x000001b0
filepath: C:\Program Files (x86)\NCH Software\ExpressAccounts\Help\index.html
buffer: <html> <head> <!-- saved from url=(0021)http://www.nch.com.au --> <meta http-equiv=Content-Type content="text/html; charset=UTF-8"> <meta name="viewport" content="width=device-width"> <title>Contents</title> <link rel=STYLESHEET href="hlp.css" type="text/css"> </head> <body> <script type="text/javascript" language="JavaScript" src="help.js"></script> <script type="text/javascript" language="JavaScript">HelpHeader("Express Accounts","3.41","Contents","","introduction.html");</script> <ul><li><a href="introduction.html">Introduction</a><li><a href="startup.html">Getting Started</a><li><a href="invoices.html">Common Tasks: Summary Overview</a><li><a href="mailmerge.html">Mail Merge</a><li><a href="multicurrencies.html">Multiple Currencies</a><li><a href="login.html">How to Logon</a><li><a href="password.html">Password Management</a><li><a href="licenceterms.html">Software License Terms</a></ul><h2>Screen References</h2><ul><li><a href="invoicemain.html">New Invoice</a><li><a href="ordermain.html">New Order</a><li><a href="quotemain.html">New Quote</a><li><a href="reconcile.html">Reconcile Account</a><li><a href="journalentry.html">Journal Entry</a><li><a href="cashtxn.html">Cash Transaction</a><li><a href="reportview.html">Report View</a><li><a href="selectinvoiceitem.html">Add Invoice Item</a><li><a href="selectorderitem.html">Add Order Item</a><li><a href="selectquoteitem.html">Add Quote Item</a><li><a href="selectcreditnoteitem.html">Add Credit Note Item</a><li><a href="backupfolder.html">Data Backup</a><li><a href="faxnumber.html">Fax Number</a><li><a href="emailprompt.html">Email Address</a><li><a href="faxsettings.html">Fax Settings</a><li><a href="printpreview.html">Print Preview</a><li><a href="order.html">Order</a><li><a href="creditnote.html">Credit Note</a><li><a href="useraccount.html">User Account</a><li><a href="payment.html">Payment</a><li><a href="reportperiod.html">Report Period</a><li><a href="recurringdialog.html">Recurring Invoice Schedule</a><li><a href="recurringorderdialog.html">Recurring Order Schedule</a><li><a href="statementdialog.html">Statement Period</a><li><a href="multibusiness.html">Multiple Businesses</a><li><a href="accountproperties.html">Account Properties</a><li><a href="accdatetimeperiod.html">Select Account and Period</a><li><a href="accdatetime.html">Select Account and Date</a><li><a href="templatesel.html">Select Template</a><li><a href="templatename.html">Name Template</a><li><a href="accountamount.html">Account Application</a><li><a href="csvmatchfields.html">Match CSV Fields</a><li><a href="selectdate.html">Select Date</a><li><a href="datetimeperiod.html">Select Period</a><li><a href="datetimeperiods.html">Select Period</a><li><a href="reportsel.html">Select Report</a><li><a href="check.html">Check</a><li><a href="qitem.html">New Item</a><li><a href="qpaycash.html">Pay By Cash</a><li><a href="qpaycreditcard.html">Pay By Credit Card</a><li><a href="qpaycheck.html">Pay By Check</a><li><a href="invoicepaynow.html">Choose Payment Method</a><li><a href="customerselect.html">Select Customer</a><li><a href="autostatement.html">Run Automatic Statements</a><li><a href="salesperson.html">Salesperson</a><li><a href="advanced.html">Advanced Settings</a><li><a href="taxrate.html">Tax Rate</a><li><a href="itemlistimportmultibus.html">Import Items from other Business</a><li><a href="customerlistimportmultibus.html">Import Customers from other Business</a><li><a href="addaccounttxn.html">Add Account</a><li><a href="packingslip.html">Packing Slip</a><li><a href="company.html">Options ~ Company</a><li><a href="numbering.html">Options ~ Numbering</a><li><a href="invoice.html">Options ~ Invoice</a><li><a href="quote.html">Options ~ Quote</a><li><a href="receipt.html">Options ~ Receipt</a><li><a href="tax.html">Options ~ Tax</a><li><a href="regional.html">Options ~ Regional</a><li><a href="payaccount.html">Options ~ Credit Card Gateways</a><li><a href="accounts.html">Options ~ Web Accounts</a><li><a href="other.html">Options ~ Other</a><li><a href="item.html">Item ~ Item</a><li><a href="
offset: 0
success 0 0
1621004437.244124
NtWriteFile
file_handle: 0x000001b0
filepath: C:\Program Files (x86)\NCH Software\ExpressAccounts\Help\invoices.html
buffer: x).</ul> <p> <u>Changing Invoice Options</u> <p> To change the way an invoice looks use the Invoice tab of Options. Options is on the menu at Tools -&gt; Options. Things you can change: <ul><li>Invoice title<li>Invoice number<li>An optional number prefix<li>The height of your logo<li>Add or change a note at the bottom of the invoice<li>Add or change a footer of the invoice<li>Margin sizes<li>Position of customer's addresses</ul> <p> <u>Receiving Payment for Invoices</u> <p> When you receive a payment from a customer use Apply Payment from the main window to enter it. Click on Payment in the main window to show the Apply Payment box. To apply a payment to an invoice, first enter the date when the payment was recieved, then the customer and/or invoice number to bring up the Amount that is owing. Then enter how much money has been paid in the amount box. From the drop down menu select how the money was paid. Finally click ok and the payment will be recorded. Next time a payment is made the updated amount will be shown in the amount box.<p> <u>Chasing Unpaid Invoices</u> <p> When the time comes to contact overdue customers you can use the Unpaid Invoices Report or the Customer List. To access the Unpaid Invoices Report first click Reports then Unpaid Invoices from the main window. To access the customer list go to View -&gt; Customers from the main menu. You can also use automatic statements to remind customers. This is done by clicking Options on the main window then going to the Other tab and setting who you want to automatically send statements to.<p> <u>Accounting Time</u> <p> When the time comes to enter your sales into your accounts or to visit your accountant, use the Accounting Report. This consolidates the key information needed for entering into your accounts and for tax purposes. To access this report go to Reports in the main window then Accounting.<p> <u>Make a payment</u> <p> Click Payment or Purchase Transaction on the main window. Enter the transaction details, date, account paid from, reference, etc. Click the Add button to select an account to apply an amount to. When all the details are correct the transaction may be recorded by clicking the Record button. <p> <u>Receive money</u> <p> Click Receive or Deposit Transaction on the main window. Enter the transaction details, date, account paid in to, reference, etc. Click the Add button to select an account to apply an amount to. When all the details are correct the transaction may be recorded by clicking the Record button. <p> <u>Manual Journal Entry</u> <p> Click Add a Manual Journal Entry on the main window. Enter the details for the purchase or receipt transaction and then allocate the amount to one or more accounts. When all the details are correct the transaction may be recorded by clicking the Record button. <p> <u>Reconcile account</u> <p> Click Reconcile accounts from the main window. Select the account to be reconciled with the bank statement. Journal entries not yet reconciled will be listed, tick off the entries that are reconciled with the bank account. Transactions may be added easily by clicking the Add Transaction links near the bottom of the window. Click the Reconcile button when done. <p> <script type="text/javascript" language="JavaScript" src="help.js"></script> <script type="text/javascript" language="JavaScript">HelpFooter("Common Tasks: Summary Overview","startup.html","mailmerge.html","NCH Software","http://www.nchsoftware.com");</script> </body> </html>
offset: 0
success 0 0
1621004437.275124
NtWriteFile
file_handle: 0x000001b0
filepath: C:\Program Files (x86)\NCH Software\ExpressAccounts\Help\invoicemain.html
buffer: <html> <head> <!-- saved from url=(0021)http://www.nch.com.au --> <meta http-equiv=Content-Type content="text/html; charset=UTF-8"> <meta name="viewport" content="width=device-width"> <title>New Invoice</title> <link rel=STYLESHEET href="hlp.css" type="text/css"> </head> <body> <script type="text/javascript" language="JavaScript" src="help.js"></script> <script type="text/javascript" language="JavaScript">HelpHeader("Express Accounts","3.41","New Invoice","licenceterms.html","ordermain.html");</script> <p> Fill in the details for the invoice. <p> <p> <b>Order Number</b> <p> <p> Choose the Order from the pull down list or type in a new order number. <p> <p> <b>Invoice Customer</b> <p> <p> Choose the Customer from the pull down list. <p> <p> <b>Date</b> <p> <p> Select the invoice date. <p> <p> <b>Terms</b> <p> <p> The payment terms are used to calculate the payment due date. <p> <p> <b>Sales Person</b> <p> <p> Enter the sales person for this invoice. <p> <p> <b>Tax</b> <p> <p> Select any special sales tax option eg. if this is a special customer who is sales-tax exempt (for example a foreign customer). <p> <p> <b>Bill To</b> <p> <p> Enter the address the invoice should be sent to. <p> <p> <b>Ship To</b> <p> <p> Enter the address the products should be sent to. Leave this blank if this is not required. <p> <p> <b>Customer PO#</b> <p> <p> The customer purchase order number is printed on the invoice and on the statements for customer reference. Leave this blank if not required. <p> <p> <b>Ship By</b> <p> <p> The ship by detail will be printed on the invoice for customer reference. Leave this blank if not required. <p> <p> <b>Tracking Ref#</b> <p> <p> The tracking reference number is printed on the invoice for customer reference. Leave this blank if not required. <p> <p> <b>Invoice Items</b> <p> <p> This is the list of items on the invoice. Click on the Add button to add a new item. <p> <p> <b>Invoice Notes</b> <p> <p> These notes are printed on the bottom of the invoice. <p> <p> <b>Internal Notes</b> <p> <p> These are notes for internal use only - they are not printed on the invoice. <p> <p> <b>Total</b> <p> <p> This is the sales tax and total display. If you think the sales tax calculation is wrong, please see the Tax tab of Options. <p> <p> <b>Record</b> <p> <p> Click on this button to Record the invoice. To select the action (to Print, Email or Fax the invoice) click on the pull down list. <p> <script type="text/javascript" language="JavaScript" src="help.js"></script> <script type="text/javascript" language="JavaScript">HelpFooter("New Invoice","licenceterms.html","ordermain.html","NCH Software","http://www.nchsoftware.com");</script> </body> </html>
offset: 0
success 0 0
1621004437.291124
NtWriteFile
file_handle: 0x000001b0
filepath: C:\Program Files (x86)\NCH Software\ExpressAccounts\Help\ordermain.html
buffer: <html> <head> <!-- saved from url=(0021)http://www.nch.com.au --> <meta http-equiv=Content-Type content="text/html; charset=UTF-8"> <meta name="viewport" content="width=device-width"> <title>New Order</title> <link rel=STYLESHEET href="hlp.css" type="text/css"> </head> <body> <script type="text/javascript" language="JavaScript" src="help.js"></script> <script type="text/javascript" language="JavaScript">HelpHeader("Express Accounts","3.41","New Order","invoicemain.html","quotemain.html");</script> <p> Fill in the details for the order. <p> <p> <b>Quote Number</b> <p> <p> Choose the quote from the pull down list or type in a new quote number. <p> <p> <b>Order Customer</b> <p> <p> Choose the Customer from the pull down list. <p> <p> <b>Date</b> <p> <p> Select the order date. <p> <p> <b>Terms</b> <p> <p> The payment terms are used to calculate the payment due date. <p> <p> <b>Sales Person</b> <p> <p> Enter the sales person for this order. <p> <p> <b>Tax</b> <p> <p> Select any special sales tax option eg. if this is a special customer who is sales-tax exempt (for example a foreign customer). <p> <p> <b>Bill To</b> <p> <p> Enter the address the order should be sent to. <p> <p> <b>Ship To</b> <p> <p> Enter the address the products should be sent to. Leave this blank if this is not required. <p> <p> <b>Ship By</b> <p> <p> The ship by detail will be printed on the order for customer reference. Leave this blank if not required. <p> <p> <b>Tracking Ref#</b> <p> <p> The tracking reference number is printed on the order for customer reference. Leave this blank if not required. <p> <p> <b>Order Items</b> <p> <p> This is the list of items on the order. Click on the Add button to add a new item. <p> <p> <b>Order Notes</b> <p> <p> These notes are printed on the bottom of the order. <p> <p> <b>Internal Notes</b> <p> <p> These are notes for internal use only - they are not printed on the order. <p> <p> <b>Total</b> <p> <p> This is the sales tax and total display. If you think the sales tax calculation is wrong, please see the Tax tab of Options. <p> <p> <b>Record</b> <p> <p> Click on this button to Record the order. To select the action (to Print, Email or Fax the order) click on the pull down list. <p> <script type="text/javascript" language="JavaScript" src="help.js"></script> <script type="text/javascript" language="JavaScript">HelpFooter("New Order","invoicemain.html","quotemain.html","NCH Software","http://www.nchsoftware.com");</script> </body> </html>
offset: 0
success 0 0
1621004437.291124
NtWriteFile
file_handle: 0x000001b0
filepath: C:\Program Files (x86)\NCH Software\ExpressAccounts\Help\quotemain.html
buffer: <html> <head> <!-- saved from url=(0021)http://www.nch.com.au --> <meta http-equiv=Content-Type content="text/html; charset=UTF-8"> <meta name="viewport" content="width=device-width"> <title>New Quote</title> <link rel=STYLESHEET href="hlp.css" type="text/css"> </head> <body> <script type="text/javascript" language="JavaScript" src="help.js"></script> <script type="text/javascript" language="JavaScript">HelpHeader("Express Accounts","3.41","New Quote","ordermain.html","reconcile.html");</script> <p> Fill in the details for the quote. <p> <p> <b>Quote Customer</b> <p> <p> Choose the Customer from the pull down list. <p> <p> <b>Date</b> <p> <p> Select the quote date. <p> <p> <b>Terms</b> <p> <p> The payment terms are used to calculate the payment due date. <p> <p> <b>Sales Person</b> <p> <p> Enter the sales person for this quote. <p> <p> <b>Tax</b> <p> <p> Select any special sales tax option eg. if this is a special customer who is sales-tax exempt (for example a foreign customer). <p> <p> <b>Bill To</b> <p> <p> Enter the address the quote should be sent to. <p> <p> <b>Ship To</b> <p> <p> Enter the address the products should be sent to. Leave this blank if this is not required. <p> <p> <b>Quote Items</b> <p> <p> This is the list of items on the quote. Click on the Add button to add a new item. <p> <p> <b>Quote Notes</b> <p> <p> These notes are printed on the bottom of the quote. <p> <p> <b>Internal Notes</b> <p> <p> These are notes for internal use only - they are not printed on the quote. <p> <p> <b>Total</b> <p> <p> This is the sales tax and total display. If you think the sales tax calculation is wrong, please see the Tax tab of Options. <p> <p> <b>Record</b> <p> <p> Click on this button to Record the quote. To select the action (to Print, Email or Fax the quote) click on the pull down list. <p> <script type="text/javascript" language="JavaScript" src="help.js"></script> <script type="text/javascript" language="JavaScript">HelpFooter("New Quote","ordermain.html","reconcile.html","NCH Software","http://www.nchsoftware.com");</script> </body> </html>
offset: 0
success 0 0
1621004437.306124
NtWriteFile
file_handle: 0x000001b0
filepath: C:\Program Files (x86)\NCH Software\ExpressAccounts\Help\reconcile.html
buffer: <html> <head> <!-- saved from url=(0021)http://www.nch.com.au --> <meta http-equiv=Content-Type content="text/html; charset=UTF-8"> <meta name="viewport" content="width=device-width"> <title>Reconcile Account</title> <link rel=STYLESHEET href="hlp.css" type="text/css"> </head> <body> <script type="text/javascript" language="JavaScript" src="help.js"></script> <script type="text/javascript" language="JavaScript">HelpHeader("Express Accounts","3.41","Reconcile Account","quotemain.html","journalentry.html");</script> <p> <b>Local Ledger Transactions</b> <p> <p> Bank Accounts can be reconciled with Journal entries. Journal entries not yet reconciled will be displayed allowing you to tick off those that can be reconciled. <p> <p> <b>Account</b> <p> <p> Select the Account you wish to reconcile from the pull down list of accounts. <p> <p> <b>Bank Statement Date</b> <p> <p> Enter the date that appears on your bank statement. <p> <p> <b>List of Account entries</b> <p> <p> List of account entries that have not yet been reconciled. Tick each entry you wish to reconcile. <p> <p> <b>Add a new payment transaction</b> <p> <p> Click here to add a new payment transaction. <p> <p> <b>Add a new receipt transaction</b> <p> <p> Click here to add a new receipt transaction. <p> <p> <b>Bank Statement's Transactions</b> <p> <p> List of statement transactions that have not yet been matched. <p> <p> <b>Load a bank statement</b> <p> <p> Click the Load a bank statement in order to load external bank statement in CSV or OFX format. <p> <p> <b>Add Transaction</b> <p> <p> Click Add Transaction to open the Payment or the Receipts dialog. <p> <script type="text/javascript" language="JavaScript" src="help.js"></script> <script type="text/javascript" language="JavaScript">HelpFooter("Reconcile Account","quotemain.html","journalentry.html","NCH Software","http://www.nchsoftware.com");</script> </body> </html>
offset: 0
success 0 0
1621004437.416124
NtWriteFile
file_handle: 0x000001b0
filepath: C:\Program Files (x86)\NCH Software\ExpressAccounts\Help\backupfolder.html
buffer: <html> <head> <!-- saved from url=(0021)http://www.nch.com.au --> <meta http-equiv=Content-Type content="text/html; charset=UTF-8"> <meta name="viewport" content="width=device-width"> <title>Data Backup</title> <link rel=STYLESHEET href="hlp.css" type="text/css"> </head> <body> <script type="text/javascript" language="JavaScript" src="help.js"></script> <script type="text/javascript" language="JavaScript">HelpHeader("Express Accounts","3.41","Data Backup","selectcreditnoteitem.html","faxnumber.html");</script> It is essential that you backup your data regularly just in case something goes wrong. Please select one of the options below. <p> <b>Backup Method</b><p> <b>Backup to a Network Folder</b><p> This is a good options if you are working in an office. Ask you Network Administrator to create a safe folder on the shared server. Select this folder and click Backup. The entire Express Invoice folder will be copied to that folder. If something goes wrong (like a hard drive crash) you just copy back the folder and everything will be restored.<p> <b>Backup to AltoVault Online Storage</b><p> This is a service that provides you with a convenient way to store and access your data online. All you need to do is supply an email address, and then you will be signed up for a free trial and can begin using your storage space straight away.<p> <b>Backup to a CD or DVD with Express Burn</b><p> Select this option to Burn all the data to disc. Express Invoice links to Express Burn to do this. See www.nch.com.au/burn for more about Express Burn.<p> <b>Backup to a Removable Drive</b><p> As an alternative use this option to backup to an external USB hard drive or USB key flash drive. Please consider using MEO to encrypt the files if using removable media. <script type="text/javascript" language="JavaScript" src="help.js"></script> <script type="text/javascript" language="JavaScript">HelpFooter("Data Backup","selectcreditnoteitem.html","faxnumber.html","NCH Software","http://www.nchsoftware.com");</script> </body> </html>
offset: 0
success 0 0
1621004437.478124
NtWriteFile
file_handle: 0x000001b0
filepath: C:\Program Files (x86)\NCH Software\ExpressAccounts\Help\useraccount.html
buffer: <html> <head> <!-- saved from url=(0021)http://www.nch.com.au --> <meta http-equiv=Content-Type content="text/html; charset=UTF-8"> <meta name="viewport" content="width=device-width"> <title>User Account</title> <link rel=STYLESHEET href="hlp.css" type="text/css"> </head> <body> <script type="text/javascript" language="JavaScript" src="help.js"></script> <script type="text/javascript" language="JavaScript">HelpHeader("Express Accounts","3.41","User Account","creditnote.html","payment.html");</script> Each Express Accounts account is identified by their email address. <p> <b>Display Name:</b><p> Enter the user's name. This is used for display purposes.<p> <b>Email address:</b><p> This is used to uniquely identify the user. The user will use this in their email as the account name.<p> <b>Password:</b><p> Enter the password for this user. The user will use this in their email to verify who they are.<p> <b>Account Enabled</b><p> Check (tick) this option to enable the account.<p> <b>User Privileges</b><p> <b>Administrator</b><p> Check this option to allow this user to be able to modify others user's preferences and to add/edit/remove transactions.<p> <b>User</b><p> Check this option to allow this user to be able to add/edit/remove transactions.<p> <b>Viewer</b><p> Check this option to disallow this user to be able to add/edit/remove transactions.<p> <b>Organisations</b><p> This is the list of organisations that the user can access. <script type="text/javascript" language="JavaScript" src="help.js"></script> <script type="text/javascript" language="JavaScript">HelpFooter("User Account","creditnote.html","payment.html","NCH Software","http://www.nchsoftware.com");</script> </body> </html>
offset: 0
success 0 0
1621004437.478124
NtWriteFile
file_handle: 0x000001b0
filepath: C:\Program Files (x86)\NCH Software\ExpressAccounts\Help\payment.html
buffer: <html> <head> <!-- saved from url=(0021)http://www.nch.com.au --> <meta http-equiv=Content-Type content="text/html; charset=UTF-8"> <meta name="viewport" content="width=device-width"> <title>Payment</title> <link rel=STYLESHEET href="hlp.css" type="text/css"> </head> <body> <script type="text/javascript" language="JavaScript" src="help.js"></script> <script type="text/javascript" language="JavaScript">HelpHeader("Express Accounts","3.41","Payment","useraccount.html","reportperiod.html");</script> The Express Invoice Payments window allows you to Add, Delete or Edit payments received. To apply a new payment, click <b>Payments</b> from the main toolbar, or press Ctrl+Y. To edit an existing payment, first open the Payments list by clicking View and selecting Payments, then select the payment you need to edit, and click the <b>Edit</b> button in the toolbar. <p> <b>Customer Payment</b><p> <b>Date:</b><p> Enter the date the payment was received (not the date of the invoice).<p> <b>Customer:</b><p> Select the customer from the drop-menu. You also have the option of leaving this field blank if you enter an invoice number.<p> <b>Amount:</b><p> If you selected a customer or invoice number, this field will automatically fill with the customer's account balance. If the payment does not match this number, enter the exact amount paid.<p> <b>Method:</b><p> Select how the payment was made.<p> <b>Reference Number:</b><p> Enter the reference number. Leave this field blank if you charge by credit card online; the reference number will generate automatically after success. If you do not charge by credit card, entering a reference number is optional, but can help you keep soft references between payments and invoices. <p> <b>Charge Customer via online Credit Card Gateway</b><p> Check this if you want to charge the customer by the credit card. You must have set the payaccount in Options on the Credit Card Gateways tab, as well as entered the customer's custom credit card information in their customer listing.<p> <b>Invoices</b><p> This is the total amount remaining which has not been applied to any invoices. <script type="text/javascript" language="JavaScript" src="help.js"></script> <script type="text/javascript" language="JavaScript">HelpFooter("Payment","useraccount.html","reportperiod.html","NCH Software","http://www.nchsoftware.com");</script> </body> </html>
offset: 0
success 0 0
1621004437.494124
NtWriteFile
file_handle: 0x000001b0
filepath: C:\Program Files (x86)\NCH Software\ExpressAccounts\Help\reportperiod.html
buffer: <html> <head> <!-- saved from url=(0021)http://www.nch.com.au --> <meta http-equiv=Content-Type content="text/html; charset=UTF-8"> <meta name="viewport" content="width=device-width"> <title>Report Period</title> <link rel=STYLESHEET href="hlp.css" type="text/css"> </head> <body> <script type="text/javascript" language="JavaScript" src="help.js"></script> <script type="text/javascript" language="JavaScript">HelpHeader("Express Accounts","3.41","Report Period","payment.html","recurringdialog.html");</script> <b>Generate Report for Period</b><p> <b>Select Period:</b><p> Select the period for the report. Fixed period choices available are the current month, the previous month, the current calendar year. Or you can choose Select and then enter any Start Date and End Date you like in the boxes below for the period of the report.<p> <b>Start Date:</b><p> Enter the date (inclusive) the report period will start from. Clicking the down arrow will display a calendar from which the start date for the report can be selected.<p> <b>End Date:</b><p> Enter the date (inclusive) the report period will end on. Clicking the down arrow will display a calendar from which the end date for the report can be selected. <script type="text/javascript" language="JavaScript" src="help.js"></script> <script type="text/javascript" language="JavaScript">HelpFooter("Report Period","payment.html","recurringdialog.html","NCH Software","http://www.nchsoftware.com");</script> </body> </html>
offset: 0
success 0 0
1621004437.666124
NtWriteFile
file_handle: 0x000001b0
filepath: C:\Program Files (x86)\NCH Software\ExpressAccounts\Help\invoicepaynow.html
buffer: <html> <head> <!-- saved from url=(0021)http://www.nch.com.au --> <meta http-equiv=Content-Type content="text/html; charset=UTF-8"> <meta name="viewport" content="width=device-width"> <title>Choose Payment Method</title> <link rel=STYLESHEET href="hlp.css" type="text/css"> </head> <body> <script type="text/javascript" language="JavaScript" src="help.js"></script> <script type="text/javascript" language="JavaScript">HelpHeader("Express Accounts","3.41","Choose Payment Method","qpaycheck.html","customerselect.html");</script> <b>Payment method</b><p> <b>Cash</b><p> pay by cash<p> <b>Check</b><p> pay by check, need check number<p> <b>Check Number:</b><p> input the check number<p> <b>Credit Card</b><p> pay by credit card. credit card information are stored in customer database. <script type="text/javascript" language="JavaScript" src="help.js"></script> <script type="text/javascript" language="JavaScript">HelpFooter("Choose Payment Method","qpaycheck.html","customerselect.html","NCH Software","http://www.nchsoftware.com");</script> </body> </html>
offset: 0
success 0 0
1621004437.775124
NtWriteFile
file_handle: 0x000001b0
filepath: C:\Program Files (x86)\NCH Software\ExpressAccounts\Help\company.html
buffer: <html> <head> <!-- saved from url=(0021)http://www.nch.com.au --> <meta http-equiv=Content-Type content="text/html; charset=UTF-8"> <meta name="viewport" content="width=device-width"> <title>Options ~ Company</title> <link rel=STYLESHEET href="hlp.css" type="text/css"> </head> <body> <script type="text/javascript" language="JavaScript" src="help.js"></script> <script type="text/javascript" language="JavaScript">HelpHeader("Express Accounts","3.41","Options ~ Company","packingslip.html","numbering.html");</script> This tab is used to enter details about your business or company. <p> <b>Company Details</b><p> <b>Business Name:</b><p> Enter the official name of the business (eg. Acme Corporation, Inc).<p> <b>Registered Number:</b><p> In many countries, each business has an official number which must be displayed on the invoice. Please enter it here.<p> <b>Type of Address:</b><p> Select Business Address or Shipping Address.<p> <b>Address:</b><p> Enter the address of your business as you want it to be printed on the invoice.<p> <b>Contact Details: </b><p> Enter the contact details you want on the invoice. For example, phone, fax and email address.This is the end of the financial year for the company for accounting and taxation reasons.This is the end of the financial year for the company for accounting and taxation reasons.<p> <b>Logo Image File (jpg):</b><p> To add your logo to invoices, statements and other reports you can select the file path to a jpg image.<p> <b>Automatic Statements</b><p> <b>Send Monthly Statements:</b><p> Statements can be automatically printed or sent at the end of each month. The statements can be sent to customers who have any due amount or customers who are overdue depending on the option you select.<p> <b>Ignore Amounts Under:</b><p> This option helps avoid printing invoices for customers who owe just a few dollars.<p> <b>Payment Methods</b><p> When you apply a payment you select the payment method. This can then be used to create reports of payments and to aid reconciling statements. You can change the default list of payments by entering a comma separated list of the methods your company accepts here. An example is Check,Bank Deposit,Credit Card etc. <script type="text/javascript" language="JavaScript" src="help.js"></script> <script type="text/javascript" language="JavaScript">HelpFooter("Options ~ Company","packingslip.html","numbering.html","NCH Software","http://www.nchsoftware.com");</script> </body> </html>
offset: 0
success 0 0
1621004437.775124
NtWriteFile
file_handle: 0x000001b0
filepath: C:\Program Files (x86)\NCH Software\ExpressAccounts\Help\numbering.html
buffer: <html> <head> <!-- saved from url=(0021)http://www.nch.com.au --> <meta http-equiv=Content-Type content="text/html; charset=UTF-8"> <meta name="viewport" content="width=device-width"> <title>Options ~ Numbering</title> <link rel=STYLESHEET href="hlp.css" type="text/css"> </head> <body> <script type="text/javascript" language="JavaScript" src="help.js"></script> <script type="text/javascript" language="JavaScript">HelpHeader("Express Accounts","3.41","Options ~ Numbering","company.html","invoice.html");</script> This tab is used to define the item number prefix and starting value Payment, Receipt and Journal entries. <p> <b>Payment Numbering</b><p> Enter the Reference prefix and starting number for payments.<p> <b>Receipt Numbering</b><p> Enter the Receipt prefix and starting number for receipts.<p> <b>Sales Numbering</b><p> Enter the Reference prefix and starting number for sales.<p> <b>Purchases Numbering</b><p> Enter the Receipt prefix and starting number for purchases.<p> <b>Journal Numbering</b><p> Enter the Journal prefix and starting number for journal entries.<p> <b>Checks Numbering</b><p> Enter the Check starting number. <script type="text/javascript" language="JavaScript" src="help.js"></script> <script type="text/javascript" language="JavaScript">HelpFooter("Options ~ Numbering","company.html","invoice.html","NCH Software","http://www.nchsoftware.com");</script> </body> </html>
offset: 0
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2340 resumed a thread in remote process 3120
Time & API Arguments Status Return Repeated
1621004458.072124
NtResumeThread
thread_handle: 0x000001b0
suspend_count: 1
process_identifier: 3120
success 0 0
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 216.58.200.238:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2009-11-16 08:53:39

Imports

Library SETUPAPI.dll:
Library ole32.dll:
0x401060 CoUninitialize
0x401064 CoInitializeEx
Library SHELL32.dll:
0x401050 ShellExecuteExW
Library USER32.dll:
0x401058 wsprintfW
Library KERNEL32.dll:
0x401000 GetLastError
0x401004 LockResource
0x401008 CreateFileW
0x40100c WriteFile
0x401010 GetModuleFileNameW
0x401014 LoadResource
0x401018 FindResourceW
0x40101c GetExitCodeProcess
0x401020 GetModuleHandleW
0x401024 GetStartupInfoW
0x401028 GetTempPathW
0x40102c WaitForSingleObject
0x401030 SizeofResource
0x401034 CloseHandle
0x401038 DeleteFileW
0x40103c ExitProcess
0x401040 lstrcpyW

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49194 173.247.250.125 audiochannel.net 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 49713 114.114.114.114 53
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 50568 114.114.114.114 53
192.168.56.101 53380 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 62912 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355

HTTP & HTTPS Requests

URI Data
http://audiochannel.net/components/eisetup.exe
GET /components/eisetup.exe HTTP/1.0
Host: audiochannel.net

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.