SmartHawk

13.6

0-day

57 个模型检测该样本为恶意！

重新分析

下载样本

64b3a6adfac5ca856a15d9c0a22840056506562ae94233a30b2c8e32a7f61cda

b192f4eb3271c0bfc58f5485cfa2b775.exe

分析耗时

75s

最近分析

文件大小

646.0KB

静态报毒动态报毒 100% ABFU AGENSLA AGENTTESLA AI SCORE=86 ATTRIBUTE AUTO BASIC BEHAVIOR BVFX7X CHISBUR CONFIDENCE ELDORADO FAREIT GDSDA HGIASOCA HIGH CONFIDENCE HIGHCONFIDENCE HLHXAF KRYPTIK KWEYF MALICIOUS PE MALWARE@#DTS295FC1KVC NANOCORE OU0@AQW2JYC PCRYPT R + TROJ SAVE SCORE SIGGEN9 SIWORS SLNTSCN24 STATIC AI SUSGEN TIAOODGM TROJANPSW TROJANX TSCOPE UNSAFE YAKBEEXMSIL ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FUE!B192F4EB3271	20210228	6.0.6.653
Alibaba	TrojanPSW:MSIL/Nanocore.7e937358	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_100% (W)	20210203	1.0
Baidu		20190318	1.0.0.2
Avast	Win32:TrojanX-gen [Trj]	20210228	21.1.5827.0
Tencent	Win32.Trojan.Inject.Auto	20210228	1.0.0.1
Kingsoft		20210228	2017.9.26.565

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619886311.60425 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Checks if process is being debugged by a debugger (50 out of 78 个事件)

Time & API	Arguments	Status	Return	Repeated
1619861121.519915 IsDebuggerPresent		failed	0	0
1619861126.222915 IsDebuggerPresent		failed	0	0
1619861126.675915 IsDebuggerPresent		failed	0	0
1619861127.222915 IsDebuggerPresent		failed	0	0
1619861127.675915 IsDebuggerPresent		failed	0	0
1619861128.222915 IsDebuggerPresent		failed	0	0
1619861128.675915 IsDebuggerPresent		failed	0	0
1619861129.222915 IsDebuggerPresent		failed	0	0
1619861129.675915 IsDebuggerPresent		failed	0	0
1619861130.222915 IsDebuggerPresent		failed	0	0
1619861130.675915 IsDebuggerPresent		failed	0	0
1619861131.222915 IsDebuggerPresent		failed	0	0
1619861131.675915 IsDebuggerPresent		failed	0	0
1619861132.222915 IsDebuggerPresent		failed	0	0
1619861132.675915 IsDebuggerPresent		failed	0	0
1619861133.222915 IsDebuggerPresent		failed	0	0
1619861133.675915 IsDebuggerPresent		failed	0	0
1619861134.222915 IsDebuggerPresent		failed	0	0
1619861134.675915 IsDebuggerPresent		failed	0	0
1619861135.222915 IsDebuggerPresent		failed	0	0
1619861135.675915 IsDebuggerPresent		failed	0	0
1619861136.222915 IsDebuggerPresent		failed	0	0
1619861136.675915 IsDebuggerPresent		failed	0	0
1619861137.222915 IsDebuggerPresent		failed	0	0
1619861137.675915 IsDebuggerPresent		failed	0	0
1619861138.222915 IsDebuggerPresent		failed	0	0
1619861138.675915 IsDebuggerPresent		failed	0	0
1619861139.222915 IsDebuggerPresent		failed	0	0
1619861139.675915 IsDebuggerPresent		failed	0	0
1619861140.222915 IsDebuggerPresent		failed	0	0
1619861140.675915 IsDebuggerPresent		failed	0	0
1619861141.222915 IsDebuggerPresent		failed	0	0
1619861141.675915 IsDebuggerPresent		failed	0	0
1619861142.222915 IsDebuggerPresent		failed	0	0
1619861142.675915 IsDebuggerPresent		failed	0	0
1619861143.222915 IsDebuggerPresent		failed	0	0
1619861143.675915 IsDebuggerPresent		failed	0	0
1619861144.222915 IsDebuggerPresent		failed	0	0
1619861144.675915 IsDebuggerPresent		failed	0	0
1619861145.222915 IsDebuggerPresent		failed	0	0
1619861145.675915 IsDebuggerPresent		failed	0	0
1619861146.222915 IsDebuggerPresent		failed	0	0
1619861146.675915 IsDebuggerPresent		failed	0	0
1619861147.222915 IsDebuggerPresent		failed	0	0
1619861147.675915 IsDebuggerPresent		failed	0	0
1619861148.222915 IsDebuggerPresent		failed	0	0
1619861148.675915 IsDebuggerPresent		failed	0	0
1619861149.222915 IsDebuggerPresent		failed	0	0
1619861149.675915 IsDebuggerPresent		failed	0	0
1619861150.222915 IsDebuggerPresent		failed	0	0

Command line console output was observed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619886312.24425 WriteConsoleW	buffer: 成功: 成功创建计划任务 "Updates\ViNXkrgidtpBt"。 console_handle: 0x00000007	success	1	0

Tries to locate where the browsers are installed (1 个事件)

file	C:\Program Files (x86)\Mozilla Firefox\nss3.dll

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619861124.613915 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 个事件)

section	cj:y+\x0b Z
section

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619886321.494125 __exception__	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 registers.esp: 1833320 registers.edi: 8881320 registers.eax: 1833320 registers.ebp: 1833400 registers.edx: 0 registers.ebx: 8881320 registers.esi: 8881320 registers.ecx: 2 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 46887 exception.address: 0x778eb727	success	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 58 个事件)

Time & API	Arguments	Status
1619861120.081915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00750000	success
1619861120.081915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00920000	success
1619861121.347915 NtProtectVirtualMemory	process_identifier: 1704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f31000	success
1619861121.519915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003fa000	success
1619861121.519915 NtProtectVirtualMemory	process_identifier: 1704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73f32000	success
1619861121.519915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f2000	success
1619861121.722915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00402000	success
1619861121.800915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00403000	success
1619861121.816915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004bb000	success
1619861121.816915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b7000	success
1619861121.847915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0040c000	success
1619861121.925915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005f0000	success
1619861122.081915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00404000	success
1619861122.097915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005f1000	success
1619861122.128915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0040a000	success
1619861122.191915 NtProtectVirtualMemory	process_identifier: 1704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 167936 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00ae2000	success
1619861125.566915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005f2000	success
1619861125.581915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005f3000	success
1619861125.581915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005f4000	success
1619861125.691915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005f5000	success
1619861125.816915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00405000	success
1619861125.816915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005f6000	success
1619861125.909915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005f7000	success
1619861125.941915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004aa000	success
1619861125.972915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a2000	success
1619861126.034915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004b5000	success
1619861126.363915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00406000	success
1619861126.488915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0049a000	success
1619861126.488915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00497000	success
1619861126.503915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003fb000	success
1619861126.519915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00408000	success
1619861126.566915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005f8000	success
1619861126.597915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005fb000	success
1619861126.831915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022e0000	success
1619861127.003915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00921000	success
1619861127.003915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00496000	success
1619861127.019915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022e1000	success
1619861127.159915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005fc000	success
1619861160.363915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005fd000	success
1619861160.378915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00409000	success
1619861160.503915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 1835008 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x06930000	success
1619861160.503915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x06ab0000	success
1619861160.503915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x06ab1000	success
1619861160.534915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x06ab2000	success
1619861160.550915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x06ab3000	success
1619861160.550915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x06ab4000	success
1619861160.550915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x06ab6000	success
1619861160.550915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x06ab9000	success
1619861160.550915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x06abd000	success
1619861160.581915 NtAllocateVirtualMemory	process_identifier: 1704 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005fe000	success

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619886321.0885 GetDiskFreeSpaceW	root_path: C: sectors_per_cluster: 8362495 number_of_free_clusters: 8362495 total_number_of_clusters: 8362495 bytes_per_sector: 512	success	1	0
1619886321.1045 GetDiskFreeSpaceW	root_path: C: sectors_per_cluster: 8362495 number_of_free_clusters: 8362495 total_number_of_clusters: 8362495 bytes_per_sector: 512	success	1	0

Steals private information from local Internet browsers (8 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Web Data-wal
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data-wal
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera7\profile\wand.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera\wand.dat

Creates a suspicious process (2 个事件)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ViNXkrgidtpBt" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpF44E.tmp"
cmdline	schtasks.exe /Create /TN "Updates\ViNXkrgidtpBt" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpF44E.tmp"

A process created a hidden window (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619861161.519915 ShellExecuteExW	parameters: /Create /TN "Updates\ViNXkrgidtpBt" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpF44E.tmp" filepath: schtasks.exe filepath_r: schtasks.exe show_type: 0	success	1	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619886314.744125 NtProtectVirtualMemory	process_identifier: 2652 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) process_handle: 0xffffffff base_address: 0x003f0000	success	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619886322.901125 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

The binary likely contains encrypted or compressed data indicative of a packer (3 个事件)

entropy

7.998930493744865

section

{'size_of_data': '0x00028600', 'virtual_address': '0x00002000', 'entropy': 7.998930493744865, 'name': 'cj:y+\\x0b\tZ', 'virtual_size': '0x0002843c'}

description

A section with a high entropy has been found

entropy

7.500465891376357

section

{'size_of_data': '0x00078400', 'virtual_address': '0x0002c000', 'entropy': 7.500465891376357, 'name': '.text', 'virtual_size': '0x00078400'}

description

A section with a high entropy has been found

entropy

0.9961240310077519

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619861122.175915 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Uses Windows utilities for basic Windows functionality (2 个事件)

cmdline	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ViNXkrgidtpBt" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpF44E.tmp"
cmdline	schtasks.exe /Create /TN "Updates\ViNXkrgidtpBt" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpF44E.tmp"

One or more of the buffers contains an embedded PE file (2 个事件)

buffer	Buffer with sha1: 9ec310eabb24f485a51035694da14e0cce3346a1
buffer	Buffer with sha1: cc3419452516bdc215a55127ac19e0b12b8e4a08

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Allocates execute permission to another process indicative of possible code injection (3 个事件)

Time & API	Arguments	Status	Return
1619861164.316915 NtAllocateVirtualMemory	process_identifier: 2652 region_size: 270336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00006c40 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619886315.166125 NtAllocateVirtualMemory	process_identifier: 1160 region_size: 339968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000000c8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619886327.088125 NtAllocateVirtualMemory	process_identifier: 340 region_size: 126976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003f4 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496

Manipulates memory of a non-child process indicative of process injection (3 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2652 manipulating memory of non-child process 340
1619886327.088125 NtUnmapViewOfSection	process_identifier: 340 region_size: 53248 process_handle: 0x000003f4 base_address: 0x00400000	failed	3221225497	0
1619886327.088125 NtAllocateVirtualMemory	process_identifier: 340 region_size: 126976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003f4 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496	0

Potential code injection by writing to the memory of another process (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619861164.331915 WriteProcessMemory	process_identifier: 2652 buffer: @ process_handle: 0x00006c40 base_address: 0x7efde008	success	1	0

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619886325.526125 RegSetValueExA	key_handle: 0x00000378 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619886325.526125 RegSetValueExA	key_handle: 0x00000378 value: `£Û>× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619886325.526125 RegSetValueExA	key_handle: 0x00000378 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619886325.526125 RegSetValueExW	key_handle: 0x00000378 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619886325.526125 RegSetValueExA	key_handle: 0x00000390 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619886325.526125 RegSetValueExA	key_handle: 0x00000390 value: `£Û>× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619886325.526125 RegSetValueExA	key_handle: 0x00000390 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619886325.573125 RegSetValueExW	key_handle: 0x00000374 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (6 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1704 called NtSetContextThread to modify thread in remote process 2652
Process injection	Process 2652 called NtSetContextThread to modify thread in remote process 1160
Process injection	Process 2652 called NtSetContextThread to modify thread in remote process 340
1619861164.331915 NtSetContextThread	thread_handle: 0x0000be64 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4198784 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2652	success	0	0
1619886315.182125 NtSetContextThread	thread_handle: 0x000000c0 registers.eip: 2010382788 registers.esp: 3210772 registers.edi: 0 registers.eax: 4526816 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1160	success	0	0
1619886327.104125 NtSetContextThread	thread_handle: 0x000003f0 registers.eip: 2010382788 registers.esp: 4259440 registers.edi: 0 registers.eax: 4310032 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 340	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (6 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1704 resumed a thread in remote process 2652
Process injection	Process 2652 resumed a thread in remote process 1160
Process injection	Process 2652 resumed a thread in remote process 340
1619861164.566915 NtResumeThread	thread_handle: 0x0000be64 suspend_count: 1 process_identifier: 2652	success	0	0
1619886315.494125 NtResumeThread	thread_handle: 0x000000c0 suspend_count: 1 process_identifier: 1160	success	0	0
1619886327.354125 NtResumeThread	thread_handle: 0x000003f0 suspend_count: 1 process_identifier: 340	success	0	0

Generates some ICMP traffic

Executed a process and injected code into it, probably while unpacking (28 个事件)

Time & API	Arguments	Status	Return
1619861121.519915 NtResumeThread	thread_handle: 0x000000d0 suspend_count: 1 process_identifier: 1704	success	0
1619861121.581915 NtResumeThread	thread_handle: 0x0000015c suspend_count: 1 process_identifier: 1704	success	0
1619861126.128915 NtResumeThread	thread_handle: 0x0000fe6c suspend_count: 1 process_identifier: 1704	success	0
1619861126.159915 NtResumeThread	thread_handle: 0x00009710 suspend_count: 1 process_identifier: 1704	success	0
1619861161.519915 CreateProcessInternalW	thread_identifier: 2968 thread_handle: 0x00004744 process_identifier: 2964 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: C:\Windows\System32\schtasks.exe track: 1 command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ViNXkrgidtpBt" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmpF44E.tmp" filepath_r: C:\Windows\System32\schtasks.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x000041e4 inherit_handles: 0	success	1
1619861164.300915 CreateProcessInternalW	thread_identifier: 952 thread_handle: 0x0000be64 process_identifier: 2652 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe track: 1 command_line: "{path}" filepath_r: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00006c40 inherit_handles: 0	success	1
1619861164.316915 NtGetContextThread	thread_handle: 0x0000be64	success	0
1619861164.316915 NtAllocateVirtualMemory	process_identifier: 2652 region_size: 270336 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x00006c40 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619861164.316915 WriteProcessMemory	process_identifier: 2652 buffer: process_handle: 0x00006c40 base_address: 0x00400000	success	1
1619861164.316915 WriteProcessMemory	process_identifier: 2652 buffer: process_handle: 0x00006c40 base_address: 0x00401000	success	1
1619861164.316915 WriteProcessMemory	process_identifier: 2652 buffer: process_handle: 0x00006c40 base_address: 0x00409000	success	1
1619861164.331915 WriteProcessMemory	process_identifier: 2652 buffer: @ process_handle: 0x00006c40 base_address: 0x7efde008	success	1
1619861164.331915 NtSetContextThread	thread_handle: 0x0000be64 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4198784 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2652	success	0
1619861164.566915 NtResumeThread	thread_handle: 0x0000be64 suspend_count: 1 process_identifier: 2652	success	0
1619861164.566915 NtResumeThread	thread_handle: 0x0000868c suspend_count: 1 process_identifier: 1704	success	0
1619886315.166125 CreateProcessInternalW	thread_identifier: 3008 thread_handle: 0x000000c0 process_identifier: 1160 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe track: 1 command_line: /scomma "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\Bz5g2TnI6i.ini" filepath_r: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000000c8 inherit_handles: 0	success	1
1619886315.166125 NtUnmapViewOfSection	process_identifier: 1160 region_size: 7143424 process_handle: 0x000000c8 base_address: 0x00400000	failed	3221225497
1619886315.166125 NtAllocateVirtualMemory	process_identifier: 1160 region_size: 339968 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000000c8 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success	0
1619886315.182125 NtGetContextThread	thread_handle: 0x000000c0	success	0
1619886315.182125 NtSetContextThread	thread_handle: 0x000000c0 registers.eip: 2010382788 registers.esp: 3210772 registers.edi: 0 registers.eax: 4526816 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1160	success	0
1619886315.494125 NtResumeThread	thread_handle: 0x000000c0 suspend_count: 1 process_identifier: 1160	success	0
1619886327.088125 CreateProcessInternalW	thread_identifier: 2412 thread_handle: 0x000003f0 process_identifier: 340 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe track: 1 command_line: /scomma "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\otXyq8FsEn.ini" filepath_r: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000003f4 inherit_handles: 0	success	1
1619886327.088125 NtUnmapViewOfSection	process_identifier: 340 region_size: 53248 process_handle: 0x000003f4 base_address: 0x00400000	failed	3221225497
1619886327.088125 NtAllocateVirtualMemory	process_identifier: 340 region_size: 126976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0x000003f4 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	failed	3221225496
1619886327.104125 NtGetContextThread	thread_handle: 0x000003f0	success	0
1619886327.104125 NtSetContextThread	thread_handle: 0x000003f0 registers.eip: 2010382788 registers.esp: 4259440 registers.edi: 0 registers.eax: 4310032 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 340	success	0
1619886327.354125 NtResumeThread	thread_handle: 0x000003f0 suspend_count: 1 process_identifier: 340	success	0
1619886315.9945 NtResumeThread	thread_handle: 0x00000100 suspend_count: 1 process_identifier: 1160	success	0

File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 个事件)

Elastic	malicious (high confidence)
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
McAfee	Fareit-FUE!B192F4EB3271
Cylance	Unsafe
Zillya	Trojan.Basic.Win32.2603
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 00561f911 )
Alibaba	TrojanPSW:MSIL/Nanocore.7e937358
K7GW	Trojan ( 00561f911 )
CrowdStrike	win/malicious_confidence_100% (W)
Cyren	W32/MSIL_Troj.VP.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:TrojanX-gen [Trj]
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender	Trojan.MSIL.Basic.2.Gen
NANO-Antivirus	Trojan.Win32.Kryptik.hlhxaf
Paloalto	generic.ml
MicroWorld-eScan	Trojan.MSIL.Basic.2.Gen
Tencent	Win32.Trojan.Inject.Auto
Ad-Aware	Trojan.MSIL.Basic.2.Gen
Sophos	Mal/Generic-R + Troj/Chisbur-WN
Comodo	Malware@#dts295fc1kvc
F-Secure	Trojan.TR/AD.Siwors.kweyf
DrWeb	Trojan.Siggen9.51787
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Backdoor.MSIL.NANOCORE.TIAOODGM
McAfee-GW-Edition	BehavesLike.Win32.Generic.jc
FireEye	Generic.mg.b192f4eb3271c0bf
Emsisoft	Trojan.MSIL.Basic.2.Gen (B)
Ikarus	Trojan-Rat.NanoCore
GData	Trojan.MSIL.Basic.2.Gen
Jiangmin	Trojan.PSW.MSIL.abfu
Webroot	W32.Trojan.Gen
Avira	TR/AD.Siwors.kweyf
Gridinsoft	Trojan.Heur!.03013281
Arcabit	Trojan.MSIL.Basic.2.Gen
AegisLab	Trojan.Multi.Generic.4!c
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Agensla.gen
Microsoft	Trojan:MSIL/Nanocore.PRA!MTB
AhnLab-V3	Trojan/Win32.AgentTesla.C4114780
VBA32	TScope.Trojan.MSIL
ALYac	Trojan.MSIL.Basic.2.Gen
MAX	malware (ai score=86)
Malwarebytes	Trojan.PCrypt.MSIL.Generic
ESET-NOD32	a variant of MSIL/Kryptik.UXZ
TrendMicro-HouseCall	Backdoor.MSIL.NANOCORE.TIAOODGM
Yandex	Trojan.Slntscn24.bVfx7x
SentinelOne	Static AI - Malicious PE

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-06-03 21:37:39

Imports

Library mscoree.dll:

• 0x4aa000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
amayapalmgarden.lk
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.