5.6
高危
1 个模型检测该样本为恶意！
重新分析
更多

2320e47a14bf402f9a8c6ee87761b0fb424d954ca16ce564cfb31f48e8ee7526

c7b6ae010848285be9d7aa45f1bd6f1a.exe

分析耗时

82s

最近分析

文件大小

933.5KB
静态报毒 动态报毒 QVM05
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
CrowdStrike 20170420 1.0
Baidu 20170613 1.0.0.2
Kingsoft 20170614 2013.8.14.323
McAfee 20170613 6.0.6.653
Tencent 20170614 1.0.0.1
Avast 20170614 8.0.1489.320
行为判定
动态指标
Performs some HTTP requests (2 个事件)
request GET http://lotte30-0.insaram.com/
request GET http://lotte30-0.insaram.com/ver02/exam/index_new.asp
Allocates read-write-execute memory (usually to unpack itself) (1 个事件)
Time & API Arguments Status Return Repeated
1620985511.176074
NtAllocateVirtualMemory
process_identifier: 2120
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00370000
success 0 0
Foreign language identified in PE resource (9 个事件)
name RT_ICON language LANG_KOREAN offset 0x00096840 filetype dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0 sublanguage SUBLANG_KOREAN size 0x00010828
name RT_ICON language LANG_KOREAN offset 0x00096840 filetype dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0 sublanguage SUBLANG_KOREAN size 0x00010828
name RT_ICON language LANG_KOREAN offset 0x00096840 filetype dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0 sublanguage SUBLANG_KOREAN size 0x00010828
name RT_ICON language LANG_KOREAN offset 0x00096840 filetype dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0 sublanguage SUBLANG_KOREAN size 0x00010828
name RT_ICON language LANG_KOREAN offset 0x00096840 filetype dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0 sublanguage SUBLANG_KOREAN size 0x00010828
name RT_ICON language LANG_KOREAN offset 0x00096840 filetype dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0 sublanguage SUBLANG_KOREAN size 0x00010828
name RT_ICON language LANG_KOREAN offset 0x00096840 filetype dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0 sublanguage SUBLANG_KOREAN size 0x00010828
name RT_ICON language LANG_KOREAN offset 0x00096840 filetype dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0 sublanguage SUBLANG_KOREAN size 0x00010828
name RT_GROUP_ICON language LANG_KOREAN offset 0x000ef404 filetype data sublanguage SUBLANG_KOREAN size 0x00000076
File has been identified by one AntiVirus engine on VirusTotal as malicious (1 个事件)
Qihoo-360 HEUR/QVM05.1.Malware.Gen
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1620985513.535074
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Disables proxy possibly for traffic interception (1 个事件)
Time & API Arguments Status Return Repeated
1620985513.082074
RegSetValueExA
key_handle: 0x00000314
value: 0
regkey_r: ProxyEnable
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
success 0 0
Creates a windows hook that monitors keyboard input (keylogger) (1 个事件)
Time & API Arguments Status Return Repeated
1620985511.863074
SetWindowsHookExA
thread_identifier: 0
callback_function: 0x00469bf8
module_address: 0x00400000
hook_identifier: 13 (WH_KEYBOARD_LL)
success 66019 0
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (15 个事件)
Time & API Arguments Status Return Repeated
1620985516.113074
RegSetValueExA
key_handle: 0x0000042c
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1620985516.113074
RegSetValueExA
key_handle: 0x0000042c
value: p¯B`ÁH×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1620985516.113074
RegSetValueExA
key_handle: 0x0000042c
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1620985516.113074
RegSetValueExW
key_handle: 0x0000042c
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1620985516.113074
RegSetValueExA
key_handle: 0x00000448
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1620985516.113074
RegSetValueExA
key_handle: 0x00000448
value: p¯B`ÁH×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1620985516.113074
RegSetValueExA
key_handle: 0x00000448
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1620985516.144074
RegSetValueExW
key_handle: 0x00000428
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
1620985518.238074
RegSetValueExA
key_handle: 0x000003c4
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1620985518.238074
RegSetValueExA
key_handle: 0x000003c4
value: @ï†aÁH×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1620985518.238074
RegSetValueExA
key_handle: 0x000003c4
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1620985518.238074
RegSetValueExW
key_handle: 0x000003c4
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1620985518.238074
RegSetValueExA
key_handle: 0x00000188
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1620985518.238074
RegSetValueExA
key_handle: 0x00000188
value: @ï†aÁH×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1620985518.238074
RegSetValueExA
key_handle: 0x00000188
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
Generates some ICMP traffic
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x470164 VirtualFree
• 0x470168 VirtualAlloc
• 0x47016c LocalFree
• 0x470170 LocalAlloc
• 0x470174 GetVersion
• 0x470178 GetCurrentThreadId
• 0x470184 VirtualQuery
• 0x470188 WideCharToMultiByte
• 0x47018c MultiByteToWideChar
• 0x470190 lstrlenA
• 0x470194 lstrcpynA
• 0x470198 LoadLibraryExA
• 0x47019c GetThreadLocale
• 0x4701a0 GetStartupInfoA
• 0x4701a4 GetProcAddress
• 0x4701a8 GetModuleHandleA
• 0x4701ac GetModuleFileNameA
• 0x4701b0 GetLocaleInfoA
• 0x4701b4 GetCommandLineA
• 0x4701b8 FreeLibrary
• 0x4701bc FindFirstFileA
• 0x4701c0 FindClose
• 0x4701c4 ExitProcess
• 0x4701c8 WriteFile
• 0x4701d0 RtlUnwind
• 0x4701d4 RaiseException
• 0x4701d8 GetStdHandle
Library user32.dll:
• 0x4701e0 GetKeyboardType
• 0x4701e4 LoadStringA
• 0x4701e8 MessageBoxA
• 0x4701ec CharNextA
Library advapi32.dll:
• 0x4701f4 RegQueryValueExA
• 0x4701f8 RegOpenKeyExA
• 0x4701fc RegCloseKey
Library oleaut32.dll:
• 0x470204 SysFreeString
• 0x470208 SysReAllocStringLen
• 0x47020c SysAllocStringLen
Library kernel32.dll:
• 0x470214 TlsSetValue
• 0x470218 TlsGetValue
• 0x47021c LocalAlloc
• 0x470220 GetModuleHandleA
Library advapi32.dll:
• 0x470228 RegQueryValueExA
• 0x47022c RegOpenKeyExA
• 0x470230 RegCloseKey
Library kernel32.dll:
• 0x470238 lstrcpyA
• 0x47023c WriteFile
• 0x470240 WaitForSingleObject
• 0x470244 VirtualQuery
• 0x470248 VirtualAlloc
• 0x47024c Sleep
• 0x470250 SizeofResource
• 0x470254 SetThreadLocale
• 0x470258 SetFilePointer
• 0x47025c SetEvent
• 0x470260 SetErrorMode
• 0x470264 SetEndOfFile
• 0x470268 ResetEvent
• 0x47026c ReadFile
• 0x470270 MultiByteToWideChar
• 0x470274 MulDiv
• 0x470278 LockResource
• 0x47027c LoadResource
• 0x470280 LoadLibraryA
• 0x47028c GlobalUnlock
• 0x470290 GlobalSize
• 0x470294 GlobalReAlloc
• 0x470298 GlobalHandle
• 0x47029c GlobalLock
• 0x4702a0 GlobalFree
• 0x4702a4 GlobalFindAtomA
• 0x4702a8 GlobalDeleteAtom
• 0x4702ac GlobalAlloc
• 0x4702b0 GlobalAddAtomA
• 0x4702b4 GetVersionExA
• 0x4702b8 GetVersion
• 0x4702bc GetUserDefaultLCID
• 0x4702c0 GetTickCount
• 0x4702c4 GetThreadLocale
• 0x4702c8 GetSystemInfo
• 0x4702cc GetStringTypeExA
• 0x4702d0 GetStdHandle
• 0x4702d4 GetProcAddress
• 0x4702d8 GetModuleHandleA
• 0x4702dc GetModuleFileNameA
• 0x4702e0 GetLocaleInfoA
• 0x4702e4 GetLocalTime
• 0x4702e8 GetLastError
• 0x4702ec GetFullPathNameA
• 0x4702f0 GetDiskFreeSpaceA
• 0x4702f4 GetDateFormatA
• 0x4702f8 GetCurrentThreadId
• 0x4702fc GetCurrentProcessId
• 0x470300 GetComputerNameA
• 0x470304 GetCPInfo
• 0x470308 GetACP
• 0x47030c FreeResource
• 0x470310 InterlockedExchange
• 0x470314 FreeLibrary
• 0x470318 FormatMessageA
• 0x47031c FindResourceA
• 0x470320 EnumCalendarInfoA
• 0x47032c CreateThread
• 0x470330 CreateFileA
• 0x470334 CreateEventA
• 0x470338 CompareStringA
• 0x47033c CloseHandle
Library version.dll:
• 0x470344 VerQueryValueA
• 0x47034c GetFileVersionInfoA
Library gdi32.dll:
• 0x470354 UnrealizeObject
• 0x470358 StretchBlt
• 0x47035c SetWindowOrgEx
• 0x470360 SetWinMetaFileBits
• 0x470364 SetViewportOrgEx
• 0x470368 SetTextColor
• 0x47036c SetStretchBltMode
• 0x470370 SetROP2
• 0x470374 SetPixel
• 0x470378 SetMapMode
• 0x47037c SetEnhMetaFileBits
• 0x470380 SetDIBColorTable
• 0x470384 SetBrushOrgEx
• 0x470388 SetBkMode
• 0x47038c SetBkColor
• 0x470390 SelectPalette
• 0x470394 SelectObject
• 0x470398 SaveDC
• 0x47039c RestoreDC
• 0x4703a0 Rectangle
• 0x4703a4 RectVisible
• 0x4703a8 RealizePalette
• 0x4703ac Polyline
• 0x4703b0 PlayEnhMetaFile
• 0x4703b4 Pie
• 0x4703b8 PatBlt
• 0x4703bc MoveToEx
• 0x4703c0 MaskBlt
• 0x4703c4 LineTo
• 0x4703c8 LPtoDP
• 0x4703cc IntersectClipRect
• 0x4703d0 GetWindowOrgEx
• 0x4703d4 GetWinMetaFileBits
• 0x4703d8 GetTextMetricsA
• 0x4703dc GetTextExtentPointA
• 0x4703e8 GetStockObject
• 0x4703ec GetPixel
• 0x4703f0 GetPaletteEntries
• 0x4703f4 GetObjectA
• 0x470404 GetEnhMetaFileBits
• 0x470408 GetDeviceCaps
• 0x47040c GetDIBits
• 0x470410 GetDIBColorTable
• 0x470414 GetDCOrgEx
• 0x47041c GetClipBox
• 0x470420 GetBrushOrgEx
• 0x470424 GetBitmapBits
• 0x470428 ExtTextOutA
• 0x47042c ExcludeClipRect
• 0x470430 Ellipse
• 0x470434 DeleteObject
• 0x470438 DeleteEnhMetaFile
• 0x47043c DeleteDC
• 0x470440 CreateSolidBrush
• 0x470444 CreatePenIndirect
• 0x470448 CreatePalette
• 0x470450 CreateFontIndirectA
• 0x470454 CreateEnhMetaFileA
• 0x470458 CreateDIBitmap
• 0x47045c CreateDIBSection
• 0x470460 CreateCompatibleDC
• 0x470468 CreateBrushIndirect
• 0x47046c CreateBitmap
• 0x470470 CopyEnhMetaFileA
• 0x470474 CloseEnhMetaFile
• 0x470478 BitBlt
Library user32.dll:
• 0x470480 CreateWindowExA
• 0x470484 WindowFromPoint
• 0x470488 WinHelpA
• 0x47048c WaitMessage
• 0x470490 UpdateWindow
• 0x470494 UnregisterClassA
• 0x470498 UnhookWindowsHookEx
• 0x47049c TranslateMessage
• 0x4704a4 TrackPopupMenu
• 0x4704ac ShowWindow
• 0x4704b0 ShowScrollBar
• 0x4704b4 ShowOwnedPopups
• 0x4704b8 ShowCursor
• 0x4704bc SetWindowsHookExA
• 0x4704c0 SetWindowTextA
• 0x4704c4 SetWindowPos
• 0x4704c8 SetWindowPlacement
• 0x4704cc SetWindowLongA
• 0x4704d0 SetTimer
• 0x4704d4 SetScrollRange
• 0x4704d8 SetScrollPos
• 0x4704dc SetScrollInfo
• 0x4704e0 SetRect
• 0x4704e4 SetPropA
• 0x4704e8 SetParent
• 0x4704ec SetMenuItemInfoA
• 0x4704f0 SetMenu
• 0x4704f4 SetForegroundWindow
• 0x4704f8 SetFocus
• 0x4704fc SetCursor
• 0x470500 SetClipboardData
• 0x470504 SetClassLongA
• 0x470508 SetCapture
• 0x47050c SetActiveWindow
• 0x470510 SendMessageA
• 0x470514 ScrollWindow
• 0x470518 ScreenToClient
• 0x47051c RemovePropA
• 0x470520 RemoveMenu
• 0x470524 ReleaseDC
• 0x470528 ReleaseCapture
• 0x470534 RegisterClassA
• 0x470538 RedrawWindow
• 0x47053c PtInRect
• 0x470540 PostQuitMessage
• 0x470544 PostMessageA
• 0x470548 PeekMessageA
• 0x47054c OpenClipboard
• 0x470550 OffsetRect
• 0x470554 OemToCharA
• 0x470558 MessageBoxA
• 0x47055c MessageBeep
• 0x470560 MapWindowPoints
• 0x470564 MapVirtualKeyA
• 0x470568 LoadStringA
• 0x47056c LoadKeyboardLayoutA
• 0x470570 LoadIconA
• 0x470574 LoadCursorA
• 0x470578 LoadBitmapA
• 0x47057c KillTimer
• 0x470580 IsZoomed
• 0x470584 IsWindowVisible
• 0x470588 IsWindowEnabled
• 0x47058c IsWindow
• 0x470590 IsRectEmpty
• 0x470594 IsIconic
• 0x470598 IsDialogMessageA
• 0x47059c IsChild
• 0x4705a0 InvalidateRect
• 0x4705a4 IntersectRect
• 0x4705a8 InsertMenuItemA
• 0x4705ac InsertMenuA
• 0x4705b0 InflateRect
• 0x4705b8 GetWindowTextA
• 0x4705bc GetWindowRect
• 0x4705c0 GetWindowPlacement
• 0x4705c4 GetWindowLongA
• 0x4705c8 GetWindowDC
• 0x4705cc GetTopWindow
• 0x4705d0 GetSystemMetrics
• 0x4705d4 GetSystemMenu
• 0x4705d8 GetSysColorBrush
• 0x4705dc GetSysColor
• 0x4705e0 GetSubMenu
• 0x4705e4 GetScrollRange
• 0x4705e8 GetScrollPos
• 0x4705ec GetScrollInfo
• 0x4705f0 GetPropA
• 0x4705f4 GetParent
• 0x4705f8 GetWindow
• 0x4705fc GetMessageTime
• 0x470600 GetMenuStringA
• 0x470604 GetMenuState
• 0x470608 GetMenuItemInfoA
• 0x47060c GetMenuItemID
• 0x470610 GetMenuItemCount
• 0x470614 GetMenu
• 0x470618 GetLastActivePopup
• 0x47061c GetKeyboardState
• 0x470624 GetKeyboardLayout
• 0x470628 GetKeyState
• 0x47062c GetKeyNameTextA
• 0x470630 GetIconInfo
• 0x470634 GetForegroundWindow
• 0x470638 GetFocus
• 0x47063c GetDesktopWindow
• 0x470640 GetDCEx
• 0x470644 GetDC
• 0x470648 GetCursorPos
• 0x47064c GetCursor
• 0x470650 GetClipboardData
• 0x470654 GetClientRect
• 0x470658 GetClassNameA
• 0x47065c GetClassInfoA
• 0x470660 GetCapture
• 0x470664 GetAsyncKeyState
• 0x470668 GetActiveWindow
• 0x47066c FrameRect
• 0x470670 FindWindowA
• 0x470674 FillRect
• 0x470678 EqualRect
• 0x47067c EnumWindows
• 0x470680 EnumThreadWindows
• 0x470684 EndPaint
• 0x470688 EnableWindow
• 0x47068c EnableScrollBar
• 0x470690 EnableMenuItem
• 0x470694 EmptyClipboard
• 0x470698 DrawTextA
• 0x47069c DrawMenuBar
• 0x4706a0 DrawIconEx
• 0x4706a4 DrawIcon
• 0x4706a8 DrawFrameControl
• 0x4706ac DrawEdge
• 0x4706b0 DispatchMessageA
• 0x4706b4 DestroyWindow
• 0x4706b8 DestroyMenu
• 0x4706bc DestroyIcon
• 0x4706c0 DestroyCursor
• 0x4706c4 DeleteMenu
• 0x4706c8 DefWindowProcA
• 0x4706cc DefMDIChildProcA
• 0x4706d0 DefFrameProcA
• 0x4706d4 CreatePopupMenu
• 0x4706d8 CreateMenu
• 0x4706dc CreateIcon
• 0x4706e0 CloseClipboard
• 0x4706e4 ClientToScreen
• 0x4706e8 CheckMenuItem
• 0x4706ec CallWindowProcA
• 0x4706f0 CallNextHookEx
• 0x4706f4 BeginPaint
• 0x4706f8 CharNextA
• 0x4706fc CharLowerBuffA
• 0x470700 CharLowerA
• 0x470704 CharUpperBuffA
• 0x470708 CharToOemA
• 0x47070c AdjustWindowRectEx
Library kernel32.dll:
• 0x470718 Sleep
Library oleaut32.dll:
• 0x470720 SafeArrayPtrOfIndex
• 0x470724 SafeArrayGetElement
• 0x470728 SafeArrayGetUBound
• 0x47072c SafeArrayGetLBound
• 0x470730 SafeArrayCreate
• 0x470734 VariantChangeType
• 0x470738 VariantCopy
• 0x47073c VariantClear
• 0x470740 VariantInit
Library ole32.dll:
• 0x47074c IsAccelerator
• 0x470750 OleDraw
• 0x470758 CoTaskMemFree
• 0x47075c ProgIDFromCLSID
• 0x470760 StringFromCLSID
• 0x470764 CoCreateInstance
• 0x470768 CoGetClassObject
• 0x47076c CoUninitialize
• 0x470770 CoInitialize
• 0x470774 IsEqualGUID
Library oleaut32.dll:
• 0x47077c GetErrorInfo
• 0x470780 GetActiveObject
• 0x470784 SysFreeString
Library comctl32.dll:
• 0x470794 ImageList_Write
• 0x470798 ImageList_Read
• 0x4707a8 ImageList_DragMove
• 0x4707ac ImageList_DragLeave
• 0x4707b0 ImageList_DragEnter
• 0x4707b4 ImageList_EndDrag
• 0x4707b8 ImageList_BeginDrag
• 0x4707bc ImageList_Remove
• 0x4707c0 ImageList_DrawEx
• 0x4707c4 ImageList_Replace
• 0x4707c8 ImageList_Draw
• 0x4707d8 ImageList_Add
• 0x4707e0 ImageList_Destroy
• 0x4707e4 ImageList_Create
Library shell32.dll:
• 0x4707ec ShellExecuteA

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49177 182.162.22.63 lotte30-0.insaram.com 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 50537 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 53657 8.8.8.8 53

HTTP & HTTPS Requests

URI Data
http://lotte30-0.insaram.com/ver02/exam/index_new.asp 
GET /ver02/exam/index_new.asp HTTP/1.1
Accept: */*
Accept-Language: zh-cn
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: lotte30-0.insaram.com
Connection: Keep-Alive
Cookie: ASPSESSIONIDSCDCTQDA=AIFIBIDCHCHEHDKHPKAGDFCB
http://lotte30-0.insaram.com/ 
GET / HTTP/1.1
Accept: */*
Accept-Language: zh-cn
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: lotte30-0.insaram.com
Connection: Keep-Alive

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.