SmartHawk

8.4

高危

5 个模型检测该样本为恶意！

重新分析

下载样本

ceccb9fb5bee0e65cc473993ebb9fb08106edd30c7789cbc5432b9e35dce7d9a

e684bff043d92fc025cf7f67e1c89e5a.exe

分析耗时

93s

最近分析

文件大小

26.0MB

静态报毒动态报毒 BSCOPE CHINA GENERIC PUA ML KINGSOFT PRESENOKER UNSAFE

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀时间	查杀版本
Alibaba	20190527	0.3.0.5
Baidu	20190318	1.0.0.2
Avast	20200829	18.4.3895.0
Kingsoft	20200829	2013.8.14.323
McAfee	20200829	6.0.6.653
Tencent	20200829	1.0.0.1
CrowdStrike	20190702	1.0

Queries for the computername (4 个事件)

Time & API	Arguments	Status	Return
1620809369.84325 GetComputerNameA	computer_name: OSKAR-PC	success	1
1620809370.90625 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620809372.00025 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620809372.93725 GetComputerNameW	computer_name: OSKAR-PC	success	1

Checks if process is being debugged by a debugger (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620809369.95325 IsDebuggerPresent		failed	0	0

This executable is signed

This executable has a PDB path (1 个事件)

pdb_path

e:\KINGSOFT_DUBA\Build\Build_Src\kisengine\kisengine\product\win32\dbginfo\kinstuiofficial.pdb

The file contains an unknown PE resource name possibly indicative of a packer (4 个事件)

resource name	CONFIG
resource name	EXE
resource name	PNG
resource name	XML

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 个事件)

suspicious_features	POST method with no referer header	suspicious_request	POST http://infoc0.duba.net/c/
suspicious_features	GET method with no useragent header	suspicious_request	GET http://config.i.duba.net/installrcmd/KInstallRcmdCfg.dat
suspicious_features	POST method with no referer header	suspicious_request	POST https://update.googleapis.com/service/update2?cup2key=10:542233527&cup2hreq=ba5f6f5b359d7a8cc13707db6085680d730393567b0ec08c5d745c7d8ec050b9

Performs some HTTP requests (8 个事件)

request	GET http://2398.35go.net/defend/o1/jcqgx.ini
request	POST http://infoc0.duba.net/c/
request	GET http://config.i.duba.net/installrcmd/KInstallRcmdCfg.dat
request	GET http://config.i.duba.net/lminstall3/1.json?time=1620792573
request	HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request	HEAD http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620790356&mv=m&mvi=1&pl=23&shardbypass=yes
request	HEAD http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=16b163312e83c206&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620790356&mv=m&mvi=3
request	POST https://update.googleapis.com/service/update2?cup2key=10:542233527&cup2hreq=ba5f6f5b359d7a8cc13707db6085680d730393567b0ec08c5d745c7d8ec050b9

Sends data using the HTTP POST Method (2 个事件)

request	POST http://infoc0.duba.net/c/
request	POST https://update.googleapis.com/service/update2?cup2key=10:542233527&cup2hreq=ba5f6f5b359d7a8cc13707db6085680d730393567b0ec08c5d745c7d8ec050b9

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620809370.40625 NtAllocateVirtualMemory	process_identifier: 2536 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x03ef0000	success	0	0

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620809369.84325 GetDiskFreeSpaceExW	root_path: C:\Windows\system32 free_bytes_available: 0 total_number_of_free_bytes: 19454722048 total_number_of_bytes: 0	success	1	0

Checks for known Chinese AV sofware registry keys (2 个事件)

regkey	.*rising
regkey	.*Kingsoft

Foreign language identified in PE resource (50 out of 59 个事件)

name

CONFIG

language

LANG_CHINESE

offset

0x000bdc38

filetype

ISO-8859 text, with CRLF line terminators

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000008b

name

EXE

language

LANG_CHINESE

offset

0x000bdcc4

filetype

PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x018f63d0

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

PNG

language

LANG_CHINESE

offset

0x019f2cfc

filetype

PNG image data, 56 x 14, 8-bit/color RGBA, non-interlaced

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000601

name

XML

language

LANG_CHINESE

offset

0x019f5a24

filetype

exported SGML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000004aa

name

XML

language

LANG_CHINESE

offset

0x019f5a24

filetype

exported SGML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000004aa

name

XML

language

LANG_CHINESE

offset

0x019f5a24

filetype

exported SGML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000004aa

Executes one or more WMI queries (3 个事件)

wmi	SELECT Caption FROM Win32_SoundDevice
wmi	select * from Win32_NetworkAdapter where PnpDeviceID like 'PCI%' or PnpDeviceID like 'USB%'
wmi	SELECT * FROM Win32_BaseBoard WHERE (SerialNumber IS NOT NULL)

File has been identified by 5 AntiVirus engines on VirusTotal as malicious (5 个事件)

Cylance	Unsafe
ClamAV	Win.Trojan.Generic-6629330-0
Sophos	Generic PUA ML (PUA)
VBA32	BScope.Adware.Presenoker
ESET-NOD32	a variant of Win32/KingSoft.B potentially unwanted

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.999649606454752

section

{'size_of_data': '0x0193c000', 'virtual_address': '0x000bd000', 'entropy': 7.999649606454752, 'name': '.rsrc', 'virtual_size': '0x0193b3d0'}

description

A section with a high entropy has been found

entropy

0.9721595184349134

description

Overall entropy of this PE file is high

Queries for potentially installed applications (50 个事件)

Time & API	Arguments	Status	Return
1620809373.01525 RegOpenKeyExW	access: 0x02000000 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360安全卫士 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360安全卫士 options: 0	failed	2
1620809373.01525 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverGenius regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverGenius options: 0	failed	2
1620809373.01525 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverGenius regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverGenius options: 0	failed	2
1620809373.01525 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 options: 0	failed	2
1620809373.01525 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 options: 0	failed	2
1620809373.03125 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 options: 0	failed	2
1620809373.03125 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 options: 0	failed	2
1620809373.03125 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 options: 0	failed	2
1620809373.03125 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 options: 0	failed	2
1620809373.03125 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 options: 0	failed	2
1620809373.03125 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 options: 0	failed	2
1620809373.03125 RegOpenKeyExW	access: 0x02000000 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360安全卫士 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360安全卫士 options: 0	failed	2
1620809373.03125 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverGenius regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverGenius options: 0	failed	2
1620809373.03125 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverGenius regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverGenius options: 0	failed	2
1620809373.03125 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 options: 0	failed	2
1620809373.03125 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 options: 0	failed	2
1620809373.03125 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 options: 0	failed	2
1620809373.03125 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 options: 0	failed	2
1620809373.03125 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 options: 0	failed	2
1620809373.03125 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 options: 0	failed	2
1620809373.03125 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 options: 0	failed	2
1620809373.03125 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 options: 0	failed	2
1620809373.04725 RegOpenKeyExW	access: 0x02000000 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360安全卫士 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360安全卫士 options: 0	failed	2
1620809373.04725 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverGenius regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverGenius options: 0	failed	2
1620809373.04725 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverGenius regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverGenius options: 0	failed	2
1620809373.04725 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 options: 0	failed	2
1620809373.04725 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 options: 0	failed	2
1620809373.04725 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 options: 0	failed	2
1620809373.04725 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 options: 0	failed	2
1620809373.04725 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 options: 0	failed	2
1620809373.04725 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 options: 0	failed	2
1620809373.04725 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 options: 0	failed	2
1620809373.04725 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 options: 0	failed	2
1620809373.21825 RegOpenKeyExW	access: 0x02000000 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360安全卫士 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360安全卫士 options: 0	failed	2
1620809373.23425 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverGenius regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverGenius options: 0	failed	2
1620809373.23425 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverGenius regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverGenius options: 0	failed	2
1620809373.23425 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 options: 0	failed	2
1620809373.23425 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 options: 0	failed	2
1620809373.23425 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 options: 0	failed	2
1620809373.23425 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度杀毒 options: 0	failed	2
1620809373.23425 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 options: 0	failed	2
1620809373.23425 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 options: 0	failed	2
1620809373.23425 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 options: 0	failed	2
1620809373.23425 RegOpenKeyExW	access: 0x00000101 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 regkey_r: SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\百度卫士 options: 0	failed	2
1620809374.34325 RegOpenKeyExW	access: 0x00020119 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kingsoft Internet Security regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kingsoft Internet Security options: 0	failed	2
1620809374.34325 RegOpenKeyExW	access: 0x00020219 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kingsoft Internet Security regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Kingsoft Internet Security options: 0	failed	2
1620809374.34325 RegOpenKeyExW	access: 0x00020119 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HuorongSysdiag regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HuorongSysdiag options: 0	failed	2
1620809374.34325 RegOpenKeyExW	access: 0x00020219 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HuorongSysdiag regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HuorongSysdiag options: 0	failed	2
1620809374.34325 RegOpenKeyExW	access: 0x00020119 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360安全卫士 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360安全卫士 options: 0	failed	2
1620809374.34325 RegOpenKeyExW	access: 0x00020219 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360安全卫士 regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360安全卫士 options: 0	failed	2

Executes one or more WMI queries which can be used to identify virtual machines (1 个事件)

wmi	select * from Win32_NetworkAdapter where PnpDeviceID like 'PCI%' or PnpDeviceID like 'USB%'

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Attempts to identify installed AV products by registry key (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\rising\RAV

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2018-12-24 10:47:09

Imports

Library KERNEL32.dll:

• 0x496104 FileTimeToSystemTime

• 0x496108 FileTimeToLocalFileTime

• 0x49610c GetUserDefaultLangID

• 0x496110 GetComputerNameA

• 0x496114 GetDiskFreeSpaceExW

• 0x496118 DeviceIoControl

• 0x49611c CreateFileA

• 0x496120 LoadLibraryA

• 0x496124 OpenMutexW

• 0x496128 OpenEventW

• 0x49612c OpenSemaphoreW

• 0x496130 GetCurrentProcessId

• 0x496134 ExpandEnvironmentStringsW

• 0x496138 CreateProcessW

• 0x49613c FlushFileBuffers

• 0x496140 GetSystemTime

• 0x496144 SetUnhandledExceptionFilter

• 0x496148 CreateEventW

• 0x49614c CreateThread

• 0x496150 SetEvent

• 0x496154 lstrcatW

• 0x496158 GetLogicalDriveStringsW

• 0x49615c QueryDosDeviceW

• 0x496160 lstrcpyW

• 0x496164 GetTempPathW

• 0x496168 GetDriveTypeW

• 0x49616c OutputDebugStringW

• 0x496170 SetCurrentDirectoryW

• 0x496174 GetCurrentDirectoryA

• 0x496178 GetFullPathNameA

• 0x49617c FindFirstFileA

• 0x496180 GetDriveTypeA

• 0x496184 ExpandEnvironmentStringsA

• 0x496188 FormatMessageA

• 0x49618c GetSystemDirectoryA

• 0x496190 SleepEx

• 0x496194 SetEnvironmentVariableA

• 0x496198 CompareStringW

• 0x49619c CompareStringA

• 0x4961a0 WriteConsoleW

• 0x4961a4 GetConsoleOutputCP

• 0x4961a8 WriteConsoleA

• 0x4961ac SetStdHandle

• 0x4961b0 GetLocaleInfoW

• 0x4961b4 CreateFileW

• 0x4961b8 GetStringTypeA

• 0x4961bc IsValidLocale

• 0x4961c0 EnumSystemLocalesA

• 0x4961c4 GetUserDefaultLCID

• 0x4961c8 GetCurrentDirectoryW

• 0x4961cc QueryPerformanceCounter

• 0x4961d0 GetCommandLineW

• 0x4961d4 GetCommandLineA

• 0x4961d8 GetEnvironmentStringsW

• 0x4961dc FreeEnvironmentStringsW

• 0x4961e0 GetEnvironmentStrings

• 0x4961e4 FreeEnvironmentStringsA

• 0x4961e8 GetConsoleMode

• 0x4961ec GetConsoleCP

• 0x4961f0 GetTimeZoneInformation

• 0x4961f4 GetStartupInfoA

• 0x4961f8 GetFileType

• 0x4961fc SetHandleCount

• 0x496200 TlsFree

• 0x496204 TlsSetValue

• 0x496208 TlsAlloc

• 0x49620c TlsGetValue

• 0x496210 IsValidCodePage

• 0x496214 GetOEMCP

• 0x496218 GetModuleFileNameA

• 0x49621c GetStdHandle

• 0x496220 ExitProcess

• 0x496224 HeapCreate

• 0x496228 GetCPInfo

• 0x49622c LCMapStringW

• 0x496230 LCMapStringA

• 0x496234 RtlUnwind

• 0x496238 GetStartupInfoW

• 0x49623c VirtualQuery

• 0x496240 GetModuleHandleA

• 0x496244 VirtualProtect

• 0x496248 GetSystemTimeAsFileTime

• 0x49624c ExitThread

• 0x496250 IsDebuggerPresent

• 0x496254 UnhandledExceptionFilter

• 0x496258 TerminateProcess

• 0x49625c HeapSize

• 0x496260 HeapReAlloc

• 0x496264 HeapDestroy

• 0x496268 VirtualAlloc

• 0x49626c VirtualFree

• 0x496270 IsProcessorFeaturePresent

• 0x496274 HeapAlloc

• 0x496278 GetProcessHeap

• 0x49627c HeapFree

• 0x496280 GetThreadLocale

• 0x496284 GetLocaleInfoA

• 0x496288 GetACP

• 0x49628c GetVersionExA

• 0x496290 InterlockedCompareExchange

• 0x496294 GetSystemInfo

• 0x496298 GetPrivateProfileStringW

• 0x49629c lstrlenW

• 0x4962a0 EnterCriticalSection

• 0x4962a4 GetCurrentProcess

• 0x4962a8 DeleteCriticalSection

• 0x4962ac GetVersionExW

• 0x4962b0 InitializeCriticalSection

• 0x4962b4 GlobalAlloc

• 0x4962b8 UnmapViewOfFile

• 0x4962bc FlushInstructionCache

• 0x4962c0 GlobalLock

• 0x4962c4 GetModuleFileNameW

• 0x4962c8 GetLocalTime

• 0x4962cc ProcessIdToSessionId

• 0x4962d0 LocalFree

• 0x4962d4 LocalAlloc

• 0x4962d8 OpenProcess

• 0x4962dc GetSystemDirectoryW

• 0x4962e0 FindClose

• 0x4962e4 GetTickCount

• 0x4962e8 GetFileAttributesW

• 0x4962ec SetEndOfFile

• 0x4962f0 WriteFile

• 0x4962f4 CreateDirectoryW

• 0x4962f8 SetFilePointer

• 0x4962fc GetCurrentThread

• 0x496300 SetThreadPriority

• 0x496304 Sleep

• 0x496308 DeleteFileW

• 0x49630c Process32NextW

• 0x496310 Process32FirstW

• 0x496314 CreateToolhelp32Snapshot

• 0x496318 WaitForSingleObject

• 0x49631c MoveFileExW

• 0x496320 TerminateThread

• 0x496324 MultiByteToWideChar

• 0x496328 RaiseException

• 0x49632c FreeResource

• 0x496330 InterlockedDecrement

• 0x496334 SetLastError

• 0x496338 FreeLibrary

• 0x49633c GetProcAddress

• 0x496340 InterlockedIncrement

• 0x496344 LoadLibraryW

• 0x496348 ReadFile

• 0x49634c InterlockedExchange

• 0x496350 GetWindowsDirectoryW

• 0x496354 lstrcmpiW

• 0x496358 WideCharToMultiByte

• 0x49635c LeaveCriticalSection

• 0x496360 CloseHandle

• 0x496364 MapViewOfFileEx

• 0x496368 CreateFileMappingW

• 0x49636c LoadLibraryExW

• 0x496370 GetCurrentThreadId

• 0x496374 FindResourceW

• 0x496378 GlobalUnlock

• 0x49637c GetFileSize

• 0x496380 LoadResource

• 0x496384 GlobalFree

• 0x496388 SizeofResource

• 0x49638c FindResourceExW

• 0x496390 GetLastError

• 0x496394 GetModuleHandleW

• 0x496398 LockResource

• 0x49639c lstrlenA

• 0x4963a0 GetPrivateProfileIntW

• 0x4963a4 GetStringTypeW

Library USER32.dll:

• 0x496428 DestroyIcon

• 0x49642c GetDlgCtrlID

• 0x496430 SetWindowTextW

• 0x496434 EnableWindow

• 0x496438 GetWindowRect

• 0x49643c UnregisterClassA

• 0x496440 GetDesktopWindow

• 0x496444 PtInRect

• 0x496448 LoadImageW

• 0x49644c SetTimer

• 0x496450 DrawIconEx

• 0x496454 GetNextDlgTabItem

• 0x496458 ScreenToClient

• 0x49645c EqualRect

• 0x496460 RegisterClassExW

• 0x496464 MoveWindow

• 0x496468 LoadBitmapW

• 0x49646c MapWindowPoints

• 0x496470 LoadCursorW

• 0x496474 GetWindow

• 0x496478 PeekMessageW

• 0x49647c IsWindow

• 0x496480 GetWindowThreadProcessId

• 0x496484 SetRect

• 0x496488 FindWindowW

• 0x49648c GetForegroundWindow

• 0x496490 TranslateMessage

• 0x496494 DispatchMessageW

• 0x496498 GetClassInfoExW

• 0x49649c SystemParametersInfoW

• 0x4964a0 GetFocus

• 0x4964a4 SetWindowPos

• 0x4964a8 PostMessageW

• 0x4964ac IsWindowEnabled

• 0x4964b0 CharNextW

• 0x4964b4 AttachThreadInput

• 0x4964b8 SetForegroundWindow

• 0x4964bc GetParent

• 0x4964c0 IsDialogMessageW

• 0x4964c4 SetActiveWindow

• 0x4964c8 RegisterWindowMessageW

• 0x4964cc GetClientRect

• 0x4964d0 GetDC

• 0x4964d4 ReleaseDC

• 0x4964d8 SetWindowLongW

• 0x4964dc SendMessageW

• 0x4964e0 GetDlgItem

• 0x4964e4 DefWindowProcW

• 0x4964e8 GetWindowLongW

• 0x4964ec ShowWindow

• 0x4964f0 InvalidateRect

• 0x4964f4 InflateRect

• 0x4964f8 DestroyWindow

• 0x4964fc GetActiveWindow

• 0x496500 CopyRect

• 0x496504 IsWindowVisible

• 0x496508 FindWindowExW

• 0x49650c UpdateLayeredWindow

• 0x496510 BeginPaint

• 0x496514 EndPaint

• 0x496518 UpdateWindow

• 0x49651c BringWindowToTop

• 0x496520 CallWindowProcW

• 0x496524 MonitorFromWindow

• 0x496528 GetMonitorInfoW

• 0x49652c GetKeyState

• 0x496530 PostThreadMessageW

• 0x496534 SetCursor

• 0x496538 DrawTextW

• 0x49653c SetCapture

• 0x496540 GetWindowTextW

• 0x496544 ReleaseCapture

• 0x496548 ClientToScreen

• 0x49654c GetCursorPos

• 0x496550 WindowFromPoint

• 0x496554 OffsetRect

• 0x496558 GetScrollPos

• 0x49655c KillTimer

• 0x496560 IntersectRect

• 0x496564 SetFocus

• 0x496568 SetRectEmpty

• 0x49656c LoadIconW

• 0x496570 GetWindowTextLengthW

• 0x496574 IsChild

• 0x496578 CreateWindowExW

• 0x49657c GetMessageW

Library GDI32.dll:

• 0x496058 TextOutW

• 0x49605c RectInRegion

• 0x496060 GetClipRgn

• 0x496064 CreateRoundRectRgn

• 0x496068 GetTextMetricsW

• 0x49606c GetTextExtentPoint32W

• 0x496070 GetTextColor

• 0x496074 OffsetRgn

• 0x496078 MoveToEx

• 0x49607c ExtSelectClipRgn

• 0x496080 LineTo

• 0x496084 CombineRgn

• 0x496088 GetViewportOrgEx

• 0x49608c GetCurrentObject

• 0x496090 SetViewportOrgEx

• 0x496094 SetBkMode

• 0x496098 SetBkColor

• 0x49609c SelectObject

• 0x4960a0 GetStockObject

• 0x4960a4 RoundRect

• 0x4960a8 GetObjectW

• 0x4960ac BitBlt

• 0x4960b0 RestoreDC

• 0x4960b4 CreateCompatibleBitmap

• 0x4960b8 GetDeviceCaps

• 0x4960bc CreateBitmap

• 0x4960c0 StretchBlt

• 0x4960c4 SetTextColor

• 0x4960c8 CreateFontIndirectW

• 0x4960cc CreatePen

• 0x4960d0 CreateRectRgn

• 0x4960d4 SetStretchBltMode

• 0x4960d8 SaveDC

• 0x4960dc Rectangle

• 0x4960e0 SelectClipRgn

• 0x4960e4 CreateDIBSection

• 0x4960e8 DeleteObject

• 0x4960ec ExtTextOutW

• 0x4960f0 CreateCompatibleDC

• 0x4960f4 CreateRectRgnIndirect

• 0x4960f8 DeleteDC

• 0x4960fc CreateFontW

Library ADVAPI32.dll:

• 0x496000 RegQueryInfoKeyW

• 0x496004 SetTokenInformation

• 0x496008 DuplicateTokenEx

• 0x49600c FreeSid

• 0x496010 EqualSid

• 0x496014 AllocateAndInitializeSid

• 0x496018 GetTokenInformation

• 0x49601c OpenProcessToken

• 0x496020 RegOpenKeyW

• 0x496024 RegEnumKeyExW

• 0x496028 RegCloseKey

• 0x49602c RegDeleteKeyW

• 0x496030 RegDeleteValueW

• 0x496034 RegSetValueExW

• 0x496038 RegCreateKeyExW

• 0x49603c RegQueryValueExW

• 0x496040 RegOpenKeyExW

• 0x496044 CreateProcessAsUserW

Library SHELL32.dll:

• 0x4963e4 SHGetSpecialFolderPathW

• 0x4963e8 ShellExecuteW

• 0x4963ec SHGetPathFromIDListW

• 0x4963f0 SHGetFolderPathW

• 0x4963f4 Shell_NotifyIconW

• 0x4963f8 SHBrowseForFolderW

• 0x4963fc SHGetSpecialFolderLocation

Library ole32.dll:

• 0x4966fc CoUninitialize

• 0x496700 CoSetProxyBlanket

• 0x496704 CoInitializeEx

• 0x496708 CoCreateGuid

• 0x49670c CoCreateInstance

• 0x496710 CoTaskMemAlloc

• 0x496714 CoTaskMemRealloc

• 0x496718 CreateStreamOnHGlobal

• 0x49671c CoTaskMemFree

Library OLEAUT32.dll:

• 0x4963b4 SysFreeString

• 0x4963b8 VariantInit

• 0x4963bc VarUI4FromStr

• 0x4963c0 SysStringLen

• 0x4963c4 SysAllocString

• 0x4963c8 VariantClear

Library SHLWAPI.dll:

• 0x496404 PathFindExtensionW

• 0x496408 PathAppendW

• 0x49640c PathRemoveFileSpecW

• 0x496410 StrToIntW

• 0x496414 PathAddBackslashW

• 0x496418 PathFileExistsW

• 0x49641c PathFindFileNameW

• 0x496420 StrToIntA

Library COMCTL32.dll:

• 0x49604c InitCommonControlsEx

• 0x496050 _TrackMouseEvent

Library MSIMG32.dll:

• 0x4963ac AlphaBlend

Library gdiplus.dll:

• 0x4965a0 GdipFillRectangleI

• 0x4965a4 GdipTranslateWorldTransform

• 0x4965a8 GdipSetStringFormatFlags

• 0x4965ac GdipSetStringFormatLineAlign

• 0x4965b0 GdipFillPath

• 0x4965b4 GdipRotateWorldTransform

• 0x4965b8 GdipSetStringFormatAlign

• 0x4965bc GdipSetStringFormatTrimming

• 0x4965c0 GdipDrawImageI

• 0x4965c4 GdipGetFontSize

• 0x4965c8 GdipResetWorldTransform

• 0x4965cc GdipDrawLine

• 0x4965d0 GdipDeleteStringFormat

• 0x4965d4 GdipDisposeImageAttributes

• 0x4965d8 GdipGetImageHeight

• 0x4965dc GdipDrawImagePointsRectI

• 0x4965e0 GdipCreateImageAttributes

• 0x4965e4 GdipGetImageWidth

• 0x4965e8 GdipSetPenDashStyle

• 0x4965ec GdipSetSmoothingMode

• 0x4965f0 GdipCreateStringFormat

• 0x4965f4 GdipSetPenMode

• 0x4965f8 GdipSetPenStartCap

• 0x4965fc GdipSetPenEndCap

• 0x496600 GdipDeleteFont

• 0x496604 GdipDeletePen

• 0x496608 GdipCreatePen1

• 0x49660c GdipDrawLinesI

• 0x496610 GdipDrawString

• 0x496614 GdipSetTextRenderingHint

• 0x496618 GdipCloneBrush

• 0x49661c GdipFillRectangle

• 0x496620 GdipDeleteBrush

• 0x496624 GdipAddPathPieI

• 0x496628 GdipSetCompositingQuality

• 0x49662c GdipCreateFont

• 0x496630 GdipDrawPath

• 0x496634 GdipSetPixelOffsetMode

• 0x496638 GdipAddPathRectangleI

• 0x49663c GdipClosePathFigure

• 0x496640 GdipGetFamily

• 0x496644 GdipCreateFontFromLogfontW

• 0x496648 GdipSetClipPath

• 0x49664c GdipAddPathArcI

• 0x496650 GdipDeletePath

• 0x496654 GdipCreatePath

• 0x496658 GdipAddPathStringI

• 0x49665c GdipMeasureString

• 0x496660 GdipDrawRectangleI

• 0x496664 GdipCreateBitmapFromHBITMAP

• 0x496668 GdipSetImageAttributesColorMatrix

• 0x49666c GdipSetInterpolationMode

• 0x496670 GdipCreateBitmapFromScan0

• 0x496674 GdipNewPrivateFontCollection

• 0x496678 GdipDeleteGraphics

• 0x49667c GdipGetImagePixelFormat

• 0x496680 GdipLoadImageFromFile

• 0x496684 GdipDeletePrivateFontCollection

• 0x496688 GdipCreateFromHDC

• 0x49668c GdipGetImageGraphicsContext

• 0x496690 GdipPrivateAddFontFile

• 0x496694 GdipCloneImage

• 0x496698 GdipGetFontCollectionFamilyCount

• 0x49669c GdipGraphicsClear

• 0x4966a0 GdipAlloc

• 0x4966a4 GdiplusStartup

• 0x4966a8 GdipDisposeImage

• 0x4966ac GdipDrawImageRectI

• 0x4966b0 GdipGetFontCollectionFamilyList

• 0x4966b4 GdipCloneBitmapArea

• 0x4966b8 GdipCloneFontFamily

• 0x4966bc GdiplusShutdown

• 0x4966c0 GdipDrawImageRectRectI

• 0x4966c4 GdipCreateBitmapFromStream

• 0x4966c8 GdipImageRotateFlip

• 0x4966cc GdipLoadImageFromStream

• 0x4966d0 GdipFree

• 0x4966d4 GdipDeleteFontFamily

• 0x4966d8 GdipCreateHBITMAPFromBitmap

• 0x4966dc GdipDrawImageRectRect

• 0x4966e0 GdipCreateSolidFill

Library VERSION.dll:

• 0x496584 GetFileVersionInfoSizeW

• 0x496588 GetFileVersionInfoW

• 0x49658c VerQueryValueW

Library WTSAPI32.dll:

• 0x496594 WTSFreeMemory

• 0x496598 WTSEnumerateSessionsW

Library RASAPI32.dll:

• 0x4963dc RasEnumConnectionsW

Library iphlpapi.dll:

• 0x4966e8 IcmpSendEcho

• 0x4966ec IcmpCloseHandle

• 0x4966f0 IcmpCreateFile

• 0x4966f4 GetAdaptersInfo

Library PSAPI.DLL:

• 0x4963d0 GetProcessImageFileNameW

• 0x4963d4 GetModuleFileNameExW

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
config.i.duba.net	A 27.159.68.242 A 27.159.68.239 A 27.159.68.243 A 27.159.68.238 A 27.159.68.240 A 27.159.68.241 A 27.159.68.248 CNAME config.i.duba.net.w.kunlunar.com A 27.159.68.244	27.159.68.240
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
r3---sn-j5o7dn7e.gvt1.com	CNAME r3.sn-j5o7dn7e.gvt1.com A 113.108.239.196	113.108.239.196
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
2398.35go.net	A 183.60.144.89 A 183.60.144.88 A 124.225.102.39 A 124.225.102.38 CNAME hcdnd101.gslb.c.cdnhwc2.com CNAME 2398.35go.net.c.cdnhwc1.com	124.225.102.39
infoc0.duba.net	A 211.159.130.116 CNAME infoc-25.gz.1252921383.clb.myqcloud.com CNAME infoc2.duba.net	211.159.130.105
r1---sn-j5o7dn7e.gvt1.com	A 113.108.239.194 CNAME r1.sn-j5o7dn7e.gvt1.com	113.108.239.194
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com	172.217.160.110
redirector.gvt1.com	A 203.208.41.65	203.208.41.65
update.googleapis.com	A 203.208.40.34	203.208.40.34
teredo.ipv6.microsoft.com

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49188	113.108.239.194 r1---sn-j5o7dn7e.gvt1.com	80
192.168.56.101	49189	113.108.239.196 r3---sn-j5o7dn7e.gvt1.com	80
192.168.56.101	49175	124.225.102.38 2398.35go.net	80
192.168.56.101	49186	203.208.40.34 update.googleapis.com	443
192.168.56.101	49187	203.208.41.65 redirector.gvt1.com	80
192.168.56.101	49177	211.159.130.116 infoc0.duba.net	80
192.168.56.101	49179	211.159.130.116 infoc0.duba.net	80
192.168.56.101	49181	211.159.130.116 infoc0.duba.net	80
192.168.56.101	49178	27.159.68.238 config.i.duba.net	80
192.168.56.101	49180	27.159.68.238 config.i.duba.net	80

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49713	114.114.114.114	53
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	54260	114.114.114.114	53
192.168.56.101	54991	114.114.114.114	53
192.168.56.101	57236	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	60088	114.114.114.114	53
192.168.56.101	60221	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53210	224.0.0.252	5355

HTTP & HTTPS Requests

URI	Data
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=16b163312e83c206&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620790356&mv=m&mvi=3	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=16b163312e83c206&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620790356&mv=m&mvi=3 HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: r3---sn-j5o7dn7e.gvt1.com
http://2398.35go.net/defend/o1/jcqgx.ini	GET /defend/o1/jcqgx.ini HTTP/1.1 Host: 2398.35go.net Content-Type: application/octet-stream User-Agent: Mozilla/4.0 Accept: /
http://infoc0.duba.net/c/	POST /c/ HTTP/1.1 Host: infoc0.duba.net Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 Accept: / Content-Length: 256 \x00\x01\x02\x01\x02\x00\x88\xe2+\xaf\x04\x00\x10\x00\xa4n"m$U\x1b\xaa\xd3\x84>\x99F\x18\xfd\xe3\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\xfdT\x9b`\x00\x00\x00\x00\x1c\x00\xe6\xe4\xbd\xfb\xec\xbd\xb0\xf1\xed\xba\xb0\xf9\xfb\xe0\xe9\xbc\xe1\xb0\xb0\xe3\xbd\xeb\xeb\xee\xff\xef\xeb\xf2G\x12\x02\x00\x00\x00\x02\x00\x00\x00\x0b\x00\x00\x00\x96\x00\x00\x00k\x00\xf3\xaa\xba\xbb\xbc\xbd\xcd\xf0\xf8\xe4\xe7\xfa\xed\xfa\xaa\xb2\xb8\xa4\xaa\xbb\xbe\xb8\xfb\xe9\xee\xed\xaa\xb2\xb8\xa4\xaa\xca\xe9\xe1\xcc\xfd\xc9\xe6\xfc\xe1\xfe\xe1\xfa\xfd\xfb\xaa\xb2\xb8\xa4\xaa\xca\xe9\xe1\xcc\xfd\xdb\xe9\xee\xed\xaa\xb2\xb8\xa4\xaa\xd9\xd9\xcf\xfd\xe9\xe6\xc2\xe1\xe9\xaa\xb2\xb8\xa4\xaa\xda\xfd\xe1\xd0\xe1\xe6\xef\xaa\xb2\xb8\xa4\xaa\xec\xfd\xea\xe9\xaa\xb2\xb8\xa4\xaa\xf9\xec\xe2\xe4\xaa\xb2\xb8\xf5\x0c\x00\x00\x00 \x00\xcc\xba\xbf\xbb\xcb\xb1\xbf\xbc\xcb\xbb\xcb\xcd\xb0\xbe\xc9\xcc\xb0\xcb\xcc\xb1\xbc\xce\xba\xc9\xb0\xce\xc9\xb1\xce\xbb\xbb\xba
http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620790356&mv=m&mvi=1&pl=23&shardbypass=yes	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620790356&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: r1---sn-j5o7dn7e.gvt1.com
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: redirector.gvt1.com
http://infoc0.duba.net/c/	POST /c/ HTTP/1.1 Host: infoc0.duba.net Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 Accept: / Content-Length: 256 \x00\x01\x02\x01\x02\x00\x80#\x915\x04\x00\x10\x00\xa4n"m$U\x1b\xaa\xd3\x84>\x99F\x18\xfd\xe3\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\xfdT\x9b`\x00\x00\x00\x00\x1c\x00\xe6\xe4\xbd\xfb\xec\xbd\xb0\xf1\xed\xba\xb0\xf9\xfb\xe0\xe9\xbc\xe1\xb0\xb0\xe3\xbd\xeb\xeb\xee\xff\xef\xeb\xf2G\x12\x02\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00k\x00\xf3\xaa\xba\xbb\xbc\xbd\xcd\xf0\xf8\xe4\xe7\xfa\xed\xfa\xaa\xb2\xb8\xa4\xaa\xbb\xbe\xb8\xfb\xe9\xee\xed\xaa\xb2\xb8\xa4\xaa\xca\xe9\xe1\xcc\xfd\xc9\xe6\xfc\xe1\xfe\xe1\xfa\xfd\xfb\xaa\xb2\xb8\xa4\xaa\xca\xe9\xe1\xcc\xfd\xdb\xe9\xee\xed\xaa\xb2\xb8\xa4\xaa\xd9\xd9\xcf\xfd\xe9\xe6\xc2\xe1\xe9\xaa\xb2\xb8\xa4\xaa\xda\xfd\xe1\xd0\xe1\xe6\xef\xaa\xb2\xb8\xa4\xaa\xec\xfd\xea\xe9\xaa\xb2\xb8\xa4\xaa\xf9\xec\xe2\xe4\xaa\xb2\xb8\xf5\x0c\x00\x00\x00 \x00\xcc\xba\xbf\xbb\xcb\xb1\xbf\xbc\xcb\xbb\xcb\xcd\xb0\xbe\xc9\xcc\xb0\xcb\xcc\xb1\xbc\xce\xba\xc9\xb0\xce\xc9\xb1\xce\xbb\xbb\xba
http://config.i.duba.net/installrcmd/KInstallRcmdCfg.dat	GET /installrcmd/KInstallRcmdCfg.dat HTTP/1.1 Host: config.i.duba.net Accept: /
http://config.i.duba.net/lminstall3/1.json?time=1620792573	GET /lminstall3/1.json?time=1620792573 HTTP/1.1 Host: config.i.duba.net Content-Type: application/octet-stream User-Agent: Mozilla/4.0 Accept: /
http://infoc0.duba.net/c/	POST /c/ HTTP/1.1 Host: infoc0.duba.net Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 Accept: / Content-Length: 107 k\x00\x02\x01\x02\x00 J\x08\x8f\x04\x00\x10\x00\xa4n"m$U\x1b\xaa\xd3\x84>\x99F\x18\xfd\xe3\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\xf9T\x9b`\x00\x00\x00\x00\x1c\x00\xe6\xe4\xbd\xfb\xec\xbd\xb0\xf1\xed\xba\xb0\xf9\xfb\xe0\xe9\xbc\xe1\xb0\xb0\xe3\xbd\xeb\xeb\xee\xff\xef\xeb\xf2\xc1\x0f\x02\x00\x00\x00b\x01\x00\x00\x00\x00\x00\x00\x00\x00

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.