9.0
极危
62 个模型检测该样本为恶意！
重新分析
更多

3417d2d864093708e19db73705acbf6e9119154acf8aa298db705145dcf09122

f21b772f1b6597a2a387d40b085485a9.exe

分析耗时

25s

最近分析

文件大小

776.0KB
静态报毒 动态报毒 100% AGENTTESLA AI SCORE=85 AIDETECTVM AUTO BTKLA2 CLASSIC CONFIDENCE DELF DELPHILESS ELXR ERAN FAREIT GENETIC HIGH CONFIDENCE HLDRUW HPLOKI HPRNZ IGENT LOKIBOT MALWARE1 MALWARE@#2TMO98T7QRL6X PWSX QWPL R + MAL SCORE SIGGEN2 SMBD STATIC AI SUSGEN SUSPICIOUS PE TRJGEN TSCOPE TSPY UNSAFE WACATAC WGW@AAKFS4HI X2066 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/Obfuscator.ac683b92 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Avast Win32:PWSX-gen [Trj] 20201210 21.1.5827.0
Baidu 20190318 1.0.0.2
Kingsoft 20201211 2017.9.26.565
McAfee Fareit-FTB!F21B772F1B65 20201211 6.0.6.653
Tencent Win32.Trojan.Inject.Auto 20201211 1.0.0.1
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1620004702.618124
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7484e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7484ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7484b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7484b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7484ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7484aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x74845511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7484559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x750d7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x750d4de3
f21b772f1b6597a2a387d40b085485a9+0x58a4d @ 0x458a4d
f21b772f1b6597a2a387d40b085485a9+0x51254 @ 0x451254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe0514ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619999681.072979
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00370000
success 0 0
1619999681.150979
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 32768
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00469000
success 0 0
1619999681.166979
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00690000
success 0 0
1620004701.321124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1620004701.368124
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 524288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00990000
success 0 0
1620004701.368124
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x009d0000
success 0 0
1620004701.368124
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00820000
success 0 0
1620004701.368124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 299008
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00822000
success 0 0
1620004701.759124
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 524288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00a10000
success 0 0
1620004701.759124
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00a50000
success 0 0
1620004702.587124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00af2000
success 0 0
1620004702.587124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620004702.587124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00af2000
success 0 0
1620004702.587124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1620004702.587124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00af2000
success 0 0
1620004702.587124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1620004702.587124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00af2000
success 0 0
1620004702.587124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620004702.587124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00af2000
success 0 0
1620004702.587124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1620004702.587124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00af2000
success 0 0
1620004702.587124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1620004702.587124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00af2000
success 0 0
1620004702.587124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620004702.587124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00af2000
success 0 0
1620004702.587124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620004702.587124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00af2000
success 0 0
1620004702.587124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1620004702.587124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00af2000
success 0 0
1620004702.587124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\file.vbs
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (3 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.271566054956992 section {'size_of_data': '0x00045c00', 'virtual_address': '0x00082000', 'entropy': 7.271566054956992, 'name': '.rsrc', 'virtual_size': '0x00045a30'} description A section with a high entropy has been found
entropy 0.36 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619999681.463979
NtAllocateVirtualMemory
process_identifier: 2064
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000104
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
Installs itself for autorun at Windows startup (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\file.vbs
Creates a thread using NtQueueApcThread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 648 created a thread in remote process 2064
Time & API Arguments Status Return Repeated
1619999681.556979
NtQueueApcThread
thread_handle: 0x00000100
process_identifier: 2064
function_address: 0x000b05c0
parameter: 0x000c0000
success 0 0
Potential code injection by writing to the memory of another process (2 个事件)
Time & API Arguments Status Return Repeated
1619999681.463979
WriteProcessMemory
process_identifier: 2064
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000104
base_address: 0x000b0000
success 1 0
1619999681.463979
WriteProcessMemory
process_identifier: 2064
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f21b772f1b6597a2a387d40b085485a9.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f21b772f1b6597a2a387d40b085485a9.exe" filesEt izWtEaTbBF = cReaTEoBJecT("WScript.sHELL") iZwtEATbBF.run """%ls""", 0, False
process_handle: 0x00000104
base_address: 0x000c0000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 648 called NtSetContextThread to modify thread in remote process 3040
Time & API Arguments Status Return Repeated
1619999681.791979
NtSetContextThread
thread_handle: 0x0000010c
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4894688
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3040
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 648 resumed a thread in remote process 3040
Time & API Arguments Status Return Repeated
1619999682.072979
NtResumeThread
thread_handle: 0x0000010c
suspend_count: 1
process_identifier: 3040
success 0 0
Executed a process and injected code into it, probably while unpacking (11 个事件)
Time & API Arguments Status Return Repeated
1619999681.463979
CreateProcessInternalW
thread_identifier: 2272
thread_handle: 0x00000100
process_identifier: 2064
current_directory:
filepath: C:\Windows\System32\notepad.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\notepad.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000104
inherit_handles: 0
success 1 0
1619999681.463979
NtAllocateVirtualMemory
process_identifier: 2064
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000104
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
1619999681.463979
NtAllocateVirtualMemory
process_identifier: 2064
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
process_handle: 0x00000104
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000c0000
success 0 0
1619999681.463979
WriteProcessMemory
process_identifier: 2064
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000104
base_address: 0x000b0000
success 1 0
1619999681.463979
WriteProcessMemory
process_identifier: 2064
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f21b772f1b6597a2a387d40b085485a9.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f21b772f1b6597a2a387d40b085485a9.exe" filesEt izWtEaTbBF = cReaTEoBJecT("WScript.sHELL") iZwtEATbBF.run """%ls""", 0, False
process_handle: 0x00000104
base_address: 0x000c0000
success 1 0
1619999681.759979
CreateProcessInternalW
thread_identifier: 428
thread_handle: 0x0000010c
process_identifier: 3040
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f21b772f1b6597a2a387d40b085485a9.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000108
inherit_handles: 0
success 1 0
1619999681.759979
NtUnmapViewOfSection
process_identifier: 3040
region_size: 4096
process_handle: 0x00000108
base_address: 0x00400000
success 0 0
1619999681.759979
NtMapViewOfSection
section_handle: 0x00000114
process_identifier: 3040
commit_size: 708608
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000108
allocation_type: 0 ()
section_offset: 0
view_size: 708608
base_address: 0x00400000
success 0 0
1619999681.791979
NtGetContextThread
thread_handle: 0x0000010c
success 0 0
1619999681.791979
NtSetContextThread
thread_handle: 0x0000010c
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4894688
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3040
success 0 0
1619999682.072979
NtResumeThread
thread_handle: 0x0000010c
suspend_count: 1
process_identifier: 3040
success 0 0
File has been identified by 62 AntiVirus engines on VirusTotal as malicious (50 out of 62 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
DrWeb Trojan.PWS.Siggen2.49010
MicroWorld-eScan Trojan.Agent.ERAN
FireEye Generic.mg.f21b772f1b6597a2
ALYac Trojan.Agent.ERAN
Cylance Unsafe
Zillya Dropper.Agent.Win32.428642
Sangfor Malware
K7AntiVirus Riskware ( 0040eff71 )
Alibaba Trojan:Win32/Obfuscator.ac683b92
K7GW Riskware ( 0040eff71 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Agent.ERAN
BitDefenderTheta Gen:NN.ZelphiF.34670.WGW@aakFS4hi
Cyren W32/Injector.QWPL-7951
Symantec Trojan.Gen.2
ESET-NOD32 MSIL/Autorun.Spy.Agent.DF
APEX Malicious
Avast Win32:PWSX-gen [Trj]
ClamAV Win.Dropper.LokiBot-7833988-0
Kaspersky HEUR:Trojan.Win32.Crypt.gen
BitDefender Trojan.Agent.ERAN
NANO-Antivirus Trojan.Win32.TrjGen.hldruw
Paloalto generic.ml
Rising Trojan.Injector!1.C6B3 (CLASSIC)
Ad-Aware Trojan.Agent.ERAN
Sophos Mal/Generic-R + Mal/Fareit-AA
Comodo Malware@#2tmo98t7qrl6x
F-Secure Trojan.TR/Injector.hprnz
VIPRE Trojan.Win32.Generic!BT
TrendMicro TSPY_HPLOKI.SMBD
McAfee-GW-Edition BehavesLike.Win32.Fareit.bc
Emsisoft Trojan.Agent.ERAN (B)
Ikarus Trojan.Inject
Jiangmin Trojan.Crypt.dgl
Webroot W32.Malware.Gen
Avira TR/Injector.hprnz
Antiy-AVL Trojan/Win32.Crypt
Gridinsoft Trojan.Win32.Wacatac.ba!s1
Microsoft Trojan:Win32/Obfuscator.KD!MTB
AegisLab Trojan.Multi.Generic.4!c
ZoneAlarm HEUR:Trojan.Win32.Crypt.gen
GData Trojan.Agent.ERAN
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2066
Acronis suspicious
McAfee Fareit-FTB!F21B772F1B65
MAX malware (ai score=85)
VBA32 TScope.Trojan.Delf
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x47413c VirtualFree
• 0x474140 VirtualAlloc
• 0x474144 LocalFree
• 0x474148 LocalAlloc
• 0x47414c GetVersion
• 0x474150 GetCurrentThreadId
• 0x47415c VirtualQuery
• 0x474160 WideCharToMultiByte
• 0x474164 MultiByteToWideChar
• 0x474168 lstrlenA
• 0x47416c lstrcpynA
• 0x474170 LoadLibraryExA
• 0x474174 GetThreadLocale
• 0x474178 GetStartupInfoA
• 0x47417c GetProcAddress
• 0x474180 GetModuleHandleA
• 0x474184 GetModuleFileNameA
• 0x474188 GetLocaleInfoA
• 0x47418c GetCommandLineA
• 0x474190 FreeLibrary
• 0x474194 FindFirstFileA
• 0x474198 FindClose
• 0x47419c ExitProcess
• 0x4741a0 ExitThread
• 0x4741a4 CreateThread
• 0x4741a8 WriteFile
• 0x4741b0 RtlUnwind
• 0x4741b4 RaiseException
• 0x4741b8 GetStdHandle
Library user32.dll:
• 0x4741c0 GetKeyboardType
• 0x4741c4 LoadStringA
• 0x4741c8 MessageBoxA
• 0x4741cc CharNextA
Library advapi32.dll:
• 0x4741d4 RegQueryValueExA
• 0x4741d8 RegOpenKeyExA
• 0x4741dc RegCloseKey
Library oleaut32.dll:
• 0x4741e4 SysFreeString
• 0x4741e8 SysReAllocStringLen
• 0x4741ec SysAllocStringLen
Library kernel32.dll:
• 0x4741f4 TlsSetValue
• 0x4741f8 TlsGetValue
• 0x4741fc LocalAlloc
• 0x474200 GetModuleHandleA
Library advapi32.dll:
• 0x474208 RegQueryValueExA
• 0x47420c RegOpenKeyExA
• 0x474210 RegCloseKey
Library kernel32.dll:
• 0x474218 lstrcpyA
• 0x47421c WriteFile
• 0x474220 WaitForSingleObject
• 0x474224 VirtualQuery
• 0x474228 VirtualProtectEx
• 0x47422c VirtualAlloc
• 0x474230 SuspendThread
• 0x474234 Sleep
• 0x474238 SizeofResource
• 0x47423c SetThreadPriority
• 0x474240 SetThreadLocale
• 0x474244 SetFilePointer
• 0x474248 SetEvent
• 0x47424c SetErrorMode
• 0x474250 SetEndOfFile
• 0x474254 ResumeThread
• 0x474258 ResetEvent
• 0x47425c ReadFile
• 0x474260 MulDiv
• 0x474264 LockResource
• 0x474268 LoadResource
• 0x47426c LoadLibraryA
• 0x474278 GlobalUnlock
• 0x47427c GlobalReAlloc
• 0x474280 GlobalHandle
• 0x474284 GlobalLock
• 0x474288 GlobalFree
• 0x47428c GlobalFindAtomA
• 0x474290 GlobalDeleteAtom
• 0x474294 GlobalAlloc
• 0x474298 GlobalAddAtomA
• 0x47429c GetVersionExA
• 0x4742a0 GetVersion
• 0x4742a4 GetTickCount
• 0x4742a8 GetThreadLocale
• 0x4742ac GetTempPathA
• 0x4742b4 GetSystemTime
• 0x4742b8 GetSystemInfo
• 0x4742bc GetStringTypeExA
• 0x4742c0 GetStdHandle
• 0x4742c4 GetProcAddress
• 0x4742c8 GetModuleHandleA
• 0x4742cc GetModuleFileNameA
• 0x4742d0 GetLocaleInfoA
• 0x4742d4 GetLocalTime
• 0x4742d8 GetLastError
• 0x4742dc GetFullPathNameA
• 0x4742e0 GetFileSize
• 0x4742e4 GetExitCodeThread
• 0x4742e8 GetDiskFreeSpaceA
• 0x4742ec GetDateFormatA
• 0x4742f0 GetCurrentThreadId
• 0x4742f4 GetCurrentProcessId
• 0x4742f8 GetCurrentProcess
• 0x4742fc GetCPInfo
• 0x474300 GetACP
• 0x474304 FreeResource
• 0x47430c InterlockedExchange
• 0x474314 FreeLibrary
• 0x474318 FormatMessageA
• 0x47431c FindResourceA
• 0x474320 FindFirstFileA
• 0x474324 FindClose
• 0x474334 ExitThread
• 0x474338 EnumCalendarInfoA
• 0x474344 CreateThread
• 0x474348 CreateFileA
• 0x47434c CreateEventA
• 0x474350 CompareStringA
• 0x474354 CloseHandle
Library version.dll:
• 0x47435c VerQueryValueA
• 0x474364 GetFileVersionInfoA
Library gdi32.dll:
• 0x47436c UnrealizeObject
• 0x474370 StretchBlt
• 0x474374 SetWindowOrgEx
• 0x474378 SetWinMetaFileBits
• 0x47437c SetViewportOrgEx
• 0x474380 SetTextColor
• 0x474384 SetStretchBltMode
• 0x474388 SetROP2
• 0x47438c SetPixel
• 0x474390 SetEnhMetaFileBits
• 0x474394 SetDIBColorTable
• 0x474398 SetBrushOrgEx
• 0x47439c SetBkMode
• 0x4743a0 SetBkColor
• 0x4743a4 SelectPalette
• 0x4743a8 SelectObject
• 0x4743ac SaveDC
• 0x4743b0 RestoreDC
• 0x4743b4 Rectangle
• 0x4743b8 RectVisible
• 0x4743bc RealizePalette
• 0x4743c0 PlayEnhMetaFile
• 0x4743c4 PatBlt
• 0x4743c8 MoveToEx
• 0x4743cc MaskBlt
• 0x4743d0 LineTo
• 0x4743d4 IntersectClipRect
• 0x4743d8 GetWindowOrgEx
• 0x4743dc GetWinMetaFileBits
• 0x4743e0 GetTextMetricsA
• 0x4743ec GetStockObject
• 0x4743f0 GetPixel
• 0x4743f4 GetPaletteEntries
• 0x4743f8 GetObjectA
• 0x474404 GetEnhMetaFileBits
• 0x474408 GetDeviceCaps
• 0x47440c GetDIBits
• 0x474410 GetDIBColorTable
• 0x474414 GetDCOrgEx
• 0x47441c GetClipBox
• 0x474420 GetBrushOrgEx
• 0x474424 GetBitmapBits
• 0x474428 ExcludeClipRect
• 0x47442c DeleteObject
• 0x474430 DeleteEnhMetaFile
• 0x474434 DeleteDC
• 0x474438 CreateSolidBrush
• 0x47443c CreatePenIndirect
• 0x474440 CreatePen
• 0x474444 CreatePalette
• 0x47444c CreateFontIndirectA
• 0x474450 CreateDIBitmap
• 0x474454 CreateDIBSection
• 0x474458 CreateCompatibleDC
• 0x474460 CreateBrushIndirect
• 0x474464 CreateBitmap
• 0x474468 CopyEnhMetaFileA
• 0x47446c BitBlt
Library user32.dll:
• 0x474474 CreateWindowExA
• 0x474478 WindowFromPoint
• 0x47447c WinHelpA
• 0x474480 WaitMessage
• 0x474484 ValidateRect
• 0x474488 UpdateWindow
• 0x47448c UnregisterClassA
• 0x474490 UnhookWindowsHookEx
• 0x474494 TranslateMessage
• 0x47449c TrackPopupMenu
• 0x4744a4 ShowWindow
• 0x4744a8 ShowScrollBar
• 0x4744ac ShowOwnedPopups
• 0x4744b0 ShowCursor
• 0x4744b4 SetWindowsHookExA
• 0x4744b8 SetWindowPos
• 0x4744bc SetWindowPlacement
• 0x4744c0 SetWindowLongA
• 0x4744c4 SetTimer
• 0x4744c8 SetScrollRange
• 0x4744cc SetScrollPos
• 0x4744d0 SetScrollInfo
• 0x4744d4 SetRect
• 0x4744d8 SetPropA
• 0x4744dc SetParent
• 0x4744e0 SetMenuItemInfoA
• 0x4744e4 SetMenu
• 0x4744e8 SetForegroundWindow
• 0x4744ec SetFocus
• 0x4744f0 SetCursor
• 0x4744f4 SetClassLongA
• 0x4744f8 SetCapture
• 0x4744fc SetActiveWindow
• 0x474500 SendMessageA
• 0x474504 ScrollWindow
• 0x474508 ScreenToClient
• 0x47450c RemovePropA
• 0x474510 RemoveMenu
• 0x474514 ReleaseDC
• 0x474518 ReleaseCapture
• 0x474524 RegisterClassA
• 0x474528 RedrawWindow
• 0x47452c PtInRect
• 0x474530 PostQuitMessage
• 0x474534 PostMessageA
• 0x474538 PeekMessageA
• 0x47453c OffsetRect
• 0x474540 OemToCharA
• 0x474548 MessageBoxA
• 0x47454c MapWindowPoints
• 0x474550 MapVirtualKeyA
• 0x474554 LoadStringA
• 0x474558 LoadKeyboardLayoutA
• 0x47455c LoadIconA
• 0x474560 LoadCursorA
• 0x474564 LoadBitmapA
• 0x474568 KillTimer
• 0x47456c IsZoomed
• 0x474570 IsWindowVisible
• 0x474574 IsWindowEnabled
• 0x474578 IsWindow
• 0x47457c IsRectEmpty
• 0x474580 IsIconic
• 0x474584 IsDialogMessageA
• 0x474588 IsChild
• 0x47458c InvalidateRect
• 0x474590 IntersectRect
• 0x474594 InsertMenuItemA
• 0x474598 InsertMenuA
• 0x47459c InflateRect
• 0x4745a4 GetWindowTextA
• 0x4745a8 GetWindowRect
• 0x4745ac GetWindowPlacement
• 0x4745b0 GetWindowLongA
• 0x4745b4 GetWindowDC
• 0x4745b8 GetTopWindow
• 0x4745bc GetSystemMetrics
• 0x4745c0 GetSystemMenu
• 0x4745c4 GetSysColorBrush
• 0x4745c8 GetSysColor
• 0x4745cc GetSubMenu
• 0x4745d0 GetScrollRange
• 0x4745d4 GetScrollPos
• 0x4745d8 GetScrollInfo
• 0x4745dc GetPropA
• 0x4745e0 GetParent
• 0x4745e4 GetWindow
• 0x4745e8 GetMenuStringA
• 0x4745ec GetMenuState
• 0x4745f0 GetMenuItemInfoA
• 0x4745f4 GetMenuItemID
• 0x4745f8 GetMenuItemCount
• 0x4745fc GetMenu
• 0x474600 GetLastActivePopup
• 0x474604 GetKeyboardState
• 0x47460c GetKeyboardLayout
• 0x474610 GetKeyState
• 0x474614 GetKeyNameTextA
• 0x474618 GetIconInfo
• 0x47461c GetForegroundWindow
• 0x474620 GetFocus
• 0x474624 GetDlgItem
• 0x474628 GetDesktopWindow
• 0x47462c GetDCEx
• 0x474630 GetDC
• 0x474634 GetCursorPos
• 0x474638 GetCursor
• 0x47463c GetClipboardData
• 0x474640 GetClientRect
• 0x474644 GetClassNameA
• 0x474648 GetClassInfoA
• 0x47464c GetCapture
• 0x474650 GetActiveWindow
• 0x474654 FrameRect
• 0x474658 FindWindowA
• 0x47465c FillRect
• 0x474660 EqualRect
• 0x474664 EnumWindows
• 0x474668 EnumThreadWindows
• 0x47466c EndPaint
• 0x474670 EnableWindow
• 0x474674 EnableScrollBar
• 0x474678 EnableMenuItem
• 0x47467c DrawTextA
• 0x474680 DrawMenuBar
• 0x474684 DrawIconEx
• 0x474688 DrawIcon
• 0x47468c DrawFrameControl
• 0x474690 DrawEdge
• 0x474694 DispatchMessageA
• 0x474698 DestroyWindow
• 0x47469c DestroyMenu
• 0x4746a0 DestroyIcon
• 0x4746a4 DestroyCursor
• 0x4746a8 DeleteMenu
• 0x4746ac DefWindowProcA
• 0x4746b0 DefMDIChildProcA
• 0x4746b4 DefFrameProcA
• 0x4746b8 CreatePopupMenu
• 0x4746bc CreateMenu
• 0x4746c0 CreateIcon
• 0x4746c4 ClientToScreen
• 0x4746c8 CheckMenuItem
• 0x4746cc CallWindowProcA
• 0x4746d0 CallNextHookEx
• 0x4746d4 BeginPaint
• 0x4746d8 CharNextA
• 0x4746dc CharLowerBuffA
• 0x4746e0 CharLowerA
• 0x4746e4 CharToOemA
• 0x4746e8 AdjustWindowRectEx
Library kernel32.dll:
• 0x4746f4 Sleep
Library oleaut32.dll:
• 0x4746fc SafeArrayPtrOfIndex
• 0x474700 SafeArrayGetUBound
• 0x474704 SafeArrayGetLBound
• 0x474708 SafeArrayCreate
• 0x47470c VariantChangeType
• 0x474710 VariantCopy
• 0x474714 VariantClear
• 0x474718 VariantInit
Library comctl32.dll:
• 0x474728 ImageList_Write
• 0x47472c ImageList_Read
• 0x47473c ImageList_DragMove
• 0x474740 ImageList_DragLeave
• 0x474744 ImageList_DragEnter
• 0x474748 ImageList_EndDrag
• 0x47474c ImageList_BeginDrag
• 0x474750 ImageList_Remove
• 0x474754 ImageList_DrawEx
• 0x474758 ImageList_Draw
• 0x474768 ImageList_Add
• 0x474770 ImageList_Destroy
• 0x474774 ImageList_Create
• 0x474778 InitCommonControls
Library comdlg32.dll:
• 0x474780 GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.