10.0
0-day
50 个模型检测该样本为恶意！
重新分析
更多

3eb5111ac0c5953960c8350d95aad5f9cdf0757e26c6d2efdc35f22a4e61bc9b

01b4ef609d5a0c676b724da8d918b2c8.exe

分析耗时

93s

最近分析

文件大小

308.1KB
静态报毒 动态报毒 3TSK2DAAYGU AI SCORE=82 ATTRIBUTE CJQZ CKGENERIC CONFIDENCE DOWNLOADER34 ELDORADO EMOTET GENCIRC GENERICKD GENERICKDZ HCEJ HIGH CONFIDENCE HIGHCONFIDENCE HSEJQL ICHMM KRYPTIK PHORPIEXUPL R011C0DHM20 R348891 SCORE SUSGEN UNSAFE WACATAC 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
CrowdStrike win/malicious_confidence_60% (W) 20190702 1.0
Alibaba Trojan:Win32/Emotet.5298ab8b 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Kingsoft 20200830 2013.8.14.323
McAfee Emotet-FRV!01B4EF609D5A 20200830 6.0.6.653
Tencent Malware.Win32.Gencirc.10cdeb6c 20200830 1.0.0.1
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1619139782.306499
GetComputerNameA
computer_name: OSKAR-PC
success 1 0
Uses Windows APIs to generate a cryptographic key (5 个事件)
Time & API Arguments Status Return Repeated
1619139771.274499
CryptGenKey
crypto_handle: 0x005549e0
algorithm_identifier: 0x0000660e ()
provider_handle: 0x005544f8
flags: 1
key: fÕÌ‘·ØRù¶;A¶K
success 1 0
1619139782.321499
CryptExportKey
crypto_handle: 0x005549e0
crypto_export_handle: 0x005549a0
buffer: f¤´†¡†”xÝÙýUn1.ê÷ĈU”¡sx3á6\øf’Q–fbO^Í„^@›`ªóˆ{ÔÅa„‚qЈä$Ÿ5XªÞ\ih‹ŸcGb­4—¹§Ï Úý¸èP
blob_type: 1
flags: 64
success 1 0
1619139816.774499
CryptExportKey
crypto_handle: 0x005549e0
crypto_export_handle: 0x005549a0
buffer: f¤B ,S G¯5]#¬£í u3ÏÖQ]0¤‰Í(Ñø¥ø¹·o¼êr;²Ïï\ÍóÎf=+xñâå]þ.Ô_õt)qâ/Aýl•”º‹á”Óå_"žía‡ƒ0$,
blob_type: 1
flags: 64
success 1 0
1619139821.431499
CryptExportKey
crypto_handle: 0x005549e0
crypto_export_handle: 0x005549a0
buffer: f¤n¼àPZêQp¶N½‡æf]OÉJ:¾uâr²þêŸezDäFmX©¯qÔ§HúùàÄ2ôönŒ †Oû¢ÖÝ«L™©/žcCþC±~ññ ©!”‰cÒKó ?OÃØä
blob_type: 1
flags: 64
success 1 0
1619139843.603499
CryptExportKey
crypto_handle: 0x005549e0
crypto_export_handle: 0x005549a0
buffer: f¤I?Fm¬±ëO¤´}[*8{ÕI›fݙÇÚS–T¢ÐÃmZ‹³Ö܉’w=è6ӟÅÃJ…a?% OØ]ft˛,?{fËe>ËTÜÛ¨M¨‹ÚDÊ?—@±
blob_type: 1
flags: 64
success 1 0
The executable uses a known packer (1 个事件)
packer Armadillo v1.71
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (3 个事件)
Time & API Arguments Status Return Repeated
1619134512.150822
NtAllocateVirtualMemory
process_identifier: 1108
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00460000
success 0 0
1619139841.462876
NtAllocateVirtualMemory
process_identifier: 1424
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0000000004000000
success 0 0
1619139770.556499
NtAllocateVirtualMemory
process_identifier: 2228
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x004e0000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (6 个事件)
Moves the original executable to a new location (1 个事件)
Time & API Arguments Status Return Repeated
1619134513.244822
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\01b4ef609d5a0c676b724da8d918b2c8.exe
newfilepath: C:\Windows\SysWOW64\lpk\SearchIndexer.exe
newfilepath_r: C:\Windows\SysWOW64\lpk\SearchIndexer.exe
flags: 3
oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\01b4ef609d5a0c676b724da8d918b2c8.exe
success 1 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619139782.790499
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
Expresses interest in specific running processes (1 个事件)
process searchindexer.exe
Reads the systems User Agent and subsequently performs requests (1 个事件)
Time & API Arguments Status Return Repeated
1619139782.431499
InternetOpenW
proxy_bypass:
access_type: 0
proxy_name:
flags: 0
user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
success 13369348 0
网络通信
Communicates with host for which no DNS query was performed (5 个事件)
host 116.202.234.183
host 172.217.24.14
host 185.94.252.104
host 69.30.203.214
host 70.121.172.89
Installs itself for autorun at Windows startup (1 个事件)
service_name SearchIndexer service_path C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\lpk\SearchIndexer.exe"
Created a service where a service was also not started (1 个事件)
Time & API Arguments Status Return Repeated
1619134514.119822
CreateServiceW
service_start_name:
start_type: 2
service_handle: 0x02b48e80
display_name: SearchIndexer
error_control: 0
service_name: SearchIndexer
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\lpk\SearchIndexer.exe"
filepath_r: "C:\Windows\SysWOW64\lpk\SearchIndexer.exe"
service_manager_handle: 0x02b64318
desired_access: 2
service_type: 16
password:
success 45387392 0
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)
Time & API Arguments Status Return Repeated
1619139785.353499
RegSetValueExA
key_handle: 0x000003b8
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619139785.368499
RegSetValueExA
key_handle: 0x000003b8
value:  ª7×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619139785.368499
RegSetValueExA
key_handle: 0x000003b8
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619139785.368499
RegSetValueExW
key_handle: 0x000003b8
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619139785.368499
RegSetValueExA
key_handle: 0x000003cc
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619139785.368499
RegSetValueExA
key_handle: 0x000003cc
value:  ª7×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619139785.368499
RegSetValueExA
key_handle: 0x000003cc
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1619139785.415499
RegSetValueExW
key_handle: 0x000003b4
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
Attempts to remove evidence of file being downloaded from the Internet (1 个事件)
file C:\Windows\SysWOW64\lpk\SearchIndexer.exe:Zone.Identifier
Generates some ICMP traffic
File has been identified by 50 AntiVirus engines on VirusTotal as malicious (50 个事件)
Bkav W32.PhorpiexUPL.Trojan
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.34397286
FireEye Trojan.GenericKD.34397286
CAT-QuickHeal Trojan.CKGENERIC
ALYac Trojan.Agent.Emotet
Cylance Unsafe
Zillya Trojan.Emotet.Win32.24751
CrowdStrike win/malicious_confidence_60% (W)
Alibaba Trojan:Win32/Emotet.5298ab8b
K7GW Riskware ( 0040eff71 )
K7AntiVirus Riskware ( 0040eff71 )
Arcabit Trojan.Generic.D20CDC66
Cyren W32/Emotet.AQT.gen!Eldorado
Symantec ML.Attribute.HighConfidence
APEX Malicious
Paloalto generic.ml
ClamAV Win.Packed.Generickdz-9481059-0
Kaspersky Backdoor.Win32.Emotet.cjqz
BitDefender Trojan.GenericKD.34397286
NANO-Antivirus Trojan.Win32.Emotet.hsejql
ViRobot Trojan.Win32.Emotet.315392.B
Rising Trojan.Kryptik!8.8 (TFE:5:3tSk2dAaYGU)
Ad-Aware Trojan.GenericKD.34397286
F-Secure Trojan.TR/AD.Emotet.ichmm
DrWeb Trojan.DownLoader34.26327
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R011C0DHM20
Sophos Troj/Emotet-CLN
Jiangmin Backdoor.Emotet.sa
Avira TR/AD.Emotet.ichmm
Antiy-AVL Trojan/Win32.Emotet
Microsoft Trojan:Win32/Emotet.PED!MTB
AegisLab Trojan.Win32.Emotet.L!c
ZoneAlarm Backdoor.Win32.Emotet.cjqz
GData Trojan.GenericKD.34397286
Cynet Malicious (score: 85)
AhnLab-V3 Trojan/Win32.Emotet.R348891
McAfee Emotet-FRV!01B4EF609D5A
VBA32 Trojan.Wacatac
Malwarebytes Trojan.Emotet
ESET-NOD32 Win32/Emotet.CD
TrendMicro-HouseCall TROJ_GEN.R011C0DHM20
Tencent Malware.Win32.Gencirc.10cdeb6c
MAX malware (ai score=82)
MaxSecure Trojan.Malware.105705873.susgen
Fortinet W32/Kryptik.HCEJ!tr
AVG Win32:Trojan-gen
Panda Trj/Agent.AJS
Qihoo-360 Win32/Backdoor.70b
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (4 个事件)
dead_host 69.30.203.214:8080
dead_host 70.121.172.89:80
dead_host 116.202.234.183:8080
dead_host 192.168.56.101:49184
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-08-21 02:02:34

Imports

Library KERNEL32.dll:
• 0x42e158 CreateEventA
• 0x42e15c lstrlenA
• 0x42e160 LoadResource
• 0x42e164 FindResourceA
• 0x42e168 LockResource
• 0x42e16c GlobalFree
• 0x42e170 GlobalUnlock
• 0x42e174 lstrcpyA
• 0x42e178 GlobalFindAtomA
• 0x42e17c GlobalAddAtomA
• 0x42e180 GlobalGetAtomNameA
• 0x42e184 lstrcatA
• 0x42e188 FreeLibrary
• 0x42e18c MulDiv
• 0x42e190 lstrcpynA
• 0x42e194 LocalFree
• 0x42e198 FormatMessageA
• 0x42e19c LocalAlloc
• 0x42e1a0 GlobalHandle
• 0x42e1a4 GlobalReAlloc
• 0x42e1a8 LocalReAlloc
• 0x42e1ac GlobalFlags
• 0x42e1c0 GetProcessVersion
• 0x42e1c4 SizeofResource
• 0x42e1c8 SetErrorMode
• 0x42e1cc SuspendThread
• 0x42e1d0 CreateFileA
• 0x42e1d4 LockFile
• 0x42e1d8 UnlockFile
• 0x42e1dc SetEndOfFile
• 0x42e1e0 MoveFileA
• 0x42e1e4 DeleteFileA
• 0x42e1e8 FindClose
• 0x42e1ec FindFirstFileA
• 0x42e1f4 GetFullPathNameA
• 0x42e1f8 GetStringTypeExA
• 0x42e1fc GetThreadLocale
• 0x42e200 GetShortPathNameA
• 0x42e204 GetFileAttributesA
• 0x42e208 GetFileSize
• 0x42e20c GetFileTime
• 0x42e218 SetFileTime
• 0x42e21c SetFileAttributesA
• 0x42e228 SetThreadPriority
• 0x42e22c ResumeThread
• 0x42e230 SetEvent
• 0x42e234 WaitForSingleObject
• 0x42e238 GetLocalTime
• 0x42e23c GetSystemTime
• 0x42e240 ExitThread
• 0x42e244 CreateThread
• 0x42e248 GetProfileStringA
• 0x42e24c GlobalLock
• 0x42e250 GlobalAlloc
• 0x42e254 GlobalDeleteAtom
• 0x42e258 lstrcmpA
• 0x42e25c lstrcmpiA
• 0x42e264 CompareStringW
• 0x42e268 CompareStringA
• 0x42e26c GetLocaleInfoW
• 0x42e278 GetStringTypeW
• 0x42e27c GetStringTypeA
• 0x42e280 ReadFile
• 0x42e284 SetStdHandle
• 0x42e288 LoadLibraryA
• 0x42e28c GetProcAddress
• 0x42e290 GetOEMCP
• 0x42e294 GetACP
• 0x42e298 IsBadCodePtr
• 0x42e29c IsBadReadPtr
• 0x42e2a0 GetVersionExA
• 0x42e2a4 GetUserDefaultLCID
• 0x42e2a8 EnumSystemLocalesA
• 0x42e2ac GetLocaleInfoA
• 0x42e2b0 IsValidCodePage
• 0x42e2b4 IsValidLocale
• 0x42e2b8 GetCPInfo
• 0x42e2bc CloseHandle
• 0x42e2c0 FlushFileBuffers
• 0x42e2c4 SetFilePointer
• 0x42e2cc WriteFile
• 0x42e2d0 GetFileType
• 0x42e2d4 GetStdHandle
• 0x42e2d8 SetHandleCount
• 0x42e2ec GetModuleFileNameA
• 0x42e2f4 IsBadWritePtr
• 0x42e2f8 VirtualAlloc
• 0x42e2fc VirtualFree
• 0x42e300 HeapCreate
• 0x42e304 HeapDestroy
• 0x42e308 ExitProcess
• 0x42e30c LCMapStringW
• 0x42e310 LCMapStringA
• 0x42e314 WideCharToMultiByte
• 0x42e318 GetCurrentThread
• 0x42e31c GetLastError
• 0x42e320 TlsGetValue
• 0x42e324 SetLastError
• 0x42e328 TlsFree
• 0x42e32c TlsAlloc
• 0x42e330 TlsSetValue
• 0x42e334 GetCurrentThreadId
• 0x42e338 HeapSize
• 0x42e33c HeapReAlloc
• 0x42e340 GetCurrentProcess
• 0x42e344 TerminateProcess
• 0x42e348 FatalAppExitA
• 0x42e34c RaiseException
• 0x42e350 HeapFree
• 0x42e354 GetVersion
• 0x42e358 GetCommandLineA
• 0x42e35c GetStartupInfoA
• 0x42e360 GetModuleHandleA
• 0x42e364 HeapAlloc
• 0x42e368 RtlUnwind
• 0x42e36c MultiByteToWideChar
• 0x42e380 InterlockedExchange
• 0x42e388 Sleep
• 0x42e390 DuplicateHandle
Library USER32.dll:
• 0x42e3a4 EndDeferWindowPos
• 0x42e3a8 CopyRect
• 0x42e3ac BeginDeferWindowPos
• 0x42e3b0 DeferWindowPos
• 0x42e3b4 EqualRect
• 0x42e3b8 ScreenToClient
• 0x42e3bc AdjustWindowRectEx
• 0x42e3c0 SetFocus
• 0x42e3c4 GetSysColor
• 0x42e3c8 MapWindowPoints
• 0x42e3cc SendDlgItemMessageA
• 0x42e3d0 UpdateWindow
• 0x42e3d4 CheckDlgButton
• 0x42e3d8 CheckRadioButton
• 0x42e3dc GetDlgItemInt
• 0x42e3e0 GetDlgItemTextA
• 0x42e3e4 SetDlgItemInt
• 0x42e3e8 SetDlgItemTextA
• 0x42e3ec IsDlgButtonChecked
• 0x42e3f0 ScrollWindowEx
• 0x42e3f4 IsDialogMessageA
• 0x42e3f8 SetWindowTextA
• 0x42e3fc MoveWindow
• 0x42e400 wvsprintfA
• 0x42e404 LoadStringA
• 0x42e408 DestroyMenu
• 0x42e40c ClientToScreen
• 0x42e410 GetDC
• 0x42e414 ReleaseDC
• 0x42e418 GetWindowDC
• 0x42e41c BeginPaint
• 0x42e420 EndPaint
• 0x42e424 TabbedTextOutA
• 0x42e428 DrawTextA
• 0x42e42c GrayStringA
• 0x42e430 GetClassNameA
• 0x42e434 PtInRect
• 0x42e438 GetDesktopWindow
• 0x42e43c InsertMenuA
• 0x42e440 DeleteMenu
• 0x42e444 GetMenuStringA
• 0x42e448 LoadCursorA
• 0x42e44c GetSysColorBrush
• 0x42e450 GetDialogBaseUnits
• 0x42e454 CharUpperA
• 0x42e458 UnregisterClassA
• 0x42e45c ShowScrollBar
• 0x42e460 GetScrollRange
• 0x42e464 SetScrollRange
• 0x42e468 GetScrollPos
• 0x42e46c SetScrollPos
• 0x42e470 GetTopWindow
• 0x42e474 IsChild
• 0x42e478 GetCapture
• 0x42e47c WinHelpA
• 0x42e480 wsprintfA
• 0x42e484 GetClassInfoA
• 0x42e488 RegisterClassA
• 0x42e48c GetMenu
• 0x42e490 GetMenuItemCount
• 0x42e494 GetSubMenu
• 0x42e498 GetMenuItemID
• 0x42e49c TrackPopupMenu
• 0x42e4a0 SetWindowPlacement
• 0x42e4a8 ScrollWindow
• 0x42e4ac GetDlgCtrlID
• 0x42e4b0 DefWindowProcA
• 0x42e4b4 CreateWindowExA
• 0x42e4b8 GetClassLongA
• 0x42e4bc SetPropA
• 0x42e4c0 UnhookWindowsHookEx
• 0x42e4c4 GetPropA
• 0x42e4c8 CallWindowProcA
• 0x42e4cc RemovePropA
• 0x42e4d0 GetMessageTime
• 0x42e4d4 GetMessagePos
• 0x42e4d8 GetForegroundWindow
• 0x42e4dc SetForegroundWindow
• 0x42e4e0 GetWindow
• 0x42e4e4 SetWindowPos
• 0x42e4ec OffsetRect
• 0x42e4f0 IntersectRect
• 0x42e4f8 GetWindowPlacement
• 0x42e4fc EndDialog
• 0x42e500 SetActiveWindow
• 0x42e504 IsWindow
• 0x42e50c DestroyWindow
• 0x42e510 GetDlgItem
• 0x42e514 OemToCharA
• 0x42e518 CharToOemA
• 0x42e520 LoadBitmapA
• 0x42e524 GetMenuState
• 0x42e528 ModifyMenuA
• 0x42e52c SetMenuItemBitmaps
• 0x42e530 CheckMenuItem
• 0x42e534 EnableMenuItem
• 0x42e538 GetFocus
• 0x42e53c GetNextDlgTabItem
• 0x42e540 GetMessageA
• 0x42e544 TranslateMessage
• 0x42e548 DispatchMessageA
• 0x42e54c GetActiveWindow
• 0x42e550 GetKeyState
• 0x42e554 CallNextHookEx
• 0x42e558 ValidateRect
• 0x42e55c IsWindowVisible
• 0x42e560 PeekMessageA
• 0x42e564 GetCursorPos
• 0x42e568 SetWindowsHookExA
• 0x42e56c GetParent
• 0x42e570 GetLastActivePopup
• 0x42e574 LoadIconA
• 0x42e578 ShowWindow
• 0x42e57c SendMessageA
• 0x42e580 AppendMenuA
• 0x42e584 HideCaret
• 0x42e588 ShowCaret
• 0x42e58c ExcludeUpdateRgn
• 0x42e590 DrawFocusRect
• 0x42e594 IsWindowEnabled
• 0x42e598 GetWindowLongA
• 0x42e59c MessageBoxA
• 0x42e5a0 SetCursor
• 0x42e5a4 ShowOwnedPopups
• 0x42e5a8 PostMessageA
• 0x42e5ac PostQuitMessage
• 0x42e5b0 EnableWindow
• 0x42e5b4 InvalidateRect
• 0x42e5b8 GetScrollInfo
• 0x42e5bc GetWindowTextA
• 0x42e5c0 SetScrollInfo
• 0x42e5c4 IsRectEmpty
• 0x42e5c8 GetWindowRect
• 0x42e5cc IsIconic
• 0x42e5d0 GetSystemMetrics
• 0x42e5d4 GetClientRect
• 0x42e5d8 DrawIcon
• 0x42e5dc GetSystemMenu
• 0x42e5e0 IsWindowUnicode
• 0x42e5e4 CharNextA
• 0x42e5e8 InflateRect
• 0x42e5ec DefDlgProcA
• 0x42e5f0 SetWindowLongA
Library GDI32.dll:
• 0x42e02c GetStockObject
• 0x42e030 SelectPalette
• 0x42e034 SetBkMode
• 0x42e038 SetPolyFillMode
• 0x42e03c SetROP2
• 0x42e040 SetStretchBltMode
• 0x42e044 SetMapMode
• 0x42e048 SetViewportOrgEx
• 0x42e04c OffsetViewportOrgEx
• 0x42e050 SetViewportExtEx
• 0x42e054 ScaleViewportExtEx
• 0x42e058 SetWindowOrgEx
• 0x42e05c OffsetWindowOrgEx
• 0x42e060 SetWindowExtEx
• 0x42e064 ScaleWindowExtEx
• 0x42e068 SelectClipRgn
• 0x42e06c ExcludeClipRect
• 0x42e070 IntersectClipRect
• 0x42e074 OffsetClipRgn
• 0x42e078 MoveToEx
• 0x42e07c LineTo
• 0x42e080 SetTextAlign
• 0x42e08c SetMapperFlags
• 0x42e094 ArcTo
• 0x42e098 SetArcDirection
• 0x42e09c PolyDraw
• 0x42e0a0 SelectObject
• 0x42e0a4 SetColorAdjustment
• 0x42e0a8 PolyBezierTo
• 0x42e0ac DeleteObject
• 0x42e0b0 GetClipRgn
• 0x42e0b4 CreateRectRgn
• 0x42e0b8 SelectClipPath
• 0x42e0bc ExtSelectClipRgn
• 0x42e0c0 PlayMetaFileRecord
• 0x42e0c4 GetObjectType
• 0x42e0c8 EnumMetaFile
• 0x42e0cc PlayMetaFile
• 0x42e0d0 GetDeviceCaps
• 0x42e0d4 GetViewportExtEx
• 0x42e0d8 GetWindowExtEx
• 0x42e0dc CreatePen
• 0x42e0e0 ExtCreatePen
• 0x42e0e4 CreateSolidBrush
• 0x42e0e8 CreateHatchBrush
• 0x42e0ec CreatePatternBrush
• 0x42e0f4 PtVisible
• 0x42e0f8 RectVisible
• 0x42e0fc TextOutA
• 0x42e100 ExtTextOutA
• 0x42e104 Escape
• 0x42e10c GetTextMetricsA
• 0x42e110 CreateFontIndirectA
• 0x42e114 RestoreDC
• 0x42e118 SaveDC
• 0x42e11c StartDocA
• 0x42e120 DeleteDC
• 0x42e124 GetObjectA
• 0x42e128 SetBkColor
• 0x42e12c SetTextColor
• 0x42e130 GetClipBox
• 0x42e134 GetDCOrgEx
• 0x42e138 PolylineTo
• 0x42e13c CreateDIBitmap
• 0x42e140 PatBlt
• 0x42e144 GetTextExtentPointA
• 0x42e148 BitBlt
• 0x42e14c CreateCompatibleDC
• 0x42e150 CreateBitmap
Library comdlg32.dll:
• 0x42e608 GetOpenFileNameA
• 0x42e60c GetSaveFileNameA
• 0x42e610 GetFileTitleA
Library WINSPOOL.DRV:
• 0x42e5f8 OpenPrinterA
• 0x42e5fc DocumentPropertiesA
• 0x42e600 ClosePrinter
Library ADVAPI32.dll:
• 0x42e000 RegSetValueExA
• 0x42e004 RegOpenKeyA
• 0x42e008 RegDeleteKeyA
• 0x42e00c RegDeleteValueA
• 0x42e010 RegCloseKey
• 0x42e014 RegQueryValueExA
• 0x42e018 RegOpenKeyExA
• 0x42e01c RegCreateKeyExA
Library SHELL32.dll:
• 0x42e398 DragAcceptFiles
• 0x42e39c SHGetFileInfoA
Library COMCTL32.dll:
• 0x42e024

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.