5.8
高危
62 个模型检测该样本为恶意！
重新分析
更多

e3278b1debb150da3621ab0790c55b5ff5077a815b738c7ca8e89c5ba48dab06

029cd9bc58901534bff1824b73ee9c5e.exe

分析耗时

24s

最近分析

文件大小

871.0KB
静态报毒 动态报毒 2GW@A89HQEOI AGENTTESLA AI SCORE=83 AIDETECTVM BUIHO5 CLASSIC CONFIDENCE DELF DELPHI DELPHILESS ENAR EQGR FAREIT GENERICKDZ GENETIC GENKRYPTIK HIGH CONFIDENCE HSFJLL HULP IGENT KCLOUD KRYPTIK LOKIBOT MALWARE1 MALWARE@#2NBGCGJ4E2UBB NOON RATNET SCORE STATIC AI SUSGEN SUSPICIOUS PE TSCOPE UNSAFE USXVPHI20 WACATAC X2094 XOGAS ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FPQ!029CD9BC5890 20201219 6.0.6.653
Alibaba TrojanSpy:Win32/Fareit.8738d024 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20201219 21.1.5827.0
Tencent Win32.Trojan-spy.Noon.Eeu 20201219 1.0.0.1
Kingsoft Win32.Troj.Undef.(kcloud) 20201219 2017.9.26.565
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619152698.139375
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75167f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75164de3
029cd9bc58901534bff1824b73ee9c5e+0x62a4d @ 0x462a4d
029cd9bc58901534bff1824b73ee9c5e+0x5b254 @ 0x45b254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfea214ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619134515.38885
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003f0000
success 0 0
1619134515.41985
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 77824
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00467000
success 0 0
1619134515.41985
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00550000
success 0 0
1619152697.280375
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619152697.311375
NtAllocateVirtualMemory
process_identifier: 200
region_size: 1572864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01f20000
success 0 0
1619152697.311375
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02060000
success 0 0
1619152697.311375
NtAllocateVirtualMemory
process_identifier: 200
region_size: 368640
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01d80000
success 0 0
1619152697.311375
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 339968
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d82000
success 0 0
1619152697.608375
NtAllocateVirtualMemory
process_identifier: 200
region_size: 1507328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x020a0000
success 0 0
1619152697.608375
NtAllocateVirtualMemory
process_identifier: 200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x021d0000
success 0 0
1619152698.108375
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f12000
success 0 0
1619152698.108375
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619152698.108375
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f12000
success 0 0
1619152698.108375
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619152698.108375
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f12000
success 0 0
1619152698.108375
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619152698.108375
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f12000
success 0 0
1619152698.108375
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619152698.108375
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f12000
success 0 0
1619152698.108375
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619152698.108375
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f12000
success 0 0
1619152698.108375
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619152698.108375
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f12000
success 0 0
1619152698.108375
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619152698.108375
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f12000
success 0 0
1619152698.108375
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619152698.108375
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f12000
success 0 0
1619152698.108375
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619152698.108375
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f12000
success 0 0
1619152698.108375
NtProtectVirtualMemory
process_identifier: 200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.376034864507941 section {'size_of_data': '0x00055000', 'virtual_address': '0x0008b000', 'entropy': 7.376034864507941, 'name': '.rsrc', 'virtual_size': '0x00054ffc'} description A section with a high entropy has been found
entropy 0.39080459770114945 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 784 called NtSetContextThread to modify thread in remote process 200
Time & API Arguments Status Return Repeated
1619134515.68585
NtSetContextThread
thread_handle: 0x00000120
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4976464
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 200
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 784 resumed a thread in remote process 200
Time & API Arguments Status Return Repeated
1619134516.04485
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 200
success 0 0
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619134515.62285
CreateProcessInternalW
thread_identifier: 2340
thread_handle: 0x00000120
process_identifier: 200
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\029cd9bc58901534bff1824b73ee9c5e.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000124
inherit_handles: 0
success 1 0
1619134515.62285
NtUnmapViewOfSection
process_identifier: 200
region_size: 4096
process_handle: 0x00000124
base_address: 0x00400000
success 0 0
1619134515.62285
NtMapViewOfSection
section_handle: 0x0000012c
process_identifier: 200
commit_size: 790528
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000124
allocation_type: 0 ()
section_offset: 0
view_size: 790528
base_address: 0x00400000
success 0 0
1619134515.68585
NtGetContextThread
thread_handle: 0x00000120
success 0 0
1619134515.68585
NtSetContextThread
thread_handle: 0x00000120
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4976464
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 200
success 0 0
1619134516.04485
NtResumeThread
thread_handle: 0x00000120
suspend_count: 1
process_identifier: 200
success 0 0
File has been identified by 62 AntiVirus engines on VirusTotal as malicious (50 out of 62 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKDZ.69532
FireEye Generic.mg.029cd9bc58901534
McAfee Fareit-FPQ!029CD9BC5890
Cylance Unsafe
Zillya Trojan.Injector.Win32.762359
SUPERAntiSpyware Trojan.Agent/Gen-Downloader
Sangfor Malware
K7AntiVirus Trojan ( 0056c99c1 )
Alibaba TrojanSpy:Win32/Fareit.8738d024
K7GW Trojan ( 0056c99c1 )
CrowdStrike win/malicious_confidence_90% (W)
Arcabit Trojan.Generic.D10F9C
Cyren W32/Injector.HULP-8842
Symantec Infostealer.Lokibot!43
TrendMicro-HouseCall PUA.Win32.Wacatac.USXVPHI20
Paloalto generic.ml
ClamAV Win.Dropper.AgentTesla-9375297-1
Kaspersky HEUR:Trojan-Spy.Win32.Noon.gen
BitDefender Trojan.GenericKDZ.69532
NANO-Antivirus Trojan.Win32.Noon.hsfjll
AegisLab Trojan.Win32.Noon.l!c
Avast Win32:Trojan-gen
Tencent Win32.Trojan-spy.Noon.Eeu
Ad-Aware Trojan.GenericKDZ.69532
Sophos Mal/Generic-S
Comodo Malware@#2nbgcgj4e2ubb
F-Secure Dropper.DR/Delphi.xogas
DrWeb BackDoor.RatNET.2
VIPRE Trojan.Win32.Generic!BT
TrendMicro PUA.Win32.Wacatac.USXVPHI20
McAfee-GW-Edition BehavesLike.Win32.Fareit.ch
Emsisoft Trojan.GenericKDZ.69532 (B)
Ikarus Trojan.Inject
Jiangmin TrojanSpy.Noon.qcf
Avira DR/Delphi.xogas
eGambit Unsafe.AI_Score_87%
Antiy-AVL Trojan/Win32.Injector
Kingsoft Win32.Troj.Undef.(kcloud)
Microsoft Trojan:Win32/Fareit.VD!MTB
ZoneAlarm HEUR:Trojan-Spy.Win32.Noon.gen
GData Trojan.GenericKDZ.69532
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2094
Acronis suspicious
VBA32 TScope.Trojan.Delf
ALYac Trojan.GenericKDZ.69532
MAX malware (ai score=83)
Malwarebytes Trojan.MalPack
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x47e178 VirtualFree
• 0x47e17c VirtualAlloc
• 0x47e180 LocalFree
• 0x47e184 LocalAlloc
• 0x47e188 GetVersion
• 0x47e18c GetCurrentThreadId
• 0x47e198 VirtualQuery
• 0x47e19c WideCharToMultiByte
• 0x47e1a4 MultiByteToWideChar
• 0x47e1a8 lstrlenA
• 0x47e1ac lstrcpynA
• 0x47e1b0 LoadLibraryExA
• 0x47e1b4 GetThreadLocale
• 0x47e1b8 GetStartupInfoA
• 0x47e1bc GetProcAddress
• 0x47e1c0 GetModuleHandleA
• 0x47e1c4 GetModuleFileNameA
• 0x47e1c8 GetLocaleInfoA
• 0x47e1cc GetLastError
• 0x47e1d4 GetCommandLineA
• 0x47e1d8 FreeLibrary
• 0x47e1dc FindFirstFileA
• 0x47e1e0 FindClose
• 0x47e1e4 ExitProcess
• 0x47e1e8 WriteFile
• 0x47e1f0 RtlUnwind
• 0x47e1f4 RaiseException
• 0x47e1f8 GetStdHandle
Library user32.dll:
• 0x47e200 GetKeyboardType
• 0x47e204 LoadStringA
• 0x47e208 MessageBoxA
• 0x47e20c CharNextA
Library advapi32.dll:
• 0x47e214 RegQueryValueExA
• 0x47e218 RegOpenKeyExA
• 0x47e21c RegCloseKey
Library oleaut32.dll:
• 0x47e224 SysFreeString
• 0x47e228 SysReAllocStringLen
• 0x47e22c SysAllocStringLen
Library kernel32.dll:
• 0x47e234 TlsSetValue
• 0x47e238 TlsGetValue
• 0x47e23c LocalAlloc
• 0x47e240 GetModuleHandleA
Library advapi32.dll:
• 0x47e248 RegQueryValueExA
• 0x47e24c RegOpenKeyExA
• 0x47e250 RegCloseKey
Library kernel32.dll:
• 0x47e258 lstrcpyA
• 0x47e25c WriteFile
• 0x47e260 WinExec
• 0x47e264 WaitForSingleObject
• 0x47e268 VirtualQuery
• 0x47e26c VirtualProtect
• 0x47e270 VirtualAlloc
• 0x47e274 Sleep
• 0x47e278 SizeofResource
• 0x47e27c SetThreadLocale
• 0x47e280 SetFilePointer
• 0x47e284 SetEvent
• 0x47e288 SetErrorMode
• 0x47e28c SetEndOfFile
• 0x47e290 ResetEvent
• 0x47e294 ReadFile
• 0x47e298 MulDiv
• 0x47e29c LockResource
• 0x47e2a0 LoadResource
• 0x47e2a4 LoadLibraryA
• 0x47e2b0 GlobalUnlock
• 0x47e2b4 GlobalReAlloc
• 0x47e2b8 GlobalHandle
• 0x47e2bc GlobalLock
• 0x47e2c0 GlobalFree
• 0x47e2c4 GlobalFindAtomA
• 0x47e2c8 GlobalDeleteAtom
• 0x47e2cc GlobalAlloc
• 0x47e2d0 GlobalAddAtomA
• 0x47e2d8 GetVersionExA
• 0x47e2dc GetVersion
• 0x47e2e0 GetTickCount
• 0x47e2e4 GetThreadLocale
• 0x47e2ec GetSystemInfo
• 0x47e2f0 GetStringTypeExA
• 0x47e2f4 GetStdHandle
• 0x47e2f8 GetProcAddress
• 0x47e2fc GetModuleHandleA
• 0x47e300 GetModuleFileNameA
• 0x47e304 GetLogicalDrives
• 0x47e308 GetLocaleInfoA
• 0x47e30c GetLocalTime
• 0x47e310 GetLastError
• 0x47e314 GetFullPathNameA
• 0x47e318 GetFileAttributesA
• 0x47e31c GetDriveTypeA
• 0x47e320 GetDiskFreeSpaceA
• 0x47e324 GetDateFormatA
• 0x47e328 GetCurrentThreadId
• 0x47e32c GetCurrentProcessId
• 0x47e330 GetCPInfo
• 0x47e334 GetACP
• 0x47e338 FreeResource
• 0x47e33c InterlockedExchange
• 0x47e340 FreeLibrary
• 0x47e344 FormatMessageA
• 0x47e348 FindResourceA
• 0x47e34c FindNextFileA
• 0x47e350 FindFirstFileA
• 0x47e354 FindClose
• 0x47e364 EnumCalendarInfoA
• 0x47e370 CreateThread
• 0x47e374 CreateFileA
• 0x47e378 CreateEventA
• 0x47e37c CompareStringA
• 0x47e380 CloseHandle
Library mpr.dll:
• 0x47e388 WNetGetConnectionA
Library version.dll:
• 0x47e390 VerQueryValueA
• 0x47e398 GetFileVersionInfoA
Library gdi32.dll:
• 0x47e3a0 UnrealizeObject
• 0x47e3a4 StretchBlt
• 0x47e3a8 SetWindowOrgEx
• 0x47e3ac SetWinMetaFileBits
• 0x47e3b0 SetViewportOrgEx
• 0x47e3b4 SetTextColor
• 0x47e3b8 SetStretchBltMode
• 0x47e3bc SetROP2
• 0x47e3c0 SetPixel
• 0x47e3c4 SetEnhMetaFileBits
• 0x47e3c8 SetDIBColorTable
• 0x47e3cc SetBrushOrgEx
• 0x47e3d0 SetBkMode
• 0x47e3d4 SetBkColor
• 0x47e3d8 SelectPalette
• 0x47e3dc SelectObject
• 0x47e3e0 SaveDC
• 0x47e3e4 RestoreDC
• 0x47e3e8 Rectangle
• 0x47e3ec RectVisible
• 0x47e3f0 RealizePalette
• 0x47e3f4 Polyline
• 0x47e3f8 PlayEnhMetaFile
• 0x47e3fc PatBlt
• 0x47e400 MoveToEx
• 0x47e404 MaskBlt
• 0x47e408 LineTo
• 0x47e40c IntersectClipRect
• 0x47e410 GetWindowOrgEx
• 0x47e414 GetWinMetaFileBits
• 0x47e418 GetTextMetricsA
• 0x47e424 GetStockObject
• 0x47e428 GetPixel
• 0x47e42c GetPaletteEntries
• 0x47e430 GetObjectA
• 0x47e43c GetEnhMetaFileBits
• 0x47e440 GetDeviceCaps
• 0x47e444 GetDIBits
• 0x47e448 GetDIBColorTable
• 0x47e44c GetDCOrgEx
• 0x47e454 GetClipBox
• 0x47e458 GetBrushOrgEx
• 0x47e45c GetBitmapBits
• 0x47e460 ExtTextOutA
• 0x47e464 ExcludeClipRect
• 0x47e468 DeleteObject
• 0x47e46c DeleteEnhMetaFile
• 0x47e470 DeleteDC
• 0x47e474 CreateSolidBrush
• 0x47e478 CreatePenIndirect
• 0x47e47c CreatePalette
• 0x47e484 CreateFontIndirectA
• 0x47e488 CreateDIBitmap
• 0x47e48c CreateDIBSection
• 0x47e490 CreateCompatibleDC
• 0x47e498 CreateBrushIndirect
• 0x47e49c CreateBitmap
• 0x47e4a0 CopyEnhMetaFileA
• 0x47e4a4 BitBlt
Library opengl32.dll:
• 0x47e4ac wglCreateContext
Library user32.dll:
• 0x47e4b4 CreateWindowExA
• 0x47e4b8 WindowFromPoint
• 0x47e4bc WinHelpA
• 0x47e4c0 WaitMessage
• 0x47e4c4 UpdateWindow
• 0x47e4c8 UnregisterClassA
• 0x47e4cc UnhookWindowsHookEx
• 0x47e4d0 TranslateMessage
• 0x47e4d8 TrackPopupMenu
• 0x47e4e0 ShowWindow
• 0x47e4e4 ShowScrollBar
• 0x47e4e8 ShowOwnedPopups
• 0x47e4ec ShowCursor
• 0x47e4f0 SetWindowsHookExA
• 0x47e4f4 SetWindowTextA
• 0x47e4f8 SetWindowPos
• 0x47e4fc SetWindowPlacement
• 0x47e500 SetWindowLongA
• 0x47e504 SetTimer
• 0x47e508 SetScrollRange
• 0x47e50c SetScrollPos
• 0x47e510 SetScrollInfo
• 0x47e514 SetRect
• 0x47e518 SetPropA
• 0x47e51c SetParent
• 0x47e520 SetMenuItemInfoA
• 0x47e524 SetMenu
• 0x47e528 SetForegroundWindow
• 0x47e52c SetFocus
• 0x47e530 SetCursor
• 0x47e534 SetClassLongA
• 0x47e538 SetCapture
• 0x47e53c SetActiveWindow
• 0x47e540 SendMessageA
• 0x47e544 ScrollWindow
• 0x47e548 ScreenToClient
• 0x47e54c RemovePropA
• 0x47e550 RemoveMenu
• 0x47e554 ReleaseDC
• 0x47e558 ReleaseCapture
• 0x47e564 RegisterClassA
• 0x47e568 RedrawWindow
• 0x47e56c PtInRect
• 0x47e570 PostQuitMessage
• 0x47e574 PostMessageA
• 0x47e578 PeekMessageA
• 0x47e57c OffsetRect
• 0x47e580 OemToCharA
• 0x47e584 MessageBoxA
• 0x47e588 MapWindowPoints
• 0x47e58c MapVirtualKeyA
• 0x47e590 LoadStringA
• 0x47e594 LoadKeyboardLayoutA
• 0x47e598 LoadIconA
• 0x47e59c LoadCursorA
• 0x47e5a0 LoadBitmapA
• 0x47e5a4 KillTimer
• 0x47e5a8 IsZoomed
• 0x47e5ac IsWindowVisible
• 0x47e5b0 IsWindowEnabled
• 0x47e5b4 IsWindow
• 0x47e5b8 IsRectEmpty
• 0x47e5bc IsIconic
• 0x47e5c0 IsDialogMessageA
• 0x47e5c4 IsChild
• 0x47e5c8 InvalidateRect
• 0x47e5cc IntersectRect
• 0x47e5d0 InsertMenuItemA
• 0x47e5d4 InsertMenuA
• 0x47e5d8 InflateRect
• 0x47e5e0 GetWindowTextA
• 0x47e5e4 GetWindowRect
• 0x47e5e8 GetWindowPlacement
• 0x47e5ec GetWindowLongA
• 0x47e5f0 GetWindowDC
• 0x47e5f4 GetTopWindow
• 0x47e5f8 GetSystemMetrics
• 0x47e5fc GetSystemMenu
• 0x47e600 GetSysColorBrush
• 0x47e604 GetSysColor
• 0x47e608 GetSubMenu
• 0x47e60c GetScrollRange
• 0x47e610 GetScrollPos
• 0x47e614 GetScrollInfo
• 0x47e618 GetPropA
• 0x47e61c GetParent
• 0x47e620 GetWindow
• 0x47e624 GetMenuStringA
• 0x47e628 GetMenuState
• 0x47e62c GetMenuItemInfoA
• 0x47e630 GetMenuItemID
• 0x47e634 GetMenuItemCount
• 0x47e638 GetMenu
• 0x47e63c GetLastActivePopup
• 0x47e640 GetKeyboardState
• 0x47e648 GetKeyboardLayout
• 0x47e64c GetKeyState
• 0x47e650 GetKeyNameTextA
• 0x47e654 GetIconInfo
• 0x47e658 GetForegroundWindow
• 0x47e65c GetFocus
• 0x47e660 GetDlgItem
• 0x47e664 GetDesktopWindow
• 0x47e668 GetDCEx
• 0x47e66c GetDC
• 0x47e670 GetCursorPos
• 0x47e674 GetCursor
• 0x47e678 GetClipboardData
• 0x47e67c GetClientRect
• 0x47e680 GetClassNameA
• 0x47e684 GetClassInfoA
• 0x47e688 GetCapture
• 0x47e68c GetActiveWindow
• 0x47e690 FrameRect
• 0x47e694 FindWindowA
• 0x47e698 FillRect
• 0x47e69c EqualRect
• 0x47e6a0 EnumWindows
• 0x47e6a4 EnumThreadWindows
• 0x47e6a8 EndPaint
• 0x47e6ac EnableWindow
• 0x47e6b0 EnableScrollBar
• 0x47e6b4 EnableMenuItem
• 0x47e6b8 DrawTextA
• 0x47e6bc DrawMenuBar
• 0x47e6c0 DrawIconEx
• 0x47e6c4 DrawIcon
• 0x47e6c8 DrawFrameControl
• 0x47e6cc DrawFocusRect
• 0x47e6d0 DrawEdge
• 0x47e6d4 DispatchMessageA
• 0x47e6d8 DestroyWindow
• 0x47e6dc DestroyMenu
• 0x47e6e0 DestroyIcon
• 0x47e6e4 DestroyCursor
• 0x47e6e8 DeleteMenu
• 0x47e6ec DefWindowProcA
• 0x47e6f0 DefMDIChildProcA
• 0x47e6f4 DefFrameProcA
• 0x47e6f8 CreatePopupMenu
• 0x47e6fc CreateMenu
• 0x47e700 CreateIcon
• 0x47e704 ClientToScreen
• 0x47e708 CheckMenuItem
• 0x47e70c CallWindowProcA
• 0x47e710 CallNextHookEx
• 0x47e714 BeginPaint
• 0x47e718 CharNextA
• 0x47e71c CharLowerBuffA
• 0x47e720 CharLowerA
• 0x47e724 CharUpperBuffA
• 0x47e728 CharToOemA
• 0x47e72c AdjustWindowRectEx
Library kernel32.dll:
• 0x47e738 Sleep
Library oleaut32.dll:
• 0x47e740 SafeArrayPtrOfIndex
• 0x47e744 SafeArrayGetUBound
• 0x47e748 SafeArrayGetLBound
• 0x47e74c SafeArrayCreate
• 0x47e750 VariantChangeType
• 0x47e754 VariantCopy
• 0x47e758 VariantClear
• 0x47e75c VariantInit
Library comctl32.dll:
• 0x47e76c ImageList_Write
• 0x47e770 ImageList_Read
• 0x47e780 ImageList_DragMove
• 0x47e784 ImageList_DragLeave
• 0x47e788 ImageList_DragEnter
• 0x47e78c ImageList_EndDrag
• 0x47e790 ImageList_BeginDrag
• 0x47e794 ImageList_Remove
• 0x47e798 ImageList_DrawEx
• 0x47e79c ImageList_Replace
• 0x47e7a0 ImageList_Draw
• 0x47e7b0 ImageList_Add
• 0x47e7b8 ImageList_Destroy
• 0x47e7bc ImageList_Create
Library comdlg32.dll:
• 0x47e7c4 GetOpenFileNameA
Library user32.dll:
• 0x47e7cc DdeCmpStringHandles
• 0x47e7d0 DdeFreeStringHandle
• 0x47e7d4 DdeQueryStringA
• 0x47e7dc DdeGetLastError
• 0x47e7e0 DdeFreeDataHandle
• 0x47e7e4 DdeUnaccessData
• 0x47e7e8 DdeAccessData
• 0x47e7ec DdeCreateDataHandle
• 0x47e7f4 DdeNameService
• 0x47e7f8 DdePostAdvise
• 0x47e7fc DdeSetUserHandle
• 0x47e800 DdeQueryConvInfo
• 0x47e804 DdeDisconnect
• 0x47e808 DdeConnect
• 0x47e80c DdeUninitialize
• 0x47e810 DdeInitializeA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.