5.8
高危
58 个模型检测该样本为恶意！
重新分析
更多

56ab1237a3aed66ebe3a7464794c1bf41c40596456f92926f6d49e482922ebd1

09034052e2b952894c6237e377e3cf44.exe

分析耗时

22s

最近分析

文件大小

1.1MB
静态报毒 动态报毒 AGEN AI SCORE=88 AIDETECTVM BTIKAC CLASSIC CONFIDENCE CRIDEX DELF DELPHILESS ELXL ELZG FAREIT FHW@A0KIADGI HIGH CONFIDENCE HKDBBN HPLOKI IGENT KMSF KRYPTIK MALWARE2 MALWARE@#2EF8LO79ZROHV S + MAL SCORE SMBD STATIC AI SUSPICIOUS PE TSCOPE TSPY UNSAFE X2066 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/Cridex.496c2334 20190527 0.3.0.5
Avast Win32:Malware-gen 20201210 21.1.5827.0
Tencent Win32.Trojan.Kryptik.Dkt 20201211 1.0.0.1
Baidu 20190318 1.0.0.2
Kingsoft 20201211 2017.9.26.565
McAfee Fareit-FTB!09034052E2B9 20201211 6.0.6.653
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619134514.752081
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34602552
registers.edi: 0
registers.eax: 0
registers.ebp: 34602888
registers.edx: 55
registers.ebx: 0
registers.esi: 0
registers.ecx: 715
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 04 6a 00 00 e9
exception.symbol: 09034052e2b952894c6237e377e3cf44+0xafdba
exception.instruction: div eax
exception.module: 09034052e2b952894c6237e377e3cf44.exe
exception.exception_code: 0xc0000094
exception.offset: 720314
exception.address: 0x4afdba
success 0 0
1619154710.551499
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75177f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75174de3
09034052e2b952894c6237e377e3cf44+0x5aa4d @ 0x45aa4d
09034052e2b952894c6237e377e3cf44+0x53254 @ 0x453254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff4014ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619134514.596081
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003d0000
success 0 0
1619134514.752081
NtProtectVirtualMemory
process_identifier: 2292
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 32768
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x004af000
success 0 0
1619134514.768081
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x005b0000
success 0 0
1619154709.660499
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619154709.692499
NtAllocateVirtualMemory
process_identifier: 368
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01d60000
success 0 0
1619154709.692499
NtAllocateVirtualMemory
process_identifier: 368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01d70000
success 0 0
1619154709.692499
NtAllocateVirtualMemory
process_identifier: 368
region_size: 335872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01db0000
success 0 0
1619154709.692499
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 307200
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01db2000
success 0 0
1619154709.973499
NtAllocateVirtualMemory
process_identifier: 368
region_size: 1245184
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01eb0000
success 0 0
1619154709.973499
NtAllocateVirtualMemory
process_identifier: 368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01fa0000
success 0 0
1619154710.442499
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ea2000
success 0 0
1619154710.442499
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619154710.442499
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ea2000
success 0 0
1619154710.442499
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619154710.442499
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ea2000
success 0 0
1619154710.442499
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619154710.442499
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ea2000
success 0 0
1619154710.442499
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619154710.442499
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ea2000
success 0 0
1619154710.442499
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619154710.442499
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ea2000
success 0 0
1619154710.442499
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619154710.442499
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ea2000
success 0 0
1619154710.442499
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619154710.442499
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ea2000
success 0 0
1619154710.442499
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619154710.442499
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ea2000
success 0 0
1619154710.442499
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619154710.442499
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ea2000
success 0 0
1619154710.442499
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.34430477863135 section {'size_of_data': '0x0004ba00', 'virtual_address': '0x000d1000', 'entropy': 7.34430477863135, 'name': '.rsrc', 'virtual_size': '0x0004b978'} description A section with a high entropy has been found
entropy 0.27239981990094553 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2292 called NtSetContextThread to modify thread in remote process 368
Time & API Arguments Status Return Repeated
1619134515.627081
NtSetContextThread
thread_handle: 0x000000ec
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4911008
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 368
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2292 resumed a thread in remote process 368
Time & API Arguments Status Return Repeated
1619134515.956081
NtResumeThread
thread_handle: 0x000000ec
suspend_count: 1
process_identifier: 368
success 0 0
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619134515.471081
CreateProcessInternalW
thread_identifier: 784
thread_handle: 0x000000ec
process_identifier: 368
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\09034052e2b952894c6237e377e3cf44.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000f0
inherit_handles: 0
success 1 0
1619134515.471081
NtUnmapViewOfSection
process_identifier: 368
region_size: 4096
process_handle: 0x000000f0
base_address: 0x00400000
success 0 0
1619134515.471081
NtMapViewOfSection
section_handle: 0x000000f8
process_identifier: 368
commit_size: 724992
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000f0
allocation_type: 0 ()
section_offset: 0
view_size: 724992
base_address: 0x00400000
success 0 0
1619134515.627081
NtGetContextThread
thread_handle: 0x000000ec
success 0 0
1619134515.627081
NtSetContextThread
thread_handle: 0x000000ec
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4911008
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 368
success 0 0
1619134515.956081
NtResumeThread
thread_handle: 0x000000ec
suspend_count: 1
process_identifier: 368
success 0 0
File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
DrWeb Trojan.PWS.Stealer.28483
MicroWorld-eScan Trojan.Delf.FareIt.Gen.7
FireEye Generic.mg.09034052e2b95289
Qihoo-360 Win32/Trojan.469
ALYac Trojan.Delf.FareIt.Gen.7
Cylance Unsafe
Zillya Dropper.Agent.Win32.427734
Sangfor Malware
K7AntiVirus Riskware ( 0040eff71 )
Alibaba Trojan:Win32/Cridex.496c2334
K7GW Riskware ( 0040eff71 )
Cybereason malicious.dd5fd0
Arcabit Trojan.Delf.FareIt.Gen.7
BitDefenderTheta Gen:NN.ZelphiF.34670.fHW@a0KIadgi
Cyren W32/Trojan.KMSF-1168
Symantec Infostealer
APEX Malicious
Avast Win32:Malware-gen
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
BitDefender Trojan.Delf.FareIt.Gen.7
NANO-Antivirus Trojan.Win32.Stealer.hkdbbn
Paloalto generic.ml
Tencent Win32.Trojan.Kryptik.Dkt
Ad-Aware Trojan.Delf.FareIt.Gen.7
Sophos Mal/Generic-S + Mal/Fareit-AA
Comodo Malware@#2ef8lo79zrohv
F-Secure Heuristic.HEUR/AGEN.1136306
VIPRE Trojan.Win32.Generic!BT
TrendMicro TSPY_HPLOKI.SMBD
McAfee-GW-Edition BehavesLike.Win32.Fareit.tc
Emsisoft Trojan.Delf.FareIt.Gen.7 (B)
SentinelOne Static AI - Suspicious PE
Jiangmin Trojan.Kryptik.asn
Avira HEUR/AGEN.1136306
MAX malware (ai score=88)
Antiy-AVL Trojan/Win32.Kryptik
Gridinsoft Trojan.Win32.Kryptik.oa!s1
Microsoft Trojan:Win32/Cridex.VD!MTB
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
GData Win32.Trojan.Injector.PA
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2066
McAfee Fareit-FTB!09034052E2B9
VBA32 TScope.Trojan.Delf
Malwarebytes Trojan.MalPack.DLF
Zoner Trojan.Win32.91112
ESET-NOD32 a variant of Win32/Injector.ELXL
TrendMicro-HouseCall TSPY_HPLOKI.SMBD
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x4bd150 VirtualFree
• 0x4bd154 VirtualAlloc
• 0x4bd158 LocalFree
• 0x4bd15c LocalAlloc
• 0x4bd160 GetTickCount
• 0x4bd168 GetVersion
• 0x4bd16c GetCurrentThreadId
• 0x4bd178 VirtualQuery
• 0x4bd17c WideCharToMultiByte
• 0x4bd180 MultiByteToWideChar
• 0x4bd184 lstrlenA
• 0x4bd188 lstrcpynA
• 0x4bd18c LoadLibraryExA
• 0x4bd190 GetThreadLocale
• 0x4bd194 GetStartupInfoA
• 0x4bd198 GetProcAddress
• 0x4bd19c GetModuleHandleA
• 0x4bd1a0 GetModuleFileNameA
• 0x4bd1a4 GetLocaleInfoA
• 0x4bd1a8 GetCommandLineA
• 0x4bd1ac FreeLibrary
• 0x4bd1b0 FindFirstFileA
• 0x4bd1b4 FindClose
• 0x4bd1b8 ExitProcess
• 0x4bd1bc ExitThread
• 0x4bd1c0 CreateThread
• 0x4bd1c4 WriteFile
• 0x4bd1cc RtlUnwind
• 0x4bd1d0 RaiseException
• 0x4bd1d4 GetStdHandle
Library user32.dll:
• 0x4bd1dc GetKeyboardType
• 0x4bd1e0 LoadStringA
• 0x4bd1e4 MessageBoxA
• 0x4bd1e8 CharNextA
Library advapi32.dll:
• 0x4bd1f0 RegQueryValueExA
• 0x4bd1f4 RegOpenKeyExA
• 0x4bd1f8 RegCloseKey
Library oleaut32.dll:
• 0x4bd200 SysFreeString
• 0x4bd204 SysReAllocStringLen
• 0x4bd208 SysAllocStringLen
Library kernel32.dll:
• 0x4bd210 TlsSetValue
• 0x4bd214 TlsGetValue
• 0x4bd218 LocalAlloc
• 0x4bd21c GetModuleHandleA
Library advapi32.dll:
• 0x4bd224 RegQueryValueExA
• 0x4bd228 RegQueryInfoKeyA
• 0x4bd22c RegOpenKeyExA
• 0x4bd230 RegFlushKey
• 0x4bd234 RegEnumKeyExA
• 0x4bd238 RegCloseKey
Library kernel32.dll:
• 0x4bd240 lstrcpyA
• 0x4bd244 lstrcmpA
• 0x4bd248 WriteFile
• 0x4bd24c WaitForSingleObject
• 0x4bd250 VirtualQuery
• 0x4bd254 VirtualProtect
• 0x4bd258 VirtualAlloc
• 0x4bd25c SuspendThread
• 0x4bd260 Sleep
• 0x4bd264 SizeofResource
• 0x4bd268 SetThreadPriority
• 0x4bd26c SetThreadLocale
• 0x4bd270 SetFilePointer
• 0x4bd274 SetEvent
• 0x4bd278 SetErrorMode
• 0x4bd27c SetEndOfFile
• 0x4bd280 SearchPathA
• 0x4bd284 ResumeThread
• 0x4bd288 ResetEvent
• 0x4bd28c ReleaseMutex
• 0x4bd290 ReadFile
• 0x4bd294 OpenFileMappingA
• 0x4bd298 MultiByteToWideChar
• 0x4bd29c MulDiv
• 0x4bd2a0 LockResource
• 0x4bd2a4 LoadResource
• 0x4bd2a8 LoadLibraryA
• 0x4bd2b0 IsDBCSLeadByte
• 0x4bd2b8 GlobalUnlock
• 0x4bd2bc GlobalReAlloc
• 0x4bd2c0 GlobalHandle
• 0x4bd2c4 GlobalLock
• 0x4bd2c8 GlobalFree
• 0x4bd2cc GlobalFindAtomA
• 0x4bd2d0 GlobalDeleteAtom
• 0x4bd2d4 GlobalAlloc
• 0x4bd2d8 GlobalAddAtomA
• 0x4bd2dc GetVersionExA
• 0x4bd2e0 GetVersion
• 0x4bd2e8 GetTickCount
• 0x4bd2ec GetThreadLocale
• 0x4bd2f0 GetTempPathA
• 0x4bd2f8 GetSystemTime
• 0x4bd2fc GetSystemInfo
• 0x4bd300 GetStringTypeExA
• 0x4bd304 GetStdHandle
• 0x4bd308 GetProcAddress
• 0x4bd30c GetModuleHandleA
• 0x4bd310 GetModuleFileNameA
• 0x4bd314 GetLocaleInfoA
• 0x4bd318 GetLocalTime
• 0x4bd31c GetLastError
• 0x4bd320 GetFullPathNameA
• 0x4bd324 GetFileSize
• 0x4bd328 GetExitCodeThread
• 0x4bd32c GetDiskFreeSpaceA
• 0x4bd330 GetDateFormatA
• 0x4bd334 GetCurrentThreadId
• 0x4bd338 GetCurrentProcessId
• 0x4bd340 GetCPInfo
• 0x4bd344 GetACP
• 0x4bd348 FreeResource
• 0x4bd350 InterlockedExchange
• 0x4bd358 FreeLibrary
• 0x4bd35c FormatMessageA
• 0x4bd360 FindResourceA
• 0x4bd364 FindFirstFileA
• 0x4bd368 FindClose
• 0x4bd378 FatalAppExitA
• 0x4bd37c ExitThread
• 0x4bd380 ExitProcess
• 0x4bd384 EnumCalendarInfoA
• 0x4bd390 CreateThread
• 0x4bd394 CreateMutexA
• 0x4bd398 CreateFileA
• 0x4bd39c CreateEventA
• 0x4bd3a0 CopyFileA
• 0x4bd3a4 CompareStringA
• 0x4bd3a8 CloseHandle
Library version.dll:
• 0x4bd3b0 VerQueryValueA
• 0x4bd3b8 GetFileVersionInfoA
Library gdi32.dll:
• 0x4bd3c0 UnrealizeObject
• 0x4bd3c4 StretchBlt
• 0x4bd3c8 SetWindowOrgEx
• 0x4bd3cc SetViewportOrgEx
• 0x4bd3d0 SetTextColor
• 0x4bd3d4 SetStretchBltMode
• 0x4bd3d8 SetROP2
• 0x4bd3dc SetPixel
• 0x4bd3e0 SetDIBColorTable
• 0x4bd3e4 SetBrushOrgEx
• 0x4bd3e8 SetBkMode
• 0x4bd3ec SetBkColor
• 0x4bd3f0 SelectPalette
• 0x4bd3f4 SelectObject
• 0x4bd3f8 SaveDC
• 0x4bd3fc RestoreDC
• 0x4bd400 Rectangle
• 0x4bd404 RectVisible
• 0x4bd408 RealizePalette
• 0x4bd40c PatBlt
• 0x4bd410 MoveToEx
• 0x4bd414 MaskBlt
• 0x4bd418 LineTo
• 0x4bd41c IntersectClipRect
• 0x4bd420 GetWindowOrgEx
• 0x4bd424 GetTextMetricsA
• 0x4bd430 GetStockObject
• 0x4bd434 GetPixel
• 0x4bd438 GetPaletteEntries
• 0x4bd43c GetObjectA
• 0x4bd440 GetDeviceCaps
• 0x4bd444 GetDIBits
• 0x4bd448 GetDIBColorTable
• 0x4bd44c GetDCOrgEx
• 0x4bd454 GetClipBox
• 0x4bd458 GetBrushOrgEx
• 0x4bd45c GetBitmapBits
• 0x4bd460 ExcludeClipRect
• 0x4bd464 DeleteObject
• 0x4bd468 DeleteDC
• 0x4bd46c CreateSolidBrush
• 0x4bd470 CreatePenIndirect
• 0x4bd474 CreatePen
• 0x4bd478 CreatePalette
• 0x4bd480 CreateFontIndirectA
• 0x4bd484 CreateDIBitmap
• 0x4bd488 CreateDIBSection
• 0x4bd48c CreateCompatibleDC
• 0x4bd494 CreateBrushIndirect
• 0x4bd498 CreateBitmap
• 0x4bd49c BitBlt
Library user32.dll:
• 0x4bd4a4 CreateWindowExA
• 0x4bd4a8 WindowFromPoint
• 0x4bd4ac WinHelpA
• 0x4bd4b0 WaitMessage
• 0x4bd4b4 ValidateRect
• 0x4bd4b8 UpdateWindow
• 0x4bd4bc UnregisterClassA
• 0x4bd4c0 UnhookWindowsHookEx
• 0x4bd4c4 TranslateMessage
• 0x4bd4cc TrackPopupMenu
• 0x4bd4d4 ShowWindow
• 0x4bd4d8 ShowScrollBar
• 0x4bd4dc ShowOwnedPopups
• 0x4bd4e0 ShowCursor
• 0x4bd4e4 SetWindowsHookExA
• 0x4bd4e8 SetWindowTextA
• 0x4bd4ec SetWindowPos
• 0x4bd4f0 SetWindowPlacement
• 0x4bd4f4 SetWindowLongA
• 0x4bd4f8 SetTimer
• 0x4bd4fc SetScrollRange
• 0x4bd500 SetScrollPos
• 0x4bd504 SetScrollInfo
• 0x4bd508 SetRect
• 0x4bd50c SetPropA
• 0x4bd510 SetParent
• 0x4bd514 SetMenuItemInfoA
• 0x4bd518 SetMenu
• 0x4bd51c SetForegroundWindow
• 0x4bd520 SetFocus
• 0x4bd524 SetCursor
• 0x4bd528 SetClassLongA
• 0x4bd52c SetCapture
• 0x4bd530 SetActiveWindow
• 0x4bd534 SendMessageA
• 0x4bd538 ScrollWindow
• 0x4bd53c ScreenToClient
• 0x4bd540 RemovePropA
• 0x4bd544 RemoveMenu
• 0x4bd548 ReleaseDC
• 0x4bd54c ReleaseCapture
• 0x4bd558 RegisterClassA
• 0x4bd55c RedrawWindow
• 0x4bd560 PtInRect
• 0x4bd564 PostQuitMessage
• 0x4bd568 PostMessageA
• 0x4bd56c PeekMessageA
• 0x4bd570 OffsetRect
• 0x4bd574 OemToCharBuffA
• 0x4bd578 OemToCharA
• 0x4bd580 MessageBoxA
• 0x4bd584 MapWindowPoints
• 0x4bd588 MapVirtualKeyA
• 0x4bd58c LoadStringA
• 0x4bd590 LoadKeyboardLayoutA
• 0x4bd594 LoadIconA
• 0x4bd598 LoadCursorA
• 0x4bd59c LoadBitmapA
• 0x4bd5a0 KillTimer
• 0x4bd5a4 IsZoomed
• 0x4bd5a8 IsWindowVisible
• 0x4bd5ac IsWindowEnabled
• 0x4bd5b0 IsWindow
• 0x4bd5b4 IsRectEmpty
• 0x4bd5b8 IsIconic
• 0x4bd5bc IsDialogMessageA
• 0x4bd5c0 IsChild
• 0x4bd5c4 InvalidateRect
• 0x4bd5c8 IntersectRect
• 0x4bd5cc InsertMenuItemA
• 0x4bd5d0 InsertMenuA
• 0x4bd5d4 InflateRect
• 0x4bd5dc GetWindowTextA
• 0x4bd5e0 GetWindowRect
• 0x4bd5e4 GetWindowPlacement
• 0x4bd5e8 GetWindowLongA
• 0x4bd5ec GetWindowDC
• 0x4bd5f0 GetTopWindow
• 0x4bd5f4 GetSystemMetrics
• 0x4bd5f8 GetSystemMenu
• 0x4bd5fc GetSysColorBrush
• 0x4bd600 GetSysColor
• 0x4bd604 GetSubMenu
• 0x4bd608 GetScrollRange
• 0x4bd60c GetScrollPos
• 0x4bd610 GetScrollInfo
• 0x4bd614 GetPropA
• 0x4bd618 GetParent
• 0x4bd61c GetWindow
• 0x4bd620 GetMenuStringA
• 0x4bd624 GetMenuState
• 0x4bd628 GetMenuItemInfoA
• 0x4bd62c GetMenuItemID
• 0x4bd630 GetMenuItemCount
• 0x4bd634 GetMenu
• 0x4bd638 GetLastActivePopup
• 0x4bd63c GetKeyboardState
• 0x4bd644 GetKeyboardLayout
• 0x4bd648 GetKeyState
• 0x4bd64c GetKeyNameTextA
• 0x4bd650 GetIconInfo
• 0x4bd654 GetForegroundWindow
• 0x4bd658 GetFocus
• 0x4bd65c GetDesktopWindow
• 0x4bd660 GetDCEx
• 0x4bd664 GetDC
• 0x4bd668 GetCursorPos
• 0x4bd66c GetCursor
• 0x4bd670 GetClientRect
• 0x4bd674 GetClassNameA
• 0x4bd678 GetClassInfoA
• 0x4bd67c GetCapture
• 0x4bd680 GetActiveWindow
• 0x4bd684 FrameRect
• 0x4bd688 FindWindowA
• 0x4bd68c FillRect
• 0x4bd690 EqualRect
• 0x4bd694 EnumWindows
• 0x4bd698 EnumThreadWindows
• 0x4bd69c EndPaint
• 0x4bd6a0 EnableWindow
• 0x4bd6a4 EnableScrollBar
• 0x4bd6a8 EnableMenuItem
• 0x4bd6ac DrawTextA
• 0x4bd6b0 DrawMenuBar
• 0x4bd6b4 DrawIconEx
• 0x4bd6b8 DrawIcon
• 0x4bd6bc DrawFrameControl
• 0x4bd6c0 DrawFocusRect
• 0x4bd6c4 DrawEdge
• 0x4bd6c8 DispatchMessageA
• 0x4bd6cc DestroyWindow
• 0x4bd6d0 DestroyMenu
• 0x4bd6d4 DestroyIcon
• 0x4bd6d8 DestroyCursor
• 0x4bd6dc DeleteMenu
• 0x4bd6e0 DefWindowProcA
• 0x4bd6e4 DefMDIChildProcA
• 0x4bd6e8 DefFrameProcA
• 0x4bd6ec CreatePopupMenu
• 0x4bd6f0 CreateMenu
• 0x4bd6f4 CreateIcon
• 0x4bd6f8 ClientToScreen
• 0x4bd6fc CheckMenuItem
• 0x4bd700 CallWindowProcA
• 0x4bd704 CallNextHookEx
• 0x4bd708 BeginPaint
• 0x4bd70c CharNextA
• 0x4bd710 CharLowerBuffA
• 0x4bd714 CharLowerA
• 0x4bd718 CharUpperBuffA
• 0x4bd71c CharToOemBuffA
• 0x4bd720 CharToOemA
• 0x4bd724 AdjustWindowRectEx
Library kernel32.dll:
• 0x4bd730 Sleep
Library oleaut32.dll:
• 0x4bd738 SafeArrayPtrOfIndex
• 0x4bd73c SafeArrayPutElement
• 0x4bd740 SafeArrayGetElement
• 0x4bd748 SafeArrayAccessData
• 0x4bd74c SafeArrayGetUBound
• 0x4bd750 SafeArrayGetLBound
• 0x4bd754 SafeArrayCreate
• 0x4bd758 VariantChangeType
• 0x4bd75c VariantCopyInd
• 0x4bd760 VariantCopy
• 0x4bd764 VariantClear
• 0x4bd768 VariantInit
Library ole32.dll:
• 0x4bd770 CoTaskMemAlloc
• 0x4bd774 CoCreateInstance
• 0x4bd778 CoUninitialize
• 0x4bd77c CoInitialize
Library oleaut32.dll:
• 0x4bd784 GetErrorInfo
• 0x4bd788 SysFreeString
Library comctl32.dll:
• 0x4bd798 ImageList_Write
• 0x4bd79c ImageList_Read
• 0x4bd7ac ImageList_DragMove
• 0x4bd7b0 ImageList_DragLeave
• 0x4bd7b4 ImageList_DragEnter
• 0x4bd7b8 ImageList_EndDrag
• 0x4bd7bc ImageList_BeginDrag
• 0x4bd7c0 ImageList_Remove
• 0x4bd7c4 ImageList_DrawEx
• 0x4bd7c8 ImageList_Replace
• 0x4bd7cc ImageList_Draw
• 0x4bd7dc ImageList_Add
• 0x4bd7e4 ImageList_Destroy
• 0x4bd7e8 ImageList_Create
• 0x4bd7ec InitCommonControls

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 51809 239.255.255.250 3702
192.168.56.101 51811 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.