10.2
0-day
56 个模型检测该样本为恶意！
重新分析
更多

9e665f51628f0692bfa838f343418956b77aef865ade1260e429a8b5c32d22ed

214332c6e7e061c8c85a28d68d841989.exe

分析耗时

97s

最近分析

文件大小

522.5KB
静态报毒 动态报毒 ACVH AI SCORE=89 ATTRIBUTE BANKERX CLOUD DOWNLOADER33 ELDORADO EMOTET ENCPK GENCIRC GYY@AUOI1QDI HDQH HIGH CONFIDENCE HIGHCONFIDENCE HKSKGL KRYPTIK MALWARE@#3JVCO1IG2AWUF POSSIBLETHREAT R011C0DER20 R338786 SCORE STRICTOR SUSGEN UNSAFE YZETE ZENPAK ZEXAE 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Backdoor:Win32/Emotet.d25381a4 20190527 0.3.0.5
Avast Win32:BankerX-gen [Trj] 20200701 18.4.3895.0
Tencent Malware.Win32.Gencirc.10cdd10a 20200701 1.0.0.1
Baidu 20190318 1.0.0.2
Kingsoft 20200701 2013.8.14.323
McAfee Emotet-FQU!214332C6E7E0 20200701 6.0.6.653
CrowdStrike 20190702 1.0
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1619270583.229374
GetComputerNameA
computer_name: OSKAR-PC
success 1 0
Uses Windows APIs to generate a cryptographic key (3 个事件)
Time & API Arguments Status Return Repeated
1619270568.886374
CryptGenKey
crypto_handle: 0x005c2b08
algorithm_identifier: 0x0000660e ()
provider_handle: 0x005c27e0
flags: 1
key: f‰}NØÄV0¨¸Åù5zD
success 1 0
1619270583.307374
CryptExportKey
crypto_handle: 0x005c2b08
crypto_export_handle: 0x005c2ac8
buffer: f¤ ‚˜÷àî;Gû;ýˆ_ÇιGÝóÃçvñ4â,Më¤÷2&µS sì0ú+l #ìŠÀG…:~ Á‹€ ʀ¦­G\K+N¢„B“ށJðö+mû­
blob_type: 1
flags: 64
success 1 0
1619270617.432374
CryptExportKey
crypto_handle: 0x005c2b08
crypto_export_handle: 0x005c2ac8
buffer: f¤ERËԌ(g‹§•Ý 7VoÍ#sd>=ë&¯•¶^@ñðñsëÍď! id´‘“Žw ºJ×W5~ÏÑÃ?èÚ/àeá ÓöK!–ö`mY"»—gûgñï$^ÚhŽM’Ì
blob_type: 1
flags: 64
success 1 0
The executable uses a known packer (1 个事件)
packer InstallShield 2000
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (3 个事件)
Time & API Arguments Status Return Repeated
1619270554.996001
NtAllocateVirtualMemory
process_identifier: 472
region_size: 40960
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x005c0000
success 0 0
1619270198.951772
NtAllocateVirtualMemory
process_identifier: 1424
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0000000004010000
success 0 0
1619270562.870374
NtAllocateVirtualMemory
process_identifier: 2272
region_size: 40960
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x003b0000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Creates a suspicious process (1 个事件)
cmdline C:\Windows\SysWOW64\cmd\cmd.exe
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (5 个事件)
Moves the original executable to a new location (1 个事件)
Time & API Arguments Status Return Repeated
1619270561.543001
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\214332c6e7e061c8c85a28d68d841989.exe
newfilepath: C:\Windows\SysWOW64\cmd\cmd.exe
newfilepath_r: C:\Windows\SysWOW64\cmd\cmd.exe
flags: 3
oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\214332c6e7e061c8c85a28d68d841989.exe
success 1 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619270583.667374
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
Expresses interest in specific running processes (1 个事件)
process cmd.exe
Reads the systems User Agent and subsequently performs requests (1 个事件)
Time & API Arguments Status Return Repeated
1619270583.417374
InternetOpenW
proxy_bypass:
access_type: 0
proxy_name:
flags: 0
user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
success 13369348 0
网络通信
Communicates with host for which no DNS query was performed (3 个事件)
host 172.217.24.14
host 190.147.137.153
host 91.236.4.234
Installs itself for autorun at Windows startup (1 个事件)
service_name cmd service_path C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\cmd\cmd.exe"
Created a service where a service was also not started (1 个事件)
Time & API Arguments Status Return Repeated
1619270562.308001
CreateServiceW
service_start_name:
start_type: 2
service_handle: 0x026f13b8
display_name: cmd
error_control: 0
service_name: cmd
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\cmd\cmd.exe"
filepath_r: "C:\Windows\SysWOW64\cmd\cmd.exe"
service_manager_handle: 0x026eed20
desired_access: 2
service_type: 16
password:
success 40833976 0
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)
Time & API Arguments Status Return Repeated
1619270586.245374
RegSetValueExA
key_handle: 0x00000394
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619270586.245374
RegSetValueExA
key_handle: 0x00000394
value: PÃÇvÝ8×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619270586.245374
RegSetValueExA
key_handle: 0x00000394
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619270586.245374
RegSetValueExW
key_handle: 0x00000394
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619270586.245374
RegSetValueExA
key_handle: 0x000003ac
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619270586.245374
RegSetValueExA
key_handle: 0x000003ac
value: PÃÇvÝ8×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619270586.245374
RegSetValueExA
key_handle: 0x000003ac
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1619270586.261374
RegSetValueExW
key_handle: 0x00000390
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
Attempts to remove evidence of file being downloaded from the Internet (1 个事件)
file C:\Windows\SysWOW64\cmd\cmd.exe:Zone.Identifier
Generates some ICMP traffic
File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 个事件)
DrWeb Trojan.DownLoader33.35922
MicroWorld-eScan Gen:Variant.Strictor.245257
FireEye Gen:Variant.Strictor.245257
CAT-QuickHeal Trojan.Zenpak
ALYac Gen:Variant.Strictor.245257
Cylance Unsafe
Zillya Trojan.Emotet.Win32.20830
K7AntiVirus Trojan ( 005677ba1 )
Alibaba Backdoor:Win32/Emotet.d25381a4
K7GW Trojan ( 005677ba1 )
Arcabit Trojan.Strictor.D3BE09
TrendMicro TROJ_GEN.R011C0DER20
BitDefenderTheta Gen:NN.ZexaE.34130.GyY@auOI1Qdi
F-Prot W32/Kryptik.BNK.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Kryptik.HDQH
TrendMicro-HouseCall TROJ_GEN.R011C0DER20
Paloalto generic.ml
ClamAV Win.Malware.Emotet-7997954-0
Kaspersky Trojan.Win32.Zenpak.acvh
BitDefender Gen:Variant.Strictor.245257
NANO-Antivirus Trojan.Win32.Emotet.hkskgl
ViRobot Trojan.Win32.Emotet.508928
Avast Win32:BankerX-gen [Trj]
Tencent Malware.Win32.Gencirc.10cdd10a
Ad-Aware Gen:Variant.Strictor.245257
Emsisoft Trojan.Emotet (A)
Comodo Malware@#3jvco1ig2awuf
F-Secure Trojan.TR/AD.Emotet.yzete
VIPRE Trojan.Win32.Generic!BT
Invincea heuristic
Sophos Mal/EncPk-APM
Ikarus Trojan-Banker.Emotet
Cyren W32/Kryptik.BNK.gen!Eldorado
Jiangmin Trojan.Zenpak.bul
Avira TR/AD.Emotet.yzete
Antiy-AVL Trojan/Win32.Zenpak
Microsoft Trojan:Win32/Emotet.ARJ!MTB
Endgame malicious (high confidence)
AegisLab Trojan.Win32.Zenpak.4!c
ZoneAlarm Trojan.Win32.Zenpak.acvh
GData Gen:Variant.Strictor.245257
Cynet Malicious (score: 85)
AhnLab-V3 Malware/Win32.RL_Generic.R338786
McAfee Emotet-FQU!214332C6E7E0
TACHYON Backdoor/W32.Emotet.535040
VBA32 Trojan.Zenpak
Malwarebytes Trojan.Emotet
APEX Malicious
Rising Trojan.Emotet!8.B95 (CLOUD)
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 190.147.137.153:443
dead_host 91.236.4.234:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-05-26 18:16:55

Imports

Library KERNEL32.dll:
• 0x467c00 ExitProcess
• 0x467c04 TerminateProcess
• 0x467c08 HeapSize
• 0x467c0c HeapReAlloc
• 0x467c10 GetCPInfo
• 0x467c14 GetACP
• 0x467c18 GetOEMCP
• 0x467c20 GetSystemTime
• 0x467c24 GetLocalTime
• 0x467c3c SetHandleCount
• 0x467c40 GetStdHandle
• 0x467c44 GetFileType
• 0x467c48 HeapDestroy
• 0x467c4c HeapCreate
• 0x467c50 VirtualFree
• 0x467c54 ExitThread
• 0x467c5c VirtualAlloc
• 0x467c60 LCMapStringA
• 0x467c64 LCMapStringW
• 0x467c68 Sleep
• 0x467c6c GetStringTypeA
• 0x467c70 GetStringTypeW
• 0x467c74 IsBadReadPtr
• 0x467c78 IsBadWritePtr
• 0x467c7c IsBadCodePtr
• 0x467c80 IsValidLocale
• 0x467c84 IsValidCodePage
• 0x467c88 GetUserDefaultLCID
• 0x467c90 GetLocaleInfoA
• 0x467c94 GetLocaleInfoW
• 0x467c98 SetStdHandle
• 0x467c9c CompareStringA
• 0x467ca0 CompareStringW
• 0x467ca8 CreateThread
• 0x467cac HeapFree
• 0x467cb0 HeapAlloc
• 0x467cb4 RaiseException
• 0x467cb8 GetCommandLineA
• 0x467cbc GetStartupInfoA
• 0x467cc0 GetModuleHandleA
• 0x467cc4 RtlUnwind
• 0x467cc8 FormatMessageA
• 0x467cd4 GetDiskFreeSpaceA
• 0x467cd8 GetTempFileNameA
• 0x467cdc SetErrorMode
• 0x467ce0 SetFileAttributesA
• 0x467ce4 SetFileTime
• 0x467cf0 GetFileTime
• 0x467cf4 GetFileSize
• 0x467cf8 GetFileAttributesA
• 0x467d0c GetModuleFileNameA
• 0x467d10 GetShortPathNameA
• 0x467d14 GetThreadLocale
• 0x467d18 GetStringTypeExA
• 0x467d1c GetFullPathNameA
• 0x467d24 FindFirstFileA
• 0x467d28 FindClose
• 0x467d2c DeleteFileA
• 0x467d30 MoveFileA
• 0x467d34 SetEndOfFile
• 0x467d38 UnlockFile
• 0x467d3c LockFile
• 0x467d40 FlushFileBuffers
• 0x467d44 SetFilePointer
• 0x467d48 WriteFile
• 0x467d4c ReadFile
• 0x467d50 CreateFileA
• 0x467d54 DuplicateHandle
• 0x467d58 GetVersionExA
• 0x467d5c GetProcessVersion
• 0x467d60 LoadLibraryA
• 0x467d64 GetProcAddress
• 0x467d68 FreeLibrary
• 0x467d6c GlobalFlags
• 0x467d70 TlsGetValue
• 0x467d74 LocalReAlloc
• 0x467d78 TlsSetValue
• 0x467d80 GlobalReAlloc
• 0x467d88 TlsFree
• 0x467d8c GlobalHandle
• 0x467d94 WaitForSingleObject
• 0x467d98 TlsAlloc
• 0x467da0 LocalFree
• 0x467da4 LocalAlloc
• 0x467da8 GetLastError
• 0x467dac SetLastError
• 0x467db0 MultiByteToWideChar
• 0x467db4 WideCharToMultiByte
• 0x467dbc GlobalAlloc
• 0x467dc0 GlobalDeleteAtom
• 0x467dc4 lstrcmpA
• 0x467dc8 lstrcmpiA
• 0x467dcc GetCurrentThread
• 0x467dd0 MulDiv
• 0x467dd8 SuspendThread
• 0x467ddc SetThreadPriority
• 0x467de0 ResumeThread
• 0x467de4 GlobalFree
• 0x467de8 GlobalLock
• 0x467dec lstrcpynA
• 0x467df0 GlobalUnlock
• 0x467df4 GlobalGetAtomNameA
• 0x467df8 GlobalAddAtomA
• 0x467dfc lstrcpyA
• 0x467e00 lstrlenA
• 0x467e04 LockResource
• 0x467e08 lstrcatA
• 0x467e0c GetCurrentThreadId
• 0x467e10 CloseHandle
• 0x467e14 GetVersion
• 0x467e18 CreateEventA
• 0x467e1c LoadLibraryExW
• 0x467e20 LoadLibraryExA
• 0x467e24 FindResourceA
• 0x467e28 LoadResource
• 0x467e2c SizeofResource
• 0x467e30 GetCurrentProcess
• 0x467e34 SetEvent
• 0x467e38 FatalAppExitA
Library USER32.dll:
• 0x467f14 EndDialog
• 0x467f18 GetNextDlgTabItem
• 0x467f1c CheckDlgButton
• 0x467f20 CheckRadioButton
• 0x467f24 GetDlgItemInt
• 0x467f28 GetDlgItemTextA
• 0x467f2c SetDlgItemInt
• 0x467f30 SetDlgItemTextA
• 0x467f34 IsDlgButtonChecked
• 0x467f38 ScrollWindowEx
• 0x467f3c IsDialogMessageA
• 0x467f40 SetWindowTextA
• 0x467f44 MoveWindow
• 0x467f48 EnableMenuItem
• 0x467f4c CheckMenuItem
• 0x467f50 SetMenuItemBitmaps
• 0x467f54 ModifyMenuA
• 0x467f58 GetMenuState
• 0x467f5c LoadBitmapA
• 0x467f64 GetCursorPos
• 0x467f68 ValidateRect
• 0x467f6c TranslateMessage
• 0x467f70 GetMessageA
• 0x467f74 GetWindowDC
• 0x467f78 BeginPaint
• 0x467f7c EndPaint
• 0x467f80 TabbedTextOutA
• 0x467f84 GrayStringA
• 0x467f88 ShowOwnedPopups
• 0x467f8c MessageBoxA
• 0x467f90 PostQuitMessage
• 0x467f94 CharToOemA
• 0x467f98 OemToCharA
• 0x467f9c LoadStringA
• 0x467fa0 GetClassNameA
• 0x467fa4 PtInRect
• 0x467fa8 ClientToScreen
• 0x467fac GetSysColorBrush
• 0x467fb0 FindWindowA
• 0x467fb4 IsRectEmpty
• 0x467fb8 OffsetRect
• 0x467fbc GetDialogBaseUnits
• 0x467fc0 CharUpperA
• 0x467fc4 InsertMenuA
• 0x467fc8 DeleteMenu
• 0x467fcc GetMenuStringA
• 0x467fd0 IntersectRect
• 0x467fd4 InflateRect
• 0x467fd8 SetMenu
• 0x467fdc ShowWindow
• 0x467fe0 GetDesktopWindow
• 0x467fe4 SetCursor
• 0x467fe8 ReleaseCapture
• 0x467fec LoadAcceleratorsA
• 0x467ff0 SetRectEmpty
• 0x467ff4 DestroyMenu
• 0x467ff8 GetActiveWindow
• 0x467ffc RedrawWindow
• 0x468000 DefMDIChildProcA
• 0x468004 DrawMenuBar
• 0x468010 DefFrameProcA
• 0x468014 BringWindowToTop
• 0x468018 PostMessageA
• 0x46801c SendDlgItemMessageA
• 0x468024 MapWindowPoints
• 0x468028 PeekMessageA
• 0x46802c DispatchMessageA
• 0x468030 GetFocus
• 0x468034 SetActiveWindow
• 0x468038 GetSystemMetrics
• 0x46803c SetFocus
• 0x468040 AdjustWindowRectEx
• 0x468044 EqualRect
• 0x468048 DeferWindowPos
• 0x46804c BeginDeferWindowPos
• 0x468050 CopyRect
• 0x468054 EndDeferWindowPos
• 0x468058 IsWindowVisible
• 0x46805c ScreenToClient
• 0x468060 ScrollWindow
• 0x468064 GetScrollInfo
• 0x468068 SetScrollInfo
• 0x46806c ShowScrollBar
• 0x468070 GetScrollRange
• 0x468074 SetScrollRange
• 0x468078 GetScrollPos
• 0x46807c GetTopWindow
• 0x468080 IsWindowEnabled
• 0x468084 IsChild
• 0x468088 GetParent
• 0x46808c GetCapture
• 0x468090 WinHelpA
• 0x468094 wsprintfA
• 0x468098 GetClassInfoA
• 0x46809c RegisterClassA
• 0x4680a0 GetMenuItemCount
• 0x4680a4 GetSubMenu
• 0x4680a8 GetMenuItemID
• 0x4680ac GetMenu
• 0x4680b0 TrackPopupMenu
• 0x4680b4 SetWindowPlacement
• 0x4680b8 GetWindowPlacement
• 0x4680bc GetDlgItem
• 0x4680c4 GetWindowTextA
• 0x4680c8 GetDlgCtrlID
• 0x4680cc GetKeyState
• 0x4680d0 DefWindowProcA
• 0x4680d4 DestroyWindow
• 0x4680d8 CreateWindowExA
• 0x4680dc SetWindowsHookExA
• 0x4680e0 CallNextHookEx
• 0x4680e4 SetPropA
• 0x4680e8 UnhookWindowsHookEx
• 0x4680ec GetLastActivePopup
• 0x4680f0 GetForegroundWindow
• 0x4680f4 SetForegroundWindow
• 0x4680f8 GetPropA
• 0x4680fc CallWindowProcA
• 0x468100 RemovePropA
• 0x468104 GetMessageTime
• 0x468108 GetMessagePos
• 0x46810c GetWindowRect
• 0x468110 GetWindowLongA
• 0x468114 SetWindowLongA
• 0x468118 UnregisterClassA
• 0x46811c SetWindowPos
• 0x468124 GetWindow
• 0x468128 EnumChildWindows
• 0x46812c UpdateWindow
• 0x468130 GetSystemMenu
• 0x468134 DrawTextA
• 0x468138 LoadIconA
• 0x46813c GetClientRect
• 0x468140 KillTimer
• 0x468144 InvalidateRect
• 0x468148 GetSysColor
• 0x46814c FillRect
• 0x468150 SetTimer
• 0x468154 GetDC
• 0x468158 ReleaseDC
• 0x46815c EnableWindow
• 0x468160 LoadCursorA
• 0x468164 SendMessageA
• 0x46816c IsIconic
• 0x468170 UnpackDDElParam
• 0x468174 IsWindow
• 0x468178 ReuseDDElParam
• 0x46817c LoadMenuA
• 0x468180 SetScrollPos
• 0x468184 WindowFromPoint
Library GDI32.dll:
• 0x467a5c SetViewportOrgEx
• 0x467a60 OffsetViewportOrgEx
• 0x467a64 SetViewportExtEx
• 0x467a68 ScaleViewportExtEx
• 0x467a6c SetWindowOrgEx
• 0x467a70 OffsetWindowOrgEx
• 0x467a74 SetWindowExtEx
• 0x467a78 ScaleWindowExtEx
• 0x467a7c GetClipBox
• 0x467a80 SelectClipRgn
• 0x467a84 ExcludeClipRect
• 0x467a88 IntersectClipRect
• 0x467a8c OffsetClipRgn
• 0x467a90 MoveToEx
• 0x467a94 LineTo
• 0x467a98 SetTextAlign
• 0x467aa4 SetMapperFlags
• 0x467aac ArcTo
• 0x467ab0 SetArcDirection
• 0x467ab4 PolyDraw
• 0x467ab8 PolylineTo
• 0x467abc SetColorAdjustment
• 0x467ac0 PolyBezierTo
• 0x467ac4 DeleteObject
• 0x467ac8 GetClipRgn
• 0x467acc CreateRectRgn
• 0x467ad0 SetMapMode
• 0x467ad4 ExtSelectClipRgn
• 0x467ad8 PlayMetaFileRecord
• 0x467adc GetObjectType
• 0x467ae0 EnumMetaFile
• 0x467ae4 PlayMetaFile
• 0x467ae8 GetViewportExtEx
• 0x467aec GetWindowExtEx
• 0x467af0 CreatePen
• 0x467af4 ExtCreatePen
• 0x467af8 CreateSolidBrush
• 0x467afc CreateHatchBrush
• 0x467b00 CreatePatternBrush
• 0x467b08 PtVisible
• 0x467b0c RectVisible
• 0x467b10 TextOutA
• 0x467b14 ExtTextOutA
• 0x467b18 Escape
• 0x467b1c LPtoDP
• 0x467b20 DPtoLP
• 0x467b24 GetTextExtentPointA
• 0x467b28 GetTextMetricsA
• 0x467b2c CreateFontIndirectA
• 0x467b30 PatBlt
• 0x467b38 GetMapMode
• 0x467b3c SetRectRgn
• 0x467b40 CombineRgn
• 0x467b44 SetStretchBltMode
• 0x467b48 SetROP2
• 0x467b4c SetPolyFillMode
• 0x467b50 SetBkMode
• 0x467b54 SelectPalette
• 0x467b58 GetStockObject
• 0x467b5c SelectObject
• 0x467b60 RestoreDC
• 0x467b64 SaveDC
• 0x467b68 StartDocA
• 0x467b6c DeleteDC
• 0x467b70 CreateBitmap
• 0x467b74 GetObjectA
• 0x467b78 SetBkColor
• 0x467b7c SetTextColor
• 0x467b80 BitBlt
• 0x467b84 CreateCompatibleDC
• 0x467b8c Ellipse
• 0x467b90 SelectClipPath
• 0x467b94 GetDeviceCaps
Library comdlg32.dll:
• 0x468268 GetSaveFileNameA
• 0x46826c GetFileTitleA
• 0x468270 ChooseColorA
• 0x468274 GetOpenFileNameA
Library WINSPOOL.DRV:
• 0x468230 OpenPrinterA
• 0x468234 DocumentPropertiesA
• 0x468238 ClosePrinter
Library ADVAPI32.dll:
• 0x4679ac RegSetValueExA
• 0x4679b0 GetFileSecurityA
• 0x4679b4 SetFileSecurityA
• 0x4679b8 RegDeleteKeyA
• 0x4679bc RegDeleteValueA
• 0x4679c0 RegCloseKey
• 0x4679c4 RegCreateKeyExA
• 0x4679c8 RegOpenKeyA
• 0x4679cc RegOpenKeyExA
• 0x4679d0 RegQueryValueExA
Library SHELL32.dll:
• 0x467ed8 DragQueryFileA
• 0x467edc DragFinish
• 0x467ee0 DragAcceptFiles
• 0x467ee4 SHGetFileInfoA
Library COMCTL32.dll:
• 0x467a08
• 0x467a0c
• 0x467a10 ImageList_Destroy
• 0x467a14 ImageList_Create
• 0x467a1c ImageList_Merge
• 0x467a20 ImageList_Read
• 0x467a24 ImageList_Write
• 0x467a28

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49713 114.114.114.114 53
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 50568 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62912 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 49714 239.255.255.250 3702
192.168.56.101 50537 239.255.255.250 1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.