5.8
高危
55 个模型检测该样本为恶意！
重新分析
更多

25f3055b70c55813ecfaecb1d3ae144508478cdacf97eb2eabf2096c4cbaec0b

229e45edc2cd571c20a4eafe346b5585.exe

分析耗时

23s

最近分析

文件大小

800.0KB
静态报毒 动态报毒 1BK8UAZ AI SCORE=85 AIDETECTVM ALI2000015 ANDROM BSCOPE CLASSIC CONFIDENCE CUGE DELFINJECT DELPHILESS EMZL EOPD FAREIT FORMBOOK GENERICKD GENKRYPTIK HIGH CONFIDENCE HRLVEZ JKLJH@0 KRADDARE KRYPTIK MALWARE2 QVM05 R002C0DHA20 SCORE SHETT SPYBOTNET SUSGEN SUSPICIOUS PE UNSAFE X2091 YGW@A8MPBFKI ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Kingsoft 20200826 2013.8.14.323
McAfee Fareit-FPQ!229E45EDC2CD 20200826 6.0.6.653
Tencent 20200826 1.0.0.1
Avast Win32:Trojan-gen 20200826 18.4.3895.0
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619301349.94925
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75177f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75174de3
229e45edc2cd571c20a4eafe346b5585+0x62a4d @ 0x462a4d
229e45edc2cd571c20a4eafe346b5585+0x5b254 @ 0x45b254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff3514ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619269229.637857
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003f0000
success 0 0
1619269229.871857
NtProtectVirtualMemory
process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 81920
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00466000
success 0 0
1619269229.871857
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f40000
success 0 0
1619301348.52725
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619301348.57425
NtAllocateVirtualMemory
process_identifier: 648
region_size: 262144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00570000
success 0 0
1619301348.57425
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00570000
success 0 0
1619301348.57425
NtAllocateVirtualMemory
process_identifier: 648
region_size: 368640
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01e00000
success 0 0
1619301348.57425
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 339968
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e02000
success 0 0
1619301349.12125
NtAllocateVirtualMemory
process_identifier: 648
region_size: 2162688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02290000
success 0 0
1619301349.12125
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02460000
success 0 0
1619301349.88625
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01df2000
success 0 0
1619301349.88625
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619301349.88625
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01df2000
success 0 0
1619301349.88625
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619301349.88625
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01df2000
success 0 0
1619301349.90225
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619301349.90225
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01df2000
success 0 0
1619301349.90225
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619301349.90225
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01df2000
success 0 0
1619301349.90225
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619301349.90225
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01df2000
success 0 0
1619301349.90225
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619301349.90225
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01df2000
success 0 0
1619301349.90225
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619301349.90225
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01df2000
success 0 0
1619301349.90225
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619301349.90225
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01df2000
success 0 0
1619301349.90225
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619301349.90225
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01df2000
success 0 0
1619301349.90225
NtProtectVirtualMemory
process_identifier: 648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.565483682704656 section {'size_of_data': '0x00044600', 'virtual_address': '0x00089000', 'entropy': 7.565483682704656, 'name': '.rsrc', 'virtual_size': '0x00044524'} description A section with a high entropy has been found
entropy 0.3423028785982478 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 172.217.24.14
host 34.98.99.30
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 732 called NtSetContextThread to modify thread in remote process 648
Time & API Arguments Status Return Repeated
1619269230.668857
NtSetContextThread
thread_handle: 0x000000f8
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4971760
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 648
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 732 resumed a thread in remote process 648
Time & API Arguments Status Return Repeated
1619269231.121857
NtResumeThread
thread_handle: 0x000000f8
suspend_count: 1
process_identifier: 648
success 0 0
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619269230.574857
CreateProcessInternalW
thread_identifier: 2296
thread_handle: 0x000000f8
process_identifier: 648
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\229e45edc2cd571c20a4eafe346b5585.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619269230.574857
NtUnmapViewOfSection
process_identifier: 648
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1619269230.574857
NtMapViewOfSection
section_handle: 0x00000104
process_identifier: 648
commit_size: 782336
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 782336
base_address: 0x00400000
success 0 0
1619269230.668857
NtGetContextThread
thread_handle: 0x000000f8
success 0 0
1619269230.668857
NtSetContextThread
thread_handle: 0x000000f8
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4971760
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 648
success 0 0
1619269231.121857
NtResumeThread
thread_handle: 0x000000f8
suspend_count: 1
process_identifier: 648
success 0 0
File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
DrWeb BackDoor.SpyBotNET.25
MicroWorld-eScan Trojan.GenericKD.43635734
FireEye Generic.mg.229e45edc2cd571c
ALYac Trojan.GenericKD.43635734
Cylance Unsafe
Zillya Trojan.Crypt.Win32.65023
K7AntiVirus Riskware ( 0040eff71 )
Alibaba Trojan:Win32/DelfInject.ali2000015
K7GW Riskware ( 0040eff71 )
Cybereason malicious.a452a4
Arcabit Trojan.Generic.D299D416
Invincea heuristic
BitDefenderTheta Gen:NN.ZelphiF.34196.YGW@a8mPbFki
Cyren W32/Injector.CUGE-8085
Symantec Trojan.Gen.2
APEX Malicious
ClamAV Win.Dropper.Formbook-9257771-0
Kaspersky HEUR:Trojan.Win32.Crypt.gen
BitDefender Trojan.GenericKD.43635734
NANO-Antivirus Trojan.Win32.Crypt.hrlvez
ViRobot Trojan.Win32.Z.Win.819200
Rising Trojan.Kryptik!1.CA3B (CLASSIC)
Ad-Aware Trojan.GenericKD.43635734
Comodo TrojWare.Win32.Agent.jkljh@0
F-Secure Trojan.TR/Kryptik.shett
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R002C0DHA20
Sophos Mal/Generic-S
SentinelOne DFI - Suspicious PE
Jiangmin Trojan.Crypt.dwe
Avira TR/Kryptik.shett
Antiy-AVL Trojan/Win32.Crypt
Microsoft Trojan:Win32/Androm.VD!MTB
AegisLab Trojan.Multi.Generic.4!c
ZoneAlarm HEUR:Trojan.Win32.Crypt.gen
GData Win32.Trojan.PSE.1BK8UAZ
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2091
McAfee Fareit-FPQ!229E45EDC2CD
MAX malware (ai score=85)
VBA32 BScope.Adware.Kraddare
Malwarebytes Trojan.MalPack.DLF
Panda Trj/CI.A
ESET-NOD32 a variant of Win32/GenKryptik.EOPD
TrendMicro-HouseCall TROJ_GEN.R002C0DHA20
Ikarus Trojan.Inject
eGambit Unsafe.AI_Score_99%
Fortinet W32/Injector.EMZL!tr
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x47d150 VirtualFree
• 0x47d154 VirtualAlloc
• 0x47d158 LocalFree
• 0x47d15c LocalAlloc
• 0x47d160 GetVersion
• 0x47d164 GetCurrentThreadId
• 0x47d170 VirtualQuery
• 0x47d174 WideCharToMultiByte
• 0x47d17c MultiByteToWideChar
• 0x47d180 lstrlenA
• 0x47d184 lstrcpynA
• 0x47d188 LoadLibraryExA
• 0x47d18c GetThreadLocale
• 0x47d190 GetStartupInfoA
• 0x47d194 GetProcAddress
• 0x47d198 GetModuleHandleA
• 0x47d19c GetModuleFileNameA
• 0x47d1a0 GetLocaleInfoA
• 0x47d1a4 GetLastError
• 0x47d1ac GetCommandLineA
• 0x47d1b0 FreeLibrary
• 0x47d1b4 FindFirstFileA
• 0x47d1b8 FindClose
• 0x47d1bc ExitProcess
• 0x47d1c0 WriteFile
• 0x47d1c8 RtlUnwind
• 0x47d1cc RaiseException
• 0x47d1d0 GetStdHandle
Library user32.dll:
• 0x47d1d8 GetKeyboardType
• 0x47d1dc LoadStringA
• 0x47d1e0 MessageBoxA
• 0x47d1e4 CharNextA
Library advapi32.dll:
• 0x47d1ec RegQueryValueExA
• 0x47d1f0 RegOpenKeyExA
• 0x47d1f4 RegCloseKey
Library oleaut32.dll:
• 0x47d1fc SysFreeString
• 0x47d200 SysReAllocStringLen
• 0x47d204 SysAllocStringLen
Library kernel32.dll:
• 0x47d20c TlsSetValue
• 0x47d210 TlsGetValue
• 0x47d214 LocalAlloc
• 0x47d218 GetModuleHandleA
Library advapi32.dll:
• 0x47d220 RegQueryValueExA
• 0x47d224 RegOpenKeyExA
• 0x47d228 RegCloseKey
Library kernel32.dll:
• 0x47d230 lstrcpyA
• 0x47d234 WriteFile
• 0x47d238 WaitForSingleObject
• 0x47d23c VirtualQuery
• 0x47d240 VirtualProtect
• 0x47d244 VirtualAlloc
• 0x47d248 Sleep
• 0x47d24c SizeofResource
• 0x47d250 SetThreadLocale
• 0x47d254 SetFilePointer
• 0x47d258 SetEvent
• 0x47d25c SetErrorMode
• 0x47d260 SetEndOfFile
• 0x47d264 ResetEvent
• 0x47d268 ReadFile
• 0x47d26c MulDiv
• 0x47d270 LockResource
• 0x47d274 LoadResource
• 0x47d278 LoadLibraryA
• 0x47d284 GlobalUnlock
• 0x47d288 GlobalReAlloc
• 0x47d28c GlobalHandle
• 0x47d290 GlobalLock
• 0x47d294 GlobalFree
• 0x47d298 GlobalFindAtomA
• 0x47d29c GlobalDeleteAtom
• 0x47d2a0 GlobalAlloc
• 0x47d2a4 GlobalAddAtomA
• 0x47d2a8 GetVersionExA
• 0x47d2ac GetVersion
• 0x47d2b0 GetTickCount
• 0x47d2b4 GetThreadLocale
• 0x47d2bc GetSystemInfo
• 0x47d2c0 GetStringTypeExA
• 0x47d2c4 GetStdHandle
• 0x47d2c8 GetProcAddress
• 0x47d2cc GetModuleHandleA
• 0x47d2d0 GetModuleFileNameA
• 0x47d2d4 GetLocaleInfoA
• 0x47d2d8 GetLocalTime
• 0x47d2dc GetLastError
• 0x47d2e0 GetFullPathNameA
• 0x47d2e4 GetFileAttributesA
• 0x47d2e8 GetDiskFreeSpaceA
• 0x47d2ec GetDateFormatA
• 0x47d2f0 GetCurrentThreadId
• 0x47d2f4 GetCurrentProcessId
• 0x47d2f8 GetCPInfo
• 0x47d2fc GetACP
• 0x47d300 FreeResource
• 0x47d304 InterlockedExchange
• 0x47d308 FreeLibrary
• 0x47d30c FormatMessageA
• 0x47d310 FindResourceA
• 0x47d314 FindNextFileA
• 0x47d318 FindFirstFileA
• 0x47d31c FindClose
• 0x47d32c EnumCalendarInfoA
• 0x47d338 CreateThread
• 0x47d33c CreateFileA
• 0x47d340 CreateEventA
• 0x47d344 CompareStringA
• 0x47d348 CloseHandle
Library version.dll:
• 0x47d350 VerQueryValueA
• 0x47d358 GetFileVersionInfoA
Library gdi32.dll:
• 0x47d360 UnrealizeObject
• 0x47d364 StretchBlt
• 0x47d368 SetWindowOrgEx
• 0x47d36c SetWindowExtEx
• 0x47d370 SetWinMetaFileBits
• 0x47d374 SetViewportOrgEx
• 0x47d378 SetViewportExtEx
• 0x47d37c SetTextColor
• 0x47d380 SetStretchBltMode
• 0x47d384 SetROP2
• 0x47d388 SetPixel
• 0x47d38c SetMapMode
• 0x47d390 SetEnhMetaFileBits
• 0x47d394 SetDIBColorTable
• 0x47d398 SetBrushOrgEx
• 0x47d39c SetBkMode
• 0x47d3a0 SetBkColor
• 0x47d3a4 SelectPalette
• 0x47d3a8 SelectObject
• 0x47d3ac SaveDC
• 0x47d3b0 RestoreDC
• 0x47d3b4 Rectangle
• 0x47d3b8 RectVisible
• 0x47d3bc RealizePalette
• 0x47d3c0 Polyline
• 0x47d3c4 PolyPolyline
• 0x47d3c8 PlayEnhMetaFile
• 0x47d3cc PatBlt
• 0x47d3d0 MoveToEx
• 0x47d3d4 MaskBlt
• 0x47d3d8 LineTo
• 0x47d3dc IntersectClipRect
• 0x47d3e0 GetWindowOrgEx
• 0x47d3e4 GetWinMetaFileBits
• 0x47d3e8 GetTextMetricsA
• 0x47d3f4 GetStockObject
• 0x47d3f8 GetPixel
• 0x47d3fc GetPaletteEntries
• 0x47d400 GetObjectA
• 0x47d40c GetEnhMetaFileBits
• 0x47d410 GetDeviceCaps
• 0x47d414 GetDIBits
• 0x47d418 GetDIBColorTable
• 0x47d41c GetDCOrgEx
• 0x47d424 GetClipBox
• 0x47d428 GetBrushOrgEx
• 0x47d42c GetBitmapBits
• 0x47d430 ExtCreatePen
• 0x47d434 ExcludeClipRect
• 0x47d438 DeleteObject
• 0x47d43c DeleteEnhMetaFile
• 0x47d440 DeleteDC
• 0x47d444 CreateSolidBrush
• 0x47d448 CreatePenIndirect
• 0x47d44c CreatePalette
• 0x47d454 CreateFontIndirectA
• 0x47d458 CreateDIBitmap
• 0x47d45c CreateDIBSection
• 0x47d460 CreateCompatibleDC
• 0x47d468 CreateBrushIndirect
• 0x47d46c CreateBitmap
• 0x47d470 CopyEnhMetaFileA
• 0x47d474 BitBlt
Library user32.dll:
• 0x47d47c CreateWindowExA
• 0x47d480 WindowFromPoint
• 0x47d484 WinHelpA
• 0x47d488 WaitMessage
• 0x47d48c ValidateRect
• 0x47d490 UpdateWindow
• 0x47d494 UnregisterClassA
• 0x47d498 UnionRect
• 0x47d49c UnhookWindowsHookEx
• 0x47d4a0 TranslateMessage
• 0x47d4a8 TrackPopupMenu
• 0x47d4b0 ShowWindow
• 0x47d4b4 ShowScrollBar
• 0x47d4b8 ShowOwnedPopups
• 0x47d4bc ShowCursor
• 0x47d4c0 SetWindowsHookExA
• 0x47d4c4 SetWindowTextA
• 0x47d4c8 SetWindowPos
• 0x47d4cc SetWindowPlacement
• 0x47d4d0 SetWindowLongA
• 0x47d4d4 SetTimer
• 0x47d4d8 SetScrollRange
• 0x47d4dc SetScrollPos
• 0x47d4e0 SetScrollInfo
• 0x47d4e4 SetRect
• 0x47d4e8 SetPropA
• 0x47d4ec SetParent
• 0x47d4f0 SetMenuItemInfoA
• 0x47d4f4 SetMenu
• 0x47d4f8 SetKeyboardState
• 0x47d4fc SetForegroundWindow
• 0x47d500 SetFocus
• 0x47d504 SetCursor
• 0x47d508 SetClipboardData
• 0x47d50c SetClassLongA
• 0x47d510 SetCapture
• 0x47d514 SetActiveWindow
• 0x47d518 SendMessageA
• 0x47d51c ScrollWindowEx
• 0x47d520 ScrollWindow
• 0x47d524 ScreenToClient
• 0x47d528 RemovePropA
• 0x47d52c RemoveMenu
• 0x47d530 ReleaseDC
• 0x47d534 ReleaseCapture
• 0x47d540 RegisterClassA
• 0x47d544 RedrawWindow
• 0x47d548 PtInRect
• 0x47d54c PostQuitMessage
• 0x47d550 PostMessageA
• 0x47d554 PeekMessageA
• 0x47d558 OpenClipboard
• 0x47d55c OffsetRect
• 0x47d560 OemToCharA
• 0x47d564 MessageBoxA
• 0x47d568 MessageBeep
• 0x47d56c MapWindowPoints
• 0x47d570 MapVirtualKeyA
• 0x47d574 LoadStringA
• 0x47d578 LoadKeyboardLayoutA
• 0x47d57c LoadIconA
• 0x47d580 LoadCursorA
• 0x47d584 LoadBitmapA
• 0x47d588 KillTimer
• 0x47d58c IsZoomed
• 0x47d590 IsWindowVisible
• 0x47d594 IsWindowEnabled
• 0x47d598 IsWindow
• 0x47d59c IsRectEmpty
• 0x47d5a0 IsIconic
• 0x47d5a4 IsDialogMessageA
• 0x47d5a8 IsChild
• 0x47d5ac IsCharAlphaNumericA
• 0x47d5b0 IsCharAlphaA
• 0x47d5b4 InvalidateRect
• 0x47d5b8 IntersectRect
• 0x47d5bc InsertMenuItemA
• 0x47d5c0 InsertMenuA
• 0x47d5c4 InflateRect
• 0x47d5cc GetWindowTextA
• 0x47d5d0 GetWindowRect
• 0x47d5d4 GetWindowPlacement
• 0x47d5d8 GetWindowLongA
• 0x47d5dc GetWindowDC
• 0x47d5e0 GetTopWindow
• 0x47d5e4 GetSystemMetrics
• 0x47d5e8 GetSystemMenu
• 0x47d5ec GetSysColorBrush
• 0x47d5f0 GetSysColor
• 0x47d5f4 GetSubMenu
• 0x47d5f8 GetScrollRange
• 0x47d5fc GetScrollPos
• 0x47d600 GetScrollInfo
• 0x47d604 GetPropA
• 0x47d608 GetParent
• 0x47d60c GetWindow
• 0x47d610 GetMessageTime
• 0x47d614 GetMenuStringA
• 0x47d618 GetMenuState
• 0x47d61c GetMenuItemInfoA
• 0x47d620 GetMenuItemID
• 0x47d624 GetMenuItemCount
• 0x47d628 GetMenu
• 0x47d62c GetLastActivePopup
• 0x47d630 GetKeyboardState
• 0x47d638 GetKeyboardLayout
• 0x47d63c GetKeyState
• 0x47d640 GetKeyNameTextA
• 0x47d644 GetInputState
• 0x47d648 GetIconInfo
• 0x47d64c GetForegroundWindow
• 0x47d650 GetFocus
• 0x47d654 GetDoubleClickTime
• 0x47d658 GetDlgItem
• 0x47d65c GetDesktopWindow
• 0x47d660 GetDCEx
• 0x47d664 GetDC
• 0x47d668 GetCursorPos
• 0x47d66c GetCursor
• 0x47d670 GetClipboardData
• 0x47d674 GetClientRect
• 0x47d678 GetClassNameA
• 0x47d67c GetClassInfoA
• 0x47d680 GetCaretPos
• 0x47d684 GetCapture
• 0x47d688 GetActiveWindow
• 0x47d68c FrameRect
• 0x47d690 FindWindowA
• 0x47d694 FillRect
• 0x47d698 EqualRect
• 0x47d69c EnumWindows
• 0x47d6a0 EnumThreadWindows
• 0x47d6a8 EndPaint
• 0x47d6ac EnableWindow
• 0x47d6b0 EnableScrollBar
• 0x47d6b4 EnableMenuItem
• 0x47d6b8 EmptyClipboard
• 0x47d6bc DrawTextA
• 0x47d6c0 DrawMenuBar
• 0x47d6c4 DrawIconEx
• 0x47d6c8 DrawIcon
• 0x47d6cc DrawFrameControl
• 0x47d6d0 DrawFocusRect
• 0x47d6d4 DrawEdge
• 0x47d6d8 DispatchMessageA
• 0x47d6dc DestroyWindow
• 0x47d6e0 DestroyMenu
• 0x47d6e4 DestroyIcon
• 0x47d6e8 DestroyCursor
• 0x47d6ec DeleteMenu
• 0x47d6f0 DefWindowProcA
• 0x47d6f4 DefMDIChildProcA
• 0x47d6f8 DefFrameProcA
• 0x47d6fc CreatePopupMenu
• 0x47d700 CreateMenu
• 0x47d704 CreateIcon
• 0x47d708 CloseClipboard
• 0x47d70c ClientToScreen
• 0x47d710 CheckMenuItem
• 0x47d714 CallWindowProcA
• 0x47d718 CallNextHookEx
• 0x47d71c BeginPaint
• 0x47d720 CharNextA
• 0x47d724 CharLowerBuffA
• 0x47d728 CharLowerA
• 0x47d72c CharUpperBuffA
• 0x47d730 CharToOemA
• 0x47d734 AdjustWindowRectEx
Library kernel32.dll:
• 0x47d740 Sleep
Library oleaut32.dll:
• 0x47d748 SafeArrayPtrOfIndex
• 0x47d74c SafeArrayGetUBound
• 0x47d750 SafeArrayGetLBound
• 0x47d754 SafeArrayCreate
• 0x47d758 VariantChangeType
• 0x47d75c VariantCopy
• 0x47d760 VariantClear
• 0x47d764 VariantInit
Library comctl32.dll:
• 0x47d774 ImageList_Write
• 0x47d778 ImageList_Read
• 0x47d788 ImageList_DragMove
• 0x47d78c ImageList_DragLeave
• 0x47d790 ImageList_DragEnter
• 0x47d794 ImageList_EndDrag
• 0x47d798 ImageList_BeginDrag
• 0x47d79c ImageList_Remove
• 0x47d7a0 ImageList_DrawEx
• 0x47d7a4 ImageList_Replace
• 0x47d7a8 ImageList_Draw
• 0x47d7b8 ImageList_Add
• 0x47d7c0 ImageList_Destroy
• 0x47d7c4 ImageList_Create
Library comdlg32.dll:
• 0x47d7cc GetSaveFileNameA
• 0x47d7d0 GetOpenFileNameA
Library kernel32.dll:
• 0x47d7d8 MulDiv

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 50537 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.