5.8
高危
61 个模型检测该样本为恶意！
重新分析
更多

6d415497a3d0845048c1ccafb82bf70283dd6976dbabb8f1cf639b9780571a40

250f32e7725c097217d28c48c4a92b61.exe

分析耗时

21s

最近分析

文件大小

501.5KB
静态报毒 动态报毒 100% AI SCORE=85 AIDETECTVM APFK AVSARHER BTOMTW CLOUD CONFIDENCE DELPHILESS EMHC FAREIT GENCIRC GENERICKD GIYVQ HIGH HIGH CONFIDENCE MALWARE@#GJXF2UD0J3A MALWAREB QVM05 SCORE SIGGEN2 STEAL SUSGEN SUSPICIOUS PE TQUQ TROJAN3 UNSAFE USXVPF420 WACATAC X2066 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FTB!250F32E7725C 20200616 6.0.6.653
Alibaba TrojanSpy:Win32/Obfuscator.f35cafad 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20200616 18.4.3895.0
Tencent Malware.Win32.Gencirc.118a20d7 20200616 1.0.0.1
Kingsoft 20200616 2013.8.14.323
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619269226.663474
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 48102964
registers.edi: 0
registers.eax: 0
registers.ebp: 48103304
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 b3 6f 00 00 e9
exception.symbol: 250f32e7725c097217d28c48c4a92b61+0x58f94
exception.instruction: div eax
exception.module: 250f32e7725c097217d28c48c4a92b61.exe
exception.exception_code: 0xc0000094
exception.offset: 364436
exception.address: 0x458f94
success 0 0
1619287371.82
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
250f32e7725c097217d28c48c4a92b61+0x243f8 @ 0x4243f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75134b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75135d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff3a14ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (28 个事件)
Time & API Arguments Status Return Repeated
1619269226.460474
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00790000
success 0 0
1619269226.663474
NtProtectVirtualMemory
process_identifier: 2772
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 32768
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00458000
success 0 0
1619269226.663474
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02df0000
success 0 0
1619287371.445
NtProtectVirtualMemory
process_identifier: 2520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619287371.492
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 589824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00450000
success 0 0
1619287371.492
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x004a0000
success 0 0
1619287371.492
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 114688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00450000
success 0 0
1619287371.492
NtProtectVirtualMemory
process_identifier: 2520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 69632
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00452000
success 0 0
1619287371.805
NtProtectVirtualMemory
process_identifier: 2520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e42000
success 0 0
1619287371.805
NtProtectVirtualMemory
process_identifier: 2520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619287371.805
NtProtectVirtualMemory
process_identifier: 2520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e42000
success 0 0
1619287371.805
NtProtectVirtualMemory
process_identifier: 2520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619287371.805
NtProtectVirtualMemory
process_identifier: 2520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e42000
success 0 0
1619287371.805
NtProtectVirtualMemory
process_identifier: 2520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619287371.805
NtProtectVirtualMemory
process_identifier: 2520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e42000
success 0 0
1619287371.805
NtProtectVirtualMemory
process_identifier: 2520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619287371.805
NtProtectVirtualMemory
process_identifier: 2520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e42000
success 0 0
1619287371.805
NtProtectVirtualMemory
process_identifier: 2520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619287371.805
NtProtectVirtualMemory
process_identifier: 2520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e42000
success 0 0
1619287371.805
NtProtectVirtualMemory
process_identifier: 2520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619287371.805
NtProtectVirtualMemory
process_identifier: 2520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e42000
success 0 0
1619287371.805
NtProtectVirtualMemory
process_identifier: 2520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619287371.805
NtProtectVirtualMemory
process_identifier: 2520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e42000
success 0 0
1619287371.805
NtProtectVirtualMemory
process_identifier: 2520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619287371.805
NtProtectVirtualMemory
process_identifier: 2520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e42000
success 0 0
1619287371.805
NtProtectVirtualMemory
process_identifier: 2520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619287371.805
NtProtectVirtualMemory
process_identifier: 2520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e42000
success 0 0
1619287371.805
NtProtectVirtualMemory
process_identifier: 2520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (1 个事件)
entropy 7.230029665712788 section {'size_of_data': '0x00014000', 'virtual_address': '0x00070000', 'entropy': 7.230029665712788, 'name': '.rsrc', 'virtual_size': '0x00013f68'} description A section with a high entropy has been found
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2772 called NtSetContextThread to modify thread in remote process 2520
Time & API Arguments Status Return Repeated
1619269226.991474
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4467664
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2520
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2772 resumed a thread in remote process 2520
Time & API Arguments Status Return Repeated
1619269228.147474
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2520
success 0 0
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619269226.819474
CreateProcessInternalW
thread_identifier: 2560
thread_handle: 0x000000fc
process_identifier: 2520
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\250f32e7725c097217d28c48c4a92b61.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619269226.819474
NtUnmapViewOfSection
process_identifier: 2520
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619269226.835474
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 2520
commit_size: 282624
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 282624
base_address: 0x00400000
success 0 0
1619269226.991474
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1619269226.991474
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4467664
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2520
success 0 0
1619269228.147474
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2520
success 0 0
File has been identified by 61 AntiVirus engines on VirusTotal as malicious (50 out of 61 个事件)
Bkav W32.AIDetectVM.malwareB
MicroWorld-eScan Trojan.GenericKD.43283491
FireEye Generic.mg.250f32e7725c0972
CAT-QuickHeal Trojan.Multi
McAfee Fareit-FTB!250F32E7725C
Malwarebytes Trojan.MalPack.DLF
Zillya Trojan.Stealer.Win32.7594
K7AntiVirus Trojan ( 005680341 )
Alibaba TrojanSpy:Win32/Obfuscator.f35cafad
K7GW Trojan ( 005680341 )
Cybereason malicious.8ac815
Arcabit Trojan.Generic.D2947423
Invincea heuristic
BitDefenderTheta AI:Packer.50081C2221
F-Prot W32/Trojan3.APFK
Symantec Trojan.Gen.2
ESET-NOD32 a variant of Win32/Injector.EMHC
TrendMicro-HouseCall Trojan.Win32.WACATAC.USXVPF420
Paloalto generic.ml
ClamAV Win.Trojan.Generic-8000835-0
GData Trojan.GenericKD.43283491
Kaspersky HEUR:Trojan-Spy.Win32.Stealer.gen
BitDefender Trojan.GenericKD.43283491
Avast Win32:Trojan-gen
Tencent Malware.Win32.Gencirc.118a20d7
Ad-Aware Trojan.GenericKD.43283491
Sophos Troj/Steal-VC
Comodo Malware@#gjxf2ud0j3a
F-Secure Trojan.TR/Injector.giyvq
DrWeb Trojan.PWS.Siggen2.45348
VIPRE Trojan.Win32.Generic!BT
TrendMicro Trojan.Win32.WACATAC.USXVPF420
McAfee-GW-Edition BehavesLike.Win32.Fareit.hh
SentinelOne DFI - Suspicious PE
Trapmine malicious.high.ml.score
Emsisoft Trojan.GenericKD.43283491 (B)
APEX Malicious
Cyren W32/Trojan.TQUQ-2832
eGambit Unsafe.AI_Score_99%
Avira TR/Injector.giyvq
Antiy-AVL Trojan[Spy]/Win32.Stealer
Microsoft Trojan:Win32/Obfuscator.KI!MTB
Endgame malicious (high confidence)
AegisLab Trojan.Multi.Generic.4!c
ZoneAlarm HEUR:Trojan-Spy.Win32.Stealer.gen
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2066
ALYac Trojan.GenericKD.43283491
MAX malware (ai score=85)
VBA32 Trojan.Wacatac
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x46413c VirtualFree
• 0x464140 VirtualAlloc
• 0x464144 LocalFree
• 0x464148 LocalAlloc
• 0x46414c GetVersion
• 0x464150 GetCurrentThreadId
• 0x46415c VirtualQuery
• 0x464160 WideCharToMultiByte
• 0x464164 MultiByteToWideChar
• 0x464168 lstrlenA
• 0x46416c lstrcpynA
• 0x464170 LoadLibraryExA
• 0x464174 GetThreadLocale
• 0x464178 GetStartupInfoA
• 0x46417c GetProcAddress
• 0x464180 GetModuleHandleA
• 0x464184 GetModuleFileNameA
• 0x464188 GetLocaleInfoA
• 0x46418c GetCommandLineA
• 0x464190 FreeLibrary
• 0x464194 FindFirstFileA
• 0x464198 FindClose
• 0x46419c ExitProcess
• 0x4641a0 WriteFile
• 0x4641a8 RtlUnwind
• 0x4641ac RaiseException
• 0x4641b0 GetStdHandle
Library user32.dll:
• 0x4641b8 GetKeyboardType
• 0x4641bc LoadStringA
• 0x4641c0 MessageBoxA
• 0x4641c4 CharNextA
Library advapi32.dll:
• 0x4641cc RegQueryValueExA
• 0x4641d0 RegOpenKeyExA
• 0x4641d4 RegCloseKey
Library oleaut32.dll:
• 0x4641dc SysFreeString
• 0x4641e0 SysReAllocStringLen
• 0x4641e4 SysAllocStringLen
Library kernel32.dll:
• 0x4641ec TlsSetValue
• 0x4641f0 TlsGetValue
• 0x4641f4 LocalAlloc
• 0x4641f8 GetModuleHandleA
Library advapi32.dll:
• 0x464200 RegQueryValueExA
• 0x464204 RegOpenKeyExA
• 0x464208 RegCloseKey
Library kernel32.dll:
• 0x464210 lstrcpyA
• 0x464214 WriteFile
• 0x46421c WaitForSingleObject
• 0x464220 VirtualQuery
• 0x464224 VirtualAlloc
• 0x464228 Sleep
• 0x46422c SizeofResource
• 0x464230 SetThreadLocale
• 0x464234 SetFilePointer
• 0x464238 SetEvent
• 0x46423c SetErrorMode
• 0x464240 SetEndOfFile
• 0x464244 ResetEvent
• 0x464248 ReadFile
• 0x46424c MulDiv
• 0x464250 LockResource
• 0x464254 LoadResource
• 0x464258 LoadLibraryA
• 0x464264 GlobalUnlock
• 0x464268 GlobalReAlloc
• 0x46426c GlobalHandle
• 0x464270 GlobalLock
• 0x464274 GlobalFree
• 0x464278 GlobalFindAtomA
• 0x46427c GlobalDeleteAtom
• 0x464280 GlobalAlloc
• 0x464284 GlobalAddAtomA
• 0x464288 GetVersionExA
• 0x46428c GetVersion
• 0x464290 GetTickCount
• 0x464294 GetThreadLocale
• 0x46429c GetSystemTime
• 0x4642a0 GetSystemInfo
• 0x4642a4 GetStringTypeExA
• 0x4642a8 GetStdHandle
• 0x4642ac GetProcAddress
• 0x4642b0 GetModuleHandleA
• 0x4642b4 GetModuleFileNameA
• 0x4642b8 GetLocaleInfoA
• 0x4642bc GetLocalTime
• 0x4642c0 GetLastError
• 0x4642c4 GetFullPathNameA
• 0x4642c8 GetFileAttributesA
• 0x4642cc GetDiskFreeSpaceA
• 0x4642d0 GetDateFormatA
• 0x4642d4 GetCurrentThreadId
• 0x4642d8 GetCurrentProcessId
• 0x4642dc GetCPInfo
• 0x4642e0 GetACP
• 0x4642e4 FreeResource
• 0x4642e8 InterlockedExchange
• 0x4642ec FreeLibrary
• 0x4642f0 FormatMessageA
• 0x4642f4 FindResourceA
• 0x4642f8 FindFirstFileA
• 0x4642fc FindClose
• 0x464308 ExitThread
• 0x46430c EnumCalendarInfoA
• 0x464318 CreateThread
• 0x46431c CreateFileA
• 0x464320 CreateEventA
• 0x464324 CompareStringA
• 0x464328 CloseHandle
Library version.dll:
• 0x464330 VerQueryValueA
• 0x464338 GetFileVersionInfoA
Library gdi32.dll:
• 0x464340 UnrealizeObject
• 0x464344 StretchBlt
• 0x464348 SetWindowOrgEx
• 0x46434c SetWinMetaFileBits
• 0x464350 SetViewportOrgEx
• 0x464354 SetTextColor
• 0x464358 SetStretchBltMode
• 0x46435c SetROP2
• 0x464360 SetPixel
• 0x464364 SetEnhMetaFileBits
• 0x464368 SetDIBColorTable
• 0x46436c SetBrushOrgEx
• 0x464370 SetBkMode
• 0x464374 SetBkColor
• 0x464378 SelectPalette
• 0x46437c SelectObject
• 0x464380 SaveDC
• 0x464384 RestoreDC
• 0x464388 Rectangle
• 0x46438c RectVisible
• 0x464390 RealizePalette
• 0x464394 Polyline
• 0x464398 PlayEnhMetaFile
• 0x46439c PatBlt
• 0x4643a0 MoveToEx
• 0x4643a4 MaskBlt
• 0x4643a8 LineTo
• 0x4643ac IntersectClipRect
• 0x4643b0 GetWindowOrgEx
• 0x4643b4 GetWinMetaFileBits
• 0x4643b8 GetTextMetricsA
• 0x4643c4 GetStockObject
• 0x4643c8 GetPixel
• 0x4643cc GetPaletteEntries
• 0x4643d0 GetObjectA
• 0x4643dc GetEnhMetaFileBits
• 0x4643e0 GetDeviceCaps
• 0x4643e4 GetDIBits
• 0x4643e8 GetDIBColorTable
• 0x4643ec GetDCOrgEx
• 0x4643f4 GetClipBox
• 0x4643f8 GetBrushOrgEx
• 0x4643fc GetBitmapBits
• 0x464400 ExcludeClipRect
• 0x464404 DeleteObject
• 0x464408 DeleteEnhMetaFile
• 0x46440c DeleteDC
• 0x464410 CreateSolidBrush
• 0x464414 CreatePenIndirect
• 0x464418 CreatePalette
• 0x464420 CreateFontIndirectA
• 0x464424 CreateDIBitmap
• 0x464428 CreateDIBSection
• 0x46442c CreateCompatibleDC
• 0x464434 CreateBrushIndirect
• 0x464438 CreateBitmap
• 0x46443c CopyEnhMetaFileA
• 0x464440 BitBlt
Library user32.dll:
• 0x464448 CreateWindowExA
• 0x46444c WindowFromPoint
• 0x464450 WinHelpA
• 0x464454 WaitMessage
• 0x464458 UpdateWindow
• 0x46445c UnregisterClassA
• 0x464460 UnhookWindowsHookEx
• 0x464464 TranslateMessage
• 0x46446c TrackPopupMenu
• 0x464474 ShowWindow
• 0x464478 ShowScrollBar
• 0x46447c ShowOwnedPopups
• 0x464480 ShowCursor
• 0x464484 SetWindowsHookExA
• 0x464488 SetWindowPos
• 0x46448c SetWindowPlacement
• 0x464490 SetWindowLongA
• 0x464494 SetTimer
• 0x464498 SetScrollRange
• 0x46449c SetScrollPos
• 0x4644a0 SetScrollInfo
• 0x4644a4 SetRect
• 0x4644a8 SetPropA
• 0x4644ac SetParent
• 0x4644b0 SetMenuItemInfoA
• 0x4644b4 SetMenu
• 0x4644b8 SetForegroundWindow
• 0x4644bc SetFocus
• 0x4644c0 SetCursor
• 0x4644c4 SetClassLongA
• 0x4644c8 SetCapture
• 0x4644cc SetActiveWindow
• 0x4644d0 SendMessageA
• 0x4644d4 ScrollWindow
• 0x4644d8 ScreenToClient
• 0x4644dc RemovePropA
• 0x4644e0 RemoveMenu
• 0x4644e4 ReleaseDC
• 0x4644e8 ReleaseCapture
• 0x4644f4 RegisterClassA
• 0x4644f8 RedrawWindow
• 0x4644fc PtInRect
• 0x464500 PostQuitMessage
• 0x464504 PostMessageA
• 0x464508 PeekMessageA
• 0x46450c OffsetRect
• 0x464510 OemToCharA
• 0x464514 MessageBoxA
• 0x464518 MapWindowPoints
• 0x46451c MapVirtualKeyA
• 0x464520 LoadStringA
• 0x464524 LoadKeyboardLayoutA
• 0x464528 LoadIconA
• 0x46452c LoadCursorA
• 0x464530 LoadBitmapA
• 0x464534 KillTimer
• 0x464538 IsZoomed
• 0x46453c IsWindowVisible
• 0x464540 IsWindowEnabled
• 0x464544 IsWindow
• 0x464548 IsRectEmpty
• 0x46454c IsIconic
• 0x464550 IsDialogMessageA
• 0x464554 IsChild
• 0x464558 InvalidateRect
• 0x46455c IntersectRect
• 0x464560 InsertMenuItemA
• 0x464564 InsertMenuA
• 0x464568 InflateRect
• 0x464570 GetWindowTextA
• 0x464574 GetWindowRect
• 0x464578 GetWindowPlacement
• 0x46457c GetWindowLongA
• 0x464580 GetWindowDC
• 0x464584 GetTopWindow
• 0x464588 GetSystemMetrics
• 0x46458c GetSystemMenu
• 0x464590 GetSysColorBrush
• 0x464594 GetSysColor
• 0x464598 GetSubMenu
• 0x46459c GetScrollRange
• 0x4645a0 GetScrollPos
• 0x4645a4 GetScrollInfo
• 0x4645a8 GetPropA
• 0x4645ac GetParent
• 0x4645b0 GetWindow
• 0x4645b4 GetMenuStringA
• 0x4645b8 GetMenuState
• 0x4645bc GetMenuItemInfoA
• 0x4645c0 GetMenuItemID
• 0x4645c4 GetMenuItemCount
• 0x4645c8 GetMenu
• 0x4645cc GetLastActivePopup
• 0x4645d0 GetKeyboardState
• 0x4645d8 GetKeyboardLayout
• 0x4645dc GetKeyState
• 0x4645e0 GetKeyNameTextA
• 0x4645e4 GetIconInfo
• 0x4645e8 GetForegroundWindow
• 0x4645ec GetFocus
• 0x4645f0 GetDlgItem
• 0x4645f4 GetDesktopWindow
• 0x4645f8 GetDCEx
• 0x4645fc GetDC
• 0x464600 GetCursorPos
• 0x464604 GetCursor
• 0x464608 GetClipboardData
• 0x46460c GetClientRect
• 0x464610 GetClassNameA
• 0x464614 GetClassInfoA
• 0x464618 GetCapture
• 0x46461c GetActiveWindow
• 0x464620 FrameRect
• 0x464624 FindWindowA
• 0x464628 FillRect
• 0x46462c EqualRect
• 0x464630 EnumWindows
• 0x464634 EnumThreadWindows
• 0x464638 EndPaint
• 0x46463c EnableWindow
• 0x464640 EnableScrollBar
• 0x464644 EnableMenuItem
• 0x464648 DrawTextA
• 0x46464c DrawMenuBar
• 0x464650 DrawIconEx
• 0x464654 DrawIcon
• 0x464658 DrawFrameControl
• 0x46465c DrawEdge
• 0x464660 DispatchMessageA
• 0x464664 DestroyWindow
• 0x464668 DestroyMenu
• 0x46466c DestroyIcon
• 0x464670 DestroyCursor
• 0x464674 DeleteMenu
• 0x464678 DefWindowProcA
• 0x46467c DefMDIChildProcA
• 0x464680 DefFrameProcA
• 0x464684 CreatePopupMenu
• 0x464688 CreateMenu
• 0x46468c CreateIcon
• 0x464690 ClientToScreen
• 0x464694 CheckMenuItem
• 0x464698 CallWindowProcA
• 0x46469c CallNextHookEx
• 0x4646a0 BeginPaint
• 0x4646a4 CharNextA
• 0x4646a8 CharLowerBuffA
• 0x4646ac CharLowerA
• 0x4646b0 CharToOemA
• 0x4646b4 AdjustWindowRectEx
Library kernel32.dll:
• 0x4646c0 Sleep
Library oleaut32.dll:
• 0x4646c8 SafeArrayPtrOfIndex
• 0x4646cc SafeArrayGetUBound
• 0x4646d0 SafeArrayGetLBound
• 0x4646d4 SafeArrayCreate
• 0x4646d8 VariantChangeType
• 0x4646dc VariantCopy
• 0x4646e0 VariantClear
• 0x4646e4 VariantInit
Library comctl32.dll:
• 0x4646f4 ImageList_Write
• 0x4646f8 ImageList_Read
• 0x464708 ImageList_DragMove
• 0x46470c ImageList_DragLeave
• 0x464710 ImageList_DragEnter
• 0x464714 ImageList_EndDrag
• 0x464718 ImageList_BeginDrag
• 0x46471c ImageList_Remove
• 0x464720 ImageList_DrawEx
• 0x464724 ImageList_Replace
• 0x464728 ImageList_Draw
• 0x464738 ImageList_Add
• 0x464740 ImageList_Destroy
• 0x464744 ImageList_Create
• 0x464748 InitCommonControls
Library comdlg32.dll:
• 0x464750 GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.