6.8
高危
58 个模型检测该样本为恶意！
重新分析
更多

67893eac6924879773f892dfaf39bbabcea8d3f012e47731dbde637328224139

280a07ae91a314b562ae5ccdc4f21973.exe

分析耗时

45s

最近分析

文件大小

727.0KB
静态报毒 动态报毒 100% AGEN AGENTTESLA AI SCORE=83 ALI2000015 CLASSIC CONFIDENCE DELF DELFINJECT DELPHILESS ELDORADO ELKP ELOL FAREIT FORMBOOK GDSDA HIGH CONFIDENCE HOYK KRYPTIK MALWARE@#VZ9CV16L6KNB R + MAL R06EC0DI220 SCORE SIGGEN2 SMDD STATIC AI SUSGEN SUSPICIOUS PE TSCOPE UNSAFE X2059 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FSK!280A07AE91A3 20201229 6.0.6.653
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20201229 21.1.5827.0
Tencent Win32.Trojan.Kryptik.Hoyk 20201229 1.0.0.1
Kingsoft 20201229 2017.9.26.565
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619360730.493751
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49086272
registers.edi: 0
registers.eax: 0
registers.ebp: 49086344
registers.edx: 33548472
registers.ebx: 0
registers.esi: 0
registers.ecx: 3945529344
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5a e9 c3 4a fa
exception.symbol: 280a07ae91a314b562ae5ccdc4f21973+0x5eae4
exception.instruction: div eax
exception.module: 280a07ae91a314b562ae5ccdc4f21973.exe
exception.exception_code: 0xc0000094
exception.offset: 387812
exception.address: 0x45eae4
success 0 0
1619360734.071124
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x739ae97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x739aea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x739ab25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x739ab4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x739aac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x739aaed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x739a5511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x739a559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74067f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74064de3
280a07ae91a314b562ae5ccdc4f21973+0x58a4d @ 0x458a4d
280a07ae91a314b562ae5ccdc4f21973+0x51254 @ 0x451254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfcd814ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619360730.024751
NtAllocateVirtualMemory
process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00610000
success 0 0
1619360730.493751
NtAllocateVirtualMemory
process_identifier: 1632
region_size: 49152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02010000
success 0 0
1619360730.493751
NtAllocateVirtualMemory
process_identifier: 1632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02ed0000
success 0 0
1619360731.055124
NtProtectVirtualMemory
process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619360731.071124
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 917504
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01f40000
success 0 0
1619360731.071124
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01fe0000
success 0 0
1619360731.071124
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00500000
success 0 0
1619360731.071124
NtProtectVirtualMemory
process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 299008
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00502000
success 0 0
1619360731.540124
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 458752
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x006e0000
success 0 0
1619360731.540124
NtAllocateVirtualMemory
process_identifier: 3004
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00710000
success 0 0
1619360734.040124
NtProtectVirtualMemory
process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619360734.040124
NtProtectVirtualMemory
process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619360734.040124
NtProtectVirtualMemory
process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619360734.040124
NtProtectVirtualMemory
process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619360734.040124
NtProtectVirtualMemory
process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619360734.040124
NtProtectVirtualMemory
process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619360734.040124
NtProtectVirtualMemory
process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619360734.040124
NtProtectVirtualMemory
process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619360734.040124
NtProtectVirtualMemory
process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619360734.040124
NtProtectVirtualMemory
process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619360734.040124
NtProtectVirtualMemory
process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619360734.040124
NtProtectVirtualMemory
process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619360734.040124
NtProtectVirtualMemory
process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619360734.040124
NtProtectVirtualMemory
process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619360734.040124
NtProtectVirtualMemory
process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619360734.040124
NtProtectVirtualMemory
process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619360734.040124
NtProtectVirtualMemory
process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619360734.040124
NtProtectVirtualMemory
process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619360734.040124
NtProtectVirtualMemory
process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619360734.040124
NtProtectVirtualMemory
process_identifier: 3004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (3 个事件)
entropy 7.549693793680028 section {'size_of_data': '0x0000cc00', 'virtual_address': '0x0005f000', 'entropy': 7.549693793680028, 'name': 'DATA', 'virtual_size': '0x0000ca2c'} description A section with a high entropy has been found
entropy 7.397321195579272 section {'size_of_data': '0x00041200', 'virtual_address': '0x0007b000', 'entropy': 7.397321195579272, 'name': '.rsrc', 'virtual_size': '0x00041084'} description A section with a high entropy has been found
entropy 0.4290633608815427 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 1632 called NtSetContextThread to modify thread in remote process 3004
Time & API Arguments Status Return Repeated
1619360730.790751
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4893504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3004
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 1632 resumed a thread in remote process 3004
Time & API Arguments Status Return Repeated
1619360730.899751
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3004
success 0 0
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 216.58.200.238:443
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619360730.774751
CreateProcessInternalW
thread_identifier: 1060
thread_handle: 0x00000108
process_identifier: 3004
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\280a07ae91a314b562ae5ccdc4f21973.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x0000010c
inherit_handles: 0
success 1 0
1619360730.774751
NtUnmapViewOfSection
process_identifier: 3004
region_size: 4096
process_handle: 0x0000010c
base_address: 0x00400000
success 0 0
1619360730.774751
NtMapViewOfSection
section_handle: 0x00000114
process_identifier: 3004
commit_size: 704512
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x0000010c
allocation_type: 0 ()
section_offset: 0
view_size: 704512
base_address: 0x00400000
success 0 0
1619360730.790751
NtGetContextThread
thread_handle: 0x00000108
success 0 0
1619360730.790751
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4893504
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3004
success 0 0
1619360730.899751
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 3004
success 0 0
File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Delf.FareIt.Gen.13
FireEye Generic.mg.280a07ae91a314b5
CAT-QuickHeal Trojan.Kryptik
McAfee Fareit-FSK!280A07AE91A3
Cylance Unsafe
Sangfor Malware
K7AntiVirus Trojan ( 005651801 )
Alibaba Trojan:Win32/DelfInject.ali2000015
K7GW Trojan ( 005651801 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Delf.FareIt.Gen.13
Cyren W32/Agent.BSS.gen!Eldorado
Symantec Trojan.Gen.2
APEX Malicious
Avast Win32:Trojan-gen
ClamAV Win.Dropper.Smdd-6956905-0
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
BitDefender Trojan.Delf.FareIt.Gen.13
Paloalto generic.ml
Tencent Win32.Trojan.Kryptik.Hoyk
Ad-Aware Trojan.Delf.FareIt.Gen.13
Emsisoft Trojan.Delf.FareIt.Gen.13 (B)
Comodo Malware@#vz9cv16l6knb
F-Secure Heuristic.HEUR/AGEN.1137417
DrWeb Trojan.PWS.Siggen2.47778
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R06EC0DI220
McAfee-GW-Edition BehavesLike.Win32.Fareit.bc
Sophos Mal/Generic-R + Mal/Fareit-AA
Ikarus Trojan.Inject
Jiangmin Trojan.Kryptik.aow
Avira HEUR/AGEN.1137417
Antiy-AVL Trojan/Win32.Kryptik
Gridinsoft Trojan.Win32.Kryptik.ba!s1
Microsoft Trojan:Win32/FormBook.BX!MTB
AegisLab Trojan.Win32.Kryptik.4!c
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
GData Trojan.Delf.FareIt.Gen.13
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2059
Acronis suspicious
BitDefenderTheta AI:Packer.12BD86BD21
ALYac Spyware.AgentTesla
MAX malware (ai score=83)
VBA32 TScope.Trojan.Delf
Malwarebytes Trojan.MalPack.DLF
ESET-NOD32 a variant of Win32/Injector.ELOL
TrendMicro-HouseCall TROJ_GEN.R06EC0DI220
Rising Trojan.Injector!1.C561 (CLASSIC)
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x46e13c VirtualFree
• 0x46e140 VirtualAlloc
• 0x46e144 LocalFree
• 0x46e148 LocalAlloc
• 0x46e14c GetVersion
• 0x46e150 GetCurrentThreadId
• 0x46e15c VirtualQuery
• 0x46e160 WideCharToMultiByte
• 0x46e164 MultiByteToWideChar
• 0x46e168 lstrlenA
• 0x46e16c lstrcpynA
• 0x46e170 LoadLibraryExA
• 0x46e174 GetThreadLocale
• 0x46e178 GetStartupInfoA
• 0x46e17c GetProcAddress
• 0x46e180 GetModuleHandleA
• 0x46e184 GetModuleFileNameA
• 0x46e188 GetLocaleInfoA
• 0x46e18c GetCommandLineA
• 0x46e190 FreeLibrary
• 0x46e194 FindFirstFileA
• 0x46e198 FindClose
• 0x46e19c ExitProcess
• 0x46e1a0 WriteFile
• 0x46e1a8 RtlUnwind
• 0x46e1ac RaiseException
• 0x46e1b0 GetStdHandle
Library user32.dll:
• 0x46e1b8 GetKeyboardType
• 0x46e1bc LoadStringA
• 0x46e1c0 MessageBoxA
• 0x46e1c4 CharNextA
Library advapi32.dll:
• 0x46e1cc RegQueryValueExA
• 0x46e1d0 RegOpenKeyExA
• 0x46e1d4 RegCloseKey
Library oleaut32.dll:
• 0x46e1dc SysFreeString
• 0x46e1e0 SysReAllocStringLen
• 0x46e1e4 SysAllocStringLen
Library kernel32.dll:
• 0x46e1ec TlsSetValue
• 0x46e1f0 TlsGetValue
• 0x46e1f4 LocalAlloc
• 0x46e1f8 GetModuleHandleA
Library advapi32.dll:
• 0x46e200 RegQueryValueExA
• 0x46e204 RegOpenKeyExA
• 0x46e208 RegCloseKey
Library kernel32.dll:
• 0x46e210 lstrcpyA
• 0x46e214 WriteFile
• 0x46e21c WaitForSingleObject
• 0x46e220 VirtualQuery
• 0x46e224 VirtualAlloc
• 0x46e228 Sleep
• 0x46e22c SizeofResource
• 0x46e230 SetThreadLocale
• 0x46e234 SetFilePointer
• 0x46e238 SetEvent
• 0x46e23c SetErrorMode
• 0x46e240 SetEndOfFile
• 0x46e244 ResetEvent
• 0x46e248 ReadFile
• 0x46e24c MulDiv
• 0x46e250 LockResource
• 0x46e254 LoadResource
• 0x46e258 LoadLibraryA
• 0x46e264 GlobalUnlock
• 0x46e268 GlobalReAlloc
• 0x46e26c GlobalHandle
• 0x46e270 GlobalLock
• 0x46e274 GlobalFree
• 0x46e278 GlobalFindAtomA
• 0x46e27c GlobalDeleteAtom
• 0x46e280 GlobalAlloc
• 0x46e284 GlobalAddAtomA
• 0x46e288 GetVersionExA
• 0x46e28c GetVersion
• 0x46e290 GetTickCount
• 0x46e294 GetThreadLocale
• 0x46e298 GetTempPathA
• 0x46e2a0 GetSystemTime
• 0x46e2a4 GetSystemInfo
• 0x46e2a8 GetStringTypeExA
• 0x46e2ac GetStdHandle
• 0x46e2b0 GetProcAddress
• 0x46e2b4 GetModuleHandleA
• 0x46e2b8 GetModuleFileNameA
• 0x46e2bc GetLocaleInfoA
• 0x46e2c0 GetLocalTime
• 0x46e2c4 GetLastError
• 0x46e2c8 GetFullPathNameA
• 0x46e2cc GetFileSize
• 0x46e2d0 GetDiskFreeSpaceA
• 0x46e2d4 GetDateFormatA
• 0x46e2d8 GetCurrentThreadId
• 0x46e2dc GetCurrentProcessId
• 0x46e2e0 GetCPInfo
• 0x46e2e4 GetACP
• 0x46e2e8 FreeResource
• 0x46e2ec InterlockedExchange
• 0x46e2f0 FreeLibrary
• 0x46e2f4 FormatMessageA
• 0x46e2f8 FindResourceA
• 0x46e300 ExitThread
• 0x46e304 EnumCalendarInfoA
• 0x46e30c DeleteFileA
• 0x46e314 CreateThread
• 0x46e318 CreateFileA
• 0x46e31c CreateEventA
• 0x46e320 CompareStringA
• 0x46e324 CloseHandle
Library version.dll:
• 0x46e32c VerQueryValueA
• 0x46e334 GetFileVersionInfoA
Library gdi32.dll:
• 0x46e33c UnrealizeObject
• 0x46e340 StretchBlt
• 0x46e344 SetWindowOrgEx
• 0x46e348 SetViewportOrgEx
• 0x46e34c SetTextColor
• 0x46e350 SetStretchBltMode
• 0x46e354 SetROP2
• 0x46e358 SetPixel
• 0x46e35c SetDIBColorTable
• 0x46e360 SetBrushOrgEx
• 0x46e364 SetBkMode
• 0x46e368 SetBkColor
• 0x46e36c SelectPalette
• 0x46e370 SelectObject
• 0x46e374 SaveDC
• 0x46e378 RestoreDC
• 0x46e37c RectVisible
• 0x46e380 RealizePalette
• 0x46e384 PatBlt
• 0x46e388 MoveToEx
• 0x46e38c MaskBlt
• 0x46e390 LineTo
• 0x46e394 IntersectClipRect
• 0x46e398 GetWindowOrgEx
• 0x46e39c GetTextMetricsA
• 0x46e3a8 GetStockObject
• 0x46e3ac GetPixel
• 0x46e3b0 GetPaletteEntries
• 0x46e3b4 GetObjectA
• 0x46e3b8 GetDeviceCaps
• 0x46e3bc GetDIBits
• 0x46e3c0 GetDIBColorTable
• 0x46e3c4 GetDCOrgEx
• 0x46e3cc GetClipBox
• 0x46e3d0 GetBrushOrgEx
• 0x46e3d4 GetBitmapBits
• 0x46e3d8 ExcludeClipRect
• 0x46e3dc DeleteObject
• 0x46e3e0 DeleteDC
• 0x46e3e4 CreateSolidBrush
• 0x46e3e8 CreatePenIndirect
• 0x46e3ec CreatePalette
• 0x46e3f4 CreateFontIndirectA
• 0x46e3f8 CreateDIBitmap
• 0x46e3fc CreateDIBSection
• 0x46e400 CreateCompatibleDC
• 0x46e408 CreateBrushIndirect
• 0x46e40c CreateBitmap
• 0x46e410 BitBlt
Library user32.dll:
• 0x46e418 CreateWindowExA
• 0x46e41c WindowFromPoint
• 0x46e420 WinHelpA
• 0x46e424 WaitMessage
• 0x46e428 UpdateWindow
• 0x46e42c UnregisterClassA
• 0x46e430 UnhookWindowsHookEx
• 0x46e434 TranslateMessage
• 0x46e43c TrackPopupMenu
• 0x46e444 ShowWindow
• 0x46e448 ShowScrollBar
• 0x46e44c ShowOwnedPopups
• 0x46e450 ShowCursor
• 0x46e454 SetWindowsHookExA
• 0x46e458 SetWindowPos
• 0x46e45c SetWindowPlacement
• 0x46e460 SetWindowLongA
• 0x46e464 SetTimer
• 0x46e468 SetScrollRange
• 0x46e46c SetScrollPos
• 0x46e470 SetScrollInfo
• 0x46e474 SetRect
• 0x46e478 SetPropA
• 0x46e47c SetParent
• 0x46e480 SetMenuItemInfoA
• 0x46e484 SetMenu
• 0x46e488 SetForegroundWindow
• 0x46e48c SetFocus
• 0x46e490 SetCursor
• 0x46e494 SetClassLongA
• 0x46e498 SetCapture
• 0x46e49c SetActiveWindow
• 0x46e4a0 SendMessageA
• 0x46e4a4 ScrollWindow
• 0x46e4a8 ScreenToClient
• 0x46e4ac RemovePropA
• 0x46e4b0 RemoveMenu
• 0x46e4b4 ReleaseDC
• 0x46e4b8 ReleaseCapture
• 0x46e4c4 RegisterClassA
• 0x46e4c8 RedrawWindow
• 0x46e4cc PtInRect
• 0x46e4d0 PostQuitMessage
• 0x46e4d4 PostMessageA
• 0x46e4d8 PeekMessageA
• 0x46e4dc OffsetRect
• 0x46e4e0 OemToCharA
• 0x46e4e4 MessageBoxA
• 0x46e4e8 MapWindowPoints
• 0x46e4ec MapVirtualKeyA
• 0x46e4f0 LoadStringA
• 0x46e4f4 LoadKeyboardLayoutA
• 0x46e4f8 LoadIconA
• 0x46e4fc LoadCursorA
• 0x46e500 LoadBitmapA
• 0x46e504 KillTimer
• 0x46e508 IsZoomed
• 0x46e50c IsWindowVisible
• 0x46e510 IsWindowEnabled
• 0x46e514 IsWindow
• 0x46e518 IsRectEmpty
• 0x46e51c IsIconic
• 0x46e520 IsDialogMessageA
• 0x46e524 IsChild
• 0x46e528 InvalidateRect
• 0x46e52c IntersectRect
• 0x46e530 InsertMenuItemA
• 0x46e534 InsertMenuA
• 0x46e538 InflateRect
• 0x46e540 GetWindowTextA
• 0x46e544 GetWindowRect
• 0x46e548 GetWindowPlacement
• 0x46e54c GetWindowLongA
• 0x46e550 GetWindowDC
• 0x46e554 GetTopWindow
• 0x46e558 GetSystemMetrics
• 0x46e55c GetSystemMenu
• 0x46e560 GetSysColorBrush
• 0x46e564 GetSysColor
• 0x46e568 GetSubMenu
• 0x46e56c GetScrollRange
• 0x46e570 GetScrollPos
• 0x46e574 GetScrollInfo
• 0x46e578 GetPropA
• 0x46e57c GetParent
• 0x46e580 GetWindow
• 0x46e584 GetMenuStringA
• 0x46e588 GetMenuState
• 0x46e58c GetMenuItemInfoA
• 0x46e590 GetMenuItemID
• 0x46e594 GetMenuItemCount
• 0x46e598 GetMenu
• 0x46e59c GetLastActivePopup
• 0x46e5a0 GetKeyboardState
• 0x46e5a8 GetKeyboardLayout
• 0x46e5ac GetKeyState
• 0x46e5b0 GetKeyNameTextA
• 0x46e5b4 GetIconInfo
• 0x46e5b8 GetForegroundWindow
• 0x46e5bc GetFocus
• 0x46e5c0 GetDlgItem
• 0x46e5c4 GetDesktopWindow
• 0x46e5c8 GetDCEx
• 0x46e5cc GetDC
• 0x46e5d0 GetCursorPos
• 0x46e5d4 GetCursor
• 0x46e5d8 GetClientRect
• 0x46e5dc GetClassNameA
• 0x46e5e0 GetClassInfoA
• 0x46e5e4 GetCapture
• 0x46e5e8 GetActiveWindow
• 0x46e5ec FrameRect
• 0x46e5f0 FindWindowA
• 0x46e5f4 FillRect
• 0x46e5f8 EqualRect
• 0x46e5fc EnumWindows
• 0x46e600 EnumThreadWindows
• 0x46e604 EndPaint
• 0x46e608 EnableWindow
• 0x46e60c EnableScrollBar
• 0x46e610 EnableMenuItem
• 0x46e614 DrawTextA
• 0x46e618 DrawMenuBar
• 0x46e61c DrawIconEx
• 0x46e620 DrawIcon
• 0x46e624 DrawFrameControl
• 0x46e628 DrawFocusRect
• 0x46e62c DrawEdge
• 0x46e630 DispatchMessageA
• 0x46e634 DestroyWindow
• 0x46e638 DestroyMenu
• 0x46e63c DestroyIcon
• 0x46e640 DestroyCursor
• 0x46e644 DeleteMenu
• 0x46e648 DefWindowProcA
• 0x46e64c DefMDIChildProcA
• 0x46e650 DefFrameProcA
• 0x46e654 CreatePopupMenu
• 0x46e658 CreateMenu
• 0x46e65c CreateIcon
• 0x46e660 ClientToScreen
• 0x46e664 CheckMenuItem
• 0x46e668 CallWindowProcA
• 0x46e66c CallNextHookEx
• 0x46e670 BeginPaint
• 0x46e674 CharNextA
• 0x46e678 CharLowerA
• 0x46e67c CharUpperBuffA
• 0x46e680 CharToOemA
• 0x46e684 AdjustWindowRectEx
Library kernel32.dll:
• 0x46e690 Sleep
Library oleaut32.dll:
• 0x46e698 SafeArrayPtrOfIndex
• 0x46e69c SafeArrayGetUBound
• 0x46e6a0 SafeArrayGetLBound
• 0x46e6a4 SafeArrayCreate
• 0x46e6a8 VariantChangeType
• 0x46e6ac VariantCopy
• 0x46e6b0 VariantClear
• 0x46e6b4 VariantInit
Library comctl32.dll:
• 0x46e6c4 ImageList_Write
• 0x46e6c8 ImageList_Read
• 0x46e6d8 ImageList_DragMove
• 0x46e6dc ImageList_DragLeave
• 0x46e6e0 ImageList_DragEnter
• 0x46e6e4 ImageList_EndDrag
• 0x46e6e8 ImageList_BeginDrag
• 0x46e6ec ImageList_Remove
• 0x46e6f0 ImageList_DrawEx
• 0x46e6f4 ImageList_Replace
• 0x46e6f8 ImageList_Draw
• 0x46e708 ImageList_Add
• 0x46e710 ImageList_Destroy
• 0x46e714 ImageList_Create
Library comdlg32.dll:
• 0x46e71c GetSaveFileNameA
• 0x46e720 GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 51378 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 50568 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 62912 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.