6.2
高危
60 个模型检测该样本为恶意！
重新分析
更多

53f1438a01754b197b51b4034b7ccacf90677125359730731282a8d4d734647d

47dfa808f0631fb13598951e9d14c299.exe

分析耗时

314s

最近分析

文件大小

2.2MB
静态报毒 动态报毒 2V5I AI SCORE=86 AIDETECTVM BANKERX CLASSIC CONFIDENCE EKVT ELDORADO EMOTET ENCPK EPLX GENCIRC GENETIC GENKRYPTIK HBR@8QRQPO HCWQ HIGH CONFIDENCE HJEOKX I6VSO INJECT3 KIRGUDU KRYPTIK MALICIOUS PE MALWARE1 MS0@AIGAIGKG PINKSBOT QAKBOT QBOT QVM20 R + MAL R338450 SCORE STATIC AI SUSGEN TROJANBANKER UNSAFE YBNPW ZEXAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
CrowdStrike win/malicious_confidence_60% (D) 20190702 1.0
Baidu 20190318 1.0.0.2
Alibaba TrojanBanker:Win32/Emotet.8f9853a1 20190527 0.3.0.5
Avast Win32:BankerX-gen [Trj] 20201229 21.1.5827.0
Kingsoft 20201229 2017.9.26.565
McAfee W32/PinkSbot-GN!47DFA808F063 20201228 6.0.6.653
Tencent Malware.Win32.Gencirc.10b9e5d2 20201229 1.0.0.1
静态指标
Queries for the computername (2 个事件)
Time & API Arguments Status Return Repeated
1619464161.781125
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619464202.453125
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Command line console output was observed (29 个事件)
Time & API Arguments Status Return Repeated
1619491246.587993
WriteConsoleW
buffer: 另一个程序正在使用此文件，进程无法访问。
console_handle: 0x0000000b
success 1 0
1619491215.813774
WriteConsoleA
buffer: ÕýÔÚ Ping 127.0.0.1
console_handle: 0x00000007
success 1 0
1619491216.282774
WriteConsoleA
buffer: ¾ßÓÐ 32 ×Ö½ÚµÄÊý¾Ý:
console_handle: 0x00000007
success 1 0
1619491216.501774
WriteConsoleA
buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´:
console_handle: 0x00000007
success 1 0
1619491216.501774
WriteConsoleA
buffer: ×Ö½Ú=32
console_handle: 0x00000007
success 1 0
1619491216.501774
WriteConsoleA
buffer: ʱ¼ä<1ms
console_handle: 0x00000007
success 1 0
1619491216.501774
WriteConsoleA
buffer: TTL=128
console_handle: 0x00000007
success 1 0
1619491217.517774
WriteConsoleA
buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´:
console_handle: 0x00000007
success 1 0
1619491217.517774
WriteConsoleA
buffer: ×Ö½Ú=32
console_handle: 0x00000007
success 1 0
1619491217.517774
WriteConsoleA
buffer: ʱ¼ä<1ms
console_handle: 0x00000007
success 1 0
1619491217.517774
WriteConsoleA
buffer: TTL=128
console_handle: 0x00000007
success 1 0
1619491218.517774
WriteConsoleA
buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´:
console_handle: 0x00000007
success 1 0
1619491218.517774
WriteConsoleA
buffer: ×Ö½Ú=32
console_handle: 0x00000007
success 1 0
1619491218.517774
WriteConsoleA
buffer: ʱ¼ä<1ms
console_handle: 0x00000007
success 1 0
1619491218.517774
WriteConsoleA
buffer: TTL=128
console_handle: 0x00000007
success 1 0
1619491219.517774
WriteConsoleA
buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´:
console_handle: 0x00000007
success 1 0
1619491219.517774
WriteConsoleA
buffer: ×Ö½Ú=32
console_handle: 0x00000007
success 1 0
1619491219.517774
WriteConsoleA
buffer: ʱ¼ä<1ms
console_handle: 0x00000007
success 1 0
1619491219.517774
WriteConsoleA
buffer: TTL=128
console_handle: 0x00000007
success 1 0
1619491220.517774
WriteConsoleA
buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´:
console_handle: 0x00000007
success 1 0
1619491220.517774
WriteConsoleA
buffer: ×Ö½Ú=32
console_handle: 0x00000007
success 1 0
1619491220.517774
WriteConsoleA
buffer: ʱ¼ä<1ms
console_handle: 0x00000007
success 1 0
1619491220.517774
WriteConsoleA
buffer: TTL=128
console_handle: 0x00000007
success 1 0
1619491221.517774
WriteConsoleA
buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´:
console_handle: 0x00000007
success 1 0
1619491221.517774
WriteConsoleA
buffer: ×Ö½Ú=32
console_handle: 0x00000007
success 1 0
1619491221.517774
WriteConsoleA
buffer: ʱ¼ä<1ms
console_handle: 0x00000007
success 1 0
1619491221.517774
WriteConsoleA
buffer: TTL=128
console_handle: 0x00000007
success 1 0
1619491222.048774
WriteConsoleA
buffer: 127.0.0.1 µÄ Ping ͳ¼ÆÐÅÏ¢: Êý¾Ý°ü: ÒÑ·¢ËÍ = 6£¬ÒѽÓÊÕ = 6£¬¶ªÊ§ = 0 (0% ¶ªÊ§)£¬
console_handle: 0x00000007
success 1 0
1619491222.095774
WriteConsoleA
buffer: Íù·µÐг̵ĹÀ¼Æʱ¼ä(ÒÔºÁÃëΪµ¥Î»): ×î¶Ì = 0ms£¬× = 0ms£¬Æ½¾ù = 0ms
console_handle: 0x00000007
success 1 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619491215.517774
GlobalMemoryStatusEx
success 1 0
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619464202.453125
__exception__
stacktrace: 
RtlConvertSidToUnicodeString+0x28 RtlFormatCurrentUserKeyPath-0x257 ntdll+0x3aeea @ 0x77d6aeea
ConvertSidToStringSidW+0x24 CopySid-0xe6 advapi32+0x14368 @ 0x76554368
47dfa808f0631fb13598951e9d14c299+0xa5b6 @ 0x40a5b6
47dfa808f0631fb13598951e9d14c299+0x8853 @ 0x408853
47dfa808f0631fb13598951e9d14c299+0x8451 @ 0x408451
47dfa808f0631fb13598951e9d14c299+0x8ec9 @ 0x408ec9
47dfa808f0631fb13598951e9d14c299+0x17cc @ 0x4017cc
47dfa808f0631fb13598951e9d14c299+0x1c66 @ 0x401c66
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1632744
registers.edi: 0
registers.eax: 32
registers.ebp: 1632784
registers.edx: 2
registers.ebx: 1
registers.esi: 32
registers.ecx: 32
exception.instruction_r: 8a 08 80 e1 0f 80 f9 01 75 24 8a 48 01 80 f9 0f
exception.symbol: RtlValidSid+0x17 RtlCopySid-0x3e ntdll+0x392a9
exception.instruction: mov cl, byte ptr [eax]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 234153
exception.address: 0x77d692a9
success 0 0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (4 个事件)
Time & API Arguments Status Return Repeated
1619464060.844125
NtAllocateVirtualMemory
process_identifier: 2424
region_size: 233472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x003a0000
success 0 0
1619464159.766125
NtAllocateVirtualMemory
process_identifier: 2424
region_size: 229376
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x020c0000
success 0 0
1619464159.766125
NtProtectVirtualMemory
process_identifier: 2424
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 245760
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619491170.736225
NtAllocateVirtualMemory
process_identifier: 796
region_size: 233472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00330000
success 0 0
Foreign language identified in PE resource (49 个事件)
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x00232b5c filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_BITMAP language LANG_KOREAN offset 0x00232d48 filetype data sublanguage SUBLANG_KOREAN size 0x00000144
name RT_BITMAP language LANG_KOREAN offset 0x00232d48 filetype data sublanguage SUBLANG_KOREAN size 0x00000144
name RT_DIALOG language LANG_KOREAN offset 0x00232f74 filetype data sublanguage SUBLANG_KOREAN size 0x00000034
name RT_DIALOG language LANG_KOREAN offset 0x00232f74 filetype data sublanguage SUBLANG_KOREAN size 0x00000034
name RT_STRING language LANG_KOREAN offset 0x00234518 filetype data sublanguage SUBLANG_KOREAN size 0x00000042
name RT_STRING language LANG_KOREAN offset 0x00234518 filetype data sublanguage SUBLANG_KOREAN size 0x00000042
name RT_STRING language LANG_KOREAN offset 0x00234518 filetype data sublanguage SUBLANG_KOREAN size 0x00000042
name RT_STRING language LANG_KOREAN offset 0x00234518 filetype data sublanguage SUBLANG_KOREAN size 0x00000042
name RT_STRING language LANG_KOREAN offset 0x00234518 filetype data sublanguage SUBLANG_KOREAN size 0x00000042
name RT_STRING language LANG_KOREAN offset 0x00234518 filetype data sublanguage SUBLANG_KOREAN size 0x00000042
name RT_STRING language LANG_KOREAN offset 0x00234518 filetype data sublanguage SUBLANG_KOREAN size 0x00000042
name RT_STRING language LANG_KOREAN offset 0x00234518 filetype data sublanguage SUBLANG_KOREAN size 0x00000042
name RT_STRING language LANG_KOREAN offset 0x00234518 filetype data sublanguage SUBLANG_KOREAN size 0x00000042
name RT_STRING language LANG_KOREAN offset 0x00234518 filetype data sublanguage SUBLANG_KOREAN size 0x00000042
name RT_STRING language LANG_KOREAN offset 0x00234518 filetype data sublanguage SUBLANG_KOREAN size 0x00000042
name RT_STRING language LANG_KOREAN offset 0x00234518 filetype data sublanguage SUBLANG_KOREAN size 0x00000042
name RT_STRING language LANG_KOREAN offset 0x00234518 filetype data sublanguage SUBLANG_KOREAN size 0x00000042
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x00234684 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_VERSION language LANG_KOREAN offset 0x00234698 filetype data sublanguage SUBLANG_KOREAN size 0x00000400
Creates a suspicious process (2 个事件)
cmdline "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\47dfa808f0631fb13598951e9d14c299.exe"
cmdline cmd.exe /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\47dfa808f0631fb13598951e9d14c299.exe"
A process created a hidden window (2 个事件)
Time & API Arguments Status Return Repeated
1619464162.453125
CreateProcessInternalW
thread_identifier: 1236
thread_handle: 0x0000014c
process_identifier: 796
current_directory:
filepath:
track: 1
command_line: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\47dfa808f0631fb13598951e9d14c299.exe /C
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
process_handle: 0x00000150
inherit_handles: 0
success 1 0
1619464214.235125
ShellExecuteExW
parameters: /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\47dfa808f0631fb13598951e9d14c299.exe"
filepath: cmd.exe
filepath_r: cmd.exe
show_type: 0
success 1 0
Uses Windows utilities for basic Windows functionality (3 个事件)
cmdline "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\47dfa808f0631fb13598951e9d14c299.exe"
cmdline ping.exe -n 6 127.0.0.1
cmdline cmd.exe /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\47dfa808f0631fb13598951e9d14c299.exe"
网络通信
Communicates with host for which no DNS query was performed (4 个事件)
host 113.108.239.196
host 172.217.24.14
host 203.208.41.34
host 203.208.41.65
File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Agent.EPLX
CAT-QuickHeal Trojan.Qbot
ALYac Trojan.Agent.EPLX
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Malware
K7AntiVirus Trojan ( 005652be1 )
BitDefender Trojan.Agent.EPLX
K7GW Trojan ( 004f7ea21 )
CrowdStrike win/malicious_confidence_60% (D)
Cyren W32/Kryptik.BLK.gen!Eldorado
Symantec Packed.Generic.459
APEX Malicious
Paloalto generic.ml
ClamAV Win.Malware.Qbot-7677435-0
Kaspersky HEUR:Trojan-Banker.Win32.Qbot.vho
Alibaba TrojanBanker:Win32/Emotet.8f9853a1
NANO-Antivirus Trojan.Win32.Inject3.hjeokx
AegisLab Trojan.Win32.Qbot.7!c
Avast Win32:BankerX-gen [Trj]
Rising Trojan.Kryptik!1.C427 (CLASSIC)
Ad-Aware Trojan.Agent.EPLX
Sophos Mal/Generic-R + Mal/EncPk-APV
Comodo TrojWare.Win32.Kryptik.HBR@8qrqpo
F-Secure Trojan.TR/Crypt.Agent.ybnpw
DrWeb Trojan.Inject3.38910
McAfee-GW-Edition W32/PinkSbot-GN!47DFA808F063
FireEye Generic.mg.47dfa808f0631fb1
Emsisoft Trojan.Agent.EPLX (B)
Ikarus Trojan-Banker.Agent
GData Trojan.Agent.EPLX
Jiangmin Trojan.Banker.Qbot.nq
Avira TR/Crypt.Agent.ybnpw
MAX malware (ai score=86)
Antiy-AVL Trojan/Win32.Emotet
Gridinsoft Trojan.Win32.Kryptik.ba!s3
Arcabit Trojan.Agent.EPLX
ZoneAlarm HEUR:Trojan-Banker.Win32.Qbot.vho
Microsoft Trojan:Win32/Emotet.MS!MTB
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.Kryptik.R338450
Acronis suspicious
McAfee W32/PinkSbot-GN!47DFA808F063
TACHYON Trojan/W32.Agent.2302976.M
VBA32 Malware-Cryptor.Kirgudu
Malwarebytes Backdoor.Qbot
ESET-NOD32 a variant of Win32/Kryptik.HCWQ
TrendMicro-HouseCall Backdoor.Win32.QAKBOT.SME
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (6 个事件)
dead_host 113.108.239.196:80
dead_host 172.217.24.14:443
dead_host 216.58.200.238:443
dead_host 192.168.56.101:49200
dead_host 192.168.56.101:49197
dead_host 203.208.41.34:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-04-20 19:48:33

Imports

Library KERNEL32.dll:
• 0x62f6b0 VirtualAlloc
• 0x62f6b4 GetModuleHandleW
• 0x62f6b8 FlushFileBuffers
• 0x62f6c0 GetSystemInfo
• 0x62f6c4 LocalFree
• 0x62f6c8 GetCurrentProcess
• 0x62f6cc lstrcpyW
• 0x62f6d4 LocalReAlloc
• 0x62f6d8 LocalAlloc
• 0x62f6dc lstrlenW
• 0x62f6e0 FindNextFileW
• 0x62f6e4 CompareStringW
• 0x62f6e8 FindClose
• 0x62f6ec lstrcmpiW
• 0x62f6f0 GetLastError
• 0x62f6f4 FindFirstFileW
• 0x62f6f8 SetLastError
• 0x62f704 ExitThread
• 0x62f70c SetEvent
• 0x62f714 Sleep
• 0x62f720 CloseHandle
• 0x62f724 CreateEventW
• 0x62f72c ResumeThread
• 0x62f730 SetThreadPriority
• 0x62f734 CreateThread
• 0x62f738 WaitForSingleObject
• 0x62f744 OpenEventW
• 0x62f74c GetTickCount
• 0x62f750 GetCurrentThreadId
• 0x62f754 GetCurrentProcessId
• 0x62f75c TerminateProcess
• 0x62f768 GetStartupInfoA
• 0x62f76c GetCommandLineA
• 0x62f770 GetVersionExA
• 0x62f774 ExitProcess
• 0x62f778 GetProcAddress
• 0x62f77c GetModuleHandleA
• 0x62f780 WriteFile
• 0x62f784 GetStdHandle
• 0x62f788 GetModuleFileNameA
• 0x62f790 VirtualProtect
• 0x62f798 WideCharToMultiByte
• 0x62f7a0 SetHandleCount
• 0x62f7a4 GetFileType
• 0x62f7a8 HeapDestroy
• 0x62f7ac HeapCreate
• 0x62f7b0 VirtualFree
• 0x62f7b4 HeapFree
• 0x62f7b8 LoadLibraryA
• 0x62f7bc GetACP
• 0x62f7c0 GetOEMCP
• 0x62f7c4 GetCPInfo
• 0x62f7c8 HeapAlloc
• 0x62f7cc HeapReAlloc
• 0x62f7d0 RtlUnwind
• 0x62f7d4 InterlockedExchange
• 0x62f7d8 VirtualQuery
• 0x62f7dc SetFilePointer
• 0x62f7e0 MultiByteToWideChar
• 0x62f7e4 LCMapStringA
• 0x62f7e8 LCMapStringW
• 0x62f7ec GetStringTypeA
• 0x62f7f0 GetStringTypeW
• 0x62f7f4 SetStdHandle
• 0x62f7f8 GetLocaleInfoA
• 0x62f7fc GetTempPathA
• 0x62f804 DeleteTimerQueue
• 0x62f808 GetFullPathNameW
• 0x62f80c VirtualFreeEx
• 0x62f814 WaitNamedPipeA
• 0x62f818 GetDateFormatA
• 0x62f81c RtlFillMemory
• 0x62f820 ReplaceFileA
• 0x62f828 BackupRead
• 0x62f82c SuspendThread
• 0x62f830 ClearCommError
• 0x62f834 SleepEx
• 0x62f838 FormatMessageW
• 0x62f83c GetDevicePowerState
Library USER32.dll:
• 0x62f848 LoadIconA
• 0x62f84c LoadCursorFromFileW
• 0x62f850 GetAsyncKeyState
• 0x62f854 GetForegroundWindow
• 0x62f858 GetKeyboardLayout
• 0x62f85c GetDC
• 0x62f860 GetSystemMetrics
• 0x62f864 GetDlgCtrlID
• 0x62f868 GetListBoxInfo
• 0x62f86c GetThreadDesktop
• 0x62f870 ShowCaret
• 0x62f874 DestroyWindow
• 0x62f878 GetClipboardViewer
• 0x62f87c GetTopWindow
• 0x62f880 CharLowerA
• 0x62f884 IsWindow
• 0x62f888 GetFocus
• 0x62f890 CreateMenu
• 0x62f894 GetCapture
• 0x62f898 GetKBCodePage
• 0x62f89c LoadStringW
• 0x62f8a0 SendMessageW
• 0x62f8a4 SetWindowPos
• 0x62f8a8 GetDesktopWindow
• 0x62f8ac GetParent
• 0x62f8b0 GetWindowLongW
• 0x62f8b4 GetWindowRect
• 0x62f8b8 SetForegroundWindow
• 0x62f8bc CheckDlgButton
• 0x62f8c0 GetClientRect
• 0x62f8c4 EndDialog
• 0x62f8c8 PostMessageW
• 0x62f8cc GetDlgItem
• 0x62f8d0 IsDlgButtonChecked
• 0x62f8d4 SendDlgItemMessageW
• 0x62f8d8 SetDlgItemTextW
• 0x62f8dc KillTimer
• 0x62f8e0 SetTimer
• 0x62f8e4 LoadImageW
• 0x62f8e8 DialogBoxParamW
• 0x62f8ec MessageBoxW
• 0x62f8f0 DefWindowProcW
• 0x62f8f4 LoadIconW
• 0x62f8f8 PostQuitMessage
• 0x62f8fc DispatchMessageW
• 0x62f900 TranslateMessage
• 0x62f904 GetMessageW
• 0x62f908 CreateWindowExW
• 0x62f90c RegisterClassW
• 0x62f910 GetDlgItemTextA
• 0x62f914 PackDDElParam
• 0x62f918 ShowCursor
• 0x62f91c WinHelpA
• 0x62f924 DlgDirListComboBoxW
• 0x62f92c DdeCmpStringHandles
• 0x62f934 LoadMenuIndirectW
• 0x62f940 EnableScrollBar
• 0x62f944 CloseWindowStation
• 0x62f948 SetWindowTextW
• 0x62f94c CreateMDIWindowA
• 0x62f950 SetScrollPos
• 0x62f954 SetShellWindow
• 0x62f958 CreateIconIndirect
• 0x62f95c GetMenuDefaultItem
• 0x62f964 WINNLSEnableIME
• 0x62f968 SendNotifyMessageW
• 0x62f974 GetWindowTextW
• 0x62f978 ReleaseDC
• 0x62f97c EnumDesktopWindows
• 0x62f980 GetLastActivePopup
Library GDI32.dll:
• 0x62f988 GetStockObject
• 0x62f98c CreateMetaFileA
• 0x62f990 CreatePatternBrush
• 0x62f994 GetPolyFillMode
• 0x62f998 DeleteDC
• 0x62f99c FillPath
• 0x62f9a0 UnrealizeObject
• 0x62f9a4 AddFontResourceA
• 0x62f9a8 GetFontLanguageInfo
• 0x62f9ac SetICMProfileW
• 0x62f9b0 GdiEntry3
• 0x62f9b4 SetGraphicsMode
• 0x62f9b8 XLATEOBJ_iXlate
• 0x62f9bc GetTextMetricsA
• 0x62f9c0 InvertRgn
• 0x62f9c4 AnyLinkedFonts
• 0x62f9c8 AddFontResourceW
• 0x62f9cc CopyEnhMetaFileW
• 0x62f9d0 GdiComment
• 0x62f9d4 DescribePixelFormat
• 0x62f9d8 GdiIsMetaPrintDC
• 0x62f9e0 EngLockSurface
• 0x62f9e4 FONTOBJ_vGetInfo
• 0x62f9e8 SetAbortProc
• 0x62f9ec SetMetaRgn
• 0x62f9f0 AddFontResourceExW
• 0x62f9f4 GetROP2
• 0x62f9f8 EngBitBlt
• 0x62f9fc STROBJ_vEnumStart
Library ADVAPI32.dll:
• 0x62fa04 RegOpenKeyA
• 0x62fa08 RegQueryValueExA
• 0x62fa0c GetAce
• 0x62fa14 RegOpenKeyExW
• 0x62fa18 RegCloseKey
• 0x62fa1c RegQueryValueExW
• 0x62fa20 SetSecurityInfo
• 0x62fa24 GetSecurityInfo
• 0x62fa28 RegOpenKeyExA
Library SHELL32.dll:
• 0x62fa30 Shell_NotifyIconW

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 50568 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 62912 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.