6.2
高危
57 个模型检测该样本为恶意！
重新分析
更多

2240c11ab9505ff6c17ea4b7d03ccb3b072e19d94357ead07116ba108c9d900d

4a0af8d2a4f9b7e38a01f7a185822666.exe

分析耗时

50s

最近分析

文件大小

672.5KB
静态报毒 动态报毒 100% AGENTTESLA AI SCORE=81 AIDETECT AUTO AVSARHER BTOMTW CLOUD CONFIDENCE DELF DELPHILESS EMHC FAREIT GENERICKDZ GENETIC HIGH CONFIDENCE HNIVLW HWUB954A KRYPT LOKIBOT MALWARE1 MALWARE@#1RV5EBQNEYLWZ MWGXE SAVE SCORE SIGGEN2 STATIC AI SUSGEN SUSPICIOUS PE TQUQ TSCOPE UNSAFE WACATAC X2066 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FTB!4A0AF8D2A4F9 20210309 6.0.6.653
Alibaba TrojanSpy:Win32/Obfuscator.b45d4260 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20210309 21.1.5827.0
Tencent Win32.Trojan.Inject.Auto 20210309 1.0.0.1
Kingsoft 20210309 2017.9.26.565
CrowdStrike win/malicious_confidence_100% (W) 20210203 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619485817.323625
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 35585588
registers.edi: 0
registers.eax: 0
registers.ebp: 35585928
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 b3 6f 00 00 e9
exception.symbol: 4a0af8d2a4f9b7e38a01f7a185822666+0x58f94
exception.instruction: div eax
exception.module: 4a0af8d2a4f9b7e38a01f7a185822666.exe
exception.exception_code: 0xc0000094
exception.offset: 364436
exception.address: 0x458f94
success 0 0
1619485819.807625
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73aae97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73aaea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73aab25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73aab4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73aaac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73aaaed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73aa5511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73aa559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74167f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74164de3
4a0af8d2a4f9b7e38a01f7a185822666+0x5aa4d @ 0x45aa4d
4a0af8d2a4f9b7e38a01f7a185822666+0x53254 @ 0x453254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe7414ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619485817.135625
NtAllocateVirtualMemory
process_identifier: 1436
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00350000
success 0 0
1619485817.323625
NtProtectVirtualMemory
process_identifier: 1436
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 32768
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00458000
success 0 0
1619485817.338625
NtAllocateVirtualMemory
process_identifier: 1436
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00660000
success 0 0
1619485818.369625
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619485818.494625
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 1572864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01f30000
success 0 0
1619485818.494625
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02070000
success 0 0
1619485818.494625
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 335872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01db0000
success 0 0
1619485818.494625
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 307200
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01db2000
success 0 0
1619485819.010625
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01e10000
success 0 0
1619485819.010625
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01e70000
success 0 0
1619485819.791625
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f22000
success 0 0
1619485819.791625
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619485819.791625
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f22000
success 0 0
1619485819.791625
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619485819.791625
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f22000
success 0 0
1619485819.791625
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619485819.791625
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f22000
success 0 0
1619485819.791625
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619485819.791625
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f22000
success 0 0
1619485819.791625
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619485819.791625
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f22000
success 0 0
1619485819.791625
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619485819.791625
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f22000
success 0 0
1619485819.791625
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619485819.791625
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f22000
success 0 0
1619485819.791625
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619485819.791625
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f22000
success 0 0
1619485819.791625
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619485819.791625
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f22000
success 0 0
1619485819.791625
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.521555415707248 section {'size_of_data': '0x0003ec00', 'virtual_address': '0x00070000', 'entropy': 7.521555415707248, 'name': '.rsrc', 'virtual_size': '0x0003eb40'} description A section with a high entropy has been found
entropy 0.37379002233804914 description Overall entropy of this PE file is high
网络通信
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 1436 called NtSetContextThread to modify thread in remote process 1056
Time & API Arguments Status Return Repeated
1619485817.963625
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4908208
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1056
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 1436 resumed a thread in remote process 1056
Time & API Arguments Status Return Repeated
1619485818.010625
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 1056
success 0 0
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.24.14:443
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619485817.869625
CreateProcessInternalW
thread_identifier: 2032
thread_handle: 0x000000fc
process_identifier: 1056
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4a0af8d2a4f9b7e38a01f7a185822666.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619485817.869625
NtUnmapViewOfSection
process_identifier: 1056
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619485817.869625
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 1056
commit_size: 720896
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 720896
base_address: 0x00400000
success 0 0
1619485817.963625
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1619485817.963625
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4908208
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1056
success 0 0
1619485818.010625
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 1056
success 0 0
File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 个事件)
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKDZ.67615
McAfee Fareit-FTB!4A0AF8D2A4F9
Cylance Unsafe
Zillya Trojan.Stealer.Win32.7594
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 005680341 )
Alibaba TrojanSpy:Win32/Obfuscator.b45d4260
K7GW Trojan ( 005680341 )
Cybereason malicious.2a4f9b
Arcabit Trojan.Generic.D1081F
Cyren W32/Delf.TQUQ-2832
Symantec Infostealer.Lokibot!43
APEX Malicious
Avast Win32:Trojan-gen
ClamAV Win.Trojan.Generic-8000835-0
Kaspersky HEUR:Trojan-Spy.Win32.Stealer.gen
BitDefender Trojan.GenericKDZ.67615
NANO-Antivirus Trojan.Win32.Stealer.hnivlw
Paloalto generic.ml
Tencent Win32.Trojan.Inject.Auto
Ad-Aware Trojan.GenericKDZ.67615
Sophos Mal/Generic-S
Comodo Malware@#1rv5ebqneylwz
F-Secure Trojan.TR/Injector.mwgxe
DrWeb Trojan.PWS.Siggen2.45348
VIPRE Trojan.Win32.Generic!BT
McAfee-GW-Edition BehavesLike.Win32.Fareit.jc
FireEye Generic.mg.4a0af8d2a4f9b7e3
Emsisoft Trojan.GenericKDZ.67615 (B)
SentinelOne Static AI - Suspicious PE
ESET-NOD32 a variant of Win32/Injector.EMHC
Avira TR/Injector.mwgxe
Antiy-AVL Trojan[Spy]/Win32.Stealer
Gridinsoft Trojan.Win32.Wacatac.ba
Microsoft Trojan:Win32/Obfuscator.KI!MTB
AegisLab Trojan.Multi.Generic.4!c
ZoneAlarm HEUR:Trojan-Spy.Win32.Stealer.gen
GData Trojan.GenericKDZ.67615
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2066
Acronis suspicious
VBA32 TScope.Trojan.Delf
ALYac Spyware.AgentTesla
MAX malware (ai score=81)
Malwarebytes Trojan.MalPack.DLF
Rising Trojan.Injector!1.C77F (CLOUD)
Yandex Trojan.AvsArher.bTOmTw
Ikarus Trojan.Win32.Krypt
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x46413c VirtualFree
• 0x464140 VirtualAlloc
• 0x464144 LocalFree
• 0x464148 LocalAlloc
• 0x46414c GetVersion
• 0x464150 GetCurrentThreadId
• 0x46415c VirtualQuery
• 0x464160 WideCharToMultiByte
• 0x464164 MultiByteToWideChar
• 0x464168 lstrlenA
• 0x46416c lstrcpynA
• 0x464170 LoadLibraryExA
• 0x464174 GetThreadLocale
• 0x464178 GetStartupInfoA
• 0x46417c GetProcAddress
• 0x464180 GetModuleHandleA
• 0x464184 GetModuleFileNameA
• 0x464188 GetLocaleInfoA
• 0x46418c GetCommandLineA
• 0x464190 FreeLibrary
• 0x464194 FindFirstFileA
• 0x464198 FindClose
• 0x46419c ExitProcess
• 0x4641a0 WriteFile
• 0x4641a8 RtlUnwind
• 0x4641ac RaiseException
• 0x4641b0 GetStdHandle
Library user32.dll:
• 0x4641b8 GetKeyboardType
• 0x4641bc LoadStringA
• 0x4641c0 MessageBoxA
• 0x4641c4 CharNextA
Library advapi32.dll:
• 0x4641cc RegQueryValueExA
• 0x4641d0 RegOpenKeyExA
• 0x4641d4 RegCloseKey
Library oleaut32.dll:
• 0x4641dc SysFreeString
• 0x4641e0 SysReAllocStringLen
• 0x4641e4 SysAllocStringLen
Library kernel32.dll:
• 0x4641ec TlsSetValue
• 0x4641f0 TlsGetValue
• 0x4641f4 LocalAlloc
• 0x4641f8 GetModuleHandleA
Library advapi32.dll:
• 0x464200 RegQueryValueExA
• 0x464204 RegOpenKeyExA
• 0x464208 RegCloseKey
Library kernel32.dll:
• 0x464210 lstrcpyA
• 0x464214 WriteFile
• 0x46421c WaitForSingleObject
• 0x464220 VirtualQuery
• 0x464224 VirtualAlloc
• 0x464228 Sleep
• 0x46422c SizeofResource
• 0x464230 SetThreadLocale
• 0x464234 SetFilePointer
• 0x464238 SetEvent
• 0x46423c SetErrorMode
• 0x464240 SetEndOfFile
• 0x464244 ResetEvent
• 0x464248 ReadFile
• 0x46424c MulDiv
• 0x464250 LockResource
• 0x464254 LoadResource
• 0x464258 LoadLibraryA
• 0x464264 GlobalUnlock
• 0x464268 GlobalReAlloc
• 0x46426c GlobalHandle
• 0x464270 GlobalLock
• 0x464274 GlobalFree
• 0x464278 GlobalFindAtomA
• 0x46427c GlobalDeleteAtom
• 0x464280 GlobalAlloc
• 0x464284 GlobalAddAtomA
• 0x464288 GetVersionExA
• 0x46428c GetVersion
• 0x464290 GetTickCount
• 0x464294 GetThreadLocale
• 0x46429c GetSystemTime
• 0x4642a0 GetSystemInfo
• 0x4642a4 GetStringTypeExA
• 0x4642a8 GetStdHandle
• 0x4642ac GetProcAddress
• 0x4642b0 GetModuleHandleA
• 0x4642b4 GetModuleFileNameA
• 0x4642b8 GetLocaleInfoA
• 0x4642bc GetLocalTime
• 0x4642c0 GetLastError
• 0x4642c4 GetFullPathNameA
• 0x4642c8 GetFileAttributesA
• 0x4642cc GetDiskFreeSpaceA
• 0x4642d0 GetDateFormatA
• 0x4642d4 GetCurrentThreadId
• 0x4642d8 GetCurrentProcessId
• 0x4642dc GetCPInfo
• 0x4642e0 GetACP
• 0x4642e4 FreeResource
• 0x4642e8 InterlockedExchange
• 0x4642ec FreeLibrary
• 0x4642f0 FormatMessageA
• 0x4642f4 FindResourceA
• 0x4642f8 FindFirstFileA
• 0x4642fc FindClose
• 0x464308 ExitThread
• 0x46430c EnumCalendarInfoA
• 0x464318 CreateThread
• 0x46431c CreateFileA
• 0x464320 CreateEventA
• 0x464324 CompareStringA
• 0x464328 CloseHandle
Library version.dll:
• 0x464330 VerQueryValueA
• 0x464338 GetFileVersionInfoA
Library gdi32.dll:
• 0x464340 UnrealizeObject
• 0x464344 StretchBlt
• 0x464348 SetWindowOrgEx
• 0x46434c SetWinMetaFileBits
• 0x464350 SetViewportOrgEx
• 0x464354 SetTextColor
• 0x464358 SetStretchBltMode
• 0x46435c SetROP2
• 0x464360 SetPixel
• 0x464364 SetEnhMetaFileBits
• 0x464368 SetDIBColorTable
• 0x46436c SetBrushOrgEx
• 0x464370 SetBkMode
• 0x464374 SetBkColor
• 0x464378 SelectPalette
• 0x46437c SelectObject
• 0x464380 SaveDC
• 0x464384 RestoreDC
• 0x464388 Rectangle
• 0x46438c RectVisible
• 0x464390 RealizePalette
• 0x464394 Polyline
• 0x464398 PlayEnhMetaFile
• 0x46439c PatBlt
• 0x4643a0 MoveToEx
• 0x4643a4 MaskBlt
• 0x4643a8 LineTo
• 0x4643ac IntersectClipRect
• 0x4643b0 GetWindowOrgEx
• 0x4643b4 GetWinMetaFileBits
• 0x4643b8 GetTextMetricsA
• 0x4643c4 GetStockObject
• 0x4643c8 GetPixel
• 0x4643cc GetPaletteEntries
• 0x4643d0 GetObjectA
• 0x4643dc GetEnhMetaFileBits
• 0x4643e0 GetDeviceCaps
• 0x4643e4 GetDIBits
• 0x4643e8 GetDIBColorTable
• 0x4643ec GetDCOrgEx
• 0x4643f4 GetClipBox
• 0x4643f8 GetBrushOrgEx
• 0x4643fc GetBitmapBits
• 0x464400 ExcludeClipRect
• 0x464404 DeleteObject
• 0x464408 DeleteEnhMetaFile
• 0x46440c DeleteDC
• 0x464410 CreateSolidBrush
• 0x464414 CreatePenIndirect
• 0x464418 CreatePalette
• 0x464420 CreateFontIndirectA
• 0x464424 CreateDIBitmap
• 0x464428 CreateDIBSection
• 0x46442c CreateCompatibleDC
• 0x464434 CreateBrushIndirect
• 0x464438 CreateBitmap
• 0x46443c CopyEnhMetaFileA
• 0x464440 BitBlt
Library user32.dll:
• 0x464448 CreateWindowExA
• 0x46444c WindowFromPoint
• 0x464450 WinHelpA
• 0x464454 WaitMessage
• 0x464458 UpdateWindow
• 0x46445c UnregisterClassA
• 0x464460 UnhookWindowsHookEx
• 0x464464 TranslateMessage
• 0x46446c TrackPopupMenu
• 0x464474 ShowWindow
• 0x464478 ShowScrollBar
• 0x46447c ShowOwnedPopups
• 0x464480 ShowCursor
• 0x464484 SetWindowsHookExA
• 0x464488 SetWindowPos
• 0x46448c SetWindowPlacement
• 0x464490 SetWindowLongA
• 0x464494 SetTimer
• 0x464498 SetScrollRange
• 0x46449c SetScrollPos
• 0x4644a0 SetScrollInfo
• 0x4644a4 SetRect
• 0x4644a8 SetPropA
• 0x4644ac SetParent
• 0x4644b0 SetMenuItemInfoA
• 0x4644b4 SetMenu
• 0x4644b8 SetForegroundWindow
• 0x4644bc SetFocus
• 0x4644c0 SetCursor
• 0x4644c4 SetClassLongA
• 0x4644c8 SetCapture
• 0x4644cc SetActiveWindow
• 0x4644d0 SendMessageA
• 0x4644d4 ScrollWindow
• 0x4644d8 ScreenToClient
• 0x4644dc RemovePropA
• 0x4644e0 RemoveMenu
• 0x4644e4 ReleaseDC
• 0x4644e8 ReleaseCapture
• 0x4644f4 RegisterClassA
• 0x4644f8 RedrawWindow
• 0x4644fc PtInRect
• 0x464500 PostQuitMessage
• 0x464504 PostMessageA
• 0x464508 PeekMessageA
• 0x46450c OffsetRect
• 0x464510 OemToCharA
• 0x464514 MessageBoxA
• 0x464518 MapWindowPoints
• 0x46451c MapVirtualKeyA
• 0x464520 LoadStringA
• 0x464524 LoadKeyboardLayoutA
• 0x464528 LoadIconA
• 0x46452c LoadCursorA
• 0x464530 LoadBitmapA
• 0x464534 KillTimer
• 0x464538 IsZoomed
• 0x46453c IsWindowVisible
• 0x464540 IsWindowEnabled
• 0x464544 IsWindow
• 0x464548 IsRectEmpty
• 0x46454c IsIconic
• 0x464550 IsDialogMessageA
• 0x464554 IsChild
• 0x464558 InvalidateRect
• 0x46455c IntersectRect
• 0x464560 InsertMenuItemA
• 0x464564 InsertMenuA
• 0x464568 InflateRect
• 0x464570 GetWindowTextA
• 0x464574 GetWindowRect
• 0x464578 GetWindowPlacement
• 0x46457c GetWindowLongA
• 0x464580 GetWindowDC
• 0x464584 GetTopWindow
• 0x464588 GetSystemMetrics
• 0x46458c GetSystemMenu
• 0x464590 GetSysColorBrush
• 0x464594 GetSysColor
• 0x464598 GetSubMenu
• 0x46459c GetScrollRange
• 0x4645a0 GetScrollPos
• 0x4645a4 GetScrollInfo
• 0x4645a8 GetPropA
• 0x4645ac GetParent
• 0x4645b0 GetWindow
• 0x4645b4 GetMenuStringA
• 0x4645b8 GetMenuState
• 0x4645bc GetMenuItemInfoA
• 0x4645c0 GetMenuItemID
• 0x4645c4 GetMenuItemCount
• 0x4645c8 GetMenu
• 0x4645cc GetLastActivePopup
• 0x4645d0 GetKeyboardState
• 0x4645d8 GetKeyboardLayout
• 0x4645dc GetKeyState
• 0x4645e0 GetKeyNameTextA
• 0x4645e4 GetIconInfo
• 0x4645e8 GetForegroundWindow
• 0x4645ec GetFocus
• 0x4645f0 GetDlgItem
• 0x4645f4 GetDesktopWindow
• 0x4645f8 GetDCEx
• 0x4645fc GetDC
• 0x464600 GetCursorPos
• 0x464604 GetCursor
• 0x464608 GetClipboardData
• 0x46460c GetClientRect
• 0x464610 GetClassNameA
• 0x464614 GetClassInfoA
• 0x464618 GetCapture
• 0x46461c GetActiveWindow
• 0x464620 FrameRect
• 0x464624 FindWindowA
• 0x464628 FillRect
• 0x46462c EqualRect
• 0x464630 EnumWindows
• 0x464634 EnumThreadWindows
• 0x464638 EndPaint
• 0x46463c EnableWindow
• 0x464640 EnableScrollBar
• 0x464644 EnableMenuItem
• 0x464648 DrawTextA
• 0x46464c DrawMenuBar
• 0x464650 DrawIconEx
• 0x464654 DrawIcon
• 0x464658 DrawFrameControl
• 0x46465c DrawEdge
• 0x464660 DispatchMessageA
• 0x464664 DestroyWindow
• 0x464668 DestroyMenu
• 0x46466c DestroyIcon
• 0x464670 DestroyCursor
• 0x464674 DeleteMenu
• 0x464678 DefWindowProcA
• 0x46467c DefMDIChildProcA
• 0x464680 DefFrameProcA
• 0x464684 CreatePopupMenu
• 0x464688 CreateMenu
• 0x46468c CreateIcon
• 0x464690 ClientToScreen
• 0x464694 CheckMenuItem
• 0x464698 CallWindowProcA
• 0x46469c CallNextHookEx
• 0x4646a0 BeginPaint
• 0x4646a4 CharNextA
• 0x4646a8 CharLowerBuffA
• 0x4646ac CharLowerA
• 0x4646b0 CharToOemA
• 0x4646b4 AdjustWindowRectEx
Library kernel32.dll:
• 0x4646c0 Sleep
Library oleaut32.dll:
• 0x4646c8 SafeArrayPtrOfIndex
• 0x4646cc SafeArrayGetUBound
• 0x4646d0 SafeArrayGetLBound
• 0x4646d4 SafeArrayCreate
• 0x4646d8 VariantChangeType
• 0x4646dc VariantCopy
• 0x4646e0 VariantClear
• 0x4646e4 VariantInit
Library comctl32.dll:
• 0x4646f4 ImageList_Write
• 0x4646f8 ImageList_Read
• 0x464708 ImageList_DragMove
• 0x46470c ImageList_DragLeave
• 0x464710 ImageList_DragEnter
• 0x464714 ImageList_EndDrag
• 0x464718 ImageList_BeginDrag
• 0x46471c ImageList_Remove
• 0x464720 ImageList_DrawEx
• 0x464724 ImageList_Replace
• 0x464728 ImageList_Draw
• 0x464738 ImageList_Add
• 0x464740 ImageList_Destroy
• 0x464744 ImageList_Create
• 0x464748 InitCommonControls
Library comdlg32.dll:
• 0x464750 GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50568 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 53658 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.