5.8
高危
58 个模型检测该样本为恶意！
重新分析
更多

4fa84ddee70c59516a5727fa29bf70e548550592998cfc07b9b2b80325756b35

4e0a15308adcca795ccc1d71b6e0f09c.exe

分析耗时

25s

最近分析

文件大小

845.0KB
静态报毒 动态报毒 0GW@AMV4QPBI AI SCORE=82 APJG APXJE CEEINJECT CLOUD CONFIDENCE CRYPTIH DELF DELPHILESS EMWL EMZL FAREIT GENETIC HIGH CONFIDENCE HQKFJH KRYPTIK PDCS R044C0PH520 S15413978 SCORE SIGGEN2 STEAL SUSPICIOUS PE TROJAN3 TSCOPE UNCLASSIFIEDMALWARE@0 UNSAFE UPAN X2091 ZELPHIF ZUSY 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Baidu 20190318 1.0.0.2
Alibaba Trojan:Win32/Injector.ddf6813b 20190527 0.3.0.5
Avast Win32:Malware-gen 20200821 18.4.3895.0
Kingsoft 20200817 2013.8.14.323
McAfee Fareit-FPQ!4E0A15308ADC 20200817 6.0.6.653
Tencent Win32.Trojan.Crypt.Pdcs 20200817 1.0.0.1
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619453641.234875
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75177f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75174de3
4e0a15308adcca795ccc1d71b6e0f09c+0x54a4d @ 0x454a4d
4e0a15308adcca795ccc1d71b6e0f09c+0x4d254 @ 0x44d254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdac14ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619426985.135139
NtAllocateVirtualMemory
process_identifier: 1476
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005b0000
success 0 0
1619426985.275139
NtProtectVirtualMemory
process_identifier: 1476
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 81920
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00475000
success 0 0
1619426985.291139
NtAllocateVirtualMemory
process_identifier: 1476
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x005f0000
success 0 0
1619453639.766875
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619453639.813875
NtAllocateVirtualMemory
process_identifier: 2244
region_size: 1114112
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01e30000
success 0 0
1619453639.813875
NtAllocateVirtualMemory
process_identifier: 2244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f00000
success 0 0
1619453639.813875
NtAllocateVirtualMemory
process_identifier: 2244
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00570000
success 0 0
1619453639.813875
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 282624
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00572000
success 0 0
1619453640.516875
NtAllocateVirtualMemory
process_identifier: 2244
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01e30000
success 0 0
1619453640.516875
NtAllocateVirtualMemory
process_identifier: 2244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01e40000
success 0 0
1619453641.188875
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619453641.188875
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619453641.203875
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619453641.203875
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619453641.203875
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619453641.203875
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619453641.203875
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619453641.203875
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619453641.203875
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619453641.203875
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619453641.203875
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619453641.203875
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619453641.203875
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619453641.203875
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619453641.203875
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619453641.203875
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619453641.203875
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619453641.203875
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619453641.203875
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619453641.203875
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.502862374167732 section {'size_of_data': '0x0003dc00', 'virtual_address': '0x0009c000', 'entropy': 7.502862374167732, 'name': '.rsrc', 'virtual_size': '0x0003dbec'} description A section with a high entropy has been found
entropy 0.29265402843601895 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 1476 called NtSetContextThread to modify thread in remote process 2244
Time & API Arguments Status Return Repeated
1619426985.978139
NtSetContextThread
thread_handle: 0x000000f8
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4859920
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2244
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 1476 resumed a thread in remote process 2244
Time & API Arguments Status Return Repeated
1619426987.385139
NtResumeThread
thread_handle: 0x000000f8
suspend_count: 1
process_identifier: 2244
success 0 0
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619426985.869139
CreateProcessInternalW
thread_identifier: 1704
thread_handle: 0x000000f8
process_identifier: 2244
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4e0a15308adcca795ccc1d71b6e0f09c.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619426985.869139
NtUnmapViewOfSection
process_identifier: 2244
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1619426985.885139
NtMapViewOfSection
section_handle: 0x00000104
process_identifier: 2244
commit_size: 671744
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 671744
base_address: 0x00400000
success 0 0
1619426985.978139
NtGetContextThread
thread_handle: 0x000000f8
success 0 0
1619426985.978139
NtSetContextThread
thread_handle: 0x000000f8
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4859920
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2244
success 0 0
1619426987.385139
NtResumeThread
thread_handle: 0x000000f8
suspend_count: 1
process_identifier: 2244
success 0 0
File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Zusy.310651
FireEye Generic.mg.4e0a15308adcca79
CAT-QuickHeal Trojan.CryptIH.S15413978
ALYac Gen:Variant.Zusy.310651
Cylance Unsafe
Zillya Trojan.Agent.Win32.1362051
AegisLab Trojan.Multi.Generic.4!c
Sangfor Malware
K7AntiVirus Riskware ( 0040eff71 )
BitDefender Gen:Variant.Zusy.310651
K7GW Riskware ( 0040eff71 )
Cybereason malicious.5168b0
TrendMicro TROJ_GEN.R044C0PH520
BitDefenderTheta Gen:NN.ZelphiF.34152.0GW@amV4qPbi
F-Prot W32/Trojan3.APJG
Symantec Trojan Horse
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan.Win32.Crypt.gen
Alibaba Trojan:Win32/Injector.ddf6813b
NANO-Antivirus Trojan.Win32.Crypt.hqkfjh
Avast Win32:Malware-gen
Rising Trojan.Injector!1.C97E (CLOUD)
Ad-Aware Gen:Variant.Zusy.310651
Comodo .UnclassifiedMalware@0
F-Secure Trojan.TR/Kryptik.apxje
DrWeb Trojan.PWS.Siggen2.53083
VIPRE Trojan.Win32.Generic!BT
Invincea heuristic
Fortinet W32/Injector.EMZL!tr
Sophos Troj/Steal-AIH
Ikarus Trojan.Inject
Cyren W32/Trojan.UPAN-4710
Jiangmin Trojan.Crypt.dvd
Webroot W32.Trojan.Gen
Avira TR/Kryptik.apxje
MAX malware (ai score=82)
Antiy-AVL Trojan/Win32.Injector
Arcabit Trojan.Zusy.D4BD7B
ZoneAlarm HEUR:Trojan.Win32.Crypt.gen
Microsoft VirTool:Win32/CeeInject.JJ!rfn
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2091
Acronis suspicious
McAfee Fareit-FPQ!4E0A15308ADC
VBA32 TScope.Trojan.Delf
Malwarebytes Trojan.MalPack.DLF
ESET-NOD32 a variant of Win32/Injector.EMWL
TrendMicro-HouseCall TROJ_GEN.R044C0PH520
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x48d13c VirtualFree
• 0x48d140 VirtualAlloc
• 0x48d144 LocalFree
• 0x48d148 LocalAlloc
• 0x48d14c GetTickCount
• 0x48d154 GetVersion
• 0x48d158 GetCurrentThreadId
• 0x48d164 VirtualQuery
• 0x48d168 WideCharToMultiByte
• 0x48d16c MultiByteToWideChar
• 0x48d170 lstrlenA
• 0x48d174 lstrcpynA
• 0x48d178 LoadLibraryExA
• 0x48d17c GetThreadLocale
• 0x48d180 GetStartupInfoA
• 0x48d184 GetProcAddress
• 0x48d188 GetModuleHandleA
• 0x48d18c GetModuleFileNameA
• 0x48d190 GetLocaleInfoA
• 0x48d194 GetCommandLineA
• 0x48d198 FreeLibrary
• 0x48d19c FindFirstFileA
• 0x48d1a0 FindClose
• 0x48d1a4 ExitProcess
• 0x48d1a8 ExitThread
• 0x48d1ac CreateThread
• 0x48d1b0 WriteFile
• 0x48d1b8 RtlUnwind
• 0x48d1bc RaiseException
• 0x48d1c0 GetStdHandle
Library user32.dll:
• 0x48d1c8 GetKeyboardType
• 0x48d1cc LoadStringA
• 0x48d1d0 MessageBoxA
• 0x48d1d4 CharNextA
Library advapi32.dll:
• 0x48d1dc RegQueryValueExA
• 0x48d1e0 RegOpenKeyExA
• 0x48d1e4 RegCloseKey
Library oleaut32.dll:
• 0x48d1ec SysFreeString
• 0x48d1f0 SysReAllocStringLen
• 0x48d1f4 SysAllocStringLen
Library kernel32.dll:
• 0x48d1fc TlsSetValue
• 0x48d200 TlsGetValue
• 0x48d204 LocalAlloc
• 0x48d208 GetModuleHandleA
Library advapi32.dll:
• 0x48d210 RegQueryValueExA
• 0x48d214 RegQueryInfoKeyA
• 0x48d218 RegOpenKeyExA
• 0x48d21c RegFlushKey
• 0x48d220 RegEnumKeyExA
• 0x48d224 RegCloseKey
Library kernel32.dll:
• 0x48d22c lstrcpyA
• 0x48d230 WriteFile
• 0x48d234 WaitForSingleObject
• 0x48d238 VirtualQuery
• 0x48d23c VirtualProtect
• 0x48d240 VirtualAlloc
• 0x48d244 SuspendThread
• 0x48d248 Sleep
• 0x48d24c SizeofResource
• 0x48d250 SetThreadPriority
• 0x48d254 SetThreadLocale
• 0x48d258 SetFilePointer
• 0x48d25c SetEvent
• 0x48d260 SetErrorMode
• 0x48d264 SetEndOfFile
• 0x48d268 ResumeThread
• 0x48d26c ResetEvent
• 0x48d270 ReadFile
• 0x48d274 MulDiv
• 0x48d278 LockResource
• 0x48d27c LoadResource
• 0x48d280 LoadLibraryA
• 0x48d28c GlobalUnlock
• 0x48d290 GlobalReAlloc
• 0x48d294 GlobalHandle
• 0x48d298 GlobalLock
• 0x48d29c GlobalFree
• 0x48d2a0 GlobalFindAtomA
• 0x48d2a4 GlobalDeleteAtom
• 0x48d2a8 GlobalAlloc
• 0x48d2ac GlobalAddAtomA
• 0x48d2b0 GetVersionExA
• 0x48d2b4 GetVersion
• 0x48d2bc GetTickCount
• 0x48d2c0 GetThreadLocale
• 0x48d2c4 GetTempPathA
• 0x48d2cc GetSystemInfo
• 0x48d2d0 GetStringTypeExA
• 0x48d2d4 GetStdHandle
• 0x48d2d8 GetProcAddress
• 0x48d2dc GetModuleHandleA
• 0x48d2e0 GetModuleFileNameA
• 0x48d2e4 GetLocaleInfoA
• 0x48d2e8 GetLocalTime
• 0x48d2ec GetLastError
• 0x48d2f0 GetFullPathNameA
• 0x48d2f4 GetFileSize
• 0x48d2f8 GetExitCodeThread
• 0x48d2fc GetDiskFreeSpaceA
• 0x48d300 GetDateFormatA
• 0x48d304 GetCurrentThreadId
• 0x48d308 GetCurrentProcessId
• 0x48d30c GetCPInfo
• 0x48d310 GetACP
• 0x48d314 FreeResource
• 0x48d31c InterlockedExchange
• 0x48d324 FreeLibrary
• 0x48d328 FormatMessageA
• 0x48d32c FindResourceA
• 0x48d330 FindFirstFileA
• 0x48d334 FindClose
• 0x48d344 EnumCalendarInfoA
• 0x48d350 CreateThread
• 0x48d354 CreateFileA
• 0x48d358 CreateEventA
• 0x48d35c CompareStringA
• 0x48d360 CloseHandle
Library version.dll:
• 0x48d368 VerQueryValueA
• 0x48d370 GetFileVersionInfoA
Library gdi32.dll:
• 0x48d378 UnrealizeObject
• 0x48d37c StretchBlt
• 0x48d380 SetWindowOrgEx
• 0x48d384 SetViewportOrgEx
• 0x48d388 SetTextColor
• 0x48d38c SetStretchBltMode
• 0x48d390 SetROP2
• 0x48d394 SetPixel
• 0x48d398 SetDIBColorTable
• 0x48d39c SetBrushOrgEx
• 0x48d3a0 SetBkMode
• 0x48d3a4 SetBkColor
• 0x48d3a8 SelectPalette
• 0x48d3ac SelectObject
• 0x48d3b0 SaveDC
• 0x48d3b4 RestoreDC
• 0x48d3b8 Rectangle
• 0x48d3bc RectVisible
• 0x48d3c0 RealizePalette
• 0x48d3c4 PatBlt
• 0x48d3c8 MoveToEx
• 0x48d3cc MaskBlt
• 0x48d3d0 LineTo
• 0x48d3d4 IntersectClipRect
• 0x48d3d8 GetWindowOrgEx
• 0x48d3dc GetTextMetricsA
• 0x48d3e8 GetStockObject
• 0x48d3ec GetPixel
• 0x48d3f0 GetPaletteEntries
• 0x48d3f4 GetObjectA
• 0x48d3f8 GetDeviceCaps
• 0x48d3fc GetDIBits
• 0x48d400 GetDIBColorTable
• 0x48d404 GetDCOrgEx
• 0x48d40c GetClipBox
• 0x48d410 GetBrushOrgEx
• 0x48d414 GetBitmapBits
• 0x48d418 ExcludeClipRect
• 0x48d41c DeleteObject
• 0x48d420 DeleteDC
• 0x48d424 CreateSolidBrush
• 0x48d428 CreatePenIndirect
• 0x48d42c CreatePen
• 0x48d430 CreatePalette
• 0x48d438 CreateFontIndirectA
• 0x48d43c CreateDIBitmap
• 0x48d440 CreateDIBSection
• 0x48d444 CreateCompatibleDC
• 0x48d44c CreateBrushIndirect
• 0x48d450 CreateBitmap
• 0x48d454 BitBlt
Library user32.dll:
• 0x48d45c CreateWindowExA
• 0x48d460 WindowFromPoint
• 0x48d464 WinHelpA
• 0x48d468 WaitMessage
• 0x48d46c ValidateRect
• 0x48d470 UpdateWindow
• 0x48d474 UnregisterClassA
• 0x48d478 UnhookWindowsHookEx
• 0x48d47c TranslateMessage
• 0x48d484 TrackPopupMenu
• 0x48d48c ShowWindow
• 0x48d490 ShowScrollBar
• 0x48d494 ShowOwnedPopups
• 0x48d498 ShowCursor
• 0x48d49c SetWindowsHookExA
• 0x48d4a0 SetWindowTextA
• 0x48d4a4 SetWindowPos
• 0x48d4a8 SetWindowPlacement
• 0x48d4ac SetWindowLongA
• 0x48d4b0 SetTimer
• 0x48d4b4 SetScrollRange
• 0x48d4b8 SetScrollPos
• 0x48d4bc SetScrollInfo
• 0x48d4c0 SetRect
• 0x48d4c4 SetPropA
• 0x48d4c8 SetParent
• 0x48d4cc SetMenuItemInfoA
• 0x48d4d0 SetMenu
• 0x48d4d4 SetForegroundWindow
• 0x48d4d8 SetFocus
• 0x48d4dc SetCursor
• 0x48d4e0 SetClassLongA
• 0x48d4e4 SetCapture
• 0x48d4e8 SetActiveWindow
• 0x48d4ec SendMessageA
• 0x48d4f0 ScrollWindow
• 0x48d4f4 ScreenToClient
• 0x48d4f8 RemovePropA
• 0x48d4fc RemoveMenu
• 0x48d500 ReleaseDC
• 0x48d504 ReleaseCapture
• 0x48d510 RegisterClassA
• 0x48d514 RedrawWindow
• 0x48d518 PtInRect
• 0x48d51c PostQuitMessage
• 0x48d520 PostMessageA
• 0x48d524 PeekMessageA
• 0x48d528 OffsetRect
• 0x48d52c OemToCharA
• 0x48d534 MessageBoxA
• 0x48d538 MessageBeep
• 0x48d53c MapWindowPoints
• 0x48d540 MapVirtualKeyA
• 0x48d544 LoadStringA
• 0x48d548 LoadKeyboardLayoutA
• 0x48d54c LoadIconA
• 0x48d550 LoadCursorA
• 0x48d554 LoadBitmapA
• 0x48d558 KillTimer
• 0x48d55c IsZoomed
• 0x48d560 IsWindowVisible
• 0x48d564 IsWindowEnabled
• 0x48d568 IsWindow
• 0x48d56c IsRectEmpty
• 0x48d570 IsIconic
• 0x48d574 IsDialogMessageA
• 0x48d578 IsChild
• 0x48d57c InvalidateRect
• 0x48d580 IntersectRect
• 0x48d584 InsertMenuItemA
• 0x48d588 InsertMenuA
• 0x48d58c InflateRect
• 0x48d594 GetWindowTextA
• 0x48d598 GetWindowRect
• 0x48d59c GetWindowPlacement
• 0x48d5a0 GetWindowLongA
• 0x48d5a4 GetWindowDC
• 0x48d5a8 GetTopWindow
• 0x48d5ac GetSystemMetrics
• 0x48d5b0 GetSystemMenu
• 0x48d5b4 GetSysColorBrush
• 0x48d5b8 GetSysColor
• 0x48d5bc GetSubMenu
• 0x48d5c0 GetScrollRange
• 0x48d5c4 GetScrollPos
• 0x48d5c8 GetScrollInfo
• 0x48d5cc GetPropA
• 0x48d5d0 GetParent
• 0x48d5d4 GetWindow
• 0x48d5d8 GetMessageTime
• 0x48d5dc GetMenuStringA
• 0x48d5e0 GetMenuState
• 0x48d5e4 GetMenuItemInfoA
• 0x48d5e8 GetMenuItemID
• 0x48d5ec GetMenuItemCount
• 0x48d5f0 GetMenu
• 0x48d5f4 GetLastActivePopup
• 0x48d5f8 GetKeyboardState
• 0x48d600 GetKeyboardLayout
• 0x48d604 GetKeyState
• 0x48d608 GetKeyNameTextA
• 0x48d60c GetIconInfo
• 0x48d610 GetForegroundWindow
• 0x48d614 GetFocus
• 0x48d618 GetDlgItem
• 0x48d61c GetDesktopWindow
• 0x48d620 GetDCEx
• 0x48d624 GetDC
• 0x48d628 GetCursorPos
• 0x48d62c GetCursor
• 0x48d630 GetClientRect
• 0x48d634 GetClassNameA
• 0x48d638 GetClassInfoA
• 0x48d63c GetCapture
• 0x48d640 GetActiveWindow
• 0x48d644 FrameRect
• 0x48d648 FindWindowA
• 0x48d64c FillRect
• 0x48d650 EqualRect
• 0x48d654 EnumWindows
• 0x48d658 EnumThreadWindows
• 0x48d65c EndPaint
• 0x48d660 EnableWindow
• 0x48d664 EnableScrollBar
• 0x48d668 EnableMenuItem
• 0x48d66c DrawTextA
• 0x48d670 DrawMenuBar
• 0x48d674 DrawIconEx
• 0x48d678 DrawIcon
• 0x48d67c DrawFrameControl
• 0x48d680 DrawFocusRect
• 0x48d684 DrawEdge
• 0x48d688 DispatchMessageA
• 0x48d68c DestroyWindow
• 0x48d690 DestroyMenu
• 0x48d694 DestroyIcon
• 0x48d698 DestroyCursor
• 0x48d69c DeleteMenu
• 0x48d6a0 DefWindowProcA
• 0x48d6a4 DefMDIChildProcA
• 0x48d6a8 DefFrameProcA
• 0x48d6ac CreatePopupMenu
• 0x48d6b0 CreateMenu
• 0x48d6b4 CreateIcon
• 0x48d6b8 ClientToScreen
• 0x48d6bc CheckMenuItem
• 0x48d6c0 CallWindowProcA
• 0x48d6c4 CallNextHookEx
• 0x48d6c8 BeginPaint
• 0x48d6cc CharNextA
• 0x48d6d0 CharLowerBuffA
• 0x48d6d4 CharLowerA
• 0x48d6d8 CharUpperBuffA
• 0x48d6dc CharToOemA
• 0x48d6e0 AdjustWindowRectEx
Library kernel32.dll:
• 0x48d6ec Sleep
Library oleaut32.dll:
• 0x48d6f4 SafeArrayPtrOfIndex
• 0x48d6f8 SafeArrayGetUBound
• 0x48d6fc SafeArrayGetLBound
• 0x48d700 SafeArrayCreate
• 0x48d704 VariantChangeType
• 0x48d708 VariantCopy
• 0x48d70c VariantClear
• 0x48d710 VariantInit
Library comctl32.dll:
• 0x48d720 ImageList_Write
• 0x48d724 ImageList_Read
• 0x48d734 ImageList_DragMove
• 0x48d738 ImageList_DragLeave
• 0x48d73c ImageList_DragEnter
• 0x48d740 ImageList_EndDrag
• 0x48d744 ImageList_BeginDrag
• 0x48d748 ImageList_Remove
• 0x48d74c ImageList_DrawEx
• 0x48d750 ImageList_Replace
• 0x48d754 ImageList_Draw
• 0x48d764 ImageList_Add
• 0x48d76c ImageList_Destroy
• 0x48d770 ImageList_Create
• 0x48d774 InitCommonControls
Library comdlg32.dll:
• 0x48d77c GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 57874 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 49238 239.255.255.250 1900
192.168.56.101 50003 239.255.255.250 3702
192.168.56.101 50005 239.255.255.250 3702
192.168.56.101 51809 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.