2.6
中危
43 个模型检测该样本为恶意！
重新分析
更多

639331fab1d0a1a1a62f8ef946be211cedde4798aaca8f5ba4767273d324da34

5eeb2b2ed6c1579ad09af20f38bcf905.exe

分析耗时

13s

最近分析

文件大小

1020.5KB
静态报毒 动态报毒 100% AI SCORE=81 AIDETECTVM CONFIDENCE DELFINJECT DLLJTT ELDORADO EPF+UYH79+4 FLYSTUDIO GENASA GENERICKD GENERICR GOFOT GRAYWARE HIGH CONFIDENCE LX0C MALICIOUS PE MALWARE1 NABI78USMNP QQWARE RA@1QRAUG SCORE STATIC AI UNSAFE YMACCO ZUSY 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee GenericR-CUA!5EEB2B2ED6C1 20201211 6.0.6.653
Alibaba Trojan:Win32/QQWare.4e5e7910 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Avast 20201210 21.1.5827.0
Tencent 20201211 1.0.0.1
Kingsoft 20201211 2017.9.26.565
行为判定
动态指标
Foreign language identified in PE resource (50 out of 52 个事件)
name TEXTINCLUDE language LANG_CHINESE offset 0x00125bd0 filetype C source, ASCII text, with CRLF line terminators sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000151
name TEXTINCLUDE language LANG_CHINESE offset 0x00125bd0 filetype C source, ASCII text, with CRLF line terminators sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000151
name TEXTINCLUDE language LANG_CHINESE offset 0x00125bd0 filetype C source, ASCII text, with CRLF line terminators sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000151
name RT_CURSOR language LANG_CHINESE offset 0x001260c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x000000b4
name RT_CURSOR language LANG_CHINESE offset 0x001260c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x000000b4
name RT_CURSOR language LANG_CHINESE offset 0x001260c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x000000b4
name RT_CURSOR language LANG_CHINESE offset 0x001260c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x000000b4
name RT_BITMAP language LANG_CHINESE offset 0x00127934 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000144
name RT_BITMAP language LANG_CHINESE offset 0x00127934 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000144
name RT_BITMAP language LANG_CHINESE offset 0x00127934 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000144
name RT_BITMAP language LANG_CHINESE offset 0x00127934 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000144
name RT_BITMAP language LANG_CHINESE offset 0x00127934 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000144
name RT_BITMAP language LANG_CHINESE offset 0x00127934 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000144
name RT_BITMAP language LANG_CHINESE offset 0x00127934 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000144
name RT_BITMAP language LANG_CHINESE offset 0x00127934 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000144
name RT_BITMAP language LANG_CHINESE offset 0x00127934 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000144
name RT_BITMAP language LANG_CHINESE offset 0x00127934 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000144
name RT_BITMAP language LANG_CHINESE offset 0x00127934 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000144
name RT_BITMAP language LANG_CHINESE offset 0x00127934 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000144
name RT_BITMAP language LANG_CHINESE offset 0x00127934 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000144
name RT_BITMAP language LANG_CHINESE offset 0x00127934 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000144
name RT_BITMAP language LANG_CHINESE offset 0x00127934 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000144
name RT_MENU language LANG_CHINESE offset 0x0012a43c filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000284
name RT_MENU language LANG_CHINESE offset 0x0012a43c filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000284
name RT_DIALOG language LANG_CHINESE offset 0x0012b684 filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x0000018c
name RT_DIALOG language LANG_CHINESE offset 0x0012b684 filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x0000018c
name RT_DIALOG language LANG_CHINESE offset 0x0012b684 filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x0000018c
name RT_DIALOG language LANG_CHINESE offset 0x0012b684 filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x0000018c
name RT_DIALOG language LANG_CHINESE offset 0x0012b684 filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x0000018c
name RT_DIALOG language LANG_CHINESE offset 0x0012b684 filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x0000018c
name RT_DIALOG language LANG_CHINESE offset 0x0012b684 filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x0000018c
name RT_DIALOG language LANG_CHINESE offset 0x0012b684 filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x0000018c
name RT_DIALOG language LANG_CHINESE offset 0x0012b684 filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x0000018c
name RT_DIALOG language LANG_CHINESE offset 0x0012b684 filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x0000018c
name RT_STRING language LANG_CHINESE offset 0x0012c0cc filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x0012c0cc filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x0012c0cc filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x0012c0cc filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x0012c0cc filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x0012c0cc filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x0012c0cc filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x0012c0cc filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x0012c0cc filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x0012c0cc filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x0012c0cc filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_GROUP_CURSOR language LANG_CHINESE offset 0x0012c118 filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000022
name RT_GROUP_CURSOR language LANG_CHINESE offset 0x0012c118 filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000022
name RT_GROUP_CURSOR language LANG_CHINESE offset 0x0012c118 filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000022
name RT_GROUP_ICON language LANG_CHINESE offset 0x0012c164 filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000014
name RT_GROUP_ICON language LANG_CHINESE offset 0x0012c164 filetype empty sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000014
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
File has been identified by 43 AntiVirus engines on VirusTotal as malicious (43 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.43277754
FireEye Generic.mg.5eeb2b2ed6c1579a
McAfee GenericR-CUA!5EEB2B2ED6C1
Cylance Unsafe
K7AntiVirus Trojan ( 005246d51 )
Alibaba Trojan:Win32/QQWare.4e5e7910
K7GW Trojan ( 005246d51 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Generic.D2945DBA
Cyren W32/S-47c1ea66!Eldorado
Symantec Trojan.Gen.MBT
APEX Malicious
Paloalto generic.ml
ClamAV Win.Malware.Zusy-6840460-0
BitDefender Trojan.GenericKD.43277754
NANO-Antivirus Trojan.Win32.Dwn.dlljtt
Ad-Aware Trojan.GenericKD.43277754
Sophos Mal/Generic-S
Comodo Worm.Win32.Dropper.RA@1qraug
F-Secure Trojan:W32/DelfInject.R
DrWeb Trojan.DownLoader11.39612
Zillya Trojan.QQWare.Win32.1084
McAfee-GW-Edition BehavesLike.Win32.Generic.fh
Emsisoft Trojan.GenericKD.43277754 (B)
SentinelOne Static AI - Malicious PE
Antiy-AVL GrayWare/Win32.FlyStudio.a
Microsoft Trojan:Win32/Ymacco.AA63
AegisLab Trojan.Win32.Generic.lx0C
GData Trojan.GenericKD.43277754
Cynet Malicious (score: 100)
Acronis suspicious
ALYac Trojan.GenericKD.43277754
MAX malware (ai score=81)
ESET-NOD32 a variant of Win32/QQWare.AA
Rising Trojan.QQWare!8.105 (TFE:5:naBI78uSmNP)
Yandex Trojan.GenAsa!EpF+UYh79+4
Ikarus Trojan.Win32.QQWare
eGambit Unsafe.AI_Score_99%
Fortinet W32/QQWare.AA!tr
MaxSecure CORRUPT:Trojan.Gofot.ges
Cybereason malicious.58772b
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2014-12-30 13:30:29

Imports

Library WINMM.dll:
• 0x4c66c4 waveOutWrite
• 0x4c66c8 waveOutPause
• 0x4c66cc waveOutReset
• 0x4c66d0 waveOutClose
• 0x4c66d4 waveOutGetNumDevs
• 0x4c66d8 waveOutOpen
• 0x4c66e0 midiStreamProperty
• 0x4c66e8 midiStreamOut
• 0x4c66ec midiStreamStop
• 0x4c66f0 midiOutReset
• 0x4c66f4 midiStreamClose
• 0x4c66f8 midiStreamRestart
• 0x4c66fc midiStreamOpen
Library WS2_32.dll:
• 0x4c6714 accept
• 0x4c6718 getpeername
• 0x4c671c recv
• 0x4c6720 ioctlsocket
• 0x4c6724 recvfrom
• 0x4c6728 inet_ntoa
• 0x4c672c WSACleanup
• 0x4c6730 closesocket
• 0x4c6734 WSAAsyncSelect
Library KERNEL32.dll:
• 0x4c6188 GetVersion
• 0x4c618c InterlockedExchange
• 0x4c6190 SetStdHandle
• 0x4c6194 IsBadCodePtr
• 0x4c6198 IsBadReadPtr
• 0x4c619c CompareStringW
• 0x4c61a0 CompareStringA
• 0x4c61a4 GetStringTypeW
• 0x4c61a8 GetStringTypeA
• 0x4c61b0 IsBadWritePtr
• 0x4c61b4 VirtualAlloc
• 0x4c61b8 LCMapStringW
• 0x4c61bc LCMapStringA
• 0x4c61c4 VirtualFree
• 0x4c61c8 HeapCreate
• 0x4c61cc HeapDestroy
• 0x4c61d4 GetFileType
• 0x4c61d8 GetStdHandle
• 0x4c61dc SetHandleCount
• 0x4c61f4 GetACP
• 0x4c61f8 HeapSize
• 0x4c61fc RaiseException
• 0x4c6200 GetLocalTime
• 0x4c6204 GetSystemTime
• 0x4c6208 RtlUnwind
• 0x4c620c GetStartupInfoA
• 0x4c6210 GetOEMCP
• 0x4c6214 GetCPInfo
• 0x4c6218 GetProcessVersion
• 0x4c621c SetErrorMode
• 0x4c6220 GlobalFlags
• 0x4c6224 GetCurrentThread
• 0x4c6228 GetFileTime
• 0x4c622c TlsGetValue
• 0x4c6230 LocalReAlloc
• 0x4c6234 TlsSetValue
• 0x4c6238 TlsFree
• 0x4c623c GlobalHandle
• 0x4c6240 TlsAlloc
• 0x4c6244 LocalAlloc
• 0x4c6248 lstrcmpA
• 0x4c624c GlobalGetAtomNameA
• 0x4c6250 GlobalAddAtomA
• 0x4c6254 GlobalFindAtomA
• 0x4c6258 GlobalDeleteAtom
• 0x4c625c lstrcmpiA
• 0x4c6260 GetThreadLocale
• 0x4c6264 SetEndOfFile
• 0x4c6268 UnlockFile
• 0x4c626c LockFile
• 0x4c6270 FlushFileBuffers
• 0x4c6274 DuplicateHandle
• 0x4c6278 lstrcpynA
• 0x4c6284 FormatMessageA
• 0x4c6288 LocalFree
• 0x4c628c WideCharToMultiByte
• 0x4c6298 CloseHandle
• 0x4c629c WaitForSingleObject
• 0x4c62a0 CreateProcessA
• 0x4c62a4 GetTickCount
• 0x4c62a8 GetCommandLineA
• 0x4c62ac MulDiv
• 0x4c62b0 GetProcAddress
• 0x4c62b4 GetModuleHandleA
• 0x4c62c0 GetFileAttributesA
• 0x4c62c4 FindClose
• 0x4c62c8 FindFirstFileA
• 0x4c62cc GlobalUnlock
• 0x4c62d0 GlobalLock
• 0x4c62d4 GlobalAlloc
• 0x4c62d8 Sleep
• 0x4c62dc CreateEventA
• 0x4c62e0 CreateThread
• 0x4c62ec GetVersionExA
• 0x4c62f4 SetLastError
• 0x4c62f8 MultiByteToWideChar
• 0x4c62fc TerminateProcess
• 0x4c6300 GetCurrentProcess
• 0x4c6304 GetFileSize
• 0x4c6308 SetFilePointer
• 0x4c630c CreateSemaphoreA
• 0x4c6310 ResumeThread
• 0x4c6314 ReleaseSemaphore
• 0x4c6320 GetProfileStringA
• 0x4c6324 WriteFile
• 0x4c6328 ReadFile
• 0x4c632c GetLastError
• 0x4c6334 CreateFileA
• 0x4c6338 SetEvent
• 0x4c633c FindResourceA
• 0x4c6340 LoadResource
• 0x4c6344 LockResource
• 0x4c6348 GetModuleFileNameA
• 0x4c634c GetCurrentThreadId
• 0x4c6350 ExitProcess
• 0x4c6354 GlobalSize
• 0x4c6358 GlobalFree
• 0x4c6364 lstrcatA
• 0x4c6368 WinExec
• 0x4c636c lstrcpyA
• 0x4c6370 FindNextFileA
• 0x4c6374 GlobalReAlloc
• 0x4c6378 HeapFree
• 0x4c637c HeapReAlloc
• 0x4c6380 GetProcessHeap
• 0x4c6384 HeapAlloc
• 0x4c6388 GetUserDefaultLCID
• 0x4c638c GetFullPathNameA
• 0x4c6390 FreeLibrary
• 0x4c6394 LoadLibraryA
• 0x4c6398 lstrlenA
• 0x4c639c lstrlenW
Library USER32.dll:
• 0x4c6414 DrawIconEx
• 0x4c6424 SetRectEmpty
• 0x4c6428 DispatchMessageA
• 0x4c642c GetMessageA
• 0x4c6430 WindowFromPoint
• 0x4c6434 DrawFocusRect
• 0x4c6438 DrawEdge
• 0x4c643c DrawFrameControl
• 0x4c6440 LoadIconA
• 0x4c6444 TranslateMessage
• 0x4c6448 CreateMenu
• 0x4c644c CreatePopupMenu
• 0x4c6450 GetSubMenu
• 0x4c6454 EnableMenuItem
• 0x4c6458 GetDesktopWindow
• 0x4c645c CloseClipboard
• 0x4c6460 GetClipboardData
• 0x4c6464 OpenClipboard
• 0x4c6468 SetClipboardData
• 0x4c646c GetClassNameA
• 0x4c6470 FindWindowA
• 0x4c6474 GetDlgItem
• 0x4c6478 FindWindowExA
• 0x4c647c AppendMenuA
• 0x4c6480 ModifyMenuA
• 0x4c6488 GetDlgCtrlID
• 0x4c648c wsprintfA
• 0x4c6490 WaitForInputIdle
• 0x4c6494 GetWindowTextA
• 0x4c649c ClientToScreen
• 0x4c64a4 LoadImageA
• 0x4c64a8 ShowWindow
• 0x4c64ac IsWindowEnabled
• 0x4c64b4 GetKeyState
• 0x4c64bc PostQuitMessage
• 0x4c64c0 IsZoomed
• 0x4c64c4 GetSystemMenu
• 0x4c64c8 DeleteMenu
• 0x4c64cc GetClassInfoA
• 0x4c64d0 DefWindowProcA
• 0x4c64d4 GetMenu
• 0x4c64d8 SetMenu
• 0x4c64dc PeekMessageA
• 0x4c64e0 IsIconic
• 0x4c64e4 SetFocus
• 0x4c64e8 GetActiveWindow
• 0x4c64ec GetWindow
• 0x4c64f4 SetWindowRgn
• 0x4c64f8 GetMessagePos
• 0x4c64fc ScreenToClient
• 0x4c6504 CopyRect
• 0x4c6508 LoadBitmapA
• 0x4c650c WinHelpA
• 0x4c6510 KillTimer
• 0x4c6514 SetTimer
• 0x4c6518 ReleaseCapture
• 0x4c651c GetCapture
• 0x4c6520 SetCapture
• 0x4c6524 GetScrollRange
• 0x4c6528 SetScrollRange
• 0x4c652c SetScrollPos
• 0x4c6530 InflateRect
• 0x4c6534 SetRect
• 0x4c6538 IntersectRect
• 0x4c653c DestroyIcon
• 0x4c6540 PtInRect
• 0x4c6544 OffsetRect
• 0x4c6548 IsWindowVisible
• 0x4c654c EnableWindow
• 0x4c6550 RedrawWindow
• 0x4c6554 GetWindowLongA
• 0x4c6558 SetWindowLongA
• 0x4c655c GetSysColor
• 0x4c6560 SetActiveWindow
• 0x4c6564 SetCursorPos
• 0x4c6568 LoadCursorA
• 0x4c656c SetCursor
• 0x4c6570 GetDC
• 0x4c6574 FillRect
• 0x4c6578 IsRectEmpty
• 0x4c657c ReleaseDC
• 0x4c6580 IsChild
• 0x4c6584 TrackPopupMenu
• 0x4c6588 DestroyMenu
• 0x4c658c SetForegroundWindow
• 0x4c6590 GetWindowRect
• 0x4c6594 EqualRect
• 0x4c6598 UpdateWindow
• 0x4c659c ValidateRect
• 0x4c65a0 InvalidateRect
• 0x4c65a4 LockWindowUpdate
• 0x4c65a8 GetClientRect
• 0x4c65ac GetFocus
• 0x4c65b0 GetParent
• 0x4c65b4 GetTopWindow
• 0x4c65b8 PostMessageA
• 0x4c65bc IsWindow
• 0x4c65c0 SetParent
• 0x4c65c4 DestroyCursor
• 0x4c65c8 SendMessageA
• 0x4c65cc SetWindowPos
• 0x4c65d0 MessageBeep
• 0x4c65d4 MessageBoxA
• 0x4c65d8 GetCursorPos
• 0x4c65dc GetSystemMetrics
• 0x4c65e0 EmptyClipboard
• 0x4c65e8 CharUpperA
• 0x4c65ec GetWindowDC
• 0x4c65f0 BeginPaint
• 0x4c65f4 EndPaint
• 0x4c65f8 TabbedTextOutA
• 0x4c65fc DrawTextA
• 0x4c6600 GrayStringA
• 0x4c6604 DestroyWindow
• 0x4c660c EndDialog
• 0x4c6610 GetNextDlgTabItem
• 0x4c6614 GetWindowPlacement
• 0x4c661c GetForegroundWindow
• 0x4c6620 GetLastActivePopup
• 0x4c6624 GetMessageTime
• 0x4c6628 RemovePropA
• 0x4c662c CallWindowProcA
• 0x4c6630 GetPropA
• 0x4c6634 UnhookWindowsHookEx
• 0x4c6638 SetPropA
• 0x4c663c GetClassLongA
• 0x4c6640 CallNextHookEx
• 0x4c6644 SetWindowsHookExA
• 0x4c6648 CreateWindowExA
• 0x4c664c GetMenuItemID
• 0x4c6650 GetMenuItemCount
• 0x4c6654 RegisterClassA
• 0x4c6658 GetScrollPos
• 0x4c665c ShowScrollBar
• 0x4c6660 SetScrollInfo
• 0x4c6664 GetScrollInfo
• 0x4c6668 ScrollWindow
• 0x4c666c AdjustWindowRectEx
• 0x4c6670 MapWindowPoints
• 0x4c6674 SendDlgItemMessageA
• 0x4c6678 ScrollWindowEx
• 0x4c667c IsDialogMessageA
• 0x4c6680 SetWindowTextA
• 0x4c6684 MoveWindow
• 0x4c6688 CheckMenuItem
• 0x4c668c SetMenuItemBitmaps
• 0x4c6690 GetMenuState
• 0x4c6698 LoadStringA
• 0x4c669c GetSysColorBrush
• 0x4c66a0 CharNextA
• 0x4c66a8 MapDialogRect
• 0x4c66ac GetNextDlgGroupItem
• 0x4c66b0 PostThreadMessageA
• 0x4c66b4 UnregisterClassA
Library GDI32.dll:
• 0x4c6038 SaveDC
• 0x4c603c RestoreDC
• 0x4c6040 SetBkMode
• 0x4c6044 SetPolyFillMode
• 0x4c6048 SetROP2
• 0x4c604c SetTextColor
• 0x4c6050 SetMapMode
• 0x4c6054 SetViewportOrgEx
• 0x4c6058 OffsetViewportOrgEx
• 0x4c605c SetViewportExtEx
• 0x4c6060 ScaleViewportExtEx
• 0x4c6064 SetWindowOrgEx
• 0x4c6068 SetWindowExtEx
• 0x4c606c ScaleWindowExtEx
• 0x4c6070 ExcludeClipRect
• 0x4c6074 GetClipBox
• 0x4c6078 MoveToEx
• 0x4c607c LineTo
• 0x4c6080 ExtSelectClipRgn
• 0x4c6084 GetViewportExtEx
• 0x4c6088 PtVisible
• 0x4c608c RectVisible
• 0x4c6090 TextOutA
• 0x4c6094 ExtTextOutA
• 0x4c6098 Escape
• 0x4c609c GetTextMetricsA
• 0x4c60a0 GetTextColor
• 0x4c60a4 SetBkColor
• 0x4c60ac SetStretchBltMode
• 0x4c60b0 GetClipRgn
• 0x4c60b4 CreatePolygonRgn
• 0x4c60b8 SelectClipRgn
• 0x4c60bc DeleteObject
• 0x4c60c0 CreateDIBitmap
• 0x4c60c8 CreatePalette
• 0x4c60cc StretchBlt
• 0x4c60d0 SelectPalette
• 0x4c60d4 RealizePalette
• 0x4c60d8 GetDIBits
• 0x4c60dc GetWindowExtEx
• 0x4c60e0 GetViewportOrgEx
• 0x4c60e4 GetWindowOrgEx
• 0x4c60e8 BeginPath
• 0x4c60ec EndPath
• 0x4c60f0 PathToRegion
• 0x4c60f4 CreateEllipticRgn
• 0x4c60f8 CreateRoundRectRgn
• 0x4c60fc GetMapMode
• 0x4c6100 GetBkMode
• 0x4c6104 GetBkColor
• 0x4c6108 GetROP2
• 0x4c610c GetStretchBltMode
• 0x4c6110 GetPolyFillMode
• 0x4c6118 CreateDCA
• 0x4c611c CreateBitmap
• 0x4c6120 SelectObject
• 0x4c6124 CreatePen
• 0x4c6128 PatBlt
• 0x4c612c FillRgn
• 0x4c6130 CreateRectRgn
• 0x4c6134 CombineRgn
• 0x4c6138 CreateSolidBrush
• 0x4c613c CreateFontIndirectA
• 0x4c6140 GetStockObject
• 0x4c6144 GetObjectA
• 0x4c6148 EndPage
• 0x4c614c EndDoc
• 0x4c6150 DeleteDC
• 0x4c6154 StartDocA
• 0x4c6158 StartPage
• 0x4c615c BitBlt
• 0x4c6160 CreateCompatibleDC
• 0x4c6164 Ellipse
• 0x4c6168 Rectangle
• 0x4c616c LPtoDP
• 0x4c6170 DPtoLP
• 0x4c6174 GetCurrentObject
• 0x4c6178 RoundRect
• 0x4c6180 GetDeviceCaps
Library WINSPOOL.DRV:
• 0x4c6704 OpenPrinterA
• 0x4c6708 DocumentPropertiesA
• 0x4c670c ClosePrinter
Library ADVAPI32.dll:
• 0x4c6000 RegCloseKey
• 0x4c6004 RegOpenKeyExA
• 0x4c6008 RegSetValueExA
• 0x4c600c RegQueryValueA
• 0x4c6010 RegCreateKeyExA
• 0x4c6014 RegQueryValueExA
Library SHELL32.dll:
• 0x4c6408 ShellExecuteA
• 0x4c640c Shell_NotifyIconA
Library ole32.dll:
• 0x4c675c CoRevokeClassObject
• 0x4c6760 OleFlushClipboard
• 0x4c676c CoGetClassObject
• 0x4c6770 CoDisconnectObject
• 0x4c6774 CoTaskMemFree
• 0x4c6778 CoTaskMemAlloc
• 0x4c677c CLSIDFromProgID
• 0x4c6780 OleRun
• 0x4c6784 CoCreateInstance
• 0x4c6788 CLSIDFromString
• 0x4c678c OleUninitialize
• 0x4c6790 OleInitialize
Library OLEAUT32.dll:
• 0x4c63a8 SysStringLen
• 0x4c63ac SysAllocStringLen
• 0x4c63b8 SysFreeString
• 0x4c63bc UnRegisterTypeLib
• 0x4c63c4 LoadTypeLib
• 0x4c63c8 LHashValOfNameSys
• 0x4c63cc RegisterTypeLib
• 0x4c63d0 SafeArrayCreate
• 0x4c63d4 SysAllocString
• 0x4c63d8 VariantInit
• 0x4c63dc VariantCopyInd
• 0x4c63e0 SafeArrayGetElement
• 0x4c63e4 SafeArrayAccessData
• 0x4c63ec SafeArrayGetDim
• 0x4c63f0 SafeArrayGetLBound
• 0x4c63f4 SafeArrayGetUBound
• 0x4c63f8 VariantChangeType
• 0x4c63fc VariantClear
• 0x4c6400 VariantCopy
Library COMCTL32.dll:
• 0x4c6024
• 0x4c6028 ImageList_Destroy
• 0x4c602c ImageList_Read
• 0x4c6030 ImageList_Duplicate
Library oledlg.dll:
• 0x4c679c
Library comdlg32.dll:
• 0x4c673c ChooseColorA
• 0x4c6740 GetOpenFileNameA
• 0x4c6744 GetSaveFileNameA
• 0x4c6748 GetFileTitleA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 51378 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 57874 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 49236 239.255.255.250 3702
192.168.56.101 51966 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.