6.8
高危
53 个模型检测该样本为恶意！
重新分析
更多

31ad6bd63545c5f7598288a195d2cd7a488c199bd09ee3b5caeb9865cf9586fa

68dc4540599e43d1c4845cec480aac3b.exe

分析耗时

40s

最近分析

文件大小

788.5KB
静态报毒 动态报毒 1BK8UAZ AI SCORE=89 AIDETECTVM ALI2000015 ANDROM BSCOPE CLASSIC CONFIDENCE CRYPTIH CUGE DELFINJECT DELPHILESS EMZL EOPD FAREIT GENERICKD GENETIC GENKRYPTIK HIGH CONFIDENCE HRLVEZ JGIOT KRADDARE KRYPTIK MALWARE2 R002C0DHA20 S15461267 SCORE SMDD SPYBOTNET UNCLASSIFIEDMALWARE@0 UNSAFE WRQY X2091 XGW@AM0SAJHI ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Baidu 20190318 1.0.0.2
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
Tencent Win32.Trojan.Crypt.Wrqy 20200831 1.0.0.1
Kingsoft 20200831 2013.8.14.323
McAfee Fareit-FPQ!68DC4540599E 20200830 6.0.6.653
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619610633.422375
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x739ae97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x739aea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x739ab25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x739ab4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x739aac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x739aaed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x739a5511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x739a559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74067f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74064de3
68dc4540599e43d1c4845cec480aac3b+0x5aa4d @ 0x45aa4d
68dc4540599e43d1c4845cec480aac3b+0x53254 @ 0x453254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfcdb14ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619610631.23475
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003f0000
success 0 0
1619610631.48475
NtProtectVirtualMemory
process_identifier: 2344
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 81920
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00466000
success 0 0
1619610631.48475
NtAllocateVirtualMemory
process_identifier: 2344
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01fa0000
success 0 0
1619610632.187375
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619610632.218375
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 851968
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01ed0000
success 0 0
1619610632.218375
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f60000
success 0 0
1619610632.218375
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 335872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00510000
success 0 0
1619610632.218375
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 307200
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00512000
success 0 0
1619610632.656375
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 851968
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02060000
success 0 0
1619610632.656375
NtAllocateVirtualMemory
process_identifier: 2856
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020f0000
success 0 0
1619610633.406375
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00592000
success 0 0
1619610633.406375
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619610633.406375
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00592000
success 0 0
1619610633.406375
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619610633.406375
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00592000
success 0 0
1619610633.406375
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619610633.406375
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00592000
success 0 0
1619610633.406375
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619610633.406375
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00592000
success 0 0
1619610633.406375
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619610633.406375
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00592000
success 0 0
1619610633.406375
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619610633.406375
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00592000
success 0 0
1619610633.406375
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619610633.406375
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00592000
success 0 0
1619610633.406375
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619610633.406375
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00592000
success 0 0
1619610633.406375
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619610633.406375
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00592000
success 0 0
1619610633.406375
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.5371870685402875 section {'size_of_data': '0x00041800', 'virtual_address': '0x00089000', 'entropy': 7.5371870685402875, 'name': '.rsrc', 'virtual_size': '0x000417cc'} description A section with a high entropy has been found
entropy 0.3326984126984127 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2344 called NtSetContextThread to modify thread in remote process 2856
Time & API Arguments Status Return Repeated
1619610631.96875
NtSetContextThread
thread_handle: 0x00000100
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907488
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2856
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2344 resumed a thread in remote process 2856
Time & API Arguments Status Return Repeated
1619610632.03175
NtResumeThread
thread_handle: 0x00000100
suspend_count: 1
process_identifier: 2856
success 0 0
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.24.14:443
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619610631.95375
CreateProcessInternalW
thread_identifier: 2760
thread_handle: 0x00000100
process_identifier: 2856
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\68dc4540599e43d1c4845cec480aac3b.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000104
inherit_handles: 0
success 1 0
1619610631.95375
NtUnmapViewOfSection
process_identifier: 2856
region_size: 4096
process_handle: 0x00000104
base_address: 0x00400000
success 0 0
1619610631.95375
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 2856
commit_size: 720896
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000104
allocation_type: 0 ()
section_offset: 0
view_size: 720896
base_address: 0x00400000
success 0 0
1619610631.96875
NtGetContextThread
thread_handle: 0x00000100
success 0 0
1619610631.96875
NtSetContextThread
thread_handle: 0x00000100
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907488
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2856
success 0 0
1619610632.03175
NtResumeThread
thread_handle: 0x00000100
suspend_count: 1
process_identifier: 2856
success 0 0
File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.43635946
FireEye Generic.mg.68dc4540599e43d1
CAT-QuickHeal Trojan.CryptIH.S15461267
ALYac Trojan.GenericKD.43635946
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
AegisLab Trojan.Multi.Generic.4!c
K7AntiVirus Riskware ( 0040eff71 )
BitDefender Trojan.GenericKD.43635946
K7GW Riskware ( 0040eff71 )
Cybereason malicious.33562f
Invincea heuristic
Cyren W32/Injector.CUGE-8085
Symantec Trojan.Gen.2
APEX Malicious
Paloalto generic.ml
ClamAV Win.Dropper.Smdd-6956905-0
Kaspersky HEUR:Trojan.Win32.Crypt.gen
Alibaba Trojan:Win32/DelfInject.ali2000015
NANO-Antivirus Trojan.Win32.Crypt.hrlvez
Tencent Win32.Trojan.Crypt.Wrqy
Ad-Aware Trojan.GenericKD.43635946
Comodo .UnclassifiedMalware@0
F-Secure Trojan.TR/Kryptik.jgiot
DrWeb BackDoor.SpyBotNET.25
Zillya Trojan.Crypt.Win32.65023
TrendMicro TROJ_GEN.R002C0DHA20
Sophos Mal/Generic-S
GData Win32.Trojan.PSE.1BK8UAZ
Jiangmin Trojan.Crypt.dwe
Avira TR/Kryptik.jgiot
MAX malware (ai score=89)
Antiy-AVL Trojan/Win32.Crypt
Arcabit Trojan.Generic.D299D4EA
ZoneAlarm HEUR:Trojan.Win32.Crypt.gen
Microsoft Trojan:Win32/Androm.VD!MTB
Cynet Malicious (score: 90)
AhnLab-V3 Suspicious/Win.Delphiless.X2091
McAfee Fareit-FPQ!68DC4540599E
VBA32 BScope.Adware.Kraddare
Malwarebytes Trojan.MalPack.DLF
ESET-NOD32 a variant of Win32/GenKryptik.EOPD
TrendMicro-HouseCall TROJ_GEN.R002C0DHA20
Rising Trojan.Kryptik!1.CA3B (CLASSIC)
Ikarus Trojan.Inject
eGambit Unsafe.AI_Score_99%
Fortinet W32/Injector.EMZL!tr
BitDefenderTheta Gen:NN.ZelphiF.34196.XGW@am0sAjhi
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x47d150 VirtualFree
• 0x47d154 VirtualAlloc
• 0x47d158 LocalFree
• 0x47d15c LocalAlloc
• 0x47d160 GetVersion
• 0x47d164 GetCurrentThreadId
• 0x47d170 VirtualQuery
• 0x47d174 WideCharToMultiByte
• 0x47d17c MultiByteToWideChar
• 0x47d180 lstrlenA
• 0x47d184 lstrcpynA
• 0x47d188 LoadLibraryExA
• 0x47d18c GetThreadLocale
• 0x47d190 GetStartupInfoA
• 0x47d194 GetProcAddress
• 0x47d198 GetModuleHandleA
• 0x47d19c GetModuleFileNameA
• 0x47d1a0 GetLocaleInfoA
• 0x47d1a4 GetLastError
• 0x47d1ac GetCommandLineA
• 0x47d1b0 FreeLibrary
• 0x47d1b4 FindFirstFileA
• 0x47d1b8 FindClose
• 0x47d1bc ExitProcess
• 0x47d1c0 WriteFile
• 0x47d1c8 RtlUnwind
• 0x47d1cc RaiseException
• 0x47d1d0 GetStdHandle
Library user32.dll:
• 0x47d1d8 GetKeyboardType
• 0x47d1dc LoadStringA
• 0x47d1e0 MessageBoxA
• 0x47d1e4 CharNextA
Library advapi32.dll:
• 0x47d1ec RegQueryValueExA
• 0x47d1f0 RegOpenKeyExA
• 0x47d1f4 RegCloseKey
Library oleaut32.dll:
• 0x47d1fc SysFreeString
• 0x47d200 SysReAllocStringLen
• 0x47d204 SysAllocStringLen
Library kernel32.dll:
• 0x47d20c TlsSetValue
• 0x47d210 TlsGetValue
• 0x47d214 LocalAlloc
• 0x47d218 GetModuleHandleA
Library advapi32.dll:
• 0x47d220 RegQueryValueExA
• 0x47d224 RegOpenKeyExA
• 0x47d228 RegCloseKey
Library kernel32.dll:
• 0x47d230 lstrcpyA
• 0x47d234 WriteFile
• 0x47d238 WaitForSingleObject
• 0x47d23c VirtualQuery
• 0x47d240 VirtualProtect
• 0x47d244 VirtualAlloc
• 0x47d248 Sleep
• 0x47d24c SizeofResource
• 0x47d250 SetThreadLocale
• 0x47d254 SetFilePointer
• 0x47d258 SetEvent
• 0x47d25c SetErrorMode
• 0x47d260 SetEndOfFile
• 0x47d264 ResetEvent
• 0x47d268 ReadFile
• 0x47d26c MulDiv
• 0x47d270 LockResource
• 0x47d274 LoadResource
• 0x47d278 LoadLibraryA
• 0x47d284 GlobalUnlock
• 0x47d288 GlobalReAlloc
• 0x47d28c GlobalHandle
• 0x47d290 GlobalLock
• 0x47d294 GlobalFree
• 0x47d298 GlobalFindAtomA
• 0x47d29c GlobalDeleteAtom
• 0x47d2a0 GlobalAlloc
• 0x47d2a4 GlobalAddAtomA
• 0x47d2a8 GetVersionExA
• 0x47d2ac GetVersion
• 0x47d2b0 GetTickCount
• 0x47d2b4 GetThreadLocale
• 0x47d2bc GetSystemInfo
• 0x47d2c0 GetStringTypeExA
• 0x47d2c4 GetStdHandle
• 0x47d2c8 GetProcAddress
• 0x47d2cc GetModuleHandleA
• 0x47d2d0 GetModuleFileNameA
• 0x47d2d4 GetLocaleInfoA
• 0x47d2d8 GetLocalTime
• 0x47d2dc GetLastError
• 0x47d2e0 GetFullPathNameA
• 0x47d2e4 GetFileAttributesA
• 0x47d2e8 GetDiskFreeSpaceA
• 0x47d2ec GetDateFormatA
• 0x47d2f0 GetCurrentThreadId
• 0x47d2f4 GetCurrentProcessId
• 0x47d2f8 GetCPInfo
• 0x47d2fc GetACP
• 0x47d300 FreeResource
• 0x47d304 InterlockedExchange
• 0x47d308 FreeLibrary
• 0x47d30c FormatMessageA
• 0x47d310 FindResourceA
• 0x47d314 FindNextFileA
• 0x47d318 FindFirstFileA
• 0x47d31c FindClose
• 0x47d32c EnumCalendarInfoA
• 0x47d338 CreateThread
• 0x47d33c CreateFileA
• 0x47d340 CreateEventA
• 0x47d344 CompareStringA
• 0x47d348 CloseHandle
Library version.dll:
• 0x47d350 VerQueryValueA
• 0x47d358 GetFileVersionInfoA
Library gdi32.dll:
• 0x47d360 UnrealizeObject
• 0x47d364 StretchBlt
• 0x47d368 SetWindowOrgEx
• 0x47d36c SetWindowExtEx
• 0x47d370 SetWinMetaFileBits
• 0x47d374 SetViewportOrgEx
• 0x47d378 SetViewportExtEx
• 0x47d37c SetTextColor
• 0x47d380 SetStretchBltMode
• 0x47d384 SetROP2
• 0x47d388 SetPixel
• 0x47d38c SetMapMode
• 0x47d390 SetEnhMetaFileBits
• 0x47d394 SetDIBColorTable
• 0x47d398 SetBrushOrgEx
• 0x47d39c SetBkMode
• 0x47d3a0 SetBkColor
• 0x47d3a4 SelectPalette
• 0x47d3a8 SelectObject
• 0x47d3ac SaveDC
• 0x47d3b0 RestoreDC
• 0x47d3b4 Rectangle
• 0x47d3b8 RectVisible
• 0x47d3bc RealizePalette
• 0x47d3c0 Polyline
• 0x47d3c4 PolyPolyline
• 0x47d3c8 PlayEnhMetaFile
• 0x47d3cc PatBlt
• 0x47d3d0 MoveToEx
• 0x47d3d4 MaskBlt
• 0x47d3d8 LineTo
• 0x47d3dc IntersectClipRect
• 0x47d3e0 GetWindowOrgEx
• 0x47d3e4 GetWinMetaFileBits
• 0x47d3e8 GetTextMetricsA
• 0x47d3f4 GetStockObject
• 0x47d3f8 GetPixel
• 0x47d3fc GetPaletteEntries
• 0x47d400 GetObjectA
• 0x47d40c GetEnhMetaFileBits
• 0x47d410 GetDeviceCaps
• 0x47d414 GetDIBits
• 0x47d418 GetDIBColorTable
• 0x47d41c GetDCOrgEx
• 0x47d424 GetClipBox
• 0x47d428 GetBrushOrgEx
• 0x47d42c GetBitmapBits
• 0x47d430 ExtCreatePen
• 0x47d434 ExcludeClipRect
• 0x47d438 DeleteObject
• 0x47d43c DeleteEnhMetaFile
• 0x47d440 DeleteDC
• 0x47d444 CreateSolidBrush
• 0x47d448 CreatePenIndirect
• 0x47d44c CreatePalette
• 0x47d454 CreateFontIndirectA
• 0x47d458 CreateDIBitmap
• 0x47d45c CreateDIBSection
• 0x47d460 CreateCompatibleDC
• 0x47d468 CreateBrushIndirect
• 0x47d46c CreateBitmap
• 0x47d470 CopyEnhMetaFileA
• 0x47d474 BitBlt
Library user32.dll:
• 0x47d47c CreateWindowExA
• 0x47d480 WindowFromPoint
• 0x47d484 WinHelpA
• 0x47d488 WaitMessage
• 0x47d48c ValidateRect
• 0x47d490 UpdateWindow
• 0x47d494 UnregisterClassA
• 0x47d498 UnionRect
• 0x47d49c UnhookWindowsHookEx
• 0x47d4a0 TranslateMessage
• 0x47d4a8 TrackPopupMenu
• 0x47d4b0 ShowWindow
• 0x47d4b4 ShowScrollBar
• 0x47d4b8 ShowOwnedPopups
• 0x47d4bc ShowCursor
• 0x47d4c0 SetWindowsHookExA
• 0x47d4c4 SetWindowTextA
• 0x47d4c8 SetWindowPos
• 0x47d4cc SetWindowPlacement
• 0x47d4d0 SetWindowLongA
• 0x47d4d4 SetTimer
• 0x47d4d8 SetScrollRange
• 0x47d4dc SetScrollPos
• 0x47d4e0 SetScrollInfo
• 0x47d4e4 SetRect
• 0x47d4e8 SetPropA
• 0x47d4ec SetParent
• 0x47d4f0 SetMenuItemInfoA
• 0x47d4f4 SetMenu
• 0x47d4f8 SetKeyboardState
• 0x47d4fc SetForegroundWindow
• 0x47d500 SetFocus
• 0x47d504 SetCursor
• 0x47d508 SetClipboardData
• 0x47d50c SetClassLongA
• 0x47d510 SetCapture
• 0x47d514 SetActiveWindow
• 0x47d518 SendMessageA
• 0x47d51c ScrollWindowEx
• 0x47d520 ScrollWindow
• 0x47d524 ScreenToClient
• 0x47d528 RemovePropA
• 0x47d52c RemoveMenu
• 0x47d530 ReleaseDC
• 0x47d534 ReleaseCapture
• 0x47d540 RegisterClassA
• 0x47d544 RedrawWindow
• 0x47d548 PtInRect
• 0x47d54c PostQuitMessage
• 0x47d550 PostMessageA
• 0x47d554 PeekMessageA
• 0x47d558 OpenClipboard
• 0x47d55c OffsetRect
• 0x47d560 OemToCharA
• 0x47d564 MessageBoxA
• 0x47d568 MessageBeep
• 0x47d56c MapWindowPoints
• 0x47d570 MapVirtualKeyA
• 0x47d574 LoadStringA
• 0x47d578 LoadKeyboardLayoutA
• 0x47d57c LoadIconA
• 0x47d580 LoadCursorA
• 0x47d584 LoadBitmapA
• 0x47d588 KillTimer
• 0x47d58c IsZoomed
• 0x47d590 IsWindowVisible
• 0x47d594 IsWindowEnabled
• 0x47d598 IsWindow
• 0x47d59c IsRectEmpty
• 0x47d5a0 IsIconic
• 0x47d5a4 IsDialogMessageA
• 0x47d5a8 IsChild
• 0x47d5ac IsCharAlphaNumericA
• 0x47d5b0 IsCharAlphaA
• 0x47d5b4 InvalidateRect
• 0x47d5b8 IntersectRect
• 0x47d5bc InsertMenuItemA
• 0x47d5c0 InsertMenuA
• 0x47d5c4 InflateRect
• 0x47d5cc GetWindowTextA
• 0x47d5d0 GetWindowRect
• 0x47d5d4 GetWindowPlacement
• 0x47d5d8 GetWindowLongA
• 0x47d5dc GetWindowDC
• 0x47d5e0 GetTopWindow
• 0x47d5e4 GetSystemMetrics
• 0x47d5e8 GetSystemMenu
• 0x47d5ec GetSysColorBrush
• 0x47d5f0 GetSysColor
• 0x47d5f4 GetSubMenu
• 0x47d5f8 GetScrollRange
• 0x47d5fc GetScrollPos
• 0x47d600 GetScrollInfo
• 0x47d604 GetPropA
• 0x47d608 GetParent
• 0x47d60c GetWindow
• 0x47d610 GetMessageTime
• 0x47d614 GetMenuStringA
• 0x47d618 GetMenuState
• 0x47d61c GetMenuItemInfoA
• 0x47d620 GetMenuItemID
• 0x47d624 GetMenuItemCount
• 0x47d628 GetMenu
• 0x47d62c GetLastActivePopup
• 0x47d630 GetKeyboardState
• 0x47d638 GetKeyboardLayout
• 0x47d63c GetKeyState
• 0x47d640 GetKeyNameTextA
• 0x47d644 GetInputState
• 0x47d648 GetIconInfo
• 0x47d64c GetForegroundWindow
• 0x47d650 GetFocus
• 0x47d654 GetDoubleClickTime
• 0x47d658 GetDlgItem
• 0x47d65c GetDesktopWindow
• 0x47d660 GetDCEx
• 0x47d664 GetDC
• 0x47d668 GetCursorPos
• 0x47d66c GetCursor
• 0x47d670 GetClipboardData
• 0x47d674 GetClientRect
• 0x47d678 GetClassNameA
• 0x47d67c GetClassInfoA
• 0x47d680 GetCaretPos
• 0x47d684 GetCapture
• 0x47d688 GetActiveWindow
• 0x47d68c FrameRect
• 0x47d690 FindWindowA
• 0x47d694 FillRect
• 0x47d698 EqualRect
• 0x47d69c EnumWindows
• 0x47d6a0 EnumThreadWindows
• 0x47d6a8 EndPaint
• 0x47d6ac EnableWindow
• 0x47d6b0 EnableScrollBar
• 0x47d6b4 EnableMenuItem
• 0x47d6b8 EmptyClipboard
• 0x47d6bc DrawTextA
• 0x47d6c0 DrawMenuBar
• 0x47d6c4 DrawIconEx
• 0x47d6c8 DrawIcon
• 0x47d6cc DrawFrameControl
• 0x47d6d0 DrawFocusRect
• 0x47d6d4 DrawEdge
• 0x47d6d8 DispatchMessageA
• 0x47d6dc DestroyWindow
• 0x47d6e0 DestroyMenu
• 0x47d6e4 DestroyIcon
• 0x47d6e8 DestroyCursor
• 0x47d6ec DeleteMenu
• 0x47d6f0 DefWindowProcA
• 0x47d6f4 DefMDIChildProcA
• 0x47d6f8 DefFrameProcA
• 0x47d6fc CreatePopupMenu
• 0x47d700 CreateMenu
• 0x47d704 CreateIcon
• 0x47d708 CloseClipboard
• 0x47d70c ClientToScreen
• 0x47d710 CheckMenuItem
• 0x47d714 CallWindowProcA
• 0x47d718 CallNextHookEx
• 0x47d71c BeginPaint
• 0x47d720 CharNextA
• 0x47d724 CharLowerBuffA
• 0x47d728 CharLowerA
• 0x47d72c CharUpperBuffA
• 0x47d730 CharToOemA
• 0x47d734 AdjustWindowRectEx
Library kernel32.dll:
• 0x47d740 Sleep
Library oleaut32.dll:
• 0x47d748 SafeArrayPtrOfIndex
• 0x47d74c SafeArrayGetUBound
• 0x47d750 SafeArrayGetLBound
• 0x47d754 SafeArrayCreate
• 0x47d758 VariantChangeType
• 0x47d75c VariantCopy
• 0x47d760 VariantClear
• 0x47d764 VariantInit
Library comctl32.dll:
• 0x47d774 ImageList_Write
• 0x47d778 ImageList_Read
• 0x47d788 ImageList_DragMove
• 0x47d78c ImageList_DragLeave
• 0x47d790 ImageList_DragEnter
• 0x47d794 ImageList_EndDrag
• 0x47d798 ImageList_BeginDrag
• 0x47d79c ImageList_Remove
• 0x47d7a0 ImageList_DrawEx
• 0x47d7a4 ImageList_Replace
• 0x47d7a8 ImageList_Draw
• 0x47d7b8 ImageList_Add
• 0x47d7c0 ImageList_Destroy
• 0x47d7c4 ImageList_Create
Library comdlg32.dll:
• 0x47d7cc GetSaveFileNameA
• 0x47d7d0 GetOpenFileNameA
Library kernel32.dll:
• 0x47d7d8 MulDiv

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50568 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.