6.6
高危
55 个模型检测该样本为恶意！
重新分析
更多

26f426fd4ff119e8830681f0692ff3b627f6c5a0d8905c2ca07b6b4298e07f95

6ad7e4bc5d99826179adc6ae6092bfd2.exe

分析耗时

43s

最近分析

文件大小

821.0KB
静态报毒 动态报毒 100% A + TROJ AI SCORE=80 AIDETECT ALI2000015 ANDROM AUTO BT61DZ CONFIDENCE CRYSIS DELF DELFINJECT DELPHILESS EMOY EMRK FAREIT HIGH CONFIDENCE HOCHXZ HPLOKI HWUBAR8A IGENT LOKIBOT MALWARE1 MALWARE@#2S75FF9LD2P9M OHYZC PONYRAT PWSX SCORE SMBD SPYBOTNET STATIC AI SUSGEN SUSPICIOUS PE TESLAAG TSCOPE TSPY UNSAFE X2094 YHAU YZY0OR9CQLYE3YCQ ZELPHIF ZGW@AY@CKNKI ZGW@HY@CKNKI 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FVZ!6AD7E4BC5D99 20210408 6.0.6.653
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Tencent Win32.Trojan.Inject.Auto 20210408 1.0.0.1
Kingsoft 20210408 2017.9.26.565
Avast Win32:PWSX-gen [Trj] 20210408 21.1.5827.0
CrowdStrike win/malicious_confidence_100% (W) 20210203 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619614339.768125
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7389e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7389ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7389b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7389b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7389ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7389aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73895511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7389559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f57f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f54de3
6ad7e4bc5d99826179adc6ae6092bfd2+0x54a4d @ 0x454a4d
6ad7e4bc5d99826179adc6ae6092bfd2+0x4d254 @ 0x44d254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfc7c14ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619614338.080875
NtAllocateVirtualMemory
process_identifier: 1912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00670000
success 0 0
1619614338.158875
NtProtectVirtualMemory
process_identifier: 1912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 36864
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0047a000
success 0 0
1619614338.158875
NtAllocateVirtualMemory
process_identifier: 1912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x023b0000
success 0 0
1619614338.533125
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619614338.580125
NtAllocateVirtualMemory
process_identifier: 1404
region_size: 720896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01e50000
success 0 0
1619614338.580125
NtAllocateVirtualMemory
process_identifier: 1404
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01ec0000
success 0 0
1619614338.580125
NtAllocateVirtualMemory
process_identifier: 1404
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00520000
success 0 0
1619614338.580125
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 282624
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00522000
success 0 0
1619614339.096125
NtAllocateVirtualMemory
process_identifier: 1404
region_size: 2293760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01fe0000
success 0 0
1619614339.096125
NtAllocateVirtualMemory
process_identifier: 1404
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x021d0000
success 0 0
1619614339.737125
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00502000
success 0 0
1619614339.737125
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619614339.737125
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00502000
success 0 0
1619614339.737125
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619614339.737125
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00502000
success 0 0
1619614339.737125
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619614339.737125
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00502000
success 0 0
1619614339.737125
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619614339.737125
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00502000
success 0 0
1619614339.737125
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619614339.737125
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00502000
success 0 0
1619614339.752125
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619614339.752125
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00502000
success 0 0
1619614339.752125
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619614339.752125
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00502000
success 0 0
1619614339.752125
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619614339.752125
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00502000
success 0 0
1619614339.752125
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619614339.752125
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00502000
success 0 0
1619614339.752125
NtProtectVirtualMemory
process_identifier: 1404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.418607927279347 section {'size_of_data': '0x0003dc00', 'virtual_address': '0x00095000', 'entropy': 7.418607927279347, 'name': '.rsrc', 'virtual_size': '0x0003db00'} description A section with a high entropy has been found
entropy 0.30121951219512194 description Overall entropy of this PE file is high
网络通信
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 1912 called NtSetContextThread to modify thread in remote process 1404
Time & API Arguments Status Return Repeated
1619614338.221875
NtSetContextThread
thread_handle: 0x00000118
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4859264
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1404
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 1912 resumed a thread in remote process 1404
Time & API Arguments Status Return Repeated
1619614338.362875
NtResumeThread
thread_handle: 0x00000118
suspend_count: 1
process_identifier: 1404
success 0 0
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.24.14:443
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619614338.221875
CreateProcessInternalW
thread_identifier: 2216
thread_handle: 0x00000118
process_identifier: 1404
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\6ad7e4bc5d99826179adc6ae6092bfd2.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x0000011c
inherit_handles: 0
success 1 0
1619614338.221875
NtUnmapViewOfSection
process_identifier: 1404
region_size: 4096
process_handle: 0x0000011c
base_address: 0x00400000
success 0 0
1619614338.221875
NtMapViewOfSection
section_handle: 0x00000124
process_identifier: 1404
commit_size: 671744
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x0000011c
allocation_type: 0 ()
section_offset: 0
view_size: 671744
base_address: 0x00400000
success 0 0
1619614338.221875
NtGetContextThread
thread_handle: 0x00000118
success 0 0
1619614338.221875
NtSetContextThread
thread_handle: 0x00000118
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4859264
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1404
success 0 0
1619614338.362875
NtResumeThread
thread_handle: 0x00000118
suspend_count: 1
process_identifier: 1404
success 0 0
File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Delf.FareIt.Gen.ZGW@hy@Cknki
McAfee Fareit-FVZ!6AD7E4BC5D99
Cylance Unsafe
Sangfor Trojan.Win32.Fareit.AQ!MTB
K7AntiVirus Trojan ( 0056cd2f1 )
Alibaba Trojan:Win32/DelfInject.ali2000015
K7GW Trojan ( 0056cd2f1 )
Cybereason malicious.c5d998
Arcabit Trojan.Delf.FareIt.Gen.E0C94F
Cyren W32/Injector.YHAU-3580
Symantec Infostealer.Lokibot!43
ESET-NOD32 a variant of Win32/Injector.EMRK
APEX Malicious
ClamAV Win.Dropper.CrySIS-9122061-0
Kaspersky HEUR:Backdoor.Win32.Androm.gen
BitDefender Trojan.Delf.FareIt.Gen.ZGW@hy@Cknki
NANO-Antivirus Trojan.Win32.Androm.hochxz
Tencent Win32.Trojan.Inject.Auto
Ad-Aware Trojan.Delf.FareIt.Gen.ZGW@hy@Cknki
Emsisoft Trojan.Delf.FareIt.Gen.ZGW@hy@Cknki (B)
Comodo Malware@#2s75ff9ld2p9m
DrWeb BackDoor.SpyBotNET.25
VIPRE Trojan.Win32.Generic!BT
TrendMicro TSPY_HPLOKI.SMBD
McAfee-GW-Edition BehavesLike.Win32.Fareit.cc
FireEye Generic.mg.6ad7e4bc5d998261
Sophos ML/PE-A + Troj/TeslaAg-WH
Ikarus Trojan.Inject
Webroot W32.Trojan.Delf.FareIt.Gen
Avira TR/Injector.ohyzc
eGambit Unsafe.AI_Score_99%
Microsoft PWS:Win32/Fareit.AQ!MTB
AegisLab Trojan.Win32.Androm.m!c
GData Trojan.Delf.FareIt.Gen.ZGW@hy@Cknki
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2094
Acronis suspicious
ALYac Backdoor.Androm.gen
MAX malware (ai score=80)
VBA32 TScope.Trojan.Delf
Malwarebytes Trojan.MalPack.DLF
Panda Trj/CI.A
TrendMicro-HouseCall TSPY_HPLOKI.SMBD
Rising Backdoor.Androm!8.113 (C64:YzY0Or9CQlYe3ycQ)
Yandex Trojan.Igent.bT61DZ.4
SentinelOne Static AI - Suspicious PE
MaxSecure Trojan.Malware.73688777.susgen
Fortinet W32/Injector.EMOY!tr
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x487178 VirtualFree
• 0x48717c VirtualAlloc
• 0x487180 LocalFree
• 0x487184 LocalAlloc
• 0x487188 GetVersion
• 0x48718c GetCurrentThreadId
• 0x487198 VirtualQuery
• 0x48719c WideCharToMultiByte
• 0x4871a0 MultiByteToWideChar
• 0x4871a4 lstrlenA
• 0x4871a8 lstrcpynA
• 0x4871ac LoadLibraryExA
• 0x4871b0 GetThreadLocale
• 0x4871b4 GetStartupInfoA
• 0x4871b8 GetProcAddress
• 0x4871bc GetModuleHandleA
• 0x4871c0 GetModuleFileNameA
• 0x4871c4 GetLocaleInfoA
• 0x4871c8 GetCommandLineA
• 0x4871cc FreeLibrary
• 0x4871d0 FindFirstFileA
• 0x4871d4 FindClose
• 0x4871d8 ExitProcess
• 0x4871dc WriteFile
• 0x4871e4 RtlUnwind
• 0x4871e8 RaiseException
• 0x4871ec GetStdHandle
Library user32.dll:
• 0x4871f4 GetKeyboardType
• 0x4871f8 LoadStringA
• 0x4871fc MessageBoxA
• 0x487200 CharNextA
Library advapi32.dll:
• 0x487208 RegQueryValueExA
• 0x48720c RegOpenKeyExA
• 0x487210 RegCloseKey
Library oleaut32.dll:
• 0x487218 SysFreeString
• 0x48721c SysReAllocStringLen
• 0x487220 SysAllocStringLen
Library kernel32.dll:
• 0x487228 TlsSetValue
• 0x48722c TlsGetValue
• 0x487230 LocalAlloc
• 0x487234 GetModuleHandleA
Library advapi32.dll:
• 0x48723c RegQueryValueExA
• 0x487240 RegOpenKeyExA
• 0x487244 RegCloseKey
Library kernel32.dll:
• 0x48724c lstrcpyA
• 0x487250 WriteFile
• 0x487254 WaitForSingleObject
• 0x487258 VirtualQuery
• 0x48725c VirtualProtect
• 0x487260 VirtualAlloc
• 0x487264 Sleep
• 0x487268 SizeofResource
• 0x48726c SetThreadLocale
• 0x487270 SetFilePointer
• 0x487274 SetEvent
• 0x487278 SetErrorMode
• 0x48727c SetEndOfFile
• 0x487280 ResetEvent
• 0x487284 ReadFile
• 0x487288 MultiByteToWideChar
• 0x48728c MulDiv
• 0x487290 LockResource
• 0x487294 LoadResource
• 0x487298 LoadLibraryA
• 0x4872a4 GlobalUnlock
• 0x4872a8 GlobalSize
• 0x4872ac GlobalReAlloc
• 0x4872b0 GlobalHandle
• 0x4872b4 GlobalLock
• 0x4872b8 GlobalFree
• 0x4872bc GlobalFindAtomA
• 0x4872c0 GlobalDeleteAtom
• 0x4872c4 GlobalAlloc
• 0x4872c8 GlobalAddAtomA
• 0x4872cc GetVersionExA
• 0x4872d0 GetVersion
• 0x4872d4 GetUserDefaultLCID
• 0x4872d8 GetTickCount
• 0x4872dc GetThreadLocale
• 0x4872e0 GetSystemInfo
• 0x4872e4 GetStringTypeExA
• 0x4872e8 GetStdHandle
• 0x4872ec GetProcAddress
• 0x4872f0 GetModuleHandleA
• 0x4872f4 GetModuleFileNameA
• 0x4872f8 GetLocaleInfoA
• 0x4872fc GetLocalTime
• 0x487300 GetLastError
• 0x487304 GetFullPathNameA
• 0x487308 GetFileAttributesA
• 0x48730c GetDiskFreeSpaceA
• 0x487310 GetDateFormatA
• 0x487314 GetCurrentThreadId
• 0x487318 GetCurrentProcessId
• 0x48731c GetComputerNameA
• 0x487320 GetCPInfo
• 0x487324 GetACP
• 0x487328 FreeResource
• 0x487330 InterlockedExchange
• 0x487338 FreeLibrary
• 0x48733c FormatMessageA
• 0x487340 FindResourceA
• 0x487344 FindFirstFileA
• 0x487348 FindClose
• 0x487354 EnumCalendarInfoA
• 0x487360 CreateThread
• 0x487364 CreateFileA
• 0x487368 CreateEventA
• 0x48736c CompareStringA
• 0x487370 CloseHandle
Library version.dll:
• 0x487378 VerQueryValueA
• 0x487380 GetFileVersionInfoA
Library gdi32.dll:
• 0x487388 UnrealizeObject
• 0x48738c StretchBlt
• 0x487390 SetWindowOrgEx
• 0x487394 SetWinMetaFileBits
• 0x487398 SetViewportOrgEx
• 0x48739c SetTextColor
• 0x4873a0 SetStretchBltMode
• 0x4873a4 SetROP2
• 0x4873a8 SetPixel
• 0x4873ac SetMapMode
• 0x4873b0 SetEnhMetaFileBits
• 0x4873b4 SetDIBColorTable
• 0x4873b8 SetBrushOrgEx
• 0x4873bc SetBkMode
• 0x4873c0 SetBkColor
• 0x4873c4 SelectPalette
• 0x4873c8 SelectObject
• 0x4873cc SaveDC
• 0x4873d0 RestoreDC
• 0x4873d4 Rectangle
• 0x4873d8 RectVisible
• 0x4873dc RealizePalette
• 0x4873e0 Polyline
• 0x4873e4 PlayEnhMetaFile
• 0x4873e8 PatBlt
• 0x4873ec MoveToEx
• 0x4873f0 MaskBlt
• 0x4873f4 LineTo
• 0x4873f8 LPtoDP
• 0x4873fc IntersectClipRect
• 0x487400 GetWindowOrgEx
• 0x487404 GetWinMetaFileBits
• 0x487408 GetTextMetricsA
• 0x487414 GetStockObject
• 0x487418 GetPixel
• 0x48741c GetPaletteEntries
• 0x487420 GetObjectA
• 0x487430 GetEnhMetaFileBits
• 0x487434 GetDeviceCaps
• 0x487438 GetDIBits
• 0x48743c GetDIBColorTable
• 0x487440 GetDCOrgEx
• 0x487448 GetClipBox
• 0x48744c GetBrushOrgEx
• 0x487450 GetBitmapBits
• 0x487454 ExcludeClipRect
• 0x487458 DeleteObject
• 0x48745c DeleteEnhMetaFile
• 0x487460 DeleteDC
• 0x487464 CreateSolidBrush
• 0x487468 CreatePenIndirect
• 0x48746c CreatePalette
• 0x487474 CreateFontIndirectA
• 0x487478 CreateEnhMetaFileA
• 0x48747c CreateDIBitmap
• 0x487480 CreateDIBSection
• 0x487484 CreateCompatibleDC
• 0x48748c CreateBrushIndirect
• 0x487490 CreateBitmap
• 0x487494 CopyEnhMetaFileA
• 0x487498 CloseEnhMetaFile
• 0x48749c BitBlt
Library opengl32.dll:
• 0x4874a4 wglCreateContext
Library user32.dll:
• 0x4874ac CreateWindowExA
• 0x4874b0 WindowFromPoint
• 0x4874b4 WinHelpA
• 0x4874b8 WaitMessage
• 0x4874bc UpdateWindow
• 0x4874c0 UnregisterClassA
• 0x4874c4 UnhookWindowsHookEx
• 0x4874c8 TranslateMessage
• 0x4874d0 TrackPopupMenu
• 0x4874d8 ShowWindow
• 0x4874dc ShowScrollBar
• 0x4874e0 ShowOwnedPopups
• 0x4874e4 ShowCursor
• 0x4874e8 SetWindowsHookExA
• 0x4874ec SetWindowPos
• 0x4874f0 SetWindowPlacement
• 0x4874f4 SetWindowLongA
• 0x4874f8 SetTimer
• 0x4874fc SetScrollRange
• 0x487500 SetScrollPos
• 0x487504 SetScrollInfo
• 0x487508 SetRect
• 0x48750c SetPropA
• 0x487510 SetParent
• 0x487514 SetMenuItemInfoA
• 0x487518 SetMenu
• 0x48751c SetForegroundWindow
• 0x487520 SetFocus
• 0x487524 SetCursor
• 0x487528 SetClassLongA
• 0x48752c SetCapture
• 0x487530 SetActiveWindow
• 0x487534 SendMessageA
• 0x487538 ScrollWindow
• 0x48753c ScreenToClient
• 0x487540 RemovePropA
• 0x487544 RemoveMenu
• 0x487548 ReleaseDC
• 0x48754c ReleaseCapture
• 0x487558 RegisterClassA
• 0x48755c RedrawWindow
• 0x487560 PtInRect
• 0x487564 PostQuitMessage
• 0x487568 PostMessageA
• 0x48756c PeekMessageA
• 0x487570 OffsetRect
• 0x487574 OemToCharA
• 0x487578 MessageBoxA
• 0x48757c MapWindowPoints
• 0x487580 MapVirtualKeyA
• 0x487584 LoadStringA
• 0x487588 LoadKeyboardLayoutA
• 0x48758c LoadIconA
• 0x487590 LoadCursorA
• 0x487594 LoadBitmapA
• 0x487598 KillTimer
• 0x48759c IsZoomed
• 0x4875a0 IsWindowVisible
• 0x4875a4 IsWindowEnabled
• 0x4875a8 IsWindow
• 0x4875ac IsRectEmpty
• 0x4875b0 IsIconic
• 0x4875b4 IsDialogMessageA
• 0x4875b8 IsChild
• 0x4875bc InvalidateRect
• 0x4875c0 IntersectRect
• 0x4875c4 InsertMenuItemA
• 0x4875c8 InsertMenuA
• 0x4875cc InflateRect
• 0x4875d4 GetWindowTextA
• 0x4875d8 GetWindowRect
• 0x4875dc GetWindowPlacement
• 0x4875e0 GetWindowLongA
• 0x4875e4 GetWindowDC
• 0x4875e8 GetTopWindow
• 0x4875ec GetSystemMetrics
• 0x4875f0 GetSystemMenu
• 0x4875f4 GetSysColorBrush
• 0x4875f8 GetSysColor
• 0x4875fc GetSubMenu
• 0x487600 GetScrollRange
• 0x487604 GetScrollPos
• 0x487608 GetScrollInfo
• 0x48760c GetPropA
• 0x487610 GetParent
• 0x487614 GetWindow
• 0x487618 GetMessageTime
• 0x48761c GetMenuStringA
• 0x487620 GetMenuState
• 0x487624 GetMenuItemInfoA
• 0x487628 GetMenuItemID
• 0x48762c GetMenuItemCount
• 0x487630 GetMenu
• 0x487634 GetLastActivePopup
• 0x487638 GetKeyboardState
• 0x487640 GetKeyboardLayout
• 0x487644 GetKeyState
• 0x487648 GetKeyNameTextA
• 0x48764c GetIconInfo
• 0x487650 GetForegroundWindow
• 0x487654 GetFocus
• 0x487658 GetDlgItem
• 0x48765c GetDesktopWindow
• 0x487660 GetDCEx
• 0x487664 GetDC
• 0x487668 GetCursorPos
• 0x48766c GetCursor
• 0x487670 GetClipboardData
• 0x487674 GetClientRect
• 0x487678 GetClassNameA
• 0x48767c GetClassInfoA
• 0x487680 GetCapture
• 0x487684 GetActiveWindow
• 0x487688 FrameRect
• 0x48768c FindWindowA
• 0x487690 FillRect
• 0x487694 EqualRect
• 0x487698 EnumWindows
• 0x48769c EnumThreadWindows
• 0x4876a0 EndPaint
• 0x4876a4 EnableWindow
• 0x4876a8 EnableScrollBar
• 0x4876ac EnableMenuItem
• 0x4876b0 DrawTextA
• 0x4876b4 DrawMenuBar
• 0x4876b8 DrawIconEx
• 0x4876bc DrawIcon
• 0x4876c0 DrawFrameControl
• 0x4876c4 DrawEdge
• 0x4876c8 DispatchMessageA
• 0x4876cc DestroyWindow
• 0x4876d0 DestroyMenu
• 0x4876d4 DestroyIcon
• 0x4876d8 DestroyCursor
• 0x4876dc DeleteMenu
• 0x4876e0 DefWindowProcA
• 0x4876e4 DefMDIChildProcA
• 0x4876e8 DefFrameProcA
• 0x4876ec CreatePopupMenu
• 0x4876f0 CreateMenu
• 0x4876f4 CreateIcon
• 0x4876f8 ClientToScreen
• 0x4876fc CheckMenuItem
• 0x487700 CallWindowProcA
• 0x487704 CallNextHookEx
• 0x487708 BeginPaint
• 0x48770c CharNextA
• 0x487710 CharLowerBuffA
• 0x487714 CharLowerA
• 0x487718 CharToOemA
• 0x48771c AdjustWindowRectEx
Library kernel32.dll:
• 0x487728 Sleep
Library oleaut32.dll:
• 0x487730 SafeArrayPtrOfIndex
• 0x487734 SafeArrayGetUBound
• 0x487738 SafeArrayGetLBound
• 0x48773c SafeArrayCreate
• 0x487740 VariantChangeType
• 0x487744 VariantCopy
• 0x487748 VariantClear
• 0x48774c VariantInit
Library ole32.dll:
• 0x487758 IsAccelerator
• 0x48775c OleDraw
• 0x487764 CoTaskMemFree
• 0x487768 ProgIDFromCLSID
• 0x48776c StringFromCLSID
• 0x487770 CoCreateInstance
• 0x487774 CoGetClassObject
• 0x487778 CoUninitialize
• 0x48777c CoInitialize
• 0x487780 IsEqualGUID
Library oleaut32.dll:
• 0x487788 CreateErrorInfo
• 0x48778c GetErrorInfo
• 0x487790 SetErrorInfo
• 0x487794 GetActiveObject
• 0x487798 SysFreeString
Library comctl32.dll:
• 0x4877a8 ImageList_Write
• 0x4877ac ImageList_Read
• 0x4877bc ImageList_DragMove
• 0x4877c0 ImageList_DragLeave
• 0x4877c4 ImageList_DragEnter
• 0x4877c8 ImageList_EndDrag
• 0x4877cc ImageList_BeginDrag
• 0x4877d0 ImageList_Remove
• 0x4877d4 ImageList_DrawEx
• 0x4877d8 ImageList_Replace
• 0x4877dc ImageList_Draw
• 0x4877ec ImageList_Add
• 0x4877f4 ImageList_Destroy
• 0x4877f8 ImageList_Create
• 0x4877fc InitCommonControls
Library comdlg32.dll:
• 0x487804 GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 51379 239.255.255.250 3702
192.168.56.101 55369 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.