5.8
高危
62 个模型检测该样本为恶意！
重新分析
更多

8e8cfe9188831a51fa67ebaee3966067a035b8e612c1ad6cd3a281f716f7e9bf

6d33a01695d849a7e373862aff864cfd.exe

分析耗时

24s

最近分析

文件大小

710.0KB
静态报毒 动态报毒 100% 8WL2UWDXA0Y 9AQS2P AGENTTESLA AI SCORE=85 ALI2000015 CONFIDENCE DEALPLY DELF DELFINJECT DELPHILESS ELDORADO ELKP FAREIT GENERICKD HEYE HIGH CONFIDENCE HJAZGJ JINU KRYPTIK KTSE LOKIBOT MALWARE@#26OUL6LWG1ION R + MAL SCORE SG0@AC05IVHI STATIC AI SUSGEN SUSPICIOUS PE TROJANPWS TSCOPE UHBAZCLLR UNSAFE WACATAC WPTJ X2059 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FSK!6D33A01695D8 20201229 6.0.6.653
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Other:Malware-gen [Trj] 20201229 21.1.5827.0
Tencent Msil.Worm.Autorun.Wptj 20201229 1.0.0.1
Kingsoft 20201229 2017.9.26.565
CrowdStrike win/malicious_confidence_80% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619596027.909081
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34668352
registers.edi: 0
registers.eax: 0
registers.ebp: 34668424
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 3742040064
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 62 e9 4a e5 fa
exception.symbol: 6d33a01695d849a7e373862aff864cfd+0x55015
exception.instruction: div eax
exception.module: 6d33a01695d849a7e373862aff864cfd.exe
exception.exception_code: 0xc0000094
exception.offset: 348181
exception.address: 0x455015
success 0 0
1619609152.138751
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75137f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75134de3
6d33a01695d849a7e373862aff864cfd+0x58a4d @ 0x458a4d
6d33a01695d849a7e373862aff864cfd+0x51254 @ 0x451254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff2f14ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619596027.784081
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00360000
success 0 0
1619596027.909081
NtAllocateVirtualMemory
process_identifier: 472
region_size: 61440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x003f0000
success 0 0
1619596027.909081
NtAllocateVirtualMemory
process_identifier: 472
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01ea0000
success 0 0
1619609150.670751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619609150.685751
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 2293760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01f20000
success 0 0
1619609150.685751
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02110000
success 0 0
1619609150.685751
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01d30000
success 0 0
1619609150.685751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 299008
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d32000
success 0 0
1619609151.123751
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 1835008
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02150000
success 0 0
1619609151.123751
NtAllocateVirtualMemory
process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x022d0000
success 0 0
1619609152.076751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01dd2000
success 0 0
1619609152.076751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619609152.076751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01dd2000
success 0 0
1619609152.076751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619609152.076751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01dd2000
success 0 0
1619609152.076751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619609152.076751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01dd2000
success 0 0
1619609152.076751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619609152.076751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01dd2000
success 0 0
1619609152.076751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619609152.076751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01dd2000
success 0 0
1619609152.076751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619609152.076751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01dd2000
success 0 0
1619609152.076751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619609152.076751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01dd2000
success 0 0
1619609152.076751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619609152.076751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01dd2000
success 0 0
1619609152.076751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619609152.076751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01dd2000
success 0 0
1619609152.076751
NtProtectVirtualMemory
process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (3 个事件)
entropy 7.699227457850579 section {'size_of_data': '0x0000fe00', 'virtual_address': '0x00056000', 'entropy': 7.699227457850579, 'name': 'DATA', 'virtual_size': '0x0000fc08'} description A section with a high entropy has been found
entropy 7.393039630868832 section {'size_of_data': '0x00044c00', 'virtual_address': '0x00073000', 'entropy': 7.393039630868832, 'name': '.rsrc', 'virtual_size': '0x00044a5c'} description A section with a high entropy has been found
entropy 0.4774330042313117 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 472 called NtSetContextThread to modify thread in remote process 2224
Time & API Arguments Status Return Repeated
1619596028.534081
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4888656
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2224
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 472 resumed a thread in remote process 2224
Time & API Arguments Status Return Repeated
1619596029.050081
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 2224
success 0 0
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619596028.237081
CreateProcessInternalW
thread_identifier: 2264
thread_handle: 0x00000104
process_identifier: 2224
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\6d33a01695d849a7e373862aff864cfd.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000108
inherit_handles: 0
success 1 0
1619596028.237081
NtUnmapViewOfSection
process_identifier: 2224
region_size: 4096
process_handle: 0x00000108
base_address: 0x00400000
success 0 0
1619596028.237081
NtMapViewOfSection
section_handle: 0x00000110
process_identifier: 2224
commit_size: 700416
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000108
allocation_type: 0 ()
section_offset: 0
view_size: 700416
base_address: 0x00400000
success 0 0
1619596028.534081
NtGetContextThread
thread_handle: 0x00000104
success 0 0
1619596028.534081
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4888656
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2224
success 0 0
1619596029.050081
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 2224
success 0 0
File has been identified by 62 AntiVirus engines on VirusTotal as malicious (50 out of 62 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.33676521
FireEye Generic.mg.6d33a01695d849a7
CAT-QuickHeal Trojanpws.Heye
McAfee Fareit-FSK!6D33A01695D8
Cylance Unsafe
Sangfor Malware
K7AntiVirus Trojan ( 00564ab51 )
Alibaba Trojan:Win32/DelfInject.ali2000015
K7GW Trojan ( 00564ab51 )
Cybereason malicious.695d84
Arcabit Trojan.Generic.D201DCE9
Cyren W32/Fareit.JO.gen!Eldorado
Symantec Trojan.Gen.2
APEX Malicious
Avast Other:Malware-gen [Trj]
ClamAV Win.Dropper.LokiBot-7688636-0
Kaspersky HEUR:Trojan-PSW.Win32.Heye.gen
BitDefender Trojan.GenericKD.33676521
NANO-Antivirus Trojan.Win32.Stealer.hjazgj
Paloalto generic.ml
Tencent Msil.Worm.Autorun.Wptj
Ad-Aware Trojan.GenericKD.33676521
Sophos Mal/Generic-R + Mal/Fareit-AA
Comodo Malware@#26oul6lwg1ion
F-Secure Trojan.TR/Agent.jinu
DrWeb Trojan.PWS.Stealer.21240
VIPRE Trojan.Win32.Generic!BT
TrendMicro TrojanSpy.Win32.FAREIT.UHBAZCLLR
McAfee-GW-Edition BehavesLike.Win32.DealPly.bc
Emsisoft Trojan.Agent (A)
SentinelOne Static AI - Suspicious PE
Jiangmin Trojan.PSW.Heye.ajs
MaxSecure Trojan.Malware.74111120.susgen
Avira TR/Agent.jinu
MAX malware (ai score=85)
Antiy-AVL Trojan/Win32.Wacatac
Gridinsoft Trojan.Win32.Kryptik.ba!s1
Microsoft PWS:Win32/Fareit.AR!MTB
AegisLab Trojan.Win32.Heye.i!c
ZoneAlarm HEUR:Trojan-PSW.Win32.Heye.gen
GData Win32.Trojan-Stealer.AgentTesla.9AQS2P
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2059
Acronis suspicious
BitDefenderTheta Gen:NN.ZelphiF.34700.SG0@aC05iVhi
ALYac Spyware.AgentTesla
VBA32 TScope.Trojan.Delf
Malwarebytes Spyware.AgentTesla
Zoner Trojan.Win32.90857
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x467150 VirtualFree
• 0x467154 VirtualAlloc
• 0x467158 LocalFree
• 0x46715c LocalAlloc
• 0x467160 GetVersion
• 0x467164 GetCurrentThreadId
• 0x467170 VirtualQuery
• 0x467174 WideCharToMultiByte
• 0x467178 MultiByteToWideChar
• 0x46717c lstrlenA
• 0x467180 lstrcpynA
• 0x467184 LoadLibraryExA
• 0x467188 GetThreadLocale
• 0x46718c GetStartupInfoA
• 0x467190 GetProcAddress
• 0x467194 GetModuleHandleA
• 0x467198 GetModuleFileNameA
• 0x46719c GetLocaleInfoA
• 0x4671a0 GetCommandLineA
• 0x4671a4 FreeLibrary
• 0x4671a8 FindFirstFileA
• 0x4671ac FindClose
• 0x4671b0 ExitProcess
• 0x4671b4 WriteFile
• 0x4671bc RtlUnwind
• 0x4671c0 RaiseException
• 0x4671c4 GetStdHandle
Library user32.dll:
• 0x4671cc GetKeyboardType
• 0x4671d0 LoadStringA
• 0x4671d4 MessageBoxA
• 0x4671d8 CharNextA
Library advapi32.dll:
• 0x4671e0 RegQueryValueExA
• 0x4671e4 RegOpenKeyExA
• 0x4671e8 RegCloseKey
Library oleaut32.dll:
• 0x4671f0 SysFreeString
• 0x4671f4 SysReAllocStringLen
• 0x4671f8 SysAllocStringLen
Library kernel32.dll:
• 0x467200 TlsSetValue
• 0x467204 TlsGetValue
• 0x467208 LocalAlloc
• 0x46720c GetModuleHandleA
Library advapi32.dll:
• 0x467214 RegQueryValueExA
• 0x467218 RegOpenKeyExA
• 0x46721c RegCloseKey
Library kernel32.dll:
• 0x467224 lstrcpyA
• 0x467228 WriteFile
• 0x46722c WaitForSingleObject
• 0x467230 VirtualQuery
• 0x467234 VirtualAlloc
• 0x467238 Sleep
• 0x46723c SizeofResource
• 0x467240 SetThreadLocale
• 0x467244 SetFilePointer
• 0x467248 SetEvent
• 0x46724c SetErrorMode
• 0x467250 SetEndOfFile
• 0x467254 ResetEvent
• 0x467258 ReadFile
• 0x46725c MulDiv
• 0x467260 LockResource
• 0x467264 LoadResource
• 0x467268 LoadLibraryA
• 0x467274 GlobalUnlock
• 0x467278 GlobalReAlloc
• 0x46727c GlobalHandle
• 0x467280 GlobalLock
• 0x467284 GlobalFree
• 0x467288 GlobalFindAtomA
• 0x46728c GlobalDeleteAtom
• 0x467290 GlobalAlloc
• 0x467294 GlobalAddAtomA
• 0x467298 GetVersionExA
• 0x46729c GetVersion
• 0x4672a0 GetTickCount
• 0x4672a4 GetThreadLocale
• 0x4672ac GetSystemTime
• 0x4672b0 GetSystemInfo
• 0x4672b4 GetStringTypeExA
• 0x4672b8 GetStdHandle
• 0x4672bc GetProcAddress
• 0x4672c0 GetModuleHandleA
• 0x4672c4 GetModuleFileNameA
• 0x4672c8 GetLocaleInfoA
• 0x4672cc GetLocalTime
• 0x4672d0 GetLastError
• 0x4672d4 GetFullPathNameA
• 0x4672d8 GetFileType
• 0x4672dc GetDiskFreeSpaceA
• 0x4672e0 GetDateFormatA
• 0x4672e4 GetCurrentThreadId
• 0x4672e8 GetCurrentProcessId
• 0x4672ec GetCPInfo
• 0x4672f0 GetACP
• 0x4672f4 FreeResource
• 0x4672f8 InterlockedExchange
• 0x4672fc FreeLibrary
• 0x467300 FormatMessageA
• 0x467304 FindResourceA
• 0x46730c ExitThread
• 0x467310 EnumCalendarInfoA
• 0x46731c CreateThread
• 0x467320 CreateFileA
• 0x467324 CreateEventA
• 0x467328 CompareStringA
• 0x46732c CloseHandle
Library version.dll:
• 0x467334 VerQueryValueA
• 0x46733c GetFileVersionInfoA
Library gdi32.dll:
• 0x467344 UnrealizeObject
• 0x467348 StretchBlt
• 0x46734c SetWindowOrgEx
• 0x467350 SetViewportOrgEx
• 0x467354 SetTextColor
• 0x467358 SetStretchBltMode
• 0x46735c SetROP2
• 0x467360 SetPixel
• 0x467364 SetDIBColorTable
• 0x467368 SetBrushOrgEx
• 0x46736c SetBkMode
• 0x467370 SetBkColor
• 0x467374 SelectPalette
• 0x467378 SelectObject
• 0x46737c SelectClipRgn
• 0x467380 SaveDC
• 0x467384 RestoreDC
• 0x467388 Rectangle
• 0x46738c RectVisible
• 0x467390 RealizePalette
• 0x467394 PatBlt
• 0x467398 MoveToEx
• 0x46739c MaskBlt
• 0x4673a0 LineTo
• 0x4673a4 IntersectClipRect
• 0x4673a8 GetWindowOrgEx
• 0x4673ac GetTextMetricsA
• 0x4673b8 GetStockObject
• 0x4673bc GetPixel
• 0x4673c0 GetPaletteEntries
• 0x4673c4 GetObjectA
• 0x4673c8 GetDeviceCaps
• 0x4673cc GetDIBits
• 0x4673d0 GetDIBColorTable
• 0x4673d4 GetDCOrgEx
• 0x4673dc GetClipBox
• 0x4673e0 GetBrushOrgEx
• 0x4673e4 GetBitmapBits
• 0x4673e8 ExcludeClipRect
• 0x4673ec DeleteObject
• 0x4673f0 DeleteDC
• 0x4673f4 CreateSolidBrush
• 0x4673f8 CreatePenIndirect
• 0x4673fc CreatePalette
• 0x467404 CreateFontIndirectA
• 0x467408 CreateDIBitmap
• 0x46740c CreateDIBSection
• 0x467410 CreateCompatibleDC
• 0x467418 CreateBrushIndirect
• 0x46741c CreateBitmap
• 0x467420 BitBlt
Library user32.dll:
• 0x467428 CreateWindowExA
• 0x46742c WindowFromPoint
• 0x467430 WinHelpA
• 0x467434 WaitMessage
• 0x467438 UpdateWindow
• 0x46743c UnregisterClassA
• 0x467440 UnhookWindowsHookEx
• 0x467444 TranslateMessage
• 0x46744c TrackPopupMenu
• 0x467454 ShowWindow
• 0x467458 ShowScrollBar
• 0x46745c ShowOwnedPopups
• 0x467460 ShowCursor
• 0x467464 SetWindowsHookExA
• 0x467468 SetWindowPos
• 0x46746c SetWindowPlacement
• 0x467470 SetWindowLongA
• 0x467474 SetTimer
• 0x467478 SetScrollRange
• 0x46747c SetScrollPos
• 0x467480 SetScrollInfo
• 0x467484 SetRect
• 0x467488 SetPropA
• 0x46748c SetParent
• 0x467490 SetMenuItemInfoA
• 0x467494 SetMenu
• 0x467498 SetForegroundWindow
• 0x46749c SetFocus
• 0x4674a0 SetCursor
• 0x4674a4 SetClassLongA
• 0x4674a8 SetCapture
• 0x4674ac SetActiveWindow
• 0x4674b0 SendMessageA
• 0x4674b4 ScrollWindow
• 0x4674b8 ScreenToClient
• 0x4674bc RemovePropA
• 0x4674c0 RemoveMenu
• 0x4674c4 ReleaseDC
• 0x4674c8 ReleaseCapture
• 0x4674d4 RegisterClassA
• 0x4674d8 RedrawWindow
• 0x4674dc PtInRect
• 0x4674e0 PostQuitMessage
• 0x4674e4 PostMessageA
• 0x4674e8 PeekMessageA
• 0x4674ec OffsetRect
• 0x4674f0 OemToCharA
• 0x4674f4 MessageBoxA
• 0x4674f8 MapWindowPoints
• 0x4674fc MapVirtualKeyA
• 0x467500 LoadStringA
• 0x467504 LoadKeyboardLayoutA
• 0x467508 LoadIconA
• 0x46750c LoadCursorA
• 0x467510 LoadBitmapA
• 0x467514 KillTimer
• 0x467518 IsZoomed
• 0x46751c IsWindowVisible
• 0x467520 IsWindowEnabled
• 0x467524 IsWindow
• 0x467528 IsRectEmpty
• 0x46752c IsIconic
• 0x467530 IsDialogMessageA
• 0x467534 IsChild
• 0x467538 InvalidateRect
• 0x46753c IntersectRect
• 0x467540 InsertMenuItemA
• 0x467544 InsertMenuA
• 0x467548 InflateRect
• 0x467550 GetWindowTextA
• 0x467554 GetWindowRect
• 0x467558 GetWindowPlacement
• 0x46755c GetWindowLongA
• 0x467560 GetWindowDC
• 0x467564 GetTopWindow
• 0x467568 GetSystemMetrics
• 0x46756c GetSystemMenu
• 0x467570 GetSysColorBrush
• 0x467574 GetSysColor
• 0x467578 GetSubMenu
• 0x46757c GetScrollRange
• 0x467580 GetScrollPos
• 0x467584 GetScrollInfo
• 0x467588 GetPropA
• 0x46758c GetParent
• 0x467590 GetWindow
• 0x467594 GetMenuStringA
• 0x467598 GetMenuState
• 0x46759c GetMenuItemInfoA
• 0x4675a0 GetMenuItemID
• 0x4675a4 GetMenuItemCount
• 0x4675a8 GetMenu
• 0x4675ac GetLastActivePopup
• 0x4675b0 GetKeyboardState
• 0x4675b8 GetKeyboardLayout
• 0x4675bc GetKeyState
• 0x4675c0 GetKeyNameTextA
• 0x4675c4 GetIconInfo
• 0x4675c8 GetForegroundWindow
• 0x4675cc GetFocus
• 0x4675d0 GetDlgItem
• 0x4675d4 GetDesktopWindow
• 0x4675d8 GetDCEx
• 0x4675dc GetDC
• 0x4675e0 GetCursorPos
• 0x4675e4 GetCursor
• 0x4675e8 GetClientRect
• 0x4675ec GetClassNameA
• 0x4675f0 GetClassInfoA
• 0x4675f4 GetCapture
• 0x4675f8 GetActiveWindow
• 0x4675fc FrameRect
• 0x467600 FindWindowA
• 0x467604 FillRect
• 0x467608 EqualRect
• 0x46760c EnumWindows
• 0x467610 EnumThreadWindows
• 0x467614 EndPaint
• 0x467618 EndDeferWindowPos
• 0x46761c EnableWindow
• 0x467620 EnableScrollBar
• 0x467624 EnableMenuItem
• 0x467628 DrawTextA
• 0x46762c DrawMenuBar
• 0x467630 DrawIconEx
• 0x467634 DrawIcon
• 0x467638 DrawFrameControl
• 0x46763c DrawFocusRect
• 0x467640 DrawEdge
• 0x467644 DispatchMessageA
• 0x467648 DestroyWindow
• 0x46764c DestroyMenu
• 0x467650 DestroyIcon
• 0x467654 DestroyCursor
• 0x467658 DeleteMenu
• 0x46765c DeferWindowPos
• 0x467660 DefWindowProcA
• 0x467664 DefMDIChildProcA
• 0x467668 DefFrameProcA
• 0x46766c CreatePopupMenu
• 0x467670 CreateMenu
• 0x467674 CreateIcon
• 0x467678 ClientToScreen
• 0x46767c CheckMenuItem
• 0x467680 CallWindowProcA
• 0x467684 CallNextHookEx
• 0x467688 BeginPaint
• 0x46768c BeginDeferWindowPos
• 0x467690 CharNextA
• 0x467694 CharLowerA
• 0x467698 CharToOemA
• 0x46769c AdjustWindowRectEx
Library kernel32.dll:
• 0x4676a8 Sleep
Library oleaut32.dll:
• 0x4676b0 SafeArrayPtrOfIndex
• 0x4676b4 SafeArrayGetUBound
• 0x4676b8 SafeArrayGetLBound
• 0x4676bc SafeArrayCreate
• 0x4676c0 VariantChangeType
• 0x4676c4 VariantCopy
• 0x4676c8 VariantClear
• 0x4676cc VariantInit
Library comctl32.dll:
• 0x4676dc ImageList_Write
• 0x4676e0 ImageList_Read
• 0x4676f0 ImageList_DragMove
• 0x4676f4 ImageList_DragLeave
• 0x4676f8 ImageList_DragEnter
• 0x4676fc ImageList_EndDrag
• 0x467700 ImageList_BeginDrag
• 0x467704 ImageList_Remove
• 0x467708 ImageList_DrawEx
• 0x46770c ImageList_Draw
• 0x46771c ImageList_Add
• 0x467724 ImageList_Destroy
• 0x467728 ImageList_Create
Library comdlg32.dll:
• 0x467730 GetSaveFileNameA
• 0x467734 GetOpenFileNameA
Library winmm.dll:
• 0x46773c mciSendCommandA
• 0x467740 mciGetErrorStringA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 57874 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 49238 239.255.255.250 1900
192.168.56.101 57757 239.255.255.250 3702
192.168.56.101 57759 239.255.255.250 3702
192.168.56.101 57761 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.