5.8
高危
59 个模型检测该样本为恶意！
重新分析
更多

20a94eccb531b9e7db7c2f15b4b02661781688b26407d8cad53ed9c3e1b16f88

7915a359a3c21fdf9e95a672c8a12019.exe

分析耗时

26s

最近分析

文件大小

909.5KB
静态报毒 动态报毒 100% 1UO2BPG4+80 4GW@AY AGEN AGENTTESLA AI SCORE=99 ALI2000015 AUTO CHISBURG CLASSIC CONFIDENCE DELF DELFINJECT DELPHILESS ELFW ELGG FAREIT GENASA GENERICKDZ HHJCPA HIGH CONFIDENCE KRYPTIK LOKI LOKIBOT MALWARE@#1Y4MNU6I3URMO R + MAL SCORE SIGGEN2 SMDF STATIC AI SUSGEN SUSPICIOUS PE UNSAFE VO4OI WACATAC X2059 ZELPHIF ZLQS 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20201228 21.1.5827.0
Tencent Win32.Trojan.Inject.Auto 20201228 1.0.0.1
Kingsoft 20201228 2017.9.26.565
McAfee Fareit-FRQ!7915A359A3C2 20201228 6.0.6.653
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619677507.813751
__exception__
stacktrace: 
7915a359a3c21fdf9e95a672c8a12019+0x6a041 @ 0x46a041
7915a359a3c21fdf9e95a672c8a12019+0x3e1f @ 0x403e1f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637912
registers.edi: 4628596
registers.eax: 0
registers.ebp: 1638204
registers.edx: 2130566132
registers.ebx: 0
registers.esi: 68
registers.ecx: 3322150912
exception.instruction_r: f7 f0 90 90 90 33 c0 5a 59 59 64 89 10 eb 18 e9
exception.symbol: 7915a359a3c21fdf9e95a672c8a12019+0x69df3
exception.instruction: div eax
exception.module: 7915a359a3c21fdf9e95a672c8a12019.exe
exception.exception_code: 0xc0000094
exception.offset: 433651
exception.address: 0x469df3
success 0 0
1619677510.625999
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75137f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75134de3
7915a359a3c21fdf9e95a672c8a12019+0x58a4d @ 0x458a4d
7915a359a3c21fdf9e95a672c8a12019+0x51254 @ 0x451254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff3f14ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (29 个事件)
Time & API Arguments Status Return Repeated
1619677507.470751
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003d0000
success 0 0
1619677508.001751
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00500000
success 0 0
1619677508.095751
NtAllocateVirtualMemory
process_identifier: 2284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00520000
success 0 0
1619677509.500999
NtAllocateVirtualMemory
process_identifier: 392
region_size: 2031616
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01ea0000
success 0 0
1619677509.500999
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02050000
success 0 0
1619677509.500999
NtAllocateVirtualMemory
process_identifier: 392
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01d30000
success 0 0
1619677509.500999
NtProtectVirtualMemory
process_identifier: 392
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 299008
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d32000
success 0 0
1619677509.828999
NtAllocateVirtualMemory
process_identifier: 392
region_size: 851968
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01ea0000
success 0 0
1619677509.828999
NtAllocateVirtualMemory
process_identifier: 392
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f30000
success 0 0
1619677510.594999
NtProtectVirtualMemory
process_identifier: 392
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e92000
success 0 0
1619677510.594999
NtProtectVirtualMemory
process_identifier: 392
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619677510.594999
NtProtectVirtualMemory
process_identifier: 392
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e92000
success 0 0
1619677510.594999
NtProtectVirtualMemory
process_identifier: 392
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619677510.594999
NtProtectVirtualMemory
process_identifier: 392
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e92000
success 0 0
1619677510.594999
NtProtectVirtualMemory
process_identifier: 392
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619677510.594999
NtProtectVirtualMemory
process_identifier: 392
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e92000
success 0 0
1619677510.594999
NtProtectVirtualMemory
process_identifier: 392
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619677510.594999
NtProtectVirtualMemory
process_identifier: 392
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e92000
success 0 0
1619677510.594999
NtProtectVirtualMemory
process_identifier: 392
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619677510.594999
NtProtectVirtualMemory
process_identifier: 392
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e92000
success 0 0
1619677510.594999
NtProtectVirtualMemory
process_identifier: 392
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619677510.594999
NtProtectVirtualMemory
process_identifier: 392
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e92000
success 0 0
1619677510.594999
NtProtectVirtualMemory
process_identifier: 392
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619677510.594999
NtProtectVirtualMemory
process_identifier: 392
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e92000
success 0 0
1619677510.594999
NtProtectVirtualMemory
process_identifier: 392
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619677510.594999
NtProtectVirtualMemory
process_identifier: 392
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e92000
success 0 0
1619677510.594999
NtProtectVirtualMemory
process_identifier: 392
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619677510.594999
NtProtectVirtualMemory
process_identifier: 392
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e92000
success 0 0
1619677510.594999
NtProtectVirtualMemory
process_identifier: 392
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.592862435108935 section {'size_of_data': '0x00064e00', 'virtual_address': '0x00084000', 'entropy': 7.592862435108935, 'name': '.rsrc', 'virtual_size': '0x00064c7c'} description A section with a high entropy has been found
entropy 0.4441386901485966 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2284 called NtSetContextThread to modify thread in remote process 392
Time & API Arguments Status Return Repeated
1619677508.907751
NtSetContextThread
thread_handle: 0x000000f8
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4526783
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 392
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2284 resumed a thread in remote process 392
Time & API Arguments Status Return Repeated
1619677509.251751
NtResumeThread
thread_handle: 0x000000f8
suspend_count: 1
process_identifier: 392
success 0 0
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619677508.845751
CreateProcessInternalW
thread_identifier: 2976
thread_handle: 0x000000f8
process_identifier: 392
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7915a359a3c21fdf9e95a672c8a12019.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619677508.845751
NtUnmapViewOfSection
process_identifier: 392
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1619677508.845751
NtMapViewOfSection
section_handle: 0x00000104
process_identifier: 392
commit_size: 688128
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 688128
base_address: 0x00400000
success 0 0
1619677508.907751
NtGetContextThread
thread_handle: 0x000000f8
success 0 0
1619677508.907751
NtSetContextThread
thread_handle: 0x000000f8
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4526783
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 392
success 0 0
1619677509.251751
NtResumeThread
thread_handle: 0x000000f8
suspend_count: 1
process_identifier: 392
success 0 0
File has been identified by 59 AntiVirus engines on VirusTotal as malicious (50 out of 59 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKDZ.65764
FireEye Generic.mg.7915a359a3c21fdf
Qihoo-360 Win32/Trojan.469
ALYac Spyware.AgentTesla
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Malware
K7AntiVirus Riskware ( 0040eff71 )
Alibaba Trojan:Win32/DelfInject.ali2000015
K7GW Riskware ( 0040eff71 )
Cybereason malicious.9a3c21
Arcabit Trojan.Generic.D100E4
Cyren W32/Delf.ZLQS-3748
Symantec Trojan.Gen.2
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
BitDefender Trojan.GenericKDZ.65764
NANO-Antivirus Trojan.Win32.Kryptik.hhjcpa
ViRobot Trojan.Win32.Z.Kryptik.931328.S
Avast Win32:Trojan-gen
Tencent Win32.Trojan.Inject.Auto
Ad-Aware Trojan.GenericKDZ.65764
Sophos Mal/Generic-R + Mal/Fareit-V
Comodo Malware@#1y4mnu6i3urmo
F-Secure Heuristic.HEUR/AGEN.1111011
DrWeb Trojan.PWS.Siggen2.45805
TrendMicro TrojanSpy.Win32.LOKI.SMDF.hp
McAfee-GW-Edition BehavesLike.Win32.Fareit.dc
Emsisoft Trojan.Injector (A)
SentinelOne Static AI - Suspicious PE
Jiangmin Trojan.PSW.Chisburg.bgl
Avira HEUR/AGEN.1111011
Antiy-AVL Trojan/Win32.Wacatac
Gridinsoft Trojan.Win32.Kryptik.ba!s1
Microsoft PWS:Win32/Fareit.C!MTB
AegisLab Trojan.Multi.Generic.4!c
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
GData Trojan.GenericKDZ.65764
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2059
McAfee Fareit-FRQ!7915A359A3C2
MAX malware (ai score=99)
VBA32 Trojan.Kryptik
Malwarebytes Spyware.LokiBot
Zoner Trojan.Win32.89922
ESET-NOD32 a variant of Win32/Injector.ELGG
TrendMicro-HouseCall TrojanSpy.Win32.LOKI.SMDF.hp
Rising Trojan.Injector!1.AF18 (CLASSIC)
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-05-11 13:21:40

Imports

Library kernel32.dll:
• 0x477164 VirtualFree
• 0x477168 VirtualAlloc
• 0x47716c LocalFree
• 0x477170 LocalAlloc
• 0x477174 GetVersion
• 0x477178 GetCurrentThreadId
• 0x477184 VirtualQuery
• 0x477188 WideCharToMultiByte
• 0x477190 MultiByteToWideChar
• 0x477194 lstrlenA
• 0x477198 lstrcpynA
• 0x47719c LoadLibraryExA
• 0x4771a0 GetThreadLocale
• 0x4771a4 GetStartupInfoA
• 0x4771a8 GetProcAddress
• 0x4771ac GetModuleHandleA
• 0x4771b0 GetModuleFileNameA
• 0x4771b4 GetLocaleInfoA
• 0x4771b8 GetLastError
• 0x4771c0 GetCommandLineA
• 0x4771c4 FreeLibrary
• 0x4771c8 FindFirstFileA
• 0x4771cc FindClose
• 0x4771d0 ExitProcess
• 0x4771d4 WriteFile
• 0x4771dc RtlUnwind
• 0x4771e0 RaiseException
• 0x4771e4 GetStdHandle
Library user32.dll:
• 0x4771ec GetKeyboardType
• 0x4771f0 LoadStringA
• 0x4771f4 MessageBoxA
• 0x4771f8 CharNextA
Library advapi32.dll:
• 0x477200 RegQueryValueExA
• 0x477204 RegOpenKeyExA
• 0x477208 RegCloseKey
Library oleaut32.dll:
• 0x477210 SysFreeString
• 0x477214 SysReAllocStringLen
• 0x477218 SysAllocStringLen
Library kernel32.dll:
• 0x477220 TlsSetValue
• 0x477224 TlsGetValue
• 0x477228 LocalAlloc
• 0x47722c GetModuleHandleA
Library advapi32.dll:
• 0x477234 RegQueryValueExA
• 0x477238 RegOpenKeyExA
• 0x47723c RegCloseKey
Library kernel32.dll:
• 0x477244 lstrcpyA
• 0x477248 WriteFile
• 0x47724c WaitForSingleObject
• 0x477250 VirtualQuery
• 0x477254 VirtualFree
• 0x477258 VirtualAlloc
• 0x47725c Sleep
• 0x477260 SizeofResource
• 0x477264 SetThreadLocale
• 0x477268 SetFilePointer
• 0x47726c SetEvent
• 0x477270 SetErrorMode
• 0x477274 SetEndOfFile
• 0x477278 ResetEvent
• 0x47727c ReadFile
• 0x477280 MultiByteToWideChar
• 0x477284 MulDiv
• 0x477288 LockResource
• 0x47728c LoadResource
• 0x477290 LoadLibraryA
• 0x47729c GlobalUnlock
• 0x4772a0 GlobalSize
• 0x4772a4 GlobalReAlloc
• 0x4772a8 GlobalHandle
• 0x4772ac GlobalLock
• 0x4772b0 GlobalFree
• 0x4772b4 GlobalFindAtomA
• 0x4772b8 GlobalDeleteAtom
• 0x4772bc GlobalAlloc
• 0x4772c0 GlobalAddAtomA
• 0x4772c8 GetVersionExA
• 0x4772cc GetVersion
• 0x4772d0 GetUserDefaultLCID
• 0x4772d4 GetTickCount
• 0x4772d8 GetThreadLocale
• 0x4772dc GetSystemInfo
• 0x4772e0 GetStringTypeExA
• 0x4772e4 GetStdHandle
• 0x4772e8 GetProcAddress
• 0x4772ec GetModuleHandleA
• 0x4772f0 GetModuleFileNameA
• 0x4772f4 GetLogicalDrives
• 0x4772f8 GetLocaleInfoA
• 0x4772fc GetLocalTime
• 0x477300 GetLastError
• 0x477304 GetFullPathNameA
• 0x477308 GetFileAttributesA
• 0x47730c GetDriveTypeA
• 0x477310 GetDiskFreeSpaceA
• 0x477314 GetDateFormatA
• 0x477318 GetCurrentThreadId
• 0x47731c GetCurrentProcessId
• 0x477320 GetComputerNameA
• 0x477324 GetCPInfo
• 0x477328 GetACP
• 0x47732c FreeResource
• 0x477330 InterlockedExchange
• 0x477334 FreeLibrary
• 0x477338 FormatMessageA
• 0x47733c FindResourceA
• 0x477340 FindNextFileA
• 0x477344 FindFirstFileA
• 0x477348 FindClose
• 0x477354 EnumCalendarInfoA
• 0x477360 CreateThread
• 0x477364 CreateFileA
• 0x477368 CreateEventA
• 0x47736c CompareStringA
• 0x477370 CloseHandle
Library mpr.dll:
• 0x477378 WNetGetConnectionA
Library version.dll:
• 0x477380 VerQueryValueA
• 0x477388 GetFileVersionInfoA
Library gdi32.dll:
• 0x477390 UnrealizeObject
• 0x477394 StretchBlt
• 0x477398 SetWindowOrgEx
• 0x47739c SetWinMetaFileBits
• 0x4773a0 SetViewportOrgEx
• 0x4773a4 SetTextColor
• 0x4773a8 SetStretchBltMode
• 0x4773ac SetROP2
• 0x4773b0 SetPixel
• 0x4773b4 SetMapMode
• 0x4773b8 SetEnhMetaFileBits
• 0x4773bc SetDIBColorTable
• 0x4773c0 SetBrushOrgEx
• 0x4773c4 SetBkMode
• 0x4773c8 SetBkColor
• 0x4773cc SelectPalette
• 0x4773d0 SelectObject
• 0x4773d4 SaveDC
• 0x4773d8 RestoreDC
• 0x4773dc Rectangle
• 0x4773e0 RectVisible
• 0x4773e4 RealizePalette
• 0x4773e8 PlayEnhMetaFile
• 0x4773ec PatBlt
• 0x4773f0 MoveToEx
• 0x4773f4 MaskBlt
• 0x4773f8 LineTo
• 0x4773fc LPtoDP
• 0x477400 IntersectClipRect
• 0x477404 GetWindowOrgEx
• 0x477408 GetWinMetaFileBits
• 0x47740c GetTextMetricsA
• 0x477418 GetStockObject
• 0x47741c GetPixel
• 0x477420 GetPaletteEntries
• 0x477424 GetObjectA
• 0x477434 GetEnhMetaFileBits
• 0x477438 GetDeviceCaps
• 0x47743c GetDIBits
• 0x477440 GetDIBColorTable
• 0x477444 GetDCOrgEx
• 0x47744c GetClipBox
• 0x477450 GetBrushOrgEx
• 0x477454 GetBitmapBits
• 0x477458 ExtTextOutA
• 0x47745c ExcludeClipRect
• 0x477460 DeleteObject
• 0x477464 DeleteEnhMetaFile
• 0x477468 DeleteDC
• 0x47746c CreateSolidBrush
• 0x477470 CreatePenIndirect
• 0x477474 CreatePen
• 0x477478 CreatePalette
• 0x477480 CreateFontIndirectA
• 0x477484 CreateEnhMetaFileA
• 0x477488 CreateDIBitmap
• 0x47748c CreateDIBSection
• 0x477490 CreateCompatibleDC
• 0x477498 CreateBrushIndirect
• 0x47749c CreateBitmap
• 0x4774a0 CopyEnhMetaFileA
• 0x4774a4 CloseEnhMetaFile
• 0x4774a8 BitBlt
Library user32.dll:
• 0x4774b0 CreateWindowExA
• 0x4774b4 WindowFromPoint
• 0x4774b8 WinHelpA
• 0x4774bc WaitMessage
• 0x4774c0 ValidateRect
• 0x4774c4 UpdateWindow
• 0x4774c8 UnregisterClassA
• 0x4774cc UnhookWindowsHookEx
• 0x4774d0 TranslateMessage
• 0x4774d8 TrackPopupMenu
• 0x4774e0 ShowWindow
• 0x4774e4 ShowScrollBar
• 0x4774e8 ShowOwnedPopups
• 0x4774ec ShowCursor
• 0x4774f0 SetWindowsHookExA
• 0x4774f4 SetWindowTextA
• 0x4774f8 SetWindowPos
• 0x4774fc SetWindowPlacement
• 0x477500 SetWindowLongA
• 0x477504 SetTimer
• 0x477508 SetScrollRange
• 0x47750c SetScrollPos
• 0x477510 SetScrollInfo
• 0x477514 SetRect
• 0x477518 SetPropA
• 0x47751c SetParent
• 0x477520 SetMenuItemInfoA
• 0x477524 SetMenu
• 0x477528 SetForegroundWindow
• 0x47752c SetFocus
• 0x477530 SetCursor
• 0x477534 SetClassLongA
• 0x477538 SetCapture
• 0x47753c SetActiveWindow
• 0x477540 SendMessageA
• 0x477544 ScrollWindow
• 0x477548 ScreenToClient
• 0x47754c RemovePropA
• 0x477550 RemoveMenu
• 0x477554 ReleaseDC
• 0x477558 ReleaseCapture
• 0x477564 RegisterClassA
• 0x477568 RedrawWindow
• 0x47756c PtInRect
• 0x477570 PostQuitMessage
• 0x477574 PostMessageA
• 0x477578 PeekMessageA
• 0x47757c OffsetRect
• 0x477580 OemToCharA
• 0x477584 MessageBoxA
• 0x477588 MapWindowPoints
• 0x47758c MapVirtualKeyA
• 0x477590 LoadStringA
• 0x477594 LoadKeyboardLayoutA
• 0x477598 LoadIconA
• 0x47759c LoadCursorA
• 0x4775a0 LoadBitmapA
• 0x4775a4 KillTimer
• 0x4775a8 IsZoomed
• 0x4775ac IsWindowVisible
• 0x4775b0 IsWindowEnabled
• 0x4775b4 IsWindow
• 0x4775b8 IsRectEmpty
• 0x4775bc IsIconic
• 0x4775c0 IsDialogMessageA
• 0x4775c4 IsChild
• 0x4775c8 InvalidateRect
• 0x4775cc IntersectRect
• 0x4775d0 InsertMenuItemA
• 0x4775d4 InsertMenuA
• 0x4775d8 InflateRect
• 0x4775e0 GetWindowTextA
• 0x4775e4 GetWindowRect
• 0x4775e8 GetWindowPlacement
• 0x4775ec GetWindowLongA
• 0x4775f0 GetWindowDC
• 0x4775f4 GetTopWindow
• 0x4775f8 GetSystemMetrics
• 0x4775fc GetSystemMenu
• 0x477600 GetSysColorBrush
• 0x477604 GetSysColor
• 0x477608 GetSubMenu
• 0x47760c GetScrollRange
• 0x477610 GetScrollPos
• 0x477614 GetScrollInfo
• 0x477618 GetPropA
• 0x47761c GetParent
• 0x477620 GetWindow
• 0x477624 GetMessageTime
• 0x477628 GetMenuStringA
• 0x47762c GetMenuState
• 0x477630 GetMenuItemInfoA
• 0x477634 GetMenuItemID
• 0x477638 GetMenuItemCount
• 0x47763c GetMenu
• 0x477640 GetLastActivePopup
• 0x477644 GetKeyboardState
• 0x47764c GetKeyboardLayout
• 0x477650 GetKeyState
• 0x477654 GetKeyNameTextA
• 0x477658 GetIconInfo
• 0x47765c GetForegroundWindow
• 0x477660 GetFocus
• 0x477664 GetDesktopWindow
• 0x477668 GetDCEx
• 0x47766c GetDC
• 0x477670 GetCursorPos
• 0x477674 GetCursor
• 0x477678 GetClipboardData
• 0x47767c GetClientRect
• 0x477680 GetClassNameA
• 0x477684 GetClassInfoA
• 0x477688 GetCapture
• 0x47768c GetActiveWindow
• 0x477690 FrameRect
• 0x477694 FindWindowA
• 0x477698 FillRect
• 0x47769c EqualRect
• 0x4776a0 EnumWindows
• 0x4776a4 EnumThreadWindows
• 0x4776a8 EndPaint
• 0x4776ac EnableWindow
• 0x4776b0 EnableScrollBar
• 0x4776b4 EnableMenuItem
• 0x4776b8 DrawTextA
• 0x4776bc DrawMenuBar
• 0x4776c0 DrawIconEx
• 0x4776c4 DrawIcon
• 0x4776c8 DrawFrameControl
• 0x4776cc DrawFocusRect
• 0x4776d0 DrawEdge
• 0x4776d4 DispatchMessageA
• 0x4776d8 DestroyWindow
• 0x4776dc DestroyMenu
• 0x4776e0 DestroyIcon
• 0x4776e4 DestroyCursor
• 0x4776e8 DeleteMenu
• 0x4776ec DefWindowProcA
• 0x4776f0 DefMDIChildProcA
• 0x4776f4 DefFrameProcA
• 0x4776f8 CreatePopupMenu
• 0x4776fc CreateMenu
• 0x477700 CreateIcon
• 0x477704 ClientToScreen
• 0x477708 CheckMenuItem
• 0x47770c CallWindowProcA
• 0x477710 CallNextHookEx
• 0x477714 BeginPaint
• 0x477718 CharNextA
• 0x47771c CharLowerBuffA
• 0x477720 CharLowerA
• 0x477724 CharUpperBuffA
• 0x477728 CharToOemA
• 0x47772c AdjustWindowRectEx
Library kernel32.dll:
• 0x477738 Sleep
Library oleaut32.dll:
• 0x477740 SafeArrayPtrOfIndex
• 0x477744 SafeArrayGetUBound
• 0x477748 SafeArrayGetLBound
• 0x47774c SafeArrayCreate
• 0x477750 VariantChangeType
• 0x477754 VariantCopy
• 0x477758 VariantClear
• 0x47775c VariantInit
Library ole32.dll:
• 0x477768 IsAccelerator
• 0x47776c OleDraw
• 0x477774 CoTaskMemFree
• 0x477778 ProgIDFromCLSID
• 0x47777c StringFromCLSID
• 0x477780 CoCreateInstance
• 0x477784 CoGetClassObject
• 0x477788 CoUninitialize
• 0x47778c CoInitialize
• 0x477790 IsEqualGUID
Library oleaut32.dll:
• 0x477798 GetErrorInfo
• 0x47779c GetActiveObject
• 0x4777a0 SysFreeString
Library comctl32.dll:
• 0x4777b0 ImageList_Write
• 0x4777b4 ImageList_Read
• 0x4777c4 ImageList_DragMove
• 0x4777c8 ImageList_DragLeave
• 0x4777cc ImageList_DragEnter
• 0x4777d0 ImageList_EndDrag
• 0x4777d4 ImageList_BeginDrag
• 0x4777d8 ImageList_Remove
• 0x4777dc ImageList_DrawEx
• 0x4777e0 ImageList_Draw
• 0x4777f0 ImageList_Add
• 0x4777f8 ImageList_Destroy
• 0x4777fc ImageList_Create
• 0x477800 InitCommonControls

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58370 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.