6.4
高危

1755e3f11115ab622f5f791a7e9edd84db4a99ce8f4eb76eb3e3ece910c6f702

7b92d9b8da680f686a1a8c3b06cdc936.exe

分析耗时

29s

最近分析

文件大小

821.5KB
静态报毒 动态报毒 ADWAREINSTCAP AI SCORE=84 AIDETECTVM CRIDEX CRYPTO ELDORADO EMOTET EREPLUS GENASA GENCIRC GENETIC HBR@8QRQPO HCAI HHMQKY HIGH CONFIDENCE INJECT3 IUBS KRYPTIK KTSE MALICIOUS PE MALWARE1 QAKBOT QBOT R + MAL R329412 SCORE SQAQ1H STATIC AI TROJANBANKER ULISE UNSAFE WACATAC ZEXAF ZPACK ZQ0@AUAFL@KI 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Packed-GBS!7B92D9B8DA68 20210121 6.0.6.653
Alibaba TrojanBanker:Win32/Qakbot.b6b2a44b 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20210122 21.1.5827.0
Tencent Malware.Win32.Gencirc.10b9d07c 20210122 1.0.0.1
Kingsoft 20210122 2017.9.26.565
CrowdStrike 20180202 1.0
静态指标
Queries for the computername (3 个事件)
Time & API Arguments Status Return Repeated
1619649221.47496
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619649227.67796
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619650387.204749
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Command line console output was observed (28 个事件)
Time & API Arguments Status Return Repeated
1619650393.532124
WriteConsoleA
buffer: ÕýÔÚ Ping 127.0.0.1
console_handle: 0x00000007
success 1 0
1619650393.563124
WriteConsoleA
buffer: ¾ßÓÐ 32 ×Ö½ÚµÄÊý¾Ý:
console_handle: 0x00000007
success 1 0
1619650393.579124
WriteConsoleA
buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´:
console_handle: 0x00000007
success 1 0
1619650393.594124
WriteConsoleA
buffer: ×Ö½Ú=32
console_handle: 0x00000007
success 1 0
1619650393.594124
WriteConsoleA
buffer: ʱ¼ä<1ms
console_handle: 0x00000007
success 1 0
1619650393.594124
WriteConsoleA
buffer: TTL=128
console_handle: 0x00000007
success 1 0
1619650394.594124
WriteConsoleA
buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´:
console_handle: 0x00000007
success 1 0
1619650394.594124
WriteConsoleA
buffer: ×Ö½Ú=32
console_handle: 0x00000007
success 1 0
1619650394.610124
WriteConsoleA
buffer: ʱ¼ä<1ms
console_handle: 0x00000007
success 1 0
1619650394.610124
WriteConsoleA
buffer: TTL=128
console_handle: 0x00000007
success 1 0
1619650395.610124
WriteConsoleA
buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´:
console_handle: 0x00000007
success 1 0
1619650395.610124
WriteConsoleA
buffer: ×Ö½Ú=32
console_handle: 0x00000007
success 1 0
1619650395.610124
WriteConsoleA
buffer: ʱ¼ä<1ms
console_handle: 0x00000007
success 1 0
1619650395.610124
WriteConsoleA
buffer: TTL=128
console_handle: 0x00000007
success 1 0
1619650396.610124
WriteConsoleA
buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´:
console_handle: 0x00000007
success 1 0
1619650396.610124
WriteConsoleA
buffer: ×Ö½Ú=32
console_handle: 0x00000007
success 1 0
1619650396.610124
WriteConsoleA
buffer: ʱ¼ä<1ms
console_handle: 0x00000007
success 1 0
1619650396.610124
WriteConsoleA
buffer: TTL=128
console_handle: 0x00000007
success 1 0
1619650397.610124
WriteConsoleA
buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´:
console_handle: 0x00000007
success 1 0
1619650397.610124
WriteConsoleA
buffer: ×Ö½Ú=32
console_handle: 0x00000007
success 1 0
1619650397.610124
WriteConsoleA
buffer: ʱ¼ä<1ms
console_handle: 0x00000007
success 1 0
1619650397.610124
WriteConsoleA
buffer: TTL=128
console_handle: 0x00000007
success 1 0
1619650398.610124
WriteConsoleA
buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´:
console_handle: 0x00000007
success 1 0
1619650398.610124
WriteConsoleA
buffer: ×Ö½Ú=32
console_handle: 0x00000007
success 1 0
1619650398.610124
WriteConsoleA
buffer: ʱ¼ä<1ms
console_handle: 0x00000007
success 1 0
1619650398.610124
WriteConsoleA
buffer: TTL=128
console_handle: 0x00000007
success 1 0
1619650398.626124
WriteConsoleA
buffer: 127.0.0.1 µÄ Ping ͳ¼ÆÐÅÏ¢: Êý¾Ý°ü: ÒÑ·¢ËÍ = 6£¬ÒѽÓÊÕ = 6£¬¶ªÊ§ = 0 (0% ¶ªÊ§)£¬
console_handle: 0x00000007
success 1 0
1619650398.626124
WriteConsoleA
buffer: Íù·µÐг̵ĹÀ¼ÆÊ±¼ä(ÒÔºÁÃëΪµ¥Î»): ×î¶Ì = 0ms£¬× = 0ms£¬Æ½¾ù = 0ms
console_handle: 0x00000007
success 1 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619650393.485124
GlobalMemoryStatusEx
success 1 0
The executable uses a known packer (1 个事件)
packer Armadillo v1.71
The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)
resource name MUI
One or more processes crashed (3 个事件)
Time & API Arguments Status Return Repeated
1619649227.75596
__exception__
stacktrace:
EqualSid+0x19 EqualPrefixSid-0xc kernelbase+0x1bfe3 @ 0x778fbfe3
7b92d9b8da680f686a1a8c3b06cdc936+0x84c6 @ 0x4084c6
7b92d9b8da680f686a1a8c3b06cdc936+0xa27d @ 0x40a27d
7b92d9b8da680f686a1a8c3b06cdc936+0xa2b8 @ 0x40a2b8
7b92d9b8da680f686a1a8c3b06cdc936+0x8f67 @ 0x408f67
7b92d9b8da680f686a1a8c3b06cdc936+0x17cf @ 0x4017cf
7b92d9b8da680f686a1a8c3b06cdc936+0x1c69 @ 0x401c69
7b92d9b8da680f686a1a8c3b06cdc936+0x1273 @ 0x401273
7b92d9b8da680f686a1a8c3b06cdc936+0xb65c2 @ 0x4b65c2
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1633776
registers.edi: 0
registers.eax: 1281
registers.ebp: 1633784
registers.edx: 0
registers.ebx: 37157128
registers.esi: 37157128
registers.ecx: 2130563072
exception.instruction_r: 66 3b 07 0f 85 e1 ef ff ff 0f b6 4e 01 33 c0 8d
exception.symbol: RtlEqualSid+0x10 RtlSetCriticalSectionSpinCount-0x26 ntdll+0x394c1
exception.instruction: cmp ax, word ptr [edi]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 234689
exception.address: 0x77d694c1
success 0 0
1619650387.860749
__exception__
stacktrace:
7b92d9b8da680f686a1a8c3b06cdc936+0x3dad @ 0x403dad
7b92d9b8da680f686a1a8c3b06cdc936+0x1b26 @ 0x401b26
7b92d9b8da680f686a1a8c3b06cdc936+0x1273 @ 0x401273
7b92d9b8da680f686a1a8c3b06cdc936+0xb65c2 @ 0x4b65c2
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637268
registers.edi: 0
registers.eax: 1447909480
registers.ebp: 1637328
registers.edx: 22104
registers.ebx: 1
registers.esi: 6250936
registers.ecx: 10
exception.instruction_r: ed 89 5d e4 89 4d e0 5a 59 5b 58 83 4d fc ff eb
exception.symbol: 7b92d9b8da680f686a1a8c3b06cdc936+0x33cf
exception.instruction: in eax, dx
exception.module: 7b92d9b8da680f686a1a8c3b06cdc936.exe
exception.exception_code: 0xc0000096
exception.offset: 13263
exception.address: 0x4033cf
success 0 0
1619650387.860749
__exception__
stacktrace:
7b92d9b8da680f686a1a8c3b06cdc936+0x3db6 @ 0x403db6
7b92d9b8da680f686a1a8c3b06cdc936+0x1b26 @ 0x401b26
7b92d9b8da680f686a1a8c3b06cdc936+0x1273 @ 0x401273
7b92d9b8da680f686a1a8c3b06cdc936+0xb65c2 @ 0x4b65c2
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637272
registers.edi: 0
registers.eax: 1447909480
registers.ebp: 1637328
registers.edx: 22104
registers.ebx: 1
registers.esi: 6250936
registers.ecx: 20
exception.instruction_r: ed 89 45 e4 5a 59 5b 58 83 4d fc ff eb 11 33 c0
exception.symbol: 7b92d9b8da680f686a1a8c3b06cdc936+0x3468
exception.instruction: in eax, dx
exception.module: 7b92d9b8da680f686a1a8c3b06cdc936.exe
exception.exception_code: 0xc0000096
exception.offset: 13416
exception.address: 0x403468
success 0 0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (6 个事件)
Time & API Arguments Status Return Repeated
1619649221.28696
NtAllocateVirtualMemory
process_identifier: 2864
region_size: 233472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x004d0000
success 0 0
1619649221.30296
NtAllocateVirtualMemory
process_identifier: 2864
region_size: 229376
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00510000
success 0 0
1619649221.30296
NtProtectVirtualMemory
process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 245760
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619650387.188749
NtAllocateVirtualMemory
process_identifier: 2116
region_size: 233472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x003c0000
success 0 0
1619650387.188749
NtAllocateVirtualMemory
process_identifier: 2116
region_size: 229376
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x004d0000
success 0 0
1619650387.188749
NtProtectVirtualMemory
process_identifier: 2116
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 245760
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7b92d9b8da680f686a1a8c3b06cdc936.exe
Creates a suspicious process (2 个事件)
cmdline "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7b92d9b8da680f686a1a8c3b06cdc936.exe"
cmdline cmd.exe /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7b92d9b8da680f686a1a8c3b06cdc936.exe"
A process created a hidden window (2 个事件)
Time & API Arguments Status Return Repeated
1619649222.50596
CreateProcessInternalW
thread_identifier: 2772
thread_handle: 0x00000140
process_identifier: 2116
current_directory:
filepath:
track: 1
command_line: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7b92d9b8da680f686a1a8c3b06cdc936.exe /C
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
process_handle: 0x00000144
inherit_handles: 0
success 1 0
1619649228.28696
ShellExecuteExW
parameters: /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7b92d9b8da680f686a1a8c3b06cdc936.exe"
filepath: cmd.exe
filepath_r: cmd.exe
show_type: 0
success 1 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (6 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (1 个事件)
entropy 7.353178479758558 section {'size_of_data': '0x00015c00', 'virtual_address': '0x000ba000', 'entropy': 7.353178479758558, 'name': '.rsrc', 'virtual_size': '0x00015b60'} description A section with a high entropy has been found
Uses Windows utilities for basic Windows functionality (3 个事件)
cmdline "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7b92d9b8da680f686a1a8c3b06cdc936.exe"
cmdline ping.exe -n 6 127.0.0.1
cmdline cmd.exe /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7b92d9b8da680f686a1a8c3b06cdc936.exe"
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Detects VMWare through the in instruction feature (1 个事件)
Time & API Arguments Status Return Repeated
1619650387.860749
__exception__
stacktrace:
7b92d9b8da680f686a1a8c3b06cdc936+0x3dad @ 0x403dad
7b92d9b8da680f686a1a8c3b06cdc936+0x1b26 @ 0x401b26
7b92d9b8da680f686a1a8c3b06cdc936+0x1273 @ 0x401273
7b92d9b8da680f686a1a8c3b06cdc936+0xb65c2 @ 0x4b65c2
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637268
registers.edi: 0
registers.eax: 1447909480
registers.ebp: 1637328
registers.edx: 22104
registers.ebx: 1
registers.esi: 6250936
registers.ecx: 10
exception.instruction_r: ed 89 5d e4 89 4d e0 5a 59 5b 58 83 4d fc ff eb
exception.symbol: 7b92d9b8da680f686a1a8c3b06cdc936+0x33cf
exception.instruction: in eax, dx
exception.module: 7b92d9b8da680f686a1a8c3b06cdc936.exe
exception.exception_code: 0xc0000096
exception.offset: 13263
exception.address: 0x4033cf
success 0 0
File has been identified by 59 AntiVirus engines on VirusTotal as malicious (50 out of 59 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Generic.Ereplus.250534FA
FireEye Generic.mg.7b92d9b8da680f68
CAT-QuickHeal Trojan.Qbot
Qihoo-360 Win32/Trojan.BO.5b9
McAfee Packed-GBS!7B92D9B8DA68
Cylance Unsafe
SUPERAntiSpyware Trojan.Agent/Gen-Kryptik
Sangfor Malware
K7AntiVirus Trojan ( 005668351 )
Alibaba TrojanBanker:Win32/Qakbot.b6b2a44b
K7GW Trojan ( 00562ec71 )
Cybereason malicious.8da680
Arcabit Generic.Ereplus.D3D2A6FA
Cyren W32/Agent.BQD.gen!Eldorado
Symantec W32.Qakbot
APEX Malicious
Avast Win32:Trojan-gen
ClamAV Win.Malware.Ulise-7640150-0
Kaspersky HEUR:Trojan-Banker.Win32.Qbot.vho
BitDefender Generic.Ereplus.250534FA
NANO-Antivirus Trojan.Win32.Qbot.hhmqky
Paloalto generic.ml
AegisLab Trojan.Win32.Qbot.7!c
Tencent Malware.Win32.Gencirc.10b9d07c
Ad-Aware Generic.Ereplus.250534FA
Sophos Mal/Generic-R + Mal/Emotet-Q
Comodo TrojWare.Win32.Kryptik.HBR@8qrqpo
F-Secure Trojan.TR/Crypt.ZPACK.Gen
DrWeb Trojan.Inject3.36382
VIPRE Trojan.Win32.Generic!BT
TrendMicro Backdoor.Win32.QAKBOT.SME
McAfee-GW-Edition BehavesLike.Win32.AdwareInstCap.ct
Emsisoft Generic.Ereplus.250534FA (B)
SentinelOne Static AI - Malicious PE
Jiangmin Trojan.Banker.Qbot.lv
Avira TR/Crypt.ZPACK.Gen
Antiy-AVL Trojan/Win32.Wacatac
Gridinsoft Trojan.Win32.Kryptik.ba!s3
Microsoft Trojan:Win32/Qakbot.BS!MTB
ZoneAlarm HEUR:Trojan-Banker.Win32.Qbot.vho
GData Generic.Ereplus.250534FA
Cynet Malicious (score: 100)
AhnLab-V3 Malware/Win32.RL_Generic.R329412
BitDefenderTheta Gen:NN.ZexaF.34780.Zq0@auafl@ki
ALYac Generic.Ereplus.250534FA
MAX malware (ai score=84)
VBA32 Backdoor.Qbot
Malwarebytes Trojan.MalPack
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-03-17 20:51:27

Imports

Library KERNEL32.dll:
0x4b8624 VirtualAlloc
0x4b8628 GetModuleHandleW
0x4b862c SetErrorMode
0x4b8630 LockFile
0x4b8634 UnlockFile
0x4b8638 SetEndOfFile
0x4b863c MoveFileA
0x4b8644 GetStringTypeExA
0x4b8648 GetThreadLocale
0x4b864c GetShortPathNameA
0x4b8650 GetFileSize
0x4b865c InterlockedExchange
0x4b8660 RtlUnwind
0x4b866c HeapReAlloc
0x4b8670 HeapAlloc
0x4b8674 HeapFree
0x4b8678 CreateDirectoryA
0x4b867c GetDriveTypeA
0x4b8684 GetSystemTime
0x4b8688 GetLocalTime
0x4b868c RaiseException
0x4b8690 GetStartupInfoA
0x4b8694 GetCommandLineA
0x4b8698 ExitProcess
0x4b869c TerminateProcess
0x4b86a0 CreateThread
0x4b86a4 ExitThread
0x4b86a8 HeapSize
0x4b86ac FlushFileBuffers
0x4b86b0 LCMapStringA
0x4b86b4 LCMapStringW
0x4b86b8 CompareStringA
0x4b86bc CompareStringW
0x4b86c0 VirtualFree
0x4b86c4 IsBadWritePtr
0x4b86cc HeapDestroy
0x4b86dc GetStringTypeA
0x4b86e0 GetStringTypeW
0x4b86e4 IsValidLocale
0x4b86e8 IsValidCodePage
0x4b86ec GetLocaleInfoA
0x4b86f0 EnumSystemLocalesA
0x4b86f4 GetUserDefaultLCID
0x4b86f8 IsBadReadPtr
0x4b86fc IsBadCodePtr
0x4b8700 SetStdHandle
0x4b8708 GetLocaleInfoW
0x4b870c SetFilePointer
0x4b8710 WriteFile
0x4b8714 ReadFile
0x4b8718 CreateFileA
0x4b871c GetProfileStringA
0x4b8720 GetCurrentProcess
0x4b8724 DuplicateHandle
0x4b872c SizeofResource
0x4b8730 GetOEMCP
0x4b8734 GetCPInfo
0x4b8738 GetProcessVersion
0x4b873c TlsGetValue
0x4b8740 LocalReAlloc
0x4b8744 TlsSetValue
0x4b8748 GlobalReAlloc
0x4b874c TlsFree
0x4b8750 GlobalHandle
0x4b8754 TlsAlloc
0x4b8758 LocalAlloc
0x4b875c GlobalFlags
0x4b8760 MulDiv
0x4b8764 GlobalSize
0x4b8778 SetLastError
0x4b877c GetDiskFreeSpaceA
0x4b8780 GetFileTime
0x4b8784 SetFileTime
0x4b8788 GetFullPathNameA
0x4b878c GetTempFileNameA
0x4b8790 GetFileAttributesA
0x4b87a0 CreateEventA
0x4b87a4 SuspendThread
0x4b87a8 SetThreadPriority
0x4b87ac ResumeThread
0x4b87b0 SetEvent
0x4b87b4 WaitForSingleObject
0x4b87b8 GetModuleFileNameA
0x4b87bc GlobalAlloc
0x4b87c0 lstrcmpA
0x4b87c4 GetCurrentThread
0x4b87c8 GlobalFree
0x4b87cc FindResourceA
0x4b87d0 LoadResource
0x4b87d4 LockResource
0x4b87d8 GetCurrentThreadId
0x4b87dc lstrcmpiA
0x4b87e0 GlobalFindAtomA
0x4b87e4 GlobalDeleteAtom
0x4b87e8 GetModuleHandleA
0x4b87ec lstrcatA
0x4b87f0 lstrcpyA
0x4b87f4 lstrcpynA
0x4b87f8 GlobalGetAtomNameA
0x4b87fc GlobalAddAtomA
0x4b8800 GetVersion
0x4b880c lstrlenW
0x4b8810 GlobalLock
0x4b8814 GlobalUnlock
0x4b8818 FormatMessageA
0x4b881c LocalFree
0x4b8820 lstrlenA
0x4b882c CreateMutexA
0x4b8830 GetLastError
0x4b8834 ReleaseMutex
0x4b8838 CloseHandle
0x4b883c CreateProcessA
0x4b8840 Sleep
0x4b8844 MultiByteToWideChar
0x4b8848 WideCharToMultiByte
0x4b884c GetProcAddress
0x4b8850 GetTickCount
0x4b8854 CopyFileA
0x4b8858 FindFirstFileA
0x4b885c DeleteFileA
0x4b8860 FindNextFileA
0x4b8864 FindClose
0x4b8868 RemoveDirectoryA
0x4b886c SetFileAttributesA
0x4b8870 GetVersionExA
0x4b8874 GetACP
0x4b887c FreeLibrary
0x4b8880 LoadLibraryA
0x4b8884 FatalAppExitA
Library USER32.dll:
0x4b888c LoadIconA
0x4b8890 LoadIconW
Library GDI32.dll:
0x4b8898 GetStockObject
0x4b889c SetBkMode
0x4b88a0 SetPolyFillMode
0x4b88a4 SetROP2
0x4b88a8 SetStretchBltMode
0x4b88ac SetMapMode
0x4b88b0 SetViewportOrgEx
0x4b88b4 OffsetViewportOrgEx
0x4b88b8 SetViewportExtEx
0x4b88bc ScaleViewportExtEx
0x4b88c0 SetWindowOrgEx
0x4b88c4 OffsetWindowOrgEx
0x4b88c8 SetWindowExtEx
0x4b88cc ScaleWindowExtEx
0x4b88d0 SelectClipRgn
0x4b88d4 ExcludeClipRect
0x4b88d8 IntersectClipRect
0x4b88dc OffsetClipRgn
0x4b88e0 MoveToEx
0x4b88e4 LineTo
0x4b88e8 SetTextAlign
0x4b88f4 SetMapperFlags
0x4b88fc ArcTo
0x4b8900 SetArcDirection
0x4b8904 PolyDraw
0x4b8908 SelectPalette
0x4b890c SetColorAdjustment
0x4b8910 PolyBezierTo
0x4b8914 GetClipRgn
0x4b8918 CreateRectRgn
0x4b891c SelectClipPath
0x4b8920 ExtSelectClipRgn
0x4b8924 PlayMetaFileRecord
0x4b8928 GetObjectType
0x4b892c EnumMetaFile
0x4b8930 PlayMetaFile
0x4b8934 GetViewportExtEx
0x4b8938 GetWindowExtEx
0x4b893c CreatePen
0x4b8940 ExtCreatePen
0x4b8944 CreateSolidBrush
0x4b8948 CreateHatchBrush
0x4b894c CreatePatternBrush
0x4b8954 PtVisible
0x4b8958 RectVisible
0x4b895c TextOutA
0x4b8960 ExtTextOutA
0x4b8964 Escape
0x4b896c GetTextMetricsA
0x4b8970 CreateFontIndirectA
0x4b8974 SelectObject
0x4b8978 RestoreDC
0x4b897c SaveDC
0x4b8980 StartDocA
0x4b8984 DeleteDC
0x4b8988 DeleteObject
0x4b898c GetDeviceCaps
0x4b8990 CreateDCA
0x4b8994 CopyMetaFileA
0x4b8998 CreateBitmap
0x4b899c GetObjectA
0x4b89a0 SetBkColor
0x4b89a4 SetTextColor
0x4b89a8 GetClipBox
0x4b89ac PolylineTo
0x4b89b0 CreateDIBitmap
0x4b89b4 PatBlt
0x4b89b8 GetTextExtentPointA
0x4b89bc BitBlt
0x4b89c0 CreateCompatibleDC
0x4b89c4 GetDCOrgEx
Library ADVAPI32.dll:
0x4b89cc GetUserNameA
0x4b89d0 RegOpenKeyA
0x4b89d4 RegQueryValueExA
Library SHELL32.dll:
0x4b89dc ExtractIconA
0x4b89e0 DragAcceptFiles
0x4b89e4 DragQueryFileA
0x4b89e8 DragFinish
0x4b89f0 SHGetFileInfoA
Library MSVCRT.dll:
0x4b89f8 _except_handler3
0x4b89fc __set_app_type
0x4b8a00 __p__fmode
0x4b8a04 __p__commode
0x4b8a08 _adjust_fdiv
0x4b8a0c __setusermatherr
0x4b8a10 _initterm
0x4b8a14 __getmainargs
0x4b8a18 _acmdln
0x4b8a1c exit
0x4b8a20 _XcptFilter
0x4b8a24 _exit
0x4b8a28 _onexit
0x4b8a2c __dllonexit
0x4b8a30 _controlfp

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 50537 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 56539 8.8.8.8 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.