6.8
高危
60 个模型检测该样本为恶意！
重新分析
更多

4c8728146976e30a09321d1e158aeeb46908c54fa8614ccef7fbc9761956eca4

83ec38668ed616414abf3c6e9b423acc.exe

分析耗时

44s

最近分析

文件大小

1.1MB
静态报毒 动态报毒 AI SCORE=88 AIDETECTVM AMDBK APAE ATTRIBUTE AUTOIT CLOUD CONFIDENCE DELF DELPHI DELPHILESS EMTN EMUK FAREIT FHW@AUDJUCKI FORMBOOK GENERICKDZ HIGH CONFIDENCE HIGHCONFIDENCE HPCXYF KRYPTIK LOKIBOT MALWARE2 MODERATE QVM05 R002C0DGU20 SCORE SUSPICIOUS PE TSCOPE UNSAFE X2091 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/Kryptik.3c9519b8 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20200806 18.4.3895.0
Tencent 20200806 1.0.0.1
Kingsoft 20200806 2013.8.14.323
McAfee Fareit-FPQ!83EC38668ED6 20200806 6.0.6.653
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619710974.166125
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
83ec38668ed616414abf3c6e9b423acc+0xc03f8 @ 0x4c03f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74164b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74165d3d
83ec38668ed616414abf3c6e9b423acc+0x17005c @ 0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfce614ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (28 个事件)
Time & API Arguments Status Return Repeated
1619710972.82275
NtAllocateVirtualMemory
process_identifier: 2288
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619710972.94775
NtAllocateVirtualMemory
process_identifier: 2288
region_size: 77824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f40000
success 0 0
1619710972.94775
NtAllocateVirtualMemory
process_identifier: 2288
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f70000
success 0 0
1619710973.541125
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619710973.572125
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 1310720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x020b0000
success 0 0
1619710973.572125
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x021b0000
success 0 0
1619710973.572125
NtAllocateVirtualMemory
process_identifier: 1056
region_size: 753664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x020b0000
success 0 0
1619710973.572125
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 724992
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x020b2000
success 0 0
1619710974.150125
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00642000
success 0 0
1619710974.150125
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619710974.150125
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00642000
success 0 0
1619710974.150125
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619710974.150125
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00642000
success 0 0
1619710974.150125
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619710974.150125
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00642000
success 0 0
1619710974.150125
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619710974.150125
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00642000
success 0 0
1619710974.150125
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619710974.150125
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00642000
success 0 0
1619710974.150125
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619710974.150125
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00642000
success 0 0
1619710974.150125
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619710974.150125
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00642000
success 0 0
1619710974.150125
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619710974.150125
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00642000
success 0 0
1619710974.150125
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619710974.150125
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00642000
success 0 0
1619710974.150125
NtProtectVirtualMemory
process_identifier: 1056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.623707188019402 section {'size_of_data': '0x0009ae00', 'virtual_address': '0x00080000', 'entropy': 7.623707188019402, 'name': '.rsrc', 'virtual_size': '0x0009ad7c'} description A section with a high entropy has been found
entropy 0.5591155234657039 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 172.217.24.14
host 203.208.41.98
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2288 called NtSetContextThread to modify thread in remote process 1056
Time & API Arguments Status Return Repeated
1619710973.24475
NtSetContextThread
thread_handle: 0x000000f8
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5769872
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1056
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2288 resumed a thread in remote process 1056
Time & API Arguments Status Return Repeated
1619710973.38575
NtResumeThread
thread_handle: 0x000000f8
suspend_count: 1
process_identifier: 1056
success 0 0
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.24.14:443
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619710973.19775
CreateProcessInternalW
thread_identifier: 2008
thread_handle: 0x000000f8
process_identifier: 1056
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\83ec38668ed616414abf3c6e9b423acc.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619710973.19775
NtUnmapViewOfSection
process_identifier: 1056
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1619710973.19775
NtMapViewOfSection
section_handle: 0x00000104
process_identifier: 1056
commit_size: 1581056
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 1581056
base_address: 0x00400000
success 0 0
1619710973.24475
NtGetContextThread
thread_handle: 0x000000f8
success 0 0
1619710973.24475
NtSetContextThread
thread_handle: 0x000000f8
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5769872
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1056
success 0 0
1619710973.38575
NtResumeThread
thread_handle: 0x000000f8
suspend_count: 1
process_identifier: 1056
success 0 0
File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 个事件)
Bkav W32.AIDetectVM.malware2
MicroWorld-eScan Trojan.GenericKDZ.69102
FireEye Generic.mg.83ec38668ed61641
CAT-QuickHeal Trojan.Kryptik
ALYac Trojan.GenericKDZ.69102
Malwarebytes Spyware.LokiBot
Zillya Trojan.Injector.Win32.754865
Sangfor Malware
K7AntiVirus Trojan ( 0056b6131 )
Alibaba Trojan:Win32/Kryptik.3c9519b8
K7GW Trojan ( 0056b6131 )
Cybereason malicious.5e47f4
Arcabit Trojan.Generic.D10DEE
Invincea heuristic
BitDefenderTheta Gen:NN.ZelphiF.34152.fHW@audJucki
Cyren W32/Trojan.APAE-7581
Symantec ML.Attribute.HighConfidence
APEX Malicious
Avast Win32:Trojan-gen
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
BitDefender Trojan.GenericKDZ.69102
NANO-Antivirus Trojan.Win32.Stealer.hpcxyf
Paloalto generic.ml
AegisLab Trojan.Win32.Kryptik.4!c
Endgame malicious (high confidence)
Emsisoft Trojan.GenericKDZ.69102 (B)
F-Secure Dropper.DR/Delphi.amdbk
DrWeb Trojan.PWS.Stealer.19347
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R002C0DGU20
Trapmine malicious.moderate.ml.score
Sophos Mal/Generic-S
SentinelOne DFI - Suspicious PE
F-Prot W32/Injector.JGW
Jiangmin Trojan.Kryptik.byu
Avira DR/Delphi.amdbk
MAX malware (ai score=88)
Antiy-AVL Trojan/Win32.Kryptik
Microsoft Trojan:Win32/FormBook.DE!MTB
ViRobot Trojan.Win32.Z.Pws.1135616
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
GData Trojan.GenericKDZ.69102
Cynet Malicious (score: 85)
AhnLab-V3 Suspicious/Win.Delphiless.X2091
Acronis suspicious
McAfee Fareit-FPQ!83EC38668ED6
VBA32 TScope.Trojan.Delf
Cylance Unsafe
Zoner Trojan.Win32.91606
ESET-NOD32 a variant of Win32/Injector.EMUK
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x47413c VirtualFree
• 0x474140 VirtualAlloc
• 0x474144 LocalFree
• 0x474148 LocalAlloc
• 0x47414c GetVersion
• 0x474150 GetCurrentThreadId
• 0x47415c VirtualQuery
• 0x474160 WideCharToMultiByte
• 0x474164 MultiByteToWideChar
• 0x474168 lstrlenA
• 0x47416c lstrcpynA
• 0x474170 LoadLibraryExA
• 0x474174 GetThreadLocale
• 0x474178 GetStartupInfoA
• 0x47417c GetProcAddress
• 0x474180 GetModuleHandleA
• 0x474184 GetModuleFileNameA
• 0x474188 GetLocaleInfoA
• 0x47418c GetCommandLineA
• 0x474190 FreeLibrary
• 0x474194 FindFirstFileA
• 0x474198 FindClose
• 0x47419c ExitProcess
• 0x4741a0 WriteFile
• 0x4741a8 RtlUnwind
• 0x4741ac RaiseException
• 0x4741b0 GetStdHandle
Library user32.dll:
• 0x4741b8 GetKeyboardType
• 0x4741bc LoadStringA
• 0x4741c0 MessageBoxA
• 0x4741c4 CharNextA
Library advapi32.dll:
• 0x4741cc RegQueryValueExA
• 0x4741d0 RegOpenKeyExA
• 0x4741d4 RegCloseKey
Library oleaut32.dll:
• 0x4741dc SysFreeString
• 0x4741e0 SysReAllocStringLen
• 0x4741e4 SysAllocStringLen
Library kernel32.dll:
• 0x4741ec TlsSetValue
• 0x4741f0 TlsGetValue
• 0x4741f4 LocalAlloc
• 0x4741f8 GetModuleHandleA
Library advapi32.dll:
• 0x474200 RegQueryValueExA
• 0x474204 RegOpenKeyExA
• 0x474208 RegCloseKey
Library kernel32.dll:
• 0x474210 lstrcpyA
• 0x474214 WriteFile
• 0x474218 WaitForSingleObject
• 0x47421c VirtualQuery
• 0x474220 VirtualAlloc
• 0x474224 Sleep
• 0x474228 SizeofResource
• 0x47422c SetThreadLocale
• 0x474230 SetFilePointer
• 0x474234 SetEvent
• 0x474238 SetErrorMode
• 0x47423c SetEndOfFile
• 0x474240 ResetEvent
• 0x474244 ReadFile
• 0x474248 MulDiv
• 0x47424c LockResource
• 0x474250 LoadResource
• 0x474254 LoadLibraryA
• 0x474260 GlobalUnlock
• 0x474264 GlobalReAlloc
• 0x474268 GlobalHandle
• 0x47426c GlobalLock
• 0x474270 GlobalFree
• 0x474274 GlobalFindAtomA
• 0x474278 GlobalDeleteAtom
• 0x47427c GlobalAlloc
• 0x474280 GlobalAddAtomA
• 0x474284 GetVersionExA
• 0x474288 GetVersion
• 0x47428c GetTickCount
• 0x474290 GetThreadLocale
• 0x474294 GetSystemInfo
• 0x474298 GetStringTypeExA
• 0x47429c GetStdHandle
• 0x4742a0 GetProcAddress
• 0x4742a4 GetModuleHandleA
• 0x4742a8 GetModuleFileNameA
• 0x4742ac GetLocaleInfoA
• 0x4742b0 GetLocalTime
• 0x4742b4 GetLastError
• 0x4742b8 GetFullPathNameA
• 0x4742bc GetDiskFreeSpaceA
• 0x4742c0 GetDateFormatA
• 0x4742c4 GetCurrentThreadId
• 0x4742c8 GetCurrentProcessId
• 0x4742cc GetCPInfo
• 0x4742d0 GetACP
• 0x4742d4 FreeResource
• 0x4742d8 InterlockedExchange
• 0x4742dc FreeLibrary
• 0x4742e0 FormatMessageA
• 0x4742e4 FindResourceA
• 0x4742e8 EnumCalendarInfoA
• 0x4742f4 CreateThread
• 0x4742f8 CreateFileA
• 0x4742fc CreateEventA
• 0x474300 CompareStringA
• 0x474304 CloseHandle
Library version.dll:
• 0x47430c VerQueryValueA
• 0x474314 GetFileVersionInfoA
Library gdi32.dll:
• 0x47431c UnrealizeObject
• 0x474320 StretchBlt
• 0x474324 SetWindowOrgEx
• 0x474328 SetViewportOrgEx
• 0x47432c SetTextColor
• 0x474330 SetStretchBltMode
• 0x474334 SetROP2
• 0x474338 SetPixel
• 0x47433c SetDIBColorTable
• 0x474340 SetBrushOrgEx
• 0x474344 SetBkMode
• 0x474348 SetBkColor
• 0x47434c SelectPalette
• 0x474350 SelectObject
• 0x474354 SaveDC
• 0x474358 RestoreDC
• 0x47435c Rectangle
• 0x474360 RectVisible
• 0x474364 RealizePalette
• 0x474368 PtVisible
• 0x47436c PatBlt
• 0x474370 MoveToEx
• 0x474374 MaskBlt
• 0x474378 LineTo
• 0x47437c IntersectClipRect
• 0x474380 GetWindowOrgEx
• 0x474384 GetTextMetricsA
• 0x474390 GetStockObject
• 0x474394 GetPixel
• 0x474398 GetPaletteEntries
• 0x47439c GetObjectA
• 0x4743a0 GetDeviceCaps
• 0x4743a4 GetDIBits
• 0x4743a8 GetDIBColorTable
• 0x4743ac GetDCOrgEx
• 0x4743b4 GetClipBox
• 0x4743b8 GetBrushOrgEx
• 0x4743bc GetBitmapBits
• 0x4743c0 ExcludeClipRect
• 0x4743c4 DeleteObject
• 0x4743c8 DeleteDC
• 0x4743cc CreateSolidBrush
• 0x4743d0 CreatePenIndirect
• 0x4743d4 CreatePen
• 0x4743d8 CreatePalette
• 0x4743e0 CreateFontIndirectA
• 0x4743e4 CreateDIBitmap
• 0x4743e8 CreateDIBSection
• 0x4743ec CreateCompatibleDC
• 0x4743f4 CreateBrushIndirect
• 0x4743f8 CreateBitmap
• 0x4743fc BitBlt
Library user32.dll:
• 0x474404 CreateWindowExA
• 0x474408 WindowFromPoint
• 0x47440c WinHelpA
• 0x474410 WaitMessage
• 0x474414 ValidateRect
• 0x474418 UpdateWindow
• 0x47441c UnregisterClassA
• 0x474420 UnhookWindowsHookEx
• 0x474424 TranslateMessage
• 0x47442c TrackPopupMenu
• 0x474434 ShowWindow
• 0x474438 ShowScrollBar
• 0x47443c ShowOwnedPopups
• 0x474440 ShowCursor
• 0x474444 SetWindowsHookExA
• 0x474448 SetWindowTextA
• 0x47444c SetWindowPos
• 0x474450 SetWindowPlacement
• 0x474454 SetWindowLongA
• 0x474458 SetTimer
• 0x47445c SetScrollRange
• 0x474460 SetScrollPos
• 0x474464 SetScrollInfo
• 0x474468 SetRect
• 0x47446c SetPropA
• 0x474470 SetParent
• 0x474474 SetMenuItemInfoA
• 0x474478 SetMenu
• 0x47447c SetForegroundWindow
• 0x474480 SetFocus
• 0x474484 SetCursor
• 0x474488 SetClassLongA
• 0x47448c SetCapture
• 0x474490 SetActiveWindow
• 0x474494 SendMessageA
• 0x474498 ScrollWindow
• 0x47449c ScreenToClient
• 0x4744a0 RemovePropA
• 0x4744a4 RemoveMenu
• 0x4744a8 ReleaseDC
• 0x4744ac ReleaseCapture
• 0x4744b8 RegisterClassA
• 0x4744bc RedrawWindow
• 0x4744c0 PtInRect
• 0x4744c4 PostQuitMessage
• 0x4744c8 PostMessageA
• 0x4744cc PeekMessageA
• 0x4744d0 OffsetRect
• 0x4744d4 OemToCharA
• 0x4744d8 MessageBoxA
• 0x4744dc MessageBeep
• 0x4744e0 MapWindowPoints
• 0x4744e4 MapVirtualKeyA
• 0x4744e8 LoadStringA
• 0x4744ec LoadKeyboardLayoutA
• 0x4744f0 LoadIconA
• 0x4744f4 LoadCursorA
• 0x4744f8 LoadBitmapA
• 0x4744fc KillTimer
• 0x474500 IsZoomed
• 0x474504 IsWindowVisible
• 0x474508 IsWindowEnabled
• 0x47450c IsWindow
• 0x474510 IsRectEmpty
• 0x474514 IsIconic
• 0x474518 IsDialogMessageA
• 0x47451c IsChild
• 0x474520 InvalidateRect
• 0x474524 IntersectRect
• 0x474528 InsertMenuItemA
• 0x47452c InsertMenuA
• 0x474530 InflateRect
• 0x474538 GetWindowTextA
• 0x47453c GetWindowRect
• 0x474540 GetWindowPlacement
• 0x474544 GetWindowLongA
• 0x474548 GetWindowDC
• 0x47454c GetTopWindow
• 0x474550 GetSystemMetrics
• 0x474554 GetSystemMenu
• 0x474558 GetSysColorBrush
• 0x47455c GetSysColor
• 0x474560 GetSubMenu
• 0x474564 GetScrollRange
• 0x474568 GetScrollPos
• 0x47456c GetScrollInfo
• 0x474570 GetPropA
• 0x474574 GetParent
• 0x474578 GetWindow
• 0x47457c GetMenuStringA
• 0x474580 GetMenuState
• 0x474584 GetMenuItemInfoA
• 0x474588 GetMenuItemID
• 0x47458c GetMenuItemCount
• 0x474590 GetMenu
• 0x474594 GetLastActivePopup
• 0x474598 GetKeyboardState
• 0x4745a0 GetKeyboardLayout
• 0x4745a4 GetKeyState
• 0x4745a8 GetKeyNameTextA
• 0x4745ac GetIconInfo
• 0x4745b0 GetForegroundWindow
• 0x4745b4 GetFocus
• 0x4745b8 GetDlgItem
• 0x4745bc GetDesktopWindow
• 0x4745c0 GetDCEx
• 0x4745c4 GetDC
• 0x4745c8 GetCursorPos
• 0x4745cc GetCursor
• 0x4745d0 GetClientRect
• 0x4745d4 GetClassNameA
• 0x4745d8 GetClassInfoA
• 0x4745dc GetCapture
• 0x4745e0 GetActiveWindow
• 0x4745e4 FrameRect
• 0x4745e8 FindWindowA
• 0x4745ec FillRect
• 0x4745f0 EqualRect
• 0x4745f4 EnumWindows
• 0x4745f8 EnumThreadWindows
• 0x4745fc EndPaint
• 0x474600 EnableWindow
• 0x474604 EnableScrollBar
• 0x474608 EnableMenuItem
• 0x47460c DrawTextA
• 0x474610 DrawMenuBar
• 0x474614 DrawIconEx
• 0x474618 DrawIcon
• 0x47461c DrawFrameControl
• 0x474620 DrawFocusRect
• 0x474624 DrawEdge
• 0x474628 DispatchMessageA
• 0x47462c DestroyWindow
• 0x474630 DestroyMenu
• 0x474634 DestroyIcon
• 0x474638 DestroyCursor
• 0x47463c DeleteMenu
• 0x474640 DefWindowProcA
• 0x474644 DefMDIChildProcA
• 0x474648 DefFrameProcA
• 0x47464c CreatePopupMenu
• 0x474650 CreateMenu
• 0x474654 CreateIcon
• 0x474658 ClientToScreen
• 0x47465c CheckMenuItem
• 0x474660 CallWindowProcA
• 0x474664 CallNextHookEx
• 0x474668 BeginPaint
• 0x47466c CharNextA
• 0x474670 CharLowerA
• 0x474674 CharToOemA
• 0x474678 AdjustWindowRectEx
Library kernel32.dll:
• 0x474684 Sleep
Library oleaut32.dll:
• 0x47468c SafeArrayPtrOfIndex
• 0x474690 SafeArrayGetUBound
• 0x474694 SafeArrayGetLBound
• 0x474698 SafeArrayCreate
• 0x47469c VariantChangeType
• 0x4746a0 VariantCopy
• 0x4746a4 VariantClear
• 0x4746a8 VariantInit
Library comctl32.dll:
• 0x4746b8 ImageList_Write
• 0x4746bc ImageList_Read
• 0x4746cc ImageList_DragMove
• 0x4746d0 ImageList_DragLeave
• 0x4746d4 ImageList_DragEnter
• 0x4746d8 ImageList_EndDrag
• 0x4746dc ImageList_BeginDrag
• 0x4746e0 ImageList_Remove
• 0x4746e4 ImageList_DrawEx
• 0x4746e8 ImageList_Replace
• 0x4746ec ImageList_Draw
• 0x4746fc ImageList_Add
• 0x474704 ImageList_Destroy
• 0x474708 ImageList_Create
• 0x47470c InitCommonControls
Library comdlg32.dll:
• 0x474714 GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50568 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.