6.6
高危
56 个模型检测该样本为恶意！
重新分析
更多

a82fbe9ea77e2efb91c14a7372f6d4ebb2ca36582b90cc9f81fb173ee3aacc41

89205a8f67e4812c6a29ccebfe2aed18.exe

分析耗时

76s

最近分析

文件大小

456.0KB
静态报毒 动态报毒 100% AGCPNXO21RS AI SCORE=80 ATTRIBUTE BANKERX BSCOPE CLASSIC CONFIDENCE CQ0@AKPE8LMI EMOTET EPAZ FAMVT GENCIRC GENERICKD GENETIC GENKRYPTIK HFGP HIGH CONFIDENCE HIGHCONFIDENCE HPMPIZ KCLOUD KORBOLTN KRYPTIK LDYSB MALWARE@#32LC6QX28WGXR NOBB R + TROJ R346459 SCORE THIAABO UNSAFE XPACK ZEXAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Emotet-FRH!89205A8F67E4 20201211 6.0.6.653
Alibaba Trojan:Win32/Emotet.392d8ebf 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:BankerX-gen [Trj] 20201210 21.1.5827.0
Tencent Malware.Win32.Gencirc.10cde542 20201211 1.0.0.1
Kingsoft Win32.Hack.Emotet.aq.(kcloud) 20201211 2017.9.26.565
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1619686148.478822
GetComputerNameA
computer_name: OSKAR-PC
success 1 0
Uses Windows APIs to generate a cryptographic key (5 个事件)
Time & API Arguments Status Return Repeated
1619686133.650822
CryptGenKey
crypto_handle: 0x0063c7e0
algorithm_identifier: 0x0000660e ()
provider_handle: 0x00593db0
flags: 1
key: fbñÐø¸íÏލ]ÞwMßÀW
success 1 0
1619686148.494822
CryptExportKey
crypto_handle: 0x0063c7e0
crypto_export_handle: 0x0063c760
buffer: f¤aºqRzâ´åS_Õ{´_€9¾œÀôX\ ð…@3cç¯äÔz€–èüß#1üÚysû ?ü_ü ëäNGÁ†?Vªï­[Z½æĶ—+Ok7ª VáëW
blob_type: 1
flags: 64
success 1 0
1619686183.228822
CryptExportKey
crypto_handle: 0x0063c7e0
crypto_export_handle: 0x0063c760
buffer: f¤’è-z˗։¸m›6Å·8VwÎӇ0#Íͬªü,eÅAWJ”¯üÈJ˜Y“í>µ >ÂA&€è 5®!RìX¥H¡Œý•\…8@ šzßuF$nNÑÀ‡ë&ªK
blob_type: 1
flags: 64
success 1 0
1619686187.869822
CryptExportKey
crypto_handle: 0x0063c7e0
crypto_export_handle: 0x0063c760
buffer: f¤óOë´ïpRžÍíG>£8ó)›°ŠØ_Ã\&Eà-¶ æA•§ˆhÞ¸áIJ„¶ —»‚¬èÕ>æÀ{…žÃ‹A@¶„Ãš֐²šŒ¶7Å: ZgCj
blob_type: 1
flags: 64
success 1 0
1619686193.416822
CryptExportKey
crypto_handle: 0x0063c7e0
crypto_export_handle: 0x0063c760
buffer: f¤ªî˜>9HSµ×P˜+[ Ù6 І9wÛûÿ…âÓͯ$¶¸i¿±ÊpÏJ=¸Áß­®4)ç8æ OŸ­Æ’ó’á\i¯zÄx>Ñ;á©þR™á|FîÙ¶<EïòòˆoVŸ‚
blob_type: 1
flags: 64
success 1 0
The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)
resource name None
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (1 个事件)
Time & API Arguments Status Return Repeated
1619686132.853822
NtAllocateVirtualMemory
process_identifier: 152
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x003f0000
success 0 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 个事件)
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619686149.228822
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
Expresses interest in specific running processes (1 个事件)
process 89205a8f67e4812c6a29ccebfe2aed18.exe
Reads the systems User Agent and subsequently performs requests (1 个事件)
Time & API Arguments Status Return Repeated
1619686148.728822
InternetOpenW
proxy_bypass:
access_type: 0
proxy_name:
flags: 0
user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
success 13369348 0
网络通信
Communicates with host for which no DNS query was performed (5 个事件)
host 149.62.173.247
host 172.217.24.14
host 185.94.252.13
host 24.249.135.121
host 50.28.51.143
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)
Time & API Arguments Status Return Repeated
1619686151.791822
RegSetValueExA
key_handle: 0x000003ac
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619686151.791822
RegSetValueExA
key_handle: 0x000003ac
value: „æ4Ò<×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619686151.791822
RegSetValueExA
key_handle: 0x000003ac
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619686151.807822
RegSetValueExW
key_handle: 0x000003ac
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619686151.807822
RegSetValueExA
key_handle: 0x000003c4
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619686151.807822
RegSetValueExA
key_handle: 0x000003c4
value: „æ4Ò<×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619686151.807822
RegSetValueExA
key_handle: 0x000003c4
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1619686151.838822
RegSetValueExW
key_handle: 0x000003a8
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 个事件)
Bkav W32.FamVT.KorboLTN.Trojan
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.34266539
FireEye Generic.mg.89205a8f67e4812c
McAfee Emotet-FRH!89205A8F67E4
Cylance Unsafe
Zillya Backdoor.Emotet.Win32.849
AegisLab Trojan.Win32.Generic.4!c
Sangfor Malware
K7AntiVirus Trojan ( 0056ba551 )
Alibaba Trojan:Win32/Emotet.392d8ebf
K7GW Trojan ( 0056ba551 )
Arcabit Trojan.Generic.D20ADDAB
Cyren W32/Trojan.NOBB-7220
Symantec ML.Attribute.HighConfidence
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan-Banker.Win32.Emotet.pef
BitDefender Trojan.GenericKD.34266539
NANO-Antivirus Trojan.Win32.Emotet.hpmpiz
Avast Win32:BankerX-gen [Trj]
Tencent Malware.Win32.Gencirc.10cde542
Ad-Aware Trojan.GenericKD.34266539
Emsisoft Trojan.Emotet (A)
Comodo Malware@#32lc6qx28wgxr
F-Secure Trojan.TR/Crypt.XPACK.ldysb
DrWeb Trojan.Emotet.995
VIPRE Trojan.Win32.Generic!BT
TrendMicro TrojanSpy.Win32.EMOTET.THIAABO
McAfee-GW-Edition BehavesLike.Win32.Emotet.gh
Sophos Mal/Generic-R + Troj/Emotet-CKL
Jiangmin Backdoor.Emotet.pe
Avira TR/Crypt.XPACK.ldysb
MAX malware (ai score=80)
Antiy-AVL Trojan[Backdoor]/Win32.Emotet
Kingsoft Win32.Hack.Emotet.aq.(kcloud)
Gridinsoft Trojan.Win32.Kryptik.oa
Microsoft Trojan:Win32/Emotet.ARJ!MTB
ZoneAlarm HEUR:Trojan-Banker.Win32.Emotet.pef
GData Trojan.GenericKD.34266539
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.Emotet.R346459
BitDefenderTheta Gen:NN.ZexaF.34670.Cq0@aKpE8Lmi
ALYac Trojan.GenericKD.34266539
VBA32 BScope.Trojan.Emotet
Malwarebytes Trojan.MalPack.TRE
ESET-NOD32 a variant of Win32/Kryptik.HFGP
TrendMicro-HouseCall TrojanSpy.Win32.EMOTET.THIAABO
Rising Trojan.Kryptik!1.C82B (CLASSIC)
Yandex Trojan.Kryptik!agCPNxo21Rs
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (5 个事件)
dead_host 192.168.56.101:49181
dead_host 24.249.135.121:80
dead_host 192.168.56.101:49180
dead_host 149.62.173.247:8080
dead_host 185.94.252.13:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-07-30 16:22:18

Imports

Library KERNEL32.dll:
• 0x44d1a0 HeapCreate
• 0x44d1a4 VirtualFree
• 0x44d1a8 IsBadWritePtr
• 0x44d1ac GetStdHandle
• 0x44d1c4 SetHandleCount
• 0x44d1c8 GetFileType
• 0x44d1d0 GetCurrentProcessId
• 0x44d1d8 HeapDestroy
• 0x44d1dc LCMapStringW
• 0x44d1e4 IsBadReadPtr
• 0x44d1e8 IsBadCodePtr
• 0x44d1ec GetUserDefaultLCID
• 0x44d1f0 EnumSystemLocalesA
• 0x44d1f4 IsValidLocale
• 0x44d1f8 IsValidCodePage
• 0x44d1fc SetStdHandle
• 0x44d200 GetLocaleInfoW
• 0x44d208 GetStringTypeW
• 0x44d20c GetStringTypeA
• 0x44d214 HeapSize
• 0x44d218 TerminateProcess
• 0x44d21c HeapReAlloc
• 0x44d220 GetCommandLineA
• 0x44d224 GetStartupInfoA
• 0x44d228 VirtualQuery
• 0x44d22c GetSystemInfo
• 0x44d230 VirtualAlloc
• 0x44d234 VirtualProtect
• 0x44d238 HeapFree
• 0x44d23c HeapAlloc
• 0x44d240 RtlUnwind
• 0x44d244 GetTickCount
• 0x44d248 SetErrorMode
• 0x44d254 GetShortPathNameA
• 0x44d258 CreateFileA
• 0x44d260 FindFirstFileA
• 0x44d264 FindClose
• 0x44d268 DuplicateHandle
• 0x44d26c GetFileSize
• 0x44d270 SetEndOfFile
• 0x44d274 UnlockFile
• 0x44d278 LockFile
• 0x44d27c FlushFileBuffers
• 0x44d280 SetFilePointer
• 0x44d284 WriteFile
• 0x44d288 ReadFile
• 0x44d28c DeleteFileA
• 0x44d290 MoveFileA
• 0x44d298 RaiseException
• 0x44d29c GetOEMCP
• 0x44d2a0 GetCPInfo
• 0x44d2a8 GlobalFlags
• 0x44d2b0 TlsFree
• 0x44d2b8 LocalReAlloc
• 0x44d2bc TlsSetValue
• 0x44d2c0 TlsAlloc
• 0x44d2c8 TlsGetValue
• 0x44d2d0 GlobalHandle
• 0x44d2d4 GlobalReAlloc
• 0x44d2dc LocalAlloc
• 0x44d2e8 GetDiskFreeSpaceA
• 0x44d2ec GetFullPathNameA
• 0x44d2f0 GetTempFileNameA
• 0x44d2f4 GetFileTime
• 0x44d2f8 SetFileTime
• 0x44d2fc GetFileAttributesA
• 0x44d30c CloseHandle
• 0x44d310 GetCurrentThread
• 0x44d314 GetModuleFileNameA
• 0x44d320 lstrcpyA
• 0x44d324 lstrcmpA
• 0x44d328 SetLastError
• 0x44d32c GlobalFree
• 0x44d330 MulDiv
• 0x44d334 GlobalAlloc
• 0x44d338 GlobalLock
• 0x44d33c GlobalUnlock
• 0x44d340 FormatMessageA
• 0x44d344 LocalFree
• 0x44d348 FreeResource
• 0x44d34c GetCurrentThreadId
• 0x44d350 GlobalGetAtomNameA
• 0x44d354 GlobalAddAtomA
• 0x44d358 GlobalFindAtomA
• 0x44d35c GlobalDeleteAtom
• 0x44d360 LoadLibraryA
• 0x44d364 FreeLibrary
• 0x44d368 lstrcatA
• 0x44d36c lstrcmpW
• 0x44d370 lstrcpynA
• 0x44d374 GetModuleHandleA
• 0x44d378 GetStringTypeExA
• 0x44d37c CompareStringW
• 0x44d380 CompareStringA
• 0x44d384 lstrlenA
• 0x44d388 GetVersion
• 0x44d38c GetLastError
• 0x44d390 MultiByteToWideChar
• 0x44d394 lstrcmpiA
• 0x44d398 LoadLibraryExW
• 0x44d39c ExitProcess
• 0x44d3a0 LoadLibraryExA
• 0x44d3a4 GetProcAddress
• 0x44d3a8 GetCurrentProcess
• 0x44d3ac WideCharToMultiByte
• 0x44d3b0 FindResourceA
• 0x44d3b4 LoadResource
• 0x44d3b8 LockResource
• 0x44d3bc SizeofResource
• 0x44d3c0 GetVersionExA
• 0x44d3c4 GetThreadLocale
• 0x44d3c8 GetLocaleInfoA
• 0x44d3cc GetACP
• 0x44d3d0 LCMapStringA
• 0x44d3d4 InterlockedExchange
Library USER32.dll:
• 0x44d438 IsZoomed
• 0x44d43c GetCursorPos
• 0x44d440 WindowFromPoint
• 0x44d444 KillTimer
• 0x44d448 SetTimer
• 0x44d44c ClientToScreen
• 0x44d450 SetRect
• 0x44d454 wsprintfA
• 0x44d458 LoadMenuA
• 0x44d45c DestroyMenu
• 0x44d460 GetActiveWindow
• 0x44d464 UnpackDDElParam
• 0x44d468 ReuseDDElParam
• 0x44d46c ReleaseCapture
• 0x44d470 LoadAcceleratorsA
• 0x44d474 InvalidateRect
• 0x44d478 InsertMenuItemA
• 0x44d47c CreatePopupMenu
• 0x44d480 SetRectEmpty
• 0x44d484 BringWindowToTop
• 0x44d488 SetMenu
• 0x44d48c GetDesktopWindow
• 0x44d494 GetMenuStringA
• 0x44d498 AppendMenuA
• 0x44d49c InsertMenuA
• 0x44d4a0 RemoveMenu
• 0x44d4a4 SetMenuItemBitmaps
• 0x44d4a8 ModifyMenuA
• 0x44d4ac GetMenuState
• 0x44d4b0 EnableMenuItem
• 0x44d4b4 CheckMenuItem
• 0x44d4bc LoadBitmapA
• 0x44d4c0 IsWindowEnabled
• 0x44d4c4 ShowWindow
• 0x44d4c8 MoveWindow
• 0x44d4cc SetWindowTextA
• 0x44d4d0 IsDialogMessageA
• 0x44d4d4 SetDlgItemTextA
• 0x44d4dc WinHelpA
• 0x44d4e0 GetCapture
• 0x44d4e4 CreateWindowExA
• 0x44d4e8 SetWindowsHookExA
• 0x44d4ec CallNextHookEx
• 0x44d4f0 GetClassLongA
• 0x44d4f4 GetClassInfoExA
• 0x44d4f8 GetClassNameA
• 0x44d4fc SetPropA
• 0x44d500 GetPropA
• 0x44d504 RemovePropA
• 0x44d508 SendDlgItemMessageA
• 0x44d50c GetFocus
• 0x44d510 SetFocus
• 0x44d514 IsChild
• 0x44d51c GetLastActivePopup
• 0x44d520 SetActiveWindow
• 0x44d524 DispatchMessageA
• 0x44d528 BeginDeferWindowPos
• 0x44d52c MessageBeep
• 0x44d530 GetDlgItem
• 0x44d534 GetTopWindow
• 0x44d538 DestroyWindow
• 0x44d53c UnhookWindowsHookEx
• 0x44d540 GetMessageTime
• 0x44d544 LoadIconA
• 0x44d548 PeekMessageA
• 0x44d54c MapWindowPoints
• 0x44d550 ScrollWindow
• 0x44d554 MessageBoxA
• 0x44d558 TrackPopupMenu
• 0x44d55c GetKeyState
• 0x44d560 SetScrollRange
• 0x44d564 GetScrollRange
• 0x44d568 SetScrollPos
• 0x44d56c GetScrollPos
• 0x44d570 SetForegroundWindow
• 0x44d574 ShowScrollBar
• 0x44d578 IsWindowVisible
• 0x44d57c GetClientRect
• 0x44d580 GetMenu
• 0x44d584 PostMessageA
• 0x44d588 GetSubMenu
• 0x44d58c GetMenuItemID
• 0x44d590 GetMenuItemCount
• 0x44d594 GetSysColor
• 0x44d598 AdjustWindowRectEx
• 0x44d59c ScreenToClient
• 0x44d5a0 EqualRect
• 0x44d5a4 DeferWindowPos
• 0x44d5a8 GetScrollInfo
• 0x44d5ac SetScrollInfo
• 0x44d5b0 GetClassInfoA
• 0x44d5b4 RegisterClassA
• 0x44d5b8 UnregisterClassA
• 0x44d5bc GetDlgCtrlID
• 0x44d5c0 DefWindowProcA
• 0x44d5c4 GetNextDlgGroupItem
• 0x44d5c8 InvalidateRgn
• 0x44d5d4 DestroyIcon
• 0x44d5d8 DeleteMenu
• 0x44d5dc LockWindowUpdate
• 0x44d5e0 GetDCEx
• 0x44d5e4 CharNextA
• 0x44d5e8 GetSysColorBrush
• 0x44d5ec EndPaint
• 0x44d5f0 CallWindowProcA
• 0x44d5f4 GetWindowLongA
• 0x44d5f8 SetWindowLongA
• 0x44d5fc SetWindowPos
• 0x44d600 OffsetRect
• 0x44d604 IntersectRect
• 0x44d60c GetWindowPlacement
• 0x44d610 GetWindowRect
• 0x44d614 CopyRect
• 0x44d618 PtInRect
• 0x44d61c GetWindow
• 0x44d620 CharUpperA
• 0x44d62c LoadCursorA
• 0x44d630 SetCursor
• 0x44d634 GetSystemMetrics
• 0x44d638 GetForegroundWindow
• 0x44d63c GetWindowTextA
• 0x44d640 IsWindow
• 0x44d644 GetParent
• 0x44d648 IsIconic
• 0x44d64c SendMessageA
• 0x44d650 UpdateWindow
• 0x44d654 GetSystemMenu
• 0x44d658 EnableWindow
• 0x44d65c PostThreadMessageA
• 0x44d660 CreateMenu
• 0x44d664 SetParent
• 0x44d668 GetMessagePos
• 0x44d66c BeginPaint
• 0x44d670 GetWindowDC
• 0x44d674 GrayStringA
• 0x44d678 DrawTextExA
• 0x44d67c DrawTextA
• 0x44d680 TabbedTextOutA
• 0x44d684 GetMenuItemInfoA
• 0x44d688 InflateRect
• 0x44d68c SetCapture
• 0x44d690 SetWindowRgn
• 0x44d694 DrawIcon
• 0x44d698 FindWindowA
• 0x44d69c FillRect
• 0x44d6a0 DestroyCursor
• 0x44d6a4 ReleaseDC
• 0x44d6a8 MapDialogRect
• 0x44d6ac GetMessageA
• 0x44d6b0 TranslateMessage
• 0x44d6b4 ValidateRect
• 0x44d6b8 ShowOwnedPopups
• 0x44d6bc PostQuitMessage
• 0x44d6c4 GetNextDlgTabItem
• 0x44d6c8 EndDialog
• 0x44d6cc UnionRect
• 0x44d6d0 IsRectEmpty
• 0x44d6d4 EndDeferWindowPos
• 0x44d6d8 GetDC
Library GDI32.dll:
• 0x44d054 SetAbortProc
• 0x44d058 AbortDoc
• 0x44d05c EndDoc
• 0x44d060 CreateEllipticRgn
• 0x44d064 LPtoDP
• 0x44d068 Ellipse
• 0x44d06c CreateFontIndirectA
• 0x44d070 BitBlt
• 0x44d074 ExtTextOutA
• 0x44d078 SaveDC
• 0x44d07c RestoreDC
• 0x44d080 SetBkMode
• 0x44d084 SetPolyFillMode
• 0x44d088 SetROP2
• 0x44d08c SetStretchBltMode
• 0x44d090 SetMapMode
• 0x44d094 ExcludeClipRect
• 0x44d098 IntersectClipRect
• 0x44d09c LineTo
• 0x44d0a0 MoveToEx
• 0x44d0a4 SetTextAlign
• 0x44d0a8 SelectClipRgn
• 0x44d0ac CreateRectRgn
• 0x44d0b0 GetViewportExtEx
• 0x44d0b4 GetWindowExtEx
• 0x44d0b8 GetPixel
• 0x44d0bc PtVisible
• 0x44d0c0 RectVisible
• 0x44d0c4 TextOutA
• 0x44d0c8 Escape
• 0x44d0cc SetViewportOrgEx
• 0x44d0d0 EndPage
• 0x44d0d4 SetViewportExtEx
• 0x44d0d8 ScaleViewportExtEx
• 0x44d0dc SetWindowOrgEx
• 0x44d0e0 SetWindowExtEx
• 0x44d0e4 ScaleWindowExtEx
• 0x44d0ec ExtSelectClipRgn
• 0x44d0f0 CreatePatternBrush
• 0x44d0f4 CreateSolidBrush
• 0x44d0f8 GetTextColor
• 0x44d100 SetRectRgn
• 0x44d104 CombineRgn
• 0x44d108 GetMapMode
• 0x44d10c GetRgnBox
• 0x44d110 GetNearestColor
• 0x44d114 GetBkMode
• 0x44d118 GetPolyFillMode
• 0x44d11c GetROP2
• 0x44d120 GetStretchBltMode
• 0x44d124 GetTextAlign
• 0x44d128 GetTextFaceA
• 0x44d12c GetWindowOrgEx
• 0x44d130 StartPage
• 0x44d134 StartDocA
• 0x44d138 GetStockObject
• 0x44d13c PatBlt
• 0x44d140 Rectangle
• 0x44d144 DPtoLP
• 0x44d148 GetViewportOrgEx
• 0x44d14c CreatePen
• 0x44d150 CreateFontA
• 0x44d154 GetCharWidthA
• 0x44d158 DeleteObject
• 0x44d15c StretchDIBits
• 0x44d160 DeleteDC
• 0x44d168 GetTextMetricsA
• 0x44d16c SelectObject
• 0x44d170 GetBkColor
• 0x44d174 CreateCompatibleDC
• 0x44d17c CreateDCA
• 0x44d180 GetDeviceCaps
• 0x44d184 CreateBitmap
• 0x44d188 GetObjectA
• 0x44d18c SetBkColor
• 0x44d190 SetTextColor
• 0x44d194 OffsetViewportOrgEx
• 0x44d198 GetClipBox
Library comdlg32.dll:
• 0x44d6f4 GetFileTitleA
• 0x44d6f8 PrintDlgA
• 0x44d6fc GetSaveFileNameA
• 0x44d704 GetOpenFileNameA
Library WINSPOOL.DRV:
• 0x44d6e0 OpenPrinterA
• 0x44d6e4 DocumentPropertiesA
• 0x44d6e8 ClosePrinter
• 0x44d6ec GetJobA
Library ADVAPI32.dll:
• 0x44d000 GetFileSecurityA
• 0x44d004 RegCloseKey
• 0x44d008 RegSetValueA
• 0x44d00c RegOpenKeyA
• 0x44d010 RegQueryValueExA
• 0x44d014 RegOpenKeyExA
• 0x44d018 RegDeleteKeyA
• 0x44d01c RegEnumKeyA
• 0x44d020 RegQueryValueA
• 0x44d024 RegCreateKeyExA
• 0x44d028 RegSetValueExA
• 0x44d02c RegCreateKeyA
• 0x44d034 SetFileSecurityA
• 0x44d038 RegDeleteValueA
Library SHELL32.dll:
• 0x44d410 DragQueryFileA
• 0x44d414 ExtractIconA
• 0x44d418 SHGetFileInfoA
• 0x44d41c DragFinish
Library COMCTL32.dll:
• 0x44d040
• 0x44d044 ImageList_Draw
• 0x44d04c ImageList_Destroy
Library SHLWAPI.dll:
• 0x44d424 PathFindFileNameA
• 0x44d428 PathStripToRootA
• 0x44d42c PathFindExtensionA
• 0x44d430 PathIsUNCA
Library oledlg.dll:
• 0x44d75c
Library ole32.dll:
• 0x44d70c CoRevokeClassObject
• 0x44d714 OleFlushClipboard
• 0x44d72c CoGetClassObject
• 0x44d730 CoTaskMemAlloc
• 0x44d734 CoTaskMemFree
• 0x44d738 CLSIDFromString
• 0x44d73c CLSIDFromProgID
• 0x44d740 OleInitialize
• 0x44d748 OleUninitialize
• 0x44d754 IsAccelerator
Library OLEAUT32.dll:
• 0x44d3dc VariantClear
• 0x44d3e0 VariantInit
• 0x44d3e4 SysAllocStringLen
• 0x44d3e8 SysFreeString
• 0x44d3ec SysAllocString
• 0x44d3f0 SysStringLen
• 0x44d3f8 VariantCopy
• 0x44d3fc SafeArrayDestroy
• 0x44d408 VariantChangeType

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 62192 239.255.255.250 3702
192.168.56.101 65005 239.255.255.250 3702
192.168.56.101 65007 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.