6.2
高危
61 个模型检测该样本为恶意！
重新分析
更多

b6072e84d6cfb921a3fb0a38bc13e148a308b7b4158cd9102d933810ee6858ab

89d1c5b0a8b0b1f9c16580c8c2715a86.exe

分析耗时

23s

最近分析

文件大小

707.5KB
静态报毒 动态报毒 100% AI SCORE=86 AIDETECTVM AUTO BT23L6 CONFIDENCE DELF DELPHILESS ELDORADO FAREIT GHDXX HIGH CONFIDENCE HNBRQF HPLOKI IGENT KCLOUD KTSE LOKIBOT MALWARE2 MALWARE@#1RVD36DV5I9SG NXL3LE S + MAL SCORE SGW@AO4OFZMI SIGGEN2 SMBD SUSGEN TSCOPE TSGENERIC TSPY UNSAFE X2079 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FTB!89D1C5B0A8B0 20201120 6.0.6.653
Alibaba Trojan:Win32/HPLOKI.45f9f0a1 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Avast Other:Malware-gen [Trj] 20201124 20.10.5736.0
Tencent Win32.Trojan.Inject.Auto 20201124 1.0.0.1
Kingsoft Win32.Troj.Generic_a.a.(kcloud) 20201124 2017.9.26.565
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619686135.106334
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34668356
registers.edi: 0
registers.eax: 0
registers.ebp: 34668424
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 3274833920
exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59 59 64
exception.symbol: 89d1c5b0a8b0b1f9c16580c8c2715a86+0x5d9ce
exception.instruction: div eax
exception.module: 89d1c5b0a8b0b1f9c16580c8c2715a86.exe
exception.exception_code: 0xc0000094
exception.offset: 383438
exception.address: 0x45d9ce
success 0 0
1619705916.45
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75137f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75134de3
89d1c5b0a8b0b1f9c16580c8c2715a86+0x54a4d @ 0x454a4d
89d1c5b0a8b0b1f9c16580c8c2715a86+0x4d254 @ 0x44d254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe0c14ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619686134.981334
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003d0000
success 0 0
1619686135.106334
NtProtectVirtualMemory
process_identifier: 2316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0045d000
success 0 0
1619686135.122334
NtAllocateVirtualMemory
process_identifier: 2316
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x007a0000
success 0 0
1619705915.169
NtProtectVirtualMemory
process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619705915.247
NtAllocateVirtualMemory
process_identifier: 2760
region_size: 1048576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x009d0000
success 0 0
1619705915.247
NtAllocateVirtualMemory
process_identifier: 2760
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00a90000
success 0 0
1619705915.247
NtAllocateVirtualMemory
process_identifier: 2760
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00820000
success 0 0
1619705915.247
NtProtectVirtualMemory
process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 286720
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00822000
success 0 0
1619705915.872
NtAllocateVirtualMemory
process_identifier: 2760
region_size: 983040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01fb0000
success 0 0
1619705915.872
NtAllocateVirtualMemory
process_identifier: 2760
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02060000
success 0 0
1619705916.419
NtProtectVirtualMemory
process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00b62000
success 0 0
1619705916.419
NtProtectVirtualMemory
process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619705916.419
NtProtectVirtualMemory
process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00b62000
success 0 0
1619705916.419
NtProtectVirtualMemory
process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619705916.419
NtProtectVirtualMemory
process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00b62000
success 0 0
1619705916.419
NtProtectVirtualMemory
process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619705916.419
NtProtectVirtualMemory
process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00b62000
success 0 0
1619705916.419
NtProtectVirtualMemory
process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619705916.419
NtProtectVirtualMemory
process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00b62000
success 0 0
1619705916.419
NtProtectVirtualMemory
process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619705916.419
NtProtectVirtualMemory
process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00b62000
success 0 0
1619705916.419
NtProtectVirtualMemory
process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619705916.419
NtProtectVirtualMemory
process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00b62000
success 0 0
1619705916.419
NtProtectVirtualMemory
process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619705916.419
NtProtectVirtualMemory
process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00b62000
success 0 0
1619705916.419
NtProtectVirtualMemory
process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619705916.419
NtProtectVirtualMemory
process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00b62000
success 0 0
1619705916.419
NtProtectVirtualMemory
process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619705916.419
NtProtectVirtualMemory
process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00b62000
success 0 0
1619705916.419
NtProtectVirtualMemory
process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.438298366011707 section {'size_of_data': '0x00040600', 'virtual_address': '0x00076000', 'entropy': 7.438298366011707, 'name': '.rsrc', 'virtual_size': '0x000404ec'} description A section with a high entropy has been found
entropy 0.36447275300778487 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2316 called NtSetContextThread to modify thread in remote process 2760
Time & API Arguments Status Return Repeated
1619686135.575334
NtSetContextThread
thread_handle: 0x00000100
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4866032
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2760
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2316 resumed a thread in remote process 2760
Time & API Arguments Status Return Repeated
1619686136.293334
NtResumeThread
thread_handle: 0x00000100
suspend_count: 1
process_identifier: 2760
success 0 0
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619686135.543334
CreateProcessInternalW
thread_identifier: 2136
thread_handle: 0x00000100
process_identifier: 2760
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\89d1c5b0a8b0b1f9c16580c8c2715a86.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000104
inherit_handles: 0
success 1 0
1619686135.543334
NtUnmapViewOfSection
process_identifier: 2760
region_size: 4096
process_handle: 0x00000104
base_address: 0x00400000
success 0 0
1619686135.543334
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 2760
commit_size: 679936
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000104
allocation_type: 0 ()
section_offset: 0
view_size: 679936
base_address: 0x00400000
success 0 0
1619686135.575334
NtGetContextThread
thread_handle: 0x00000100
success 0 0
1619686135.575334
NtSetContextThread
thread_handle: 0x00000100
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4866032
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2760
success 0 0
1619686136.293334
NtResumeThread
thread_handle: 0x00000100
suspend_count: 1
process_identifier: 2760
success 0 0
File has been identified by 61 AntiVirus engines on VirusTotal as malicious (50 out of 61 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Delf.FareIt.Gen.7
FireEye Generic.mg.89d1c5b0a8b0b1f9
CAT-QuickHeal Trojan.Multi
Qihoo-360 Win32/Trojan.ed1
McAfee Fareit-FTB!89D1C5B0A8B0
Cylance Unsafe
Zillya Dropper.Agent.Win32.430725
Sangfor Malware
K7AntiVirus Riskware ( 0040eff71 )
Alibaba Trojan:Win32/HPLOKI.45f9f0a1
K7GW Riskware ( 0040eff71 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Delf.FareIt.Gen.7
Cyren W32/Injector.ABY.gen!Eldorado
Symantec Infostealer.Lokibot!43
APEX Malicious
Paloalto generic.ml
ClamAV Win.Trojan.Fareit-8723799-0
Kaspersky HEUR:Trojan.Win32.Crypt.gen
BitDefender Trojan.Delf.FareIt.Gen.7
NANO-Antivirus Trojan.Win32.Crypt.hnbrqf
Avast Other:Malware-gen [Trj]
Tencent Win32.Trojan.Inject.Auto
Ad-Aware Trojan.Delf.FareIt.Gen.7
Sophos Mal/Generic-S + Mal/Generic-L
Comodo Malware@#1rvd36dv5i9sg
F-Secure Trojan.TR/Agent.ghdxx
DrWeb Trojan.PWS.Siggen2.51483
VIPRE Win32.Malware!Drop
TrendMicro TSPY_HPLOKI.SMBD
McAfee-GW-Edition BehavesLike.Win32.Fareit.bc
Emsisoft Trojan.Delf.FareIt.Gen.7 (B)
Ikarus Trojan.Inject
Webroot W32.Trojan.Gen
Avira TR/Agent.ghdxx
MAX malware (ai score=86)
Antiy-AVL Trojan/Win32.TSGeneric
Kingsoft Win32.Troj.Generic_a.a.(kcloud)
Microsoft PWS:Win32/Fareit.AO!MTB
AegisLab Trojan.Win32.Crypt.4!c
ZoneAlarm HEUR:Trojan.Win32.Crypt.gen
GData Win32.Trojan.Agent.NXL3LE
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2079
VBA32 TScope.Trojan.Delf
ALYac Spyware.Infostealer.Fareit
Malwarebytes Trojan.MalPack.DLF
Zoner Trojan.Win32.91477
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x46a13c VirtualFree
• 0x46a140 VirtualAlloc
• 0x46a144 LocalFree
• 0x46a148 LocalAlloc
• 0x46a14c GetVersion
• 0x46a150 GetCurrentThreadId
• 0x46a15c VirtualQuery
• 0x46a160 WideCharToMultiByte
• 0x46a164 MultiByteToWideChar
• 0x46a168 lstrlenA
• 0x46a16c lstrcpynA
• 0x46a170 LoadLibraryExA
• 0x46a174 GetThreadLocale
• 0x46a178 GetStartupInfoA
• 0x46a17c GetProcAddress
• 0x46a180 GetModuleHandleA
• 0x46a184 GetModuleFileNameA
• 0x46a188 GetLocaleInfoA
• 0x46a18c GetCommandLineA
• 0x46a190 FreeLibrary
• 0x46a194 FindFirstFileA
• 0x46a198 FindClose
• 0x46a19c ExitProcess
• 0x46a1a0 WriteFile
• 0x46a1a8 RtlUnwind
• 0x46a1ac RaiseException
• 0x46a1b0 GetStdHandle
Library user32.dll:
• 0x46a1b8 GetKeyboardType
• 0x46a1bc LoadStringA
• 0x46a1c0 MessageBoxA
• 0x46a1c4 CharNextA
Library advapi32.dll:
• 0x46a1cc RegQueryValueExA
• 0x46a1d0 RegOpenKeyExA
• 0x46a1d4 RegCloseKey
Library oleaut32.dll:
• 0x46a1dc SysFreeString
• 0x46a1e0 SysReAllocStringLen
• 0x46a1e4 SysAllocStringLen
Library kernel32.dll:
• 0x46a1ec TlsSetValue
• 0x46a1f0 TlsGetValue
• 0x46a1f4 LocalAlloc
• 0x46a1f8 GetModuleHandleA
Library advapi32.dll:
• 0x46a200 RegQueryValueExA
• 0x46a204 RegOpenKeyExA
• 0x46a208 RegCloseKey
Library kernel32.dll:
• 0x46a210 lstrcpyA
• 0x46a214 WriteFile
• 0x46a218 WaitForSingleObject
• 0x46a21c VirtualQuery
• 0x46a220 VirtualProtectEx
• 0x46a224 VirtualAlloc
• 0x46a228 Sleep
• 0x46a22c SizeofResource
• 0x46a230 SetThreadLocale
• 0x46a234 SetFilePointer
• 0x46a238 SetEvent
• 0x46a23c SetErrorMode
• 0x46a240 SetEndOfFile
• 0x46a244 ResetEvent
• 0x46a248 ReadFile
• 0x46a24c MulDiv
• 0x46a250 LockResource
• 0x46a254 LoadResource
• 0x46a258 LoadLibraryA
• 0x46a264 GlobalUnlock
• 0x46a268 GlobalReAlloc
• 0x46a26c GlobalHandle
• 0x46a270 GlobalLock
• 0x46a274 GlobalFree
• 0x46a278 GlobalFindAtomA
• 0x46a27c GlobalDeleteAtom
• 0x46a280 GlobalAlloc
• 0x46a284 GlobalAddAtomA
• 0x46a288 GetVersionExA
• 0x46a28c GetVersion
• 0x46a290 GetTickCount
• 0x46a294 GetThreadLocale
• 0x46a298 GetSystemInfo
• 0x46a29c GetStringTypeExA
• 0x46a2a0 GetStdHandle
• 0x46a2a4 GetProcAddress
• 0x46a2a8 GetModuleHandleA
• 0x46a2ac GetModuleFileNameA
• 0x46a2b0 GetLocaleInfoA
• 0x46a2b4 GetLocalTime
• 0x46a2b8 GetLastError
• 0x46a2bc GetFullPathNameA
• 0x46a2c0 GetFileType
• 0x46a2c4 GetFileAttributesA
• 0x46a2c8 GetDiskFreeSpaceA
• 0x46a2cc GetDateFormatA
• 0x46a2d0 GetCurrentThreadId
• 0x46a2d4 GetCurrentProcessId
• 0x46a2d8 GetCurrentProcess
• 0x46a2dc GetCPInfo
• 0x46a2e0 GetACP
• 0x46a2e4 FreeResource
• 0x46a2e8 InterlockedExchange
• 0x46a2ec FreeLibrary
• 0x46a2f0 FormatMessageA
• 0x46a2f4 FindResourceA
• 0x46a2f8 FindFirstFileA
• 0x46a2fc FindClose
• 0x46a308 EnumCalendarInfoA
• 0x46a314 CreateThread
• 0x46a318 CreateFileA
• 0x46a31c CreateEventA
• 0x46a320 CompareStringA
• 0x46a324 CloseHandle
Library version.dll:
• 0x46a32c VerQueryValueA
• 0x46a334 GetFileVersionInfoA
Library gdi32.dll:
• 0x46a33c UnrealizeObject
• 0x46a340 StretchBlt
• 0x46a344 SetWindowOrgEx
• 0x46a348 SetWinMetaFileBits
• 0x46a34c SetViewportOrgEx
• 0x46a350 SetTextColor
• 0x46a354 SetStretchBltMode
• 0x46a358 SetROP2
• 0x46a35c SetPixel
• 0x46a360 SetEnhMetaFileBits
• 0x46a364 SetDIBColorTable
• 0x46a368 SetBrushOrgEx
• 0x46a36c SetBkMode
• 0x46a370 SetBkColor
• 0x46a374 SelectPalette
• 0x46a378 SelectObject
• 0x46a37c SelectClipRgn
• 0x46a380 SaveDC
• 0x46a384 RestoreDC
• 0x46a388 Rectangle
• 0x46a38c RectVisible
• 0x46a390 RealizePalette
• 0x46a394 Polyline
• 0x46a398 PlayEnhMetaFile
• 0x46a39c PatBlt
• 0x46a3a0 MoveToEx
• 0x46a3a4 MaskBlt
• 0x46a3a8 LineTo
• 0x46a3ac IntersectClipRect
• 0x46a3b0 GetWindowOrgEx
• 0x46a3b4 GetWinMetaFileBits
• 0x46a3b8 GetTextMetricsA
• 0x46a3c4 GetStockObject
• 0x46a3c8 GetPixel
• 0x46a3cc GetPaletteEntries
• 0x46a3d0 GetObjectA
• 0x46a3dc GetEnhMetaFileBits
• 0x46a3e0 GetDeviceCaps
• 0x46a3e4 GetDIBits
• 0x46a3e8 GetDIBColorTable
• 0x46a3ec GetDCOrgEx
• 0x46a3f4 GetClipRgn
• 0x46a3f8 GetClipBox
• 0x46a3fc GetBrushOrgEx
• 0x46a400 GetBitmapBits
• 0x46a404 ExcludeClipRect
• 0x46a408 DeleteObject
• 0x46a40c DeleteEnhMetaFile
• 0x46a410 DeleteDC
• 0x46a414 CreateSolidBrush
• 0x46a418 CreateRectRgn
• 0x46a41c CreatePenIndirect
• 0x46a420 CreatePalette
• 0x46a428 CreateFontIndirectA
• 0x46a42c CreateDIBitmap
• 0x46a430 CreateDIBSection
• 0x46a434 CreateCompatibleDC
• 0x46a43c CreateBrushIndirect
• 0x46a440 CreateBitmap
• 0x46a444 CopyEnhMetaFileA
• 0x46a448 BitBlt
Library user32.dll:
• 0x46a450 CreateWindowExA
• 0x46a454 WindowFromPoint
• 0x46a458 WinHelpA
• 0x46a45c WaitMessage
• 0x46a460 UpdateWindow
• 0x46a464 UnregisterClassA
• 0x46a468 UnhookWindowsHookEx
• 0x46a46c TranslateMessage
• 0x46a474 TrackPopupMenu
• 0x46a47c ShowWindow
• 0x46a480 ShowScrollBar
• 0x46a484 ShowOwnedPopups
• 0x46a488 ShowCursor
• 0x46a48c SetWindowsHookExA
• 0x46a490 SetWindowPos
• 0x46a494 SetWindowPlacement
• 0x46a498 SetWindowLongA
• 0x46a49c SetTimer
• 0x46a4a0 SetScrollRange
• 0x46a4a4 SetScrollPos
• 0x46a4a8 SetScrollInfo
• 0x46a4ac SetRect
• 0x46a4b0 SetPropA
• 0x46a4b4 SetParent
• 0x46a4b8 SetMenuItemInfoA
• 0x46a4bc SetMenu
• 0x46a4c0 SetForegroundWindow
• 0x46a4c4 SetFocus
• 0x46a4c8 SetCursor
• 0x46a4cc SetClassLongA
• 0x46a4d0 SetCapture
• 0x46a4d4 SetActiveWindow
• 0x46a4d8 SendMessageA
• 0x46a4dc ScrollWindow
• 0x46a4e0 ScreenToClient
• 0x46a4e4 RemovePropA
• 0x46a4e8 RemoveMenu
• 0x46a4ec ReleaseDC
• 0x46a4f0 ReleaseCapture
• 0x46a4fc RegisterClassA
• 0x46a500 RedrawWindow
• 0x46a504 PtInRect
• 0x46a508 PostQuitMessage
• 0x46a50c PostMessageA
• 0x46a510 PeekMessageA
• 0x46a514 OffsetRect
• 0x46a518 OemToCharA
• 0x46a51c MessageBoxA
• 0x46a520 MapWindowPoints
• 0x46a524 MapVirtualKeyA
• 0x46a528 LoadStringA
• 0x46a52c LoadKeyboardLayoutA
• 0x46a530 LoadIconA
• 0x46a534 LoadCursorA
• 0x46a538 LoadBitmapA
• 0x46a53c KillTimer
• 0x46a540 IsZoomed
• 0x46a544 IsWindowVisible
• 0x46a548 IsWindowEnabled
• 0x46a54c IsWindow
• 0x46a550 IsRectEmpty
• 0x46a554 IsIconic
• 0x46a558 IsDialogMessageA
• 0x46a55c IsChild
• 0x46a560 InvalidateRect
• 0x46a564 IntersectRect
• 0x46a568 InsertMenuItemA
• 0x46a56c InsertMenuA
• 0x46a570 InflateRect
• 0x46a578 GetWindowTextA
• 0x46a57c GetWindowRect
• 0x46a580 GetWindowPlacement
• 0x46a584 GetWindowLongA
• 0x46a588 GetWindowDC
• 0x46a58c GetTopWindow
• 0x46a590 GetSystemMetrics
• 0x46a594 GetSystemMenu
• 0x46a598 GetSysColorBrush
• 0x46a59c GetSysColor
• 0x46a5a0 GetSubMenu
• 0x46a5a4 GetScrollRange
• 0x46a5a8 GetScrollPos
• 0x46a5ac GetScrollInfo
• 0x46a5b0 GetPropA
• 0x46a5b4 GetParent
• 0x46a5b8 GetWindow
• 0x46a5bc GetMenuStringA
• 0x46a5c0 GetMenuState
• 0x46a5c4 GetMenuItemInfoA
• 0x46a5c8 GetMenuItemID
• 0x46a5cc GetMenuItemCount
• 0x46a5d0 GetMenu
• 0x46a5d4 GetLastActivePopup
• 0x46a5d8 GetKeyboardState
• 0x46a5e0 GetKeyboardLayout
• 0x46a5e4 GetKeyState
• 0x46a5e8 GetKeyNameTextA
• 0x46a5ec GetIconInfo
• 0x46a5f0 GetForegroundWindow
• 0x46a5f4 GetFocus
• 0x46a5f8 GetDlgItem
• 0x46a5fc GetDesktopWindow
• 0x46a600 GetDCEx
• 0x46a604 GetDC
• 0x46a608 GetCursorPos
• 0x46a60c GetCursor
• 0x46a610 GetClipboardData
• 0x46a614 GetClientRect
• 0x46a618 GetClassNameA
• 0x46a61c GetClassInfoA
• 0x46a620 GetCapture
• 0x46a624 GetActiveWindow
• 0x46a628 FrameRect
• 0x46a62c FindWindowA
• 0x46a630 FillRect
• 0x46a634 EqualRect
• 0x46a638 EnumWindows
• 0x46a63c EnumThreadWindows
• 0x46a640 EndPaint
• 0x46a644 EnableWindow
• 0x46a648 EnableScrollBar
• 0x46a64c EnableMenuItem
• 0x46a650 DrawTextA
• 0x46a654 DrawMenuBar
• 0x46a658 DrawIconEx
• 0x46a65c DrawIcon
• 0x46a660 DrawFrameControl
• 0x46a664 DrawFocusRect
• 0x46a668 DrawEdge
• 0x46a66c DispatchMessageA
• 0x46a670 DestroyWindow
• 0x46a674 DestroyMenu
• 0x46a678 DestroyIcon
• 0x46a67c DestroyCursor
• 0x46a680 DeleteMenu
• 0x46a684 DefWindowProcA
• 0x46a688 DefMDIChildProcA
• 0x46a68c DefFrameProcA
• 0x46a690 CreatePopupMenu
• 0x46a694 CreateMenu
• 0x46a698 CreateIcon
• 0x46a69c ClientToScreen
• 0x46a6a0 CheckMenuItem
• 0x46a6a4 CallWindowProcA
• 0x46a6a8 CallNextHookEx
• 0x46a6ac BeginPaint
• 0x46a6b0 CharNextA
• 0x46a6b4 CharLowerBuffA
• 0x46a6b8 CharLowerA
• 0x46a6bc CharToOemA
• 0x46a6c0 AdjustWindowRectEx
Library kernel32.dll:
• 0x46a6cc Sleep
Library oleaut32.dll:
• 0x46a6d4 SafeArrayPtrOfIndex
• 0x46a6d8 SafeArrayGetUBound
• 0x46a6dc SafeArrayGetLBound
• 0x46a6e0 SafeArrayCreate
• 0x46a6e4 VariantChangeType
• 0x46a6e8 VariantCopy
• 0x46a6ec VariantClear
• 0x46a6f0 VariantInit
Library comctl32.dll:
• 0x46a700 ImageList_Write
• 0x46a704 ImageList_Read
• 0x46a714 ImageList_DragMove
• 0x46a718 ImageList_DragLeave
• 0x46a71c ImageList_DragEnter
• 0x46a720 ImageList_EndDrag
• 0x46a724 ImageList_BeginDrag
• 0x46a728 ImageList_Remove
• 0x46a72c ImageList_DrawEx
• 0x46a730 ImageList_Replace
• 0x46a734 ImageList_Draw
• 0x46a744 ImageList_Add
• 0x46a74c ImageList_Destroy
• 0x46a750 ImageList_Create
Library comdlg32.dll:
• 0x46a758 GetSaveFileNameA
• 0x46a75c GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.