5.8
高危
62 个模型检测该样本为恶意！
重新分析
更多

c94bbe19d634268f0794329f8c8a92cc9c1282a55f6a3de656858a4ed0fb80a0

8c7e51625b5ae0f4ea088eb08d52e739.exe

分析耗时

23s

最近分析

文件大小

677.5KB
静态报毒 动态报毒 AI SCORE=80 APFK AUTO AVSARHER BTOMTW CLOUD CONFIDENCE DELPHILESS EMHC FAREIT GENERICKD HIGH CONFIDENCE KHPIM LOKIBOT MALWARE@#2C4LQFNXH4057 SCORE SIGGEN2 SUSPICIOUS PE THFODBO TQUQ TROJAN3 UNSAFE WACATAC X2066 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba TrojanSpy:Win32/Obfuscator.f78a413e 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Tencent Win32.Trojan.Inject.Auto 20200614 1.0.0.1
Kingsoft 20200614 2013.8.14.323
McAfee Fareit-FTB!8C7E51625B5A 20200614 6.0.6.653
Avast Win32:Trojan-gen 20200614 18.4.3895.0
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619686134.755279
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49151540
registers.edi: 0
registers.eax: 0
registers.ebp: 49151880
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 b3 6f 00 00 e9
exception.symbol: 8c7e51625b5ae0f4ea088eb08d52e739+0x58f94
exception.instruction: div eax
exception.module: 8c7e51625b5ae0f4ea088eb08d52e739.exe
exception.exception_code: 0xc0000094
exception.offset: 364436
exception.address: 0x458f94
success 0 0
1619705432.081501
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75177f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75174de3
8c7e51625b5ae0f4ea088eb08d52e739+0x5aa4d @ 0x45aa4d
8c7e51625b5ae0f4ea088eb08d52e739+0x53254 @ 0x453254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff4c14ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619686134.599279
NtAllocateVirtualMemory
process_identifier: 368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x007b0000
success 0 0
1619686134.755279
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 32768
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00458000
success 0 0
1619686134.771279
NtAllocateVirtualMemory
process_identifier: 368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00880000
success 0 0
1619705430.612501
NtProtectVirtualMemory
process_identifier: 1464
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619705430.659501
NtAllocateVirtualMemory
process_identifier: 1464
region_size: 262144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00520000
success 0 0
1619705430.659501
NtAllocateVirtualMemory
process_identifier: 1464
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00520000
success 0 0
1619705430.659501
NtAllocateVirtualMemory
process_identifier: 1464
region_size: 335872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00560000
success 0 0
1619705430.659501
NtProtectVirtualMemory
process_identifier: 1464
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 307200
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619705431.300501
NtAllocateVirtualMemory
process_identifier: 1464
region_size: 1572864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01f70000
success 0 0
1619705431.300501
NtAllocateVirtualMemory
process_identifier: 1464
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020b0000
success 0 0
1619705432.050501
NtProtectVirtualMemory
process_identifier: 1464
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f62000
success 0 0
1619705432.050501
NtProtectVirtualMemory
process_identifier: 1464
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619705432.050501
NtProtectVirtualMemory
process_identifier: 1464
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f62000
success 0 0
1619705432.050501
NtProtectVirtualMemory
process_identifier: 1464
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619705432.050501
NtProtectVirtualMemory
process_identifier: 1464
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f62000
success 0 0
1619705432.050501
NtProtectVirtualMemory
process_identifier: 1464
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619705432.050501
NtProtectVirtualMemory
process_identifier: 1464
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f62000
success 0 0
1619705432.050501
NtProtectVirtualMemory
process_identifier: 1464
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619705432.050501
NtProtectVirtualMemory
process_identifier: 1464
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f62000
success 0 0
1619705432.050501
NtProtectVirtualMemory
process_identifier: 1464
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619705432.050501
NtProtectVirtualMemory
process_identifier: 1464
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f62000
success 0 0
1619705432.050501
NtProtectVirtualMemory
process_identifier: 1464
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619705432.050501
NtProtectVirtualMemory
process_identifier: 1464
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f62000
success 0 0
1619705432.050501
NtProtectVirtualMemory
process_identifier: 1464
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619705432.050501
NtProtectVirtualMemory
process_identifier: 1464
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f62000
success 0 0
1619705432.050501
NtProtectVirtualMemory
process_identifier: 1464
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619705432.050501
NtProtectVirtualMemory
process_identifier: 1464
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f62000
success 0 0
1619705432.050501
NtProtectVirtualMemory
process_identifier: 1464
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619705432.050501
NtProtectVirtualMemory
process_identifier: 1464
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f62000
success 0 0
1619705432.050501
NtProtectVirtualMemory
process_identifier: 1464
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.414796116750824 section {'size_of_data': '0x00040000', 'virtual_address': '0x00070000', 'entropy': 7.414796116750824, 'name': '.rsrc', 'virtual_size': '0x0003ff54'} description A section with a high entropy has been found
entropy 0.37841832963784183 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 368 called NtSetContextThread to modify thread in remote process 1464
Time & API Arguments Status Return Repeated
1619686135.349279
NtSetContextThread
thread_handle: 0x00000100
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4910960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1464
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 368 resumed a thread in remote process 1464
Time & API Arguments Status Return Repeated
1619686135.787279
NtResumeThread
thread_handle: 0x00000100
suspend_count: 1
process_identifier: 1464
success 0 0
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619686134.990279
CreateProcessInternalW
thread_identifier: 2316
thread_handle: 0x00000100
process_identifier: 1464
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\8c7e51625b5ae0f4ea088eb08d52e739.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000104
inherit_handles: 0
success 1 0
1619686134.990279
NtUnmapViewOfSection
process_identifier: 1464
region_size: 4096
process_handle: 0x00000104
base_address: 0x00400000
success 0 0
1619686135.005279
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 1464
commit_size: 724992
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000104
allocation_type: 0 ()
section_offset: 0
view_size: 724992
base_address: 0x00400000
success 0 0
1619686135.349279
NtGetContextThread
thread_handle: 0x00000100
success 0 0
1619686135.349279
NtSetContextThread
thread_handle: 0x00000100
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4910960
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1464
success 0 0
1619686135.787279
NtResumeThread
thread_handle: 0x00000100
suspend_count: 1
process_identifier: 1464
success 0 0
File has been identified by 62 AntiVirus engines on VirusTotal as malicious (50 out of 62 个事件)
MicroWorld-eScan Trojan.GenericKD.33966453
CAT-QuickHeal TrojanSpy.Stealer
ALYac Trojan.GenericKD.33966453
Cylance Unsafe
Zillya Trojan.Stealer.Win32.7594
Sangfor Malware
K7AntiVirus Trojan ( 005680341 )
Alibaba TrojanSpy:Win32/Obfuscator.f78a413e
K7GW Trojan ( 005680341 )
Cybereason malicious.959072
Arcabit Trojan.Generic.D2064975
TrendMicro Trojan.Win32.WACATAC.THFODBO
BitDefenderTheta AI:Packer.32184F2721
F-Prot W32/Trojan3.APFK
Symantec Infostealer.Lokibot!43
APEX Malicious
Paloalto generic.ml
ClamAV Win.Trojan.Generic-8000835-0
Kaspersky HEUR:Trojan-Spy.Win32.Stealer.gen
BitDefender Trojan.GenericKD.33966453
AegisLab Trojan.Win32.Generic.4!c
Tencent Win32.Trojan.Inject.Auto
Ad-Aware Trojan.GenericKD.33966453
Sophos Mal/Generic-S
Comodo Malware@#2c4lqfnxh4057
F-Secure Trojan.TR/Injector.khpim
DrWeb Trojan.PWS.Siggen2.45348
VIPRE Trojan.Win32.Generic!BT
Invincea heuristic
Trapmine suspicious.low.ml.score
FireEye Generic.mg.8c7e51625b5ae0f4
Emsisoft Trojan.GenericKD.33966453 (B)
SentinelOne DFI - Suspicious PE
Cyren W32/Trojan.TQUQ-2832
Jiangmin TrojanSpy.Stealer.crj
Webroot W32.Trojan.Gen
Avira TR/Injector.khpim
MAX malware (ai score=80)
Antiy-AVL Trojan[Spy]/Win32.Stealer
Microsoft Trojan:Win32/Obfuscator.KI!MTB
Endgame malicious (high confidence)
ZoneAlarm HEUR:Trojan-Spy.Win32.Stealer.gen
GData Trojan.GenericKD.33966453
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2066
Acronis suspicious
McAfee Fareit-FTB!8C7E51625B5A
TACHYON Trojan/W32.DP-Agent.693760.H
VBA32 Trojan.Wacatac
Malwarebytes Trojan.MalPack.DLF
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x46413c VirtualFree
• 0x464140 VirtualAlloc
• 0x464144 LocalFree
• 0x464148 LocalAlloc
• 0x46414c GetVersion
• 0x464150 GetCurrentThreadId
• 0x46415c VirtualQuery
• 0x464160 WideCharToMultiByte
• 0x464164 MultiByteToWideChar
• 0x464168 lstrlenA
• 0x46416c lstrcpynA
• 0x464170 LoadLibraryExA
• 0x464174 GetThreadLocale
• 0x464178 GetStartupInfoA
• 0x46417c GetProcAddress
• 0x464180 GetModuleHandleA
• 0x464184 GetModuleFileNameA
• 0x464188 GetLocaleInfoA
• 0x46418c GetCommandLineA
• 0x464190 FreeLibrary
• 0x464194 FindFirstFileA
• 0x464198 FindClose
• 0x46419c ExitProcess
• 0x4641a0 WriteFile
• 0x4641a8 RtlUnwind
• 0x4641ac RaiseException
• 0x4641b0 GetStdHandle
Library user32.dll:
• 0x4641b8 GetKeyboardType
• 0x4641bc LoadStringA
• 0x4641c0 MessageBoxA
• 0x4641c4 CharNextA
Library advapi32.dll:
• 0x4641cc RegQueryValueExA
• 0x4641d0 RegOpenKeyExA
• 0x4641d4 RegCloseKey
Library oleaut32.dll:
• 0x4641dc SysFreeString
• 0x4641e0 SysReAllocStringLen
• 0x4641e4 SysAllocStringLen
Library kernel32.dll:
• 0x4641ec TlsSetValue
• 0x4641f0 TlsGetValue
• 0x4641f4 LocalAlloc
• 0x4641f8 GetModuleHandleA
Library advapi32.dll:
• 0x464200 RegQueryValueExA
• 0x464204 RegOpenKeyExA
• 0x464208 RegCloseKey
Library kernel32.dll:
• 0x464210 lstrcpyA
• 0x464214 WriteFile
• 0x46421c WaitForSingleObject
• 0x464220 VirtualQuery
• 0x464224 VirtualAlloc
• 0x464228 Sleep
• 0x46422c SizeofResource
• 0x464230 SetThreadLocale
• 0x464234 SetFilePointer
• 0x464238 SetEvent
• 0x46423c SetErrorMode
• 0x464240 SetEndOfFile
• 0x464244 ResetEvent
• 0x464248 ReadFile
• 0x46424c MulDiv
• 0x464250 LockResource
• 0x464254 LoadResource
• 0x464258 LoadLibraryA
• 0x464264 GlobalUnlock
• 0x464268 GlobalReAlloc
• 0x46426c GlobalHandle
• 0x464270 GlobalLock
• 0x464274 GlobalFree
• 0x464278 GlobalFindAtomA
• 0x46427c GlobalDeleteAtom
• 0x464280 GlobalAlloc
• 0x464284 GlobalAddAtomA
• 0x464288 GetVersionExA
• 0x46428c GetVersion
• 0x464290 GetTickCount
• 0x464294 GetThreadLocale
• 0x46429c GetSystemTime
• 0x4642a0 GetSystemInfo
• 0x4642a4 GetStringTypeExA
• 0x4642a8 GetStdHandle
• 0x4642ac GetProcAddress
• 0x4642b0 GetModuleHandleA
• 0x4642b4 GetModuleFileNameA
• 0x4642b8 GetLocaleInfoA
• 0x4642bc GetLocalTime
• 0x4642c0 GetLastError
• 0x4642c4 GetFullPathNameA
• 0x4642c8 GetFileAttributesA
• 0x4642cc GetDiskFreeSpaceA
• 0x4642d0 GetDateFormatA
• 0x4642d4 GetCurrentThreadId
• 0x4642d8 GetCurrentProcessId
• 0x4642dc GetCPInfo
• 0x4642e0 GetACP
• 0x4642e4 FreeResource
• 0x4642e8 InterlockedExchange
• 0x4642ec FreeLibrary
• 0x4642f0 FormatMessageA
• 0x4642f4 FindResourceA
• 0x4642f8 FindFirstFileA
• 0x4642fc FindClose
• 0x464308 ExitThread
• 0x46430c EnumCalendarInfoA
• 0x464318 CreateThread
• 0x46431c CreateFileA
• 0x464320 CreateEventA
• 0x464324 CompareStringA
• 0x464328 CloseHandle
Library version.dll:
• 0x464330 VerQueryValueA
• 0x464338 GetFileVersionInfoA
Library gdi32.dll:
• 0x464340 UnrealizeObject
• 0x464344 StretchBlt
• 0x464348 SetWindowOrgEx
• 0x46434c SetWinMetaFileBits
• 0x464350 SetViewportOrgEx
• 0x464354 SetTextColor
• 0x464358 SetStretchBltMode
• 0x46435c SetROP2
• 0x464360 SetPixel
• 0x464364 SetEnhMetaFileBits
• 0x464368 SetDIBColorTable
• 0x46436c SetBrushOrgEx
• 0x464370 SetBkMode
• 0x464374 SetBkColor
• 0x464378 SelectPalette
• 0x46437c SelectObject
• 0x464380 SaveDC
• 0x464384 RestoreDC
• 0x464388 Rectangle
• 0x46438c RectVisible
• 0x464390 RealizePalette
• 0x464394 Polyline
• 0x464398 PlayEnhMetaFile
• 0x46439c PatBlt
• 0x4643a0 MoveToEx
• 0x4643a4 MaskBlt
• 0x4643a8 LineTo
• 0x4643ac IntersectClipRect
• 0x4643b0 GetWindowOrgEx
• 0x4643b4 GetWinMetaFileBits
• 0x4643b8 GetTextMetricsA
• 0x4643c4 GetStockObject
• 0x4643c8 GetPixel
• 0x4643cc GetPaletteEntries
• 0x4643d0 GetObjectA
• 0x4643dc GetEnhMetaFileBits
• 0x4643e0 GetDeviceCaps
• 0x4643e4 GetDIBits
• 0x4643e8 GetDIBColorTable
• 0x4643ec GetDCOrgEx
• 0x4643f4 GetClipBox
• 0x4643f8 GetBrushOrgEx
• 0x4643fc GetBitmapBits
• 0x464400 ExcludeClipRect
• 0x464404 DeleteObject
• 0x464408 DeleteEnhMetaFile
• 0x46440c DeleteDC
• 0x464410 CreateSolidBrush
• 0x464414 CreatePenIndirect
• 0x464418 CreatePalette
• 0x464420 CreateFontIndirectA
• 0x464424 CreateDIBitmap
• 0x464428 CreateDIBSection
• 0x46442c CreateCompatibleDC
• 0x464434 CreateBrushIndirect
• 0x464438 CreateBitmap
• 0x46443c CopyEnhMetaFileA
• 0x464440 BitBlt
Library user32.dll:
• 0x464448 CreateWindowExA
• 0x46444c WindowFromPoint
• 0x464450 WinHelpA
• 0x464454 WaitMessage
• 0x464458 UpdateWindow
• 0x46445c UnregisterClassA
• 0x464460 UnhookWindowsHookEx
• 0x464464 TranslateMessage
• 0x46446c TrackPopupMenu
• 0x464474 ShowWindow
• 0x464478 ShowScrollBar
• 0x46447c ShowOwnedPopups
• 0x464480 ShowCursor
• 0x464484 SetWindowsHookExA
• 0x464488 SetWindowPos
• 0x46448c SetWindowPlacement
• 0x464490 SetWindowLongA
• 0x464494 SetTimer
• 0x464498 SetScrollRange
• 0x46449c SetScrollPos
• 0x4644a0 SetScrollInfo
• 0x4644a4 SetRect
• 0x4644a8 SetPropA
• 0x4644ac SetParent
• 0x4644b0 SetMenuItemInfoA
• 0x4644b4 SetMenu
• 0x4644b8 SetForegroundWindow
• 0x4644bc SetFocus
• 0x4644c0 SetCursor
• 0x4644c4 SetClassLongA
• 0x4644c8 SetCapture
• 0x4644cc SetActiveWindow
• 0x4644d0 SendMessageA
• 0x4644d4 ScrollWindow
• 0x4644d8 ScreenToClient
• 0x4644dc RemovePropA
• 0x4644e0 RemoveMenu
• 0x4644e4 ReleaseDC
• 0x4644e8 ReleaseCapture
• 0x4644f4 RegisterClassA
• 0x4644f8 RedrawWindow
• 0x4644fc PtInRect
• 0x464500 PostQuitMessage
• 0x464504 PostMessageA
• 0x464508 PeekMessageA
• 0x46450c OffsetRect
• 0x464510 OemToCharA
• 0x464514 MessageBoxA
• 0x464518 MapWindowPoints
• 0x46451c MapVirtualKeyA
• 0x464520 LoadStringA
• 0x464524 LoadKeyboardLayoutA
• 0x464528 LoadIconA
• 0x46452c LoadCursorA
• 0x464530 LoadBitmapA
• 0x464534 KillTimer
• 0x464538 IsZoomed
• 0x46453c IsWindowVisible
• 0x464540 IsWindowEnabled
• 0x464544 IsWindow
• 0x464548 IsRectEmpty
• 0x46454c IsIconic
• 0x464550 IsDialogMessageA
• 0x464554 IsChild
• 0x464558 InvalidateRect
• 0x46455c IntersectRect
• 0x464560 InsertMenuItemA
• 0x464564 InsertMenuA
• 0x464568 InflateRect
• 0x464570 GetWindowTextA
• 0x464574 GetWindowRect
• 0x464578 GetWindowPlacement
• 0x46457c GetWindowLongA
• 0x464580 GetWindowDC
• 0x464584 GetTopWindow
• 0x464588 GetSystemMetrics
• 0x46458c GetSystemMenu
• 0x464590 GetSysColorBrush
• 0x464594 GetSysColor
• 0x464598 GetSubMenu
• 0x46459c GetScrollRange
• 0x4645a0 GetScrollPos
• 0x4645a4 GetScrollInfo
• 0x4645a8 GetPropA
• 0x4645ac GetParent
• 0x4645b0 GetWindow
• 0x4645b4 GetMenuStringA
• 0x4645b8 GetMenuState
• 0x4645bc GetMenuItemInfoA
• 0x4645c0 GetMenuItemID
• 0x4645c4 GetMenuItemCount
• 0x4645c8 GetMenu
• 0x4645cc GetLastActivePopup
• 0x4645d0 GetKeyboardState
• 0x4645d8 GetKeyboardLayout
• 0x4645dc GetKeyState
• 0x4645e0 GetKeyNameTextA
• 0x4645e4 GetIconInfo
• 0x4645e8 GetForegroundWindow
• 0x4645ec GetFocus
• 0x4645f0 GetDlgItem
• 0x4645f4 GetDesktopWindow
• 0x4645f8 GetDCEx
• 0x4645fc GetDC
• 0x464600 GetCursorPos
• 0x464604 GetCursor
• 0x464608 GetClipboardData
• 0x46460c GetClientRect
• 0x464610 GetClassNameA
• 0x464614 GetClassInfoA
• 0x464618 GetCapture
• 0x46461c GetActiveWindow
• 0x464620 FrameRect
• 0x464624 FindWindowA
• 0x464628 FillRect
• 0x46462c EqualRect
• 0x464630 EnumWindows
• 0x464634 EnumThreadWindows
• 0x464638 EndPaint
• 0x46463c EnableWindow
• 0x464640 EnableScrollBar
• 0x464644 EnableMenuItem
• 0x464648 DrawTextA
• 0x46464c DrawMenuBar
• 0x464650 DrawIconEx
• 0x464654 DrawIcon
• 0x464658 DrawFrameControl
• 0x46465c DrawEdge
• 0x464660 DispatchMessageA
• 0x464664 DestroyWindow
• 0x464668 DestroyMenu
• 0x46466c DestroyIcon
• 0x464670 DestroyCursor
• 0x464674 DeleteMenu
• 0x464678 DefWindowProcA
• 0x46467c DefMDIChildProcA
• 0x464680 DefFrameProcA
• 0x464684 CreatePopupMenu
• 0x464688 CreateMenu
• 0x46468c CreateIcon
• 0x464690 ClientToScreen
• 0x464694 CheckMenuItem
• 0x464698 CallWindowProcA
• 0x46469c CallNextHookEx
• 0x4646a0 BeginPaint
• 0x4646a4 CharNextA
• 0x4646a8 CharLowerBuffA
• 0x4646ac CharLowerA
• 0x4646b0 CharToOemA
• 0x4646b4 AdjustWindowRectEx
Library kernel32.dll:
• 0x4646c0 Sleep
Library oleaut32.dll:
• 0x4646c8 SafeArrayPtrOfIndex
• 0x4646cc SafeArrayGetUBound
• 0x4646d0 SafeArrayGetLBound
• 0x4646d4 SafeArrayCreate
• 0x4646d8 VariantChangeType
• 0x4646dc VariantCopy
• 0x4646e0 VariantClear
• 0x4646e4 VariantInit
Library comctl32.dll:
• 0x4646f4 ImageList_Write
• 0x4646f8 ImageList_Read
• 0x464708 ImageList_DragMove
• 0x46470c ImageList_DragLeave
• 0x464710 ImageList_DragEnter
• 0x464714 ImageList_EndDrag
• 0x464718 ImageList_BeginDrag
• 0x46471c ImageList_Remove
• 0x464720 ImageList_DrawEx
• 0x464724 ImageList_Replace
• 0x464728 ImageList_Draw
• 0x464738 ImageList_Add
• 0x464740 ImageList_Destroy
• 0x464744 ImageList_Create
• 0x464748 InitCommonControls
Library comdlg32.dll:
• 0x464750 GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.