6.4
高危
56 个模型检测该样本为恶意！
重新分析
更多

fb257efdf56f0513106558a04bc49ef5d35059d9613dcf690f1d9bcb7edb452b

9645d5c96aad3d907d251b17174b8f7d.exe

分析耗时

38s

最近分析

文件大小

673.0KB
静态报毒 动态报毒 100% AGENTTESLA AI SCORE=87 AIDETECTVM ALI2000015 BT3MPN CLASSIC CONFIDENCE CSJVZ DELF DELFINJECT DELPHILESS ELDORADO EMOY FAREIT GENETIC HIGH CONFIDENCE HNDTOP HPLOKI IGENT KCLOUD KRYPTIK MALWARE2 MALWARE@#2ABA1NU2RS5WH QGW@AAFQ5OEI SCORE SMBD SPYBOTNET STATIC AI SUSPICIOUS PE TROJANX TSCOPE TSPY UNSAFE WANNACRY X2094 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FTB!9645D5C96AAD 20201211 6.0.6.653
Baidu 20190318 1.0.0.2
Avast Win32:TrojanX-gen [Trj] 20201210 21.1.5827.0
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
Kingsoft Win32.Troj.Undef.(kcloud) 20201211 2017.9.26.565
Tencent 20201211 1.0.0.1
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)
resource name None
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619793957.915625
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34275140
registers.edi: 0
registers.eax: 0
registers.ebp: 34275208
registers.edx: 5
registers.ebx: 0
registers.esi: 0
registers.ecx: 915
exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 89 c9 89 c9 33 c0 5a 59
exception.symbol: 9645d5c96aad3d907d251b17174b8f7d+0x56027
exception.instruction: div eax
exception.module: 9645d5c96aad3d907d251b17174b8f7d.exe
exception.exception_code: 0xc0000094
exception.offset: 352295
exception.address: 0x456027
success 0 0
1619793963.399875
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75177f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75174de3
9645d5c96aad3d907d251b17174b8f7d+0x54a4d @ 0x454a4d
9645d5c96aad3d907d251b17174b8f7d+0x4d254 @ 0x44d254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdac14ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619793957.712625
NtAllocateVirtualMemory
process_identifier: 3064
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01ea0000
success 0 0
1619793957.915625
NtProtectVirtualMemory
process_identifier: 3064
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 32768
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00456000
success 0 0
1619793957.931625
NtAllocateVirtualMemory
process_identifier: 3064
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f60000
success 0 0
1619793960.164875
NtProtectVirtualMemory
process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619793960.195875
NtAllocateVirtualMemory
process_identifier: 2864
region_size: 393216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01d90000
success 0 0
1619793960.195875
NtAllocateVirtualMemory
process_identifier: 2864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01db0000
success 0 0
1619793960.195875
NtAllocateVirtualMemory
process_identifier: 2864
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00510000
success 0 0
1619793960.195875
NtProtectVirtualMemory
process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 286720
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00512000
success 0 0
1619793961.149875
NtAllocateVirtualMemory
process_identifier: 2864
region_size: 1572864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01f30000
success 0 0
1619793961.149875
NtAllocateVirtualMemory
process_identifier: 2864
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02070000
success 0 0
1619793963.336875
NtProtectVirtualMemory
process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619793963.336875
NtProtectVirtualMemory
process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619793963.336875
NtProtectVirtualMemory
process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619793963.336875
NtProtectVirtualMemory
process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619793963.352875
NtProtectVirtualMemory
process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619793963.352875
NtProtectVirtualMemory
process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619793963.352875
NtProtectVirtualMemory
process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619793963.352875
NtProtectVirtualMemory
process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619793963.352875
NtProtectVirtualMemory
process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619793963.352875
NtProtectVirtualMemory
process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619793963.352875
NtProtectVirtualMemory
process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619793963.352875
NtProtectVirtualMemory
process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619793963.352875
NtProtectVirtualMemory
process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619793963.352875
NtProtectVirtualMemory
process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619793963.352875
NtProtectVirtualMemory
process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619793963.352875
NtProtectVirtualMemory
process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619793963.352875
NtProtectVirtualMemory
process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619793963.352875
NtProtectVirtualMemory
process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619793963.352875
NtProtectVirtualMemory
process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619793963.352875
NtProtectVirtualMemory
process_identifier: 2864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.327017886415285 section {'size_of_data': '0x00041400', 'virtual_address': '0x0006d000', 'entropy': 7.327017886415285, 'name': '.rsrc', 'virtual_size': '0x00041230'} description A section with a high entropy has been found
entropy 0.38839285714285715 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 3064 called NtSetContextThread to modify thread in remote process 2864
Time & API Arguments Status Return Repeated
1619793958.946625
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4864640
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2864
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 3064 resumed a thread in remote process 2864
Time & API Arguments Status Return Repeated
1619793959.868625
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2864
success 0 0
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619793958.728625
CreateProcessInternalW
thread_identifier: 1060
thread_handle: 0x000000fc
process_identifier: 2864
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\9645d5c96aad3d907d251b17174b8f7d.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619793958.728625
NtUnmapViewOfSection
process_identifier: 2864
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619793958.743625
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 2864
commit_size: 675840
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 675840
base_address: 0x00400000
success 0 0
1619793958.946625
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1619793958.946625
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4864640
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2864
success 0 0
1619793959.868625
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2864
success 0 0
File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Delf.FareIt.Gen.7
FireEye Generic.mg.9645d5c96aad3d90
McAfee Fareit-FTB!9645D5C96AAD
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Malware
K7AntiVirus Riskware ( 0040eff71 )
BitDefender Trojan.Delf.FareIt.Gen.7
K7GW Riskware ( 0040eff71 )
Cybereason malicious.846fdb
Cyren W32/Injector.ABY.gen!Eldorado
Symantec Ransom.Wannacry
APEX Malicious
Avast Win32:TrojanX-gen [Trj]
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
Alibaba Trojan:Win32/DelfInject.ali2000015
NANO-Antivirus Trojan.Win32.Kryptik.hndtop
AegisLab Trojan.Win32.Kryptik.4!c
Rising Trojan.Injector!1.C99D (CLASSIC)
Ad-Aware Trojan.Delf.FareIt.Gen.7
Emsisoft Trojan.Delf.FareIt.Gen.7 (B)
Comodo Malware@#2aba1nu2rs5wh
F-Secure Trojan.TR/AD.AgentTesla.csjvz
DrWeb BackDoor.SpyBotNET.25
Zillya Trojan.Injector.Win32.748875
TrendMicro TSPY_HPLOKI.SMBD
McAfee-GW-Edition BehavesLike.Win32.Fareit.jc
Sophos Mal/Generic-S
Avira TR/AD.AgentTesla.csjvz
Antiy-AVL Trojan/Win32.Kryptik
Kingsoft Win32.Troj.Undef.(kcloud)
Microsoft PWS:Win32/Fareit.AQ!MTB
Arcabit Trojan.Delf.FareIt.Gen.7
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
GData Trojan.Delf.FareIt.Gen.7
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2094
Acronis suspicious
BitDefenderTheta Gen:NN.ZelphiF.34670.QGW@aafQ5Oei
ALYac Trojan.Delf.FareIt.Gen.7
MAX malware (ai score=87)
VBA32 TScope.Trojan.Delf
Malwarebytes Trojan.MalPack.DLF
Panda Trj/Genetic.gen
Zoner Trojan.Win32.91489
ESET-NOD32 a variant of Win32/Injector.EMOY
TrendMicro-HouseCall TSPY_HPLOKI.SMBD
Yandex Trojan.Igent.bT3Mpn.60
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x46213c VirtualFree
• 0x462140 VirtualAlloc
• 0x462144 LocalFree
• 0x462148 LocalAlloc
• 0x46214c GetVersion
• 0x462150 GetCurrentThreadId
• 0x46215c VirtualQuery
• 0x462160 WideCharToMultiByte
• 0x462164 MultiByteToWideChar
• 0x462168 lstrlenA
• 0x46216c lstrcpynA
• 0x462170 LoadLibraryExA
• 0x462174 GetThreadLocale
• 0x462178 GetStartupInfoA
• 0x46217c GetProcAddress
• 0x462180 GetModuleHandleA
• 0x462184 GetModuleFileNameA
• 0x462188 GetLocaleInfoA
• 0x46218c GetCommandLineA
• 0x462190 FreeLibrary
• 0x462194 FindFirstFileA
• 0x462198 FindClose
• 0x46219c ExitProcess
• 0x4621a0 WriteFile
• 0x4621a8 RtlUnwind
• 0x4621ac RaiseException
• 0x4621b0 GetStdHandle
Library user32.dll:
• 0x4621b8 GetKeyboardType
• 0x4621bc LoadStringA
• 0x4621c0 MessageBoxA
• 0x4621c4 CharNextA
Library advapi32.dll:
• 0x4621cc RegQueryValueExA
• 0x4621d0 RegOpenKeyExA
• 0x4621d4 RegCloseKey
Library oleaut32.dll:
• 0x4621dc SysFreeString
• 0x4621e0 SysReAllocStringLen
• 0x4621e4 SysAllocStringLen
Library kernel32.dll:
• 0x4621ec TlsSetValue
• 0x4621f0 TlsGetValue
• 0x4621f4 LocalAlloc
• 0x4621f8 GetModuleHandleA
Library advapi32.dll:
• 0x462200 RegQueryValueExA
• 0x462204 RegOpenKeyExA
• 0x462208 RegCloseKey
Library kernel32.dll:
• 0x462210 lstrcpyA
• 0x462214 WriteFile
• 0x462218 WaitForSingleObject
• 0x46221c VirtualQuery
• 0x462220 VirtualProtectEx
• 0x462224 VirtualAlloc
• 0x462228 Sleep
• 0x46222c SizeofResource
• 0x462230 SetThreadLocale
• 0x462234 SetFilePointer
• 0x462238 SetEvent
• 0x46223c SetErrorMode
• 0x462240 SetEndOfFile
• 0x462244 ResetEvent
• 0x462248 ReadFile
• 0x46224c MulDiv
• 0x462250 LockResource
• 0x462254 LoadResource
• 0x462258 LoadLibraryA
• 0x462264 GlobalUnlock
• 0x462268 GlobalReAlloc
• 0x46226c GlobalHandle
• 0x462270 GlobalLock
• 0x462274 GlobalFree
• 0x462278 GlobalFindAtomA
• 0x46227c GlobalDeleteAtom
• 0x462280 GlobalAlloc
• 0x462284 GlobalAddAtomA
• 0x462288 GetVersionExA
• 0x46228c GetVersion
• 0x462290 GetTickCount
• 0x462294 GetThreadLocale
• 0x462298 GetSystemInfo
• 0x46229c GetStringTypeExA
• 0x4622a0 GetStdHandle
• 0x4622a4 GetProcAddress
• 0x4622a8 GetModuleHandleA
• 0x4622ac GetModuleFileNameA
• 0x4622b0 GetLocaleInfoA
• 0x4622b4 GetLocalTime
• 0x4622b8 GetLastError
• 0x4622bc GetFullPathNameA
• 0x4622c0 GetDiskFreeSpaceA
• 0x4622c4 GetDateFormatA
• 0x4622c8 GetCurrentThreadId
• 0x4622cc GetCurrentProcessId
• 0x4622d0 GetCurrentProcess
• 0x4622d4 GetCPInfo
• 0x4622d8 GetACP
• 0x4622dc FreeResource
• 0x4622e0 InterlockedExchange
• 0x4622e4 FreeLibrary
• 0x4622e8 FormatMessageA
• 0x4622ec FindResourceA
• 0x4622f0 EnumCalendarInfoA
• 0x4622fc CreateThread
• 0x462300 CreateFileA
• 0x462304 CreateEventA
• 0x462308 CompareStringA
• 0x46230c CloseHandle
Library version.dll:
• 0x462314 VerQueryValueA
• 0x46231c GetFileVersionInfoA
Library gdi32.dll:
• 0x462324 UnrealizeObject
• 0x462328 StretchBlt
• 0x46232c SetWindowOrgEx
• 0x462330 SetViewportOrgEx
• 0x462334 SetTextColor
• 0x462338 SetStretchBltMode
• 0x46233c SetROP2
• 0x462340 SetPixel
• 0x462344 SetDIBColorTable
• 0x462348 SetBrushOrgEx
• 0x46234c SetBkMode
• 0x462350 SetBkColor
• 0x462354 SelectPalette
• 0x462358 SelectObject
• 0x46235c SelectClipRgn
• 0x462360 SaveDC
• 0x462364 RestoreDC
• 0x462368 Rectangle
• 0x46236c RectVisible
• 0x462370 RealizePalette
• 0x462374 PatBlt
• 0x462378 MoveToEx
• 0x46237c MaskBlt
• 0x462380 LineTo
• 0x462384 IntersectClipRect
• 0x462388 GetWindowOrgEx
• 0x46238c GetTextMetricsA
• 0x462398 GetStockObject
• 0x46239c GetPixel
• 0x4623a0 GetPaletteEntries
• 0x4623a4 GetObjectA
• 0x4623a8 GetDeviceCaps
• 0x4623ac GetDIBits
• 0x4623b0 GetDIBColorTable
• 0x4623b4 GetDCOrgEx
• 0x4623bc GetClipBox
• 0x4623c0 GetBrushOrgEx
• 0x4623c4 GetBitmapBits
• 0x4623c8 ExcludeClipRect
• 0x4623cc DeleteObject
• 0x4623d0 DeleteDC
• 0x4623d4 CreateSolidBrush
• 0x4623d8 CreatePenIndirect
• 0x4623dc CreatePalette
• 0x4623e4 CreateFontIndirectA
• 0x4623e8 CreateDIBitmap
• 0x4623ec CreateDIBSection
• 0x4623f0 CreateCompatibleDC
• 0x4623f8 CreateBrushIndirect
• 0x4623fc CreateBitmap
• 0x462400 BitBlt
Library user32.dll:
• 0x462408 CreateWindowExA
• 0x46240c WindowFromPoint
• 0x462410 WinHelpA
• 0x462414 WaitMessage
• 0x462418 UpdateWindow
• 0x46241c UnregisterClassA
• 0x462420 UnhookWindowsHookEx
• 0x462424 TranslateMessage
• 0x46242c TrackPopupMenu
• 0x462434 ShowWindow
• 0x462438 ShowScrollBar
• 0x46243c ShowOwnedPopups
• 0x462440 ShowCursor
• 0x462444 SetWindowsHookExA
• 0x462448 SetWindowPos
• 0x46244c SetWindowPlacement
• 0x462450 SetWindowLongA
• 0x462454 SetTimer
• 0x462458 SetScrollRange
• 0x46245c SetScrollPos
• 0x462460 SetScrollInfo
• 0x462464 SetRect
• 0x462468 SetPropA
• 0x46246c SetParent
• 0x462470 SetMenuItemInfoA
• 0x462474 SetMenu
• 0x462478 SetForegroundWindow
• 0x46247c SetFocus
• 0x462480 SetCursor
• 0x462484 SetClassLongA
• 0x462488 SetCapture
• 0x46248c SetActiveWindow
• 0x462490 SendMessageA
• 0x462494 ScrollWindow
• 0x462498 ScreenToClient
• 0x46249c RemovePropA
• 0x4624a0 RemoveMenu
• 0x4624a4 ReleaseDC
• 0x4624a8 ReleaseCapture
• 0x4624b4 RegisterClassA
• 0x4624b8 RedrawWindow
• 0x4624bc PtInRect
• 0x4624c0 PostQuitMessage
• 0x4624c4 PostMessageA
• 0x4624c8 PeekMessageA
• 0x4624cc OffsetRect
• 0x4624d0 OemToCharA
• 0x4624d4 MessageBoxA
• 0x4624d8 MapWindowPoints
• 0x4624dc MapVirtualKeyA
• 0x4624e0 LoadStringA
• 0x4624e4 LoadKeyboardLayoutA
• 0x4624e8 LoadIconA
• 0x4624ec LoadCursorA
• 0x4624f0 LoadBitmapA
• 0x4624f4 KillTimer
• 0x4624f8 IsZoomed
• 0x4624fc IsWindowVisible
• 0x462500 IsWindowEnabled
• 0x462504 IsWindow
• 0x462508 IsRectEmpty
• 0x46250c IsIconic
• 0x462510 IsDialogMessageA
• 0x462514 IsChild
• 0x462518 InvalidateRect
• 0x46251c IntersectRect
• 0x462520 InsertMenuItemA
• 0x462524 InsertMenuA
• 0x462528 InflateRect
• 0x462530 GetWindowTextA
• 0x462534 GetWindowRect
• 0x462538 GetWindowPlacement
• 0x46253c GetWindowLongA
• 0x462540 GetWindowDC
• 0x462544 GetTopWindow
• 0x462548 GetSystemMetrics
• 0x46254c GetSystemMenu
• 0x462550 GetSysColorBrush
• 0x462554 GetSysColor
• 0x462558 GetSubMenu
• 0x46255c GetScrollRange
• 0x462560 GetScrollPos
• 0x462564 GetScrollInfo
• 0x462568 GetPropA
• 0x46256c GetParent
• 0x462570 GetWindow
• 0x462574 GetMenuStringA
• 0x462578 GetMenuState
• 0x46257c GetMenuItemInfoA
• 0x462580 GetMenuItemID
• 0x462584 GetMenuItemCount
• 0x462588 GetMenu
• 0x46258c GetLastActivePopup
• 0x462590 GetKeyboardState
• 0x462598 GetKeyboardLayout
• 0x46259c GetKeyState
• 0x4625a0 GetKeyNameTextA
• 0x4625a4 GetIconInfo
• 0x4625a8 GetForegroundWindow
• 0x4625ac GetFocus
• 0x4625b0 GetDesktopWindow
• 0x4625b4 GetDCEx
• 0x4625b8 GetDC
• 0x4625bc GetCursorPos
• 0x4625c0 GetCursor
• 0x4625c4 GetClientRect
• 0x4625c8 GetClassNameA
• 0x4625cc GetClassInfoA
• 0x4625d0 GetCapture
• 0x4625d4 GetActiveWindow
• 0x4625d8 FrameRect
• 0x4625dc FindWindowA
• 0x4625e0 FillRect
• 0x4625e4 EqualRect
• 0x4625e8 EnumWindows
• 0x4625ec EnumThreadWindows
• 0x4625f0 EndPaint
• 0x4625f4 EnableWindow
• 0x4625f8 EnableScrollBar
• 0x4625fc EnableMenuItem
• 0x462600 DrawTextA
• 0x462604 DrawMenuBar
• 0x462608 DrawIconEx
• 0x46260c DrawIcon
• 0x462610 DrawFrameControl
• 0x462614 DrawEdge
• 0x462618 DispatchMessageA
• 0x46261c DestroyWindow
• 0x462620 DestroyMenu
• 0x462624 DestroyIcon
• 0x462628 DestroyCursor
• 0x46262c DeleteMenu
• 0x462630 DefWindowProcA
• 0x462634 DefMDIChildProcA
• 0x462638 DefFrameProcA
• 0x46263c CreatePopupMenu
• 0x462640 CreateMenu
• 0x462644 CreateIcon
• 0x462648 ClientToScreen
• 0x46264c CheckMenuItem
• 0x462650 CallWindowProcA
• 0x462654 CallNextHookEx
• 0x462658 BringWindowToTop
• 0x46265c BeginPaint
• 0x462660 CharNextA
• 0x462664 CharLowerA
• 0x462668 CharToOemA
• 0x46266c AdjustWindowRectEx
Library kernel32.dll:
• 0x462678 Sleep
Library oleaut32.dll:
• 0x462680 SafeArrayPtrOfIndex
• 0x462684 SafeArrayGetUBound
• 0x462688 SafeArrayGetLBound
• 0x46268c SafeArrayCreate
• 0x462690 VariantChangeType
• 0x462694 VariantCopy
• 0x462698 VariantClear
• 0x46269c VariantInit
Library comctl32.dll:
• 0x4626ac ImageList_Write
• 0x4626b0 ImageList_Read
• 0x4626c0 ImageList_DragMove
• 0x4626c4 ImageList_DragLeave
• 0x4626c8 ImageList_DragEnter
• 0x4626cc ImageList_EndDrag
• 0x4626d0 ImageList_BeginDrag
• 0x4626d4 ImageList_Remove
• 0x4626d8 ImageList_DrawEx
• 0x4626dc ImageList_Draw
• 0x4626ec ImageList_Add
• 0x4626f4 ImageList_Destroy
• 0x4626f8 ImageList_Create
• 0x4626fc InitCommonControls
Library comdlg32.dll:
• 0x462704 ReplaceTextA
• 0x462708 FindTextA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50003 239.255.255.250 3702
192.168.56.101 50005 239.255.255.250 3702
192.168.56.101 51966 239.255.255.250 1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.