5.8
高危
57 个模型检测该样本为恶意！
重新分析
更多

abe3b715d6cdbdee68f7fa07dcc3adec8d247a7729af88c782d0282e9cf4d7ac

977739767e9e846d48ac30f116ca87e7.exe

分析耗时

32s

最近分析

文件大小

938.0KB
静态报毒 动态报毒 100% 6GW@A4PLSPDI 7CMLIJSQLLK AGEN AGENSLA AI SCORE=87 ALI2000015 CLASSIC CONFIDENCE DELFINJECT DELPHILESS ELFW ELHY FAREIT GENASA GENERICKD HIAOGL HIGH CONFIDENCE KPOT LOKI MALICIOUS PE MALWARE@#3V3JCBY3JJWKV R + MAL SALX SCORE SIGGEN9 SMDF STATIC AI SUSGEN UNSAFE WACATAC X2059 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FRQ!977739767E9E 20201229 6.0.6.653
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20201229 21.1.5827.0
Kingsoft 20201229 2017.9.26.565
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619803063.434626
__exception__
stacktrace: 
977739767e9e846d48ac30f116ca87e7+0x6c1b4 @ 0x46c1b4
977739767e9e846d48ac30f116ca87e7+0x3d4f @ 0x403d4f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637912
registers.edi: 4637160
registers.eax: 0
registers.ebp: 1638204
registers.edx: 2130566132
registers.ebx: 0
registers.esi: 72
registers.ecx: 3353673728
exception.instruction_r: f7 f0 90 90 90 90 33 c0 5a 59 59 64 89 10 eb 13
exception.symbol: 977739767e9e846d48ac30f116ca87e7+0x6bf86
exception.instruction: div eax
exception.module: 977739767e9e846d48ac30f116ca87e7.exe
exception.exception_code: 0xc0000094
exception.offset: 442246
exception.address: 0x46bf86
success 0 0
1619803067.747249
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75157f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75154de3
977739767e9e846d48ac30f116ca87e7+0x58a4d @ 0x458a4d
977739767e9e846d48ac30f116ca87e7+0x51254 @ 0x451254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfea414ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (29 个事件)
Time & API Arguments Status Return Repeated
1619803062.527626
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003f0000
success 0 0
1619803063.699626
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 28672
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x005f0000
success 0 0
1619803063.715626
NtAllocateVirtualMemory
process_identifier: 2984
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00610000
success 0 0
1619803064.810249
NtAllocateVirtualMemory
process_identifier: 2732
region_size: 262144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x003c0000
success 0 0
1619803064.810249
NtAllocateVirtualMemory
process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003c0000
success 0 0
1619803064.810249
NtAllocateVirtualMemory
process_identifier: 2732
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01e00000
success 0 0
1619803064.872249
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 299008
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e02000
success 0 0
1619803066.247249
NtAllocateVirtualMemory
process_identifier: 2732
region_size: 1835008
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02040000
success 0 0
1619803066.247249
NtAllocateVirtualMemory
process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x021c0000
success 0 0
1619803067.669249
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f32000
success 0 0
1619803067.669249
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619803067.685249
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f32000
success 0 0
1619803067.685249
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619803067.685249
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f32000
success 0 0
1619803067.685249
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619803067.685249
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f32000
success 0 0
1619803067.685249
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619803067.685249
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f32000
success 0 0
1619803067.685249
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619803067.685249
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f32000
success 0 0
1619803067.685249
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619803067.685249
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f32000
success 0 0
1619803067.685249
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619803067.685249
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f32000
success 0 0
1619803067.685249
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619803067.685249
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f32000
success 0 0
1619803067.685249
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619803067.700249
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f32000
success 0 0
1619803067.700249
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.374541156101748 section {'size_of_data': '0x0006a000', 'virtual_address': '0x00086000', 'entropy': 7.374541156101748, 'name': '.rsrc', 'virtual_size': '0x00069e98'} description A section with a high entropy has been found
entropy 0.45250800426894344 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2984 called NtSetContextThread to modify thread in remote process 2732
Time & API Arguments Status Return Repeated
1619803063.934626
NtSetContextThread
thread_handle: 0x00000100
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4526783
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2732
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2984 resumed a thread in remote process 2732
Time & API Arguments Status Return Repeated
1619803064.496626
NtResumeThread
thread_handle: 0x00000100
suspend_count: 1
process_identifier: 2732
success 0 0
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619803063.871626
CreateProcessInternalW
thread_identifier: 912
thread_handle: 0x00000100
process_identifier: 2732
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\977739767e9e846d48ac30f116ca87e7.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000104
inherit_handles: 0
success 1 0
1619803063.871626
NtUnmapViewOfSection
process_identifier: 2732
region_size: 4096
process_handle: 0x00000104
base_address: 0x00400000
success 0 0
1619803063.871626
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 2732
commit_size: 692224
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000104
allocation_type: 0 ()
section_offset: 0
view_size: 692224
base_address: 0x00400000
success 0 0
1619803063.934626
NtGetContextThread
thread_handle: 0x00000100
success 0 0
1619803063.934626
NtSetContextThread
thread_handle: 0x00000100
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4526783
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2732
success 0 0
1619803064.496626
NtResumeThread
thread_handle: 0x00000100
suspend_count: 1
process_identifier: 2732
success 0 0
File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.42912934
McAfee Fareit-FRQ!977739767E9E
Cylance Unsafe
Sangfor Malware
K7AntiVirus Trojan ( 00564aec1 )
Alibaba Trojan:Win32/DelfInject.ali2000015
K7GW Trojan ( 00564aec1 )
Cybereason malicious.67e9e8
Arcabit Trojan.Generic.D28ECCA6
BitDefenderTheta Gen:NN.ZelphiF.34700.6GW@a4pLspdi
Cyren W32/Injector.SALX-1519
Symantec Trojan.Gen.2
APEX Malicious
Avast Win32:Trojan-gen
Kaspersky HEUR:Trojan-PSW.Win32.Agensla.gen
BitDefender Trojan.GenericKD.42912934
NANO-Antivirus Trojan.Win32.Agensla.hiaogl
Paloalto generic.ml
Ad-Aware Trojan.GenericKD.42912934
Emsisoft Trojan.GenericKD.42912934 (B)
Comodo Malware@#3v3jcby3jjwkv
F-Secure Heuristic.HEUR/AGEN.1133373
DrWeb Trojan.Siggen9.32093
VIPRE Trojan.Win32.Generic!BT
TrendMicro TrojanSpy.Win32.LOKI.SMDF.hp
McAfee-GW-Edition BehavesLike.Win32.Fareit.dc
FireEye Generic.mg.977739767e9e846d
Sophos Mal/Generic-R + Mal/Fareit-V
SentinelOne Static AI - Malicious PE
Jiangmin Trojan.PSW.Agensla.fg
eGambit Unsafe.AI_Score_99%
Avira HEUR/AGEN.1133373
MAX malware (ai score=87)
Antiy-AVL Trojan[PSW]/Win32.Agensla
Gridinsoft Ransom.Win32.Wacatac.vb
Microsoft Trojan:Win32/Kpot.PA!MTB
AegisLab Trojan.Win32.Malicious.4!c
ZoneAlarm HEUR:Trojan-PSW.Win32.Agensla.gen
GData Trojan.GenericKD.42912934
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2059
Acronis suspicious
VBA32 Trojan.Wacatac
ALYac Trojan.GenericKD.42912934
Malwarebytes Trojan.MalPack.DLF
ESET-NOD32 a variant of Win32/Injector.ELHY
TrendMicro-HouseCall TrojanSpy.Win32.LOKI.SMDF.hp
Rising Trojan.Injector!1.AFE3 (CLASSIC)
Yandex Trojan.GenAsa!7cMlIjsqLlk
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x479178 VirtualFree
• 0x47917c VirtualAlloc
• 0x479180 LocalFree
• 0x479184 LocalAlloc
• 0x479188 GetVersion
• 0x47918c GetCurrentThreadId
• 0x479198 VirtualQuery
• 0x47919c WideCharToMultiByte
• 0x4791a4 MultiByteToWideChar
• 0x4791a8 lstrlenA
• 0x4791ac lstrcpynA
• 0x4791b0 LoadLibraryExA
• 0x4791b4 GetThreadLocale
• 0x4791b8 GetStartupInfoA
• 0x4791bc GetProcAddress
• 0x4791c0 GetModuleHandleA
• 0x4791c4 GetModuleFileNameA
• 0x4791c8 GetLocaleInfoA
• 0x4791cc GetLastError
• 0x4791d4 GetCommandLineA
• 0x4791d8 FreeLibrary
• 0x4791dc FindFirstFileA
• 0x4791e0 FindClose
• 0x4791e4 ExitProcess
• 0x4791e8 WriteFile
• 0x4791f0 RtlUnwind
• 0x4791f4 RaiseException
• 0x4791f8 GetStdHandle
Library user32.dll:
• 0x479200 GetKeyboardType
• 0x479204 LoadStringA
• 0x479208 MessageBoxA
• 0x47920c CharNextA
Library advapi32.dll:
• 0x479214 RegQueryValueExA
• 0x479218 RegOpenKeyExA
• 0x47921c RegCloseKey
Library oleaut32.dll:
• 0x479224 SysFreeString
• 0x479228 SysReAllocStringLen
• 0x47922c SysAllocStringLen
Library kernel32.dll:
• 0x479234 TlsSetValue
• 0x479238 TlsGetValue
• 0x47923c LocalAlloc
• 0x479240 GetModuleHandleA
Library advapi32.dll:
• 0x479248 RegQueryValueExA
• 0x47924c RegOpenKeyExA
• 0x479250 RegCloseKey
Library kernel32.dll:
• 0x479258 lstrcpyA
• 0x47925c WriteFile
• 0x479260 WaitForSingleObject
• 0x479264 VirtualQuery
• 0x479268 VirtualFree
• 0x47926c VirtualAllocEx
• 0x479270 VirtualAlloc
• 0x479274 Sleep
• 0x479278 SizeofResource
• 0x47927c SetThreadLocale
• 0x479280 SetFilePointer
• 0x479284 SetEvent
• 0x479288 SetErrorMode
• 0x47928c SetEndOfFile
• 0x479290 ResetEvent
• 0x479294 ReadFile
• 0x479298 MultiByteToWideChar
• 0x47929c MulDiv
• 0x4792a0 LockResource
• 0x4792a4 LoadResource
• 0x4792a8 LoadLibraryA
• 0x4792b4 GlobalUnlock
• 0x4792b8 GlobalSize
• 0x4792bc GlobalReAlloc
• 0x4792c0 GlobalHandle
• 0x4792c4 GlobalLock
• 0x4792c8 GlobalFree
• 0x4792cc GlobalFindAtomA
• 0x4792d0 GlobalDeleteAtom
• 0x4792d4 GlobalAlloc
• 0x4792d8 GlobalAddAtomA
• 0x4792dc GetVersionExA
• 0x4792e0 GetVersion
• 0x4792e4 GetUserDefaultLCID
• 0x4792e8 GetTickCount
• 0x4792ec GetThreadLocale
• 0x4792f0 GetSystemInfo
• 0x4792f4 GetStringTypeExA
• 0x4792f8 GetStdHandle
• 0x4792fc GetProcAddress
• 0x479300 GetModuleHandleA
• 0x479304 GetModuleFileNameA
• 0x479308 GetLocaleInfoA
• 0x47930c GetLocalTime
• 0x479310 GetLastError
• 0x479314 GetFullPathNameA
• 0x479318 GetDiskFreeSpaceA
• 0x47931c GetDateFormatA
• 0x479320 GetCurrentThreadId
• 0x479324 GetCurrentProcessId
• 0x479328 GetCurrentProcess
• 0x47932c GetComputerNameA
• 0x479330 GetCPInfo
• 0x479334 GetACP
• 0x479338 FreeResource
• 0x47933c InterlockedExchange
• 0x479340 FreeLibrary
• 0x479344 FormatMessageA
• 0x479348 FindResourceA
• 0x47934c FindNextFileA
• 0x479350 FindFirstFileA
• 0x479354 FindClose
• 0x479360 EnumCalendarInfoA
• 0x47936c CreateThread
• 0x479370 CreateFileA
• 0x479374 CreateEventA
• 0x479378 CompareStringA
• 0x47937c CloseHandle
Library version.dll:
• 0x479384 VerQueryValueA
• 0x47938c GetFileVersionInfoA
Library gdi32.dll:
• 0x479394 UnrealizeObject
• 0x479398 StretchBlt
• 0x47939c SetWindowOrgEx
• 0x4793a0 SetWindowExtEx
• 0x4793a4 SetWinMetaFileBits
• 0x4793a8 SetViewportOrgEx
• 0x4793ac SetViewportExtEx
• 0x4793b0 SetTextColor
• 0x4793b4 SetStretchBltMode
• 0x4793b8 SetROP2
• 0x4793bc SetPixel
• 0x4793c0 SetMapMode
• 0x4793c4 SetEnhMetaFileBits
• 0x4793c8 SetDIBColorTable
• 0x4793cc SetBrushOrgEx
• 0x4793d0 SetBkMode
• 0x4793d4 SetBkColor
• 0x4793d8 SelectPalette
• 0x4793dc SelectObject
• 0x4793e0 SaveDC
• 0x4793e4 RestoreDC
• 0x4793e8 RectVisible
• 0x4793ec RealizePalette
• 0x4793f0 PolyPolyline
• 0x4793f4 PlayEnhMetaFile
• 0x4793f8 PatBlt
• 0x4793fc MoveToEx
• 0x479400 MaskBlt
• 0x479404 LineTo
• 0x479408 LPtoDP
• 0x47940c IntersectClipRect
• 0x479410 GetWindowOrgEx
• 0x479414 GetWinMetaFileBits
• 0x479418 GetTextMetricsA
• 0x479424 GetStockObject
• 0x479428 GetPixel
• 0x47942c GetPaletteEntries
• 0x479430 GetObjectA
• 0x479440 GetEnhMetaFileBits
• 0x479444 GetDeviceCaps
• 0x479448 GetDIBits
• 0x47944c GetDIBColorTable
• 0x479450 GetDCOrgEx
• 0x479458 GetClipBox
• 0x47945c GetBrushOrgEx
• 0x479460 GetBitmapBits
• 0x479464 ExtCreatePen
• 0x479468 ExcludeClipRect
• 0x47946c DeleteObject
• 0x479470 DeleteEnhMetaFile
• 0x479474 DeleteDC
• 0x479478 CreateSolidBrush
• 0x47947c CreatePenIndirect
• 0x479480 CreatePalette
• 0x479488 CreateFontIndirectA
• 0x47948c CreateEnhMetaFileA
• 0x479490 CreateDIBitmap
• 0x479494 CreateDIBSection
• 0x479498 CreateCompatibleDC
• 0x4794a0 CreateBrushIndirect
• 0x4794a4 CreateBitmap
• 0x4794a8 CopyEnhMetaFileA
• 0x4794ac CloseEnhMetaFile
• 0x4794b0 BitBlt
Library opengl32.dll:
• 0x4794b8 wglDeleteContext
Library user32.dll:
• 0x4794c0 CreateWindowExA
• 0x4794c4 WindowFromPoint
• 0x4794c8 WinHelpA
• 0x4794cc WaitMessage
• 0x4794d0 ValidateRect
• 0x4794d4 UpdateWindow
• 0x4794d8 UnregisterClassA
• 0x4794dc UnionRect
• 0x4794e0 UnhookWindowsHookEx
• 0x4794e4 TranslateMessage
• 0x4794ec TrackPopupMenu
• 0x4794f4 ShowWindow
• 0x4794f8 ShowScrollBar
• 0x4794fc ShowOwnedPopups
• 0x479500 ShowCursor
• 0x479504 SetWindowsHookExA
• 0x479508 SetWindowTextA
• 0x47950c SetWindowPos
• 0x479510 SetWindowPlacement
• 0x479514 SetWindowLongA
• 0x479518 SetTimer
• 0x47951c SetScrollRange
• 0x479520 SetScrollPos
• 0x479524 SetScrollInfo
• 0x479528 SetRect
• 0x47952c SetPropA
• 0x479530 SetParent
• 0x479534 SetMenuItemInfoA
• 0x479538 SetMenu
• 0x47953c SetKeyboardState
• 0x479540 SetForegroundWindow
• 0x479544 SetFocus
• 0x479548 SetCursor
• 0x47954c SetClipboardData
• 0x479550 SetClassLongA
• 0x479554 SetCapture
• 0x479558 SetActiveWindow
• 0x47955c SendMessageA
• 0x479560 ScrollWindowEx
• 0x479564 ScrollWindow
• 0x479568 ScreenToClient
• 0x47956c RemovePropA
• 0x479570 RemoveMenu
• 0x479574 ReleaseDC
• 0x479578 ReleaseCapture
• 0x479584 RegisterClassA
• 0x479588 RedrawWindow
• 0x47958c PtInRect
• 0x479590 PostQuitMessage
• 0x479594 PostMessageA
• 0x479598 PeekMessageA
• 0x47959c OpenClipboard
• 0x4795a0 OffsetRect
• 0x4795a4 OemToCharA
• 0x4795a8 MessageBoxA
• 0x4795ac MessageBeep
• 0x4795b0 MapWindowPoints
• 0x4795b4 MapVirtualKeyA
• 0x4795b8 LoadStringA
• 0x4795bc LoadKeyboardLayoutA
• 0x4795c0 LoadIconA
• 0x4795c4 LoadCursorA
• 0x4795c8 LoadBitmapA
• 0x4795cc KillTimer
• 0x4795d0 IsZoomed
• 0x4795d4 IsWindowVisible
• 0x4795d8 IsWindowEnabled
• 0x4795dc IsWindow
• 0x4795e0 IsRectEmpty
• 0x4795e4 IsIconic
• 0x4795e8 IsDialogMessageA
• 0x4795ec IsChild
• 0x4795f0 IsCharAlphaNumericA
• 0x4795f4 IsCharAlphaA
• 0x4795f8 InvalidateRect
• 0x4795fc IntersectRect
• 0x479600 InsertMenuItemA
• 0x479604 InsertMenuA
• 0x479608 InflateRect
• 0x479610 GetWindowTextA
• 0x479614 GetWindowRect
• 0x479618 GetWindowPlacement
• 0x47961c GetWindowLongA
• 0x479620 GetWindowDC
• 0x479624 GetTopWindow
• 0x479628 GetSystemMetrics
• 0x47962c GetSystemMenu
• 0x479630 GetSysColorBrush
• 0x479634 GetSysColor
• 0x479638 GetSubMenu
• 0x47963c GetScrollRange
• 0x479640 GetScrollPos
• 0x479644 GetScrollInfo
• 0x479648 GetPropA
• 0x47964c GetParent
• 0x479650 GetWindow
• 0x479654 GetMessageTime
• 0x479658 GetMenuStringA
• 0x47965c GetMenuState
• 0x479660 GetMenuItemInfoA
• 0x479664 GetMenuItemID
• 0x479668 GetMenuItemCount
• 0x47966c GetMenu
• 0x479670 GetLastActivePopup
• 0x479674 GetKeyboardState
• 0x47967c GetKeyboardLayout
• 0x479680 GetKeyState
• 0x479684 GetKeyNameTextA
• 0x479688 GetIconInfo
• 0x47968c GetForegroundWindow
• 0x479690 GetFocus
• 0x479694 GetDoubleClickTime
• 0x479698 GetDesktopWindow
• 0x47969c GetDCEx
• 0x4796a0 GetDC
• 0x4796a4 GetCursorPos
• 0x4796a8 GetCursor
• 0x4796ac GetClipboardData
• 0x4796b0 GetClientRect
• 0x4796b4 GetClassNameA
• 0x4796b8 GetClassInfoA
• 0x4796bc GetCaretPos
• 0x4796c0 GetCapture
• 0x4796c4 GetActiveWindow
• 0x4796c8 FrameRect
• 0x4796cc FindWindowA
• 0x4796d0 FillRect
• 0x4796d4 EqualRect
• 0x4796d8 EnumWindows
• 0x4796dc EnumThreadWindows
• 0x4796e4 EndPaint
• 0x4796e8 EnableWindow
• 0x4796ec EnableScrollBar
• 0x4796f0 EnableMenuItem
• 0x4796f4 EmptyClipboard
• 0x4796f8 DrawTextA
• 0x4796fc DrawMenuBar
• 0x479700 DrawIconEx
• 0x479704 DrawIcon
• 0x479708 DrawFrameControl
• 0x47970c DrawFocusRect
• 0x479710 DrawEdge
• 0x479714 DispatchMessageA
• 0x479718 DestroyWindow
• 0x47971c DestroyMenu
• 0x479720 DestroyIcon
• 0x479724 DestroyCursor
• 0x479728 DeleteMenu
• 0x47972c DefWindowProcA
• 0x479730 DefMDIChildProcA
• 0x479734 DefFrameProcA
• 0x479738 CreatePopupMenu
• 0x47973c CreateMenu
• 0x479740 CreateIcon
• 0x479744 CloseClipboard
• 0x479748 ClientToScreen
• 0x47974c CheckMenuItem
• 0x479750 CallWindowProcA
• 0x479754 CallNextHookEx
• 0x479758 BeginPaint
• 0x47975c CharNextA
• 0x479760 CharLowerBuffA
• 0x479764 CharLowerA
• 0x479768 CharUpperBuffA
• 0x47976c CharToOemA
• 0x479770 AdjustWindowRectEx
Library kernel32.dll:
• 0x47977c Sleep
Library oleaut32.dll:
• 0x479784 SafeArrayPtrOfIndex
• 0x479788 SafeArrayGetUBound
• 0x47978c SafeArrayGetLBound
• 0x479790 SafeArrayCreate
• 0x479794 VariantChangeType
• 0x479798 VariantCopy
• 0x47979c VariantClear
• 0x4797a0 VariantInit
Library ole32.dll:
• 0x4797ac IsAccelerator
• 0x4797b0 OleDraw
• 0x4797b8 CoTaskMemFree
• 0x4797bc ProgIDFromCLSID
• 0x4797c0 StringFromCLSID
• 0x4797c4 CoCreateInstance
• 0x4797c8 CoGetClassObject
• 0x4797cc CoUninitialize
• 0x4797d0 CoInitialize
• 0x4797d4 IsEqualGUID
Library oleaut32.dll:
• 0x4797dc GetErrorInfo
• 0x4797e0 GetActiveObject
• 0x4797e4 SysFreeString
Library comctl32.dll:
• 0x4797f4 ImageList_Write
• 0x4797f8 ImageList_Read
• 0x479808 ImageList_DragMove
• 0x47980c ImageList_DragLeave
• 0x479810 ImageList_DragEnter
• 0x479814 ImageList_EndDrag
• 0x479818 ImageList_BeginDrag
• 0x47981c ImageList_Remove
• 0x479820 ImageList_DrawEx
• 0x479824 ImageList_Draw
• 0x479834 ImageList_Add
• 0x47983c ImageList_Destroy
• 0x479840 ImageList_Create
Library kernel32.dll:
• 0x479848 MulDiv

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50003 239.255.255.250 3702
192.168.56.101 50005 239.255.255.250 3702
192.168.56.101 58368 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.