7.0
高危
58 个模型检测该样本为恶意！
重新分析
更多

8c5dbc066a5c278653b42be8664fc8c77dee1e3c154ddd91614385e7cf390d83

9ca4ddf20851b6b64269c467f0466e22.exe

分析耗时

81s

最近分析

文件大小

448.0KB
静态报毒 动态报毒 AI SCORE=83 AIDETECTVM BSCOPE CLASSIC CONFIDENCE CQ0@AOW395EB DOWNLOADER34 ELDORADO EMOTET GENCIRC GENERICKDZ GENETIC HCEJ HIGH CONFIDENCE HSEZKH KRYPTIK MALWARE2 NDYYA NONAME@0 R + TROJ R347905 SCORE SUSGEN THHAFBO UNSAFE ZEXAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Emotet-FRV!9CA4DDF20851 20200913 6.0.6.653
Alibaba Trojan:Win32/Emotet.abcb1b6f 20190527 0.3.0.5
Avast 20200914 18.4.3895.0
Baidu 20190318 1.0.0.2
Kingsoft 20200913 2013.8.14.323
Tencent Malware.Win32.Gencirc.10cde817 20200913 1.0.0.1
CrowdStrike win/malicious_confidence_60% (W) 20190702 1.0
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1619793167.848875
GetComputerNameA
computer_name: OSKAR-PC
success 1 0
Uses Windows APIs to generate a cryptographic key (4 个事件)
Time & API Arguments Status Return Repeated
1619793158.223875
CryptGenKey
crypto_handle: 0x003579e0
algorithm_identifier: 0x0000660e ()
provider_handle: 0x00356f08
flags: 1
key: fIQSœ&èÁ¶W<'Ì7
success 1 0
1619793167.879875
CryptExportKey
crypto_handle: 0x003579e0
crypto_export_handle: 0x00356ec8
buffer: f¤jÉ}‹’DìÍTþQû±Ö·æÉiûŸeŸn»ûÃ#Ó\û/Pb¶0í¾61ßløi¡¯iÇ œèåQõ FžBO‡K§úmáu÷]ۉc97åc«Q'¸”ª¹ŸìzYx¢?
blob_type: 1
flags: 64
success 1 0
1619793204.067875
CryptExportKey
crypto_handle: 0x003579e0
crypto_export_handle: 0x00356ec8
buffer: f¤>@è=£yÈÀSNë=Jzä3T„BAyã•z\ŸÜÿÛû¶ýis­é–|Ùµ[ø®yÓíÌí?ynŸ¥³f#Í0ÿþœçË®ÂNS7@A•²ºÅù)ú“ Ž
blob_type: 1
flags: 64
success 1 0
1619793209.489875
CryptExportKey
crypto_handle: 0x003579e0
crypto_export_handle: 0x00356ec8
buffer: f¤bxANy¹ˆ©¦ ÙY,7Љ•½äÜ3–¡ÚÌ>-\Îé‹}ºKT°d- w£0Óòӓy²=s…³fßRóÐiD©þî붤߃?­Z0‡ŽKv]¢;¡“ê1V,"‡
blob_type: 1
flags: 64
success 1 0
The executable uses a known packer (1 个事件)
packer Armadillo v1.71
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (1 个事件)
Time & API Arguments Status Return Repeated
1619793157.582875
NtAllocateVirtualMemory
process_identifier: 2144
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02010000
success 0 0
Foreign language identified in PE resource (33 个事件)
name RT_CURSOR language LANG_CHINESE offset 0x00072c80 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x000000b4
name RT_CURSOR language LANG_CHINESE offset 0x00072c80 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x000000b4
name RT_BITMAP language LANG_CHINESE offset 0x00073658 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000144
name RT_BITMAP language LANG_CHINESE offset 0x00073658 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000144
name RT_BITMAP language LANG_CHINESE offset 0x00073658 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000144
name RT_BITMAP language LANG_CHINESE offset 0x00073658 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000144
name RT_ICON language LANG_CHINESE offset 0x00069a78 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x00069a78 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x00069a78 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x00069a78 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x00069a78 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x00069a78 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x00069a78 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x00069a78 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_DIALOG language LANG_CHINESE offset 0x00073348 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x000000e2
name RT_DIALOG language LANG_CHINESE offset 0x00073348 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x000000e2
name RT_DIALOG language LANG_CHINESE offset 0x00073348 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x000000e2
name RT_STRING language LANG_CHINESE offset 0x000740c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x000740c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x000740c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x000740c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x000740c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x000740c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x000740c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x000740c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x000740c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x000740c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x000740c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x000740c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_RCDATA language LANG_CHINESE offset 0x00069f58 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00008344
name RT_GROUP_CURSOR language LANG_CHINESE offset 0x00072d38 filetype Lotus unknown worksheet or configuration, revision 0x2 sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000022
name RT_GROUP_ICON language LANG_CHINESE offset 0x00069ee0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000076
name RT_VERSION language LANG_CHINESE offset 0x00072848 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000300
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 个事件)
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619793168.551875
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
Expresses interest in specific running processes (1 个事件)
process 9ca4ddf20851b6b64269c467f0466e22.exe
Reads the systems User Agent and subsequently performs requests (1 个事件)
Time & API Arguments Status Return Repeated
1619793168.098875
InternetOpenW
proxy_bypass:
access_type: 0
proxy_name:
flags: 0
user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
success 13369348 0
网络通信
Communicates with host for which no DNS query was performed (4 个事件)
host 172.217.24.14
host 67.205.85.243
host 69.30.203.214
host 75.139.38.211
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)
Time & API Arguments Status Return Repeated
1619793171.114875
RegSetValueExA
key_handle: 0x000003c8
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619793171.114875
RegSetValueExA
key_handle: 0x000003c8
value:  g•¦=×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619793171.114875
RegSetValueExA
key_handle: 0x000003c8
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619793171.114875
RegSetValueExW
key_handle: 0x000003c8
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619793171.114875
RegSetValueExA
key_handle: 0x000003e0
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619793171.114875
RegSetValueExA
key_handle: 0x000003e0
value:  g•¦=×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619793171.114875
RegSetValueExA
key_handle: 0x000003e0
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1619793171.160875
RegSetValueExW
key_handle: 0x000003c4
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
DrWeb Trojan.DownLoader34.24265
MicroWorld-eScan Trojan.GenericKDZ.69487
FireEye Trojan.GenericKDZ.69487
CAT-QuickHeal Trojan.Multi
Qihoo-360 Generic/Trojan.ae7
McAfee Emotet-FRV!9CA4DDF20851
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Malware
K7AntiVirus Trojan ( 0056df731 )
BitDefender Trojan.GenericKDZ.69487
K7GW Trojan ( 0056df731 )
TrendMicro TrojanSpy.Win32.EMOTET.THHAFBO
BitDefenderTheta Gen:NN.ZexaF.34216.Cq0@aOw395eb
Cyren W32/Emotet.AQB.gen!Eldorado
Symantec Trojan.Emotet
APEX Malicious
Paloalto generic.ml
ClamAV Win.Trojan.Emotet-9371545-0
Kaspersky HEUR:Backdoor.Win32.Emotet.vho
Alibaba Trojan:Win32/Emotet.abcb1b6f
NANO-Antivirus Trojan.Win32.Kryptik.hsezkh
ViRobot Trojan.Win32.Emotet.458752.B
Rising Trojan.Kryptik!1.CA7F (CLASSIC)
Ad-Aware Trojan.GenericKDZ.69487
Comodo fls.noname@0
F-Secure Trojan.TR/AD.Emotet.ndyya
Zillya Backdoor.Emotet.Win32.1010
Invincea Mal/Generic-R + Troj/Emotet-CLD
Sophos Troj/Emotet-CLD
Ikarus Trojan-Banker.Emotet
GData Trojan.GenericKDZ.69487
Jiangmin Backdoor.Emotet.ra
Webroot W32.Trojan.Emotet
Avira TR/AD.Emotet.ndyya
MAX malware (ai score=83)
Antiy-AVL Trojan[Backdoor]/Win32.Emotet
Arcabit Trojan.Generic.D10F6F
ZoneAlarm HEUR:Backdoor.Win32.Emotet.vho
Microsoft Trojan:Win32/Emotet.ARJ!MTB
Cynet Malicious (score: 85)
AhnLab-V3 Trojan/Win32.Emotet.R347905
VBA32 BScope.Backdoor.Emotet
ALYac Trojan.GenericKDZ.69487
TACHYON Trojan/W32.Emotet.458752.C
Malwarebytes Trojan.Emotet
ESET-NOD32 Win32/Emotet.CD
TrendMicro-HouseCall TrojanSpy.Win32.EMOTET.THHAFBO
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)
dead_host 69.30.203.214:8080
dead_host 192.168.56.101:49182
dead_host 75.139.38.211:80
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-08-15 02:43:56

Imports

Library WS2_32.dll:
• 0x42f4e0 shutdown
• 0x42f4e4 WSAStartup
• 0x42f4e8 WSACleanup
• 0x42f4ec send
• 0x42f4f0 recv
• 0x42f4f4 closesocket
• 0x42f4fc WSACloseEvent
• 0x42f500 WSAEventSelect
• 0x42f504 WSACreateEvent
• 0x42f508 socket
• 0x42f50c inet_addr
• 0x42f514 connect
• 0x42f518 gethostbyaddr
• 0x42f51c htons
• 0x42f520 gethostbyname
Library KERNEL32.dll:
• 0x42f0bc FindClose
• 0x42f0c0 FindFirstFileA
• 0x42f0c8 GetFullPathNameA
• 0x42f0d4 GetTickCount
• 0x42f0d8 GetFileAttributesA
• 0x42f0dc GetFileSize
• 0x42f0e0 GetFileTime
• 0x42f0e4 RtlUnwind
• 0x42f0e8 CreateThread
• 0x42f0ec ExitThread
• 0x42f0f0 RaiseException
• 0x42f0f4 GetStartupInfoA
• 0x42f0f8 GetCommandLineA
• 0x42f0fc HeapAlloc
• 0x42f100 HeapFree
• 0x42f104 TerminateProcess
• 0x42f108 HeapReAlloc
• 0x42f10c HeapSize
• 0x42f110 GetACP
• 0x42f120 LCMapStringA
• 0x42f124 LCMapStringW
• 0x42f138 GetStdHandle
• 0x42f13c GetFileType
• 0x42f140 HeapDestroy
• 0x42f144 HeapCreate
• 0x42f148 VirtualFree
• 0x42f14c VirtualAlloc
• 0x42f150 GetStringTypeA
• 0x42f154 GetStringTypeW
• 0x42f158 IsBadCodePtr
• 0x42f15c SetStdHandle
• 0x42f160 CompareStringA
• 0x42f164 CompareStringW
• 0x42f16c GetProfileStringA
• 0x42f170 InterlockedExchange
• 0x42f174 ResetEvent
• 0x42f178 CreateEventA
• 0x42f17c CloseHandle
• 0x42f180 WaitForSingleObject
• 0x42f184 SetEvent
• 0x42f188 lstrlenA
• 0x42f18c Sleep
• 0x42f190 ExitProcess
• 0x42f19c WideCharToMultiByte
• 0x42f1a0 MultiByteToWideChar
• 0x42f1a4 LocalFree
• 0x42f1a8 FormatMessageA
• 0x42f1ac SetEndOfFile
• 0x42f1b0 UnlockFile
• 0x42f1b4 LockFile
• 0x42f1b8 FlushFileBuffers
• 0x42f1bc SetFilePointer
• 0x42f1c0 WriteFile
• 0x42f1c4 ReadFile
• 0x42f1c8 CreateFileA
• 0x42f1cc GetCurrentProcess
• 0x42f1d0 DuplicateHandle
• 0x42f1d4 SetErrorMode
• 0x42f1d8 GetOEMCP
• 0x42f1dc GetCPInfo
• 0x42f1e0 GetThreadLocale
• 0x42f1e4 SizeofResource
• 0x42f1e8 IsBadWritePtr
• 0x42f1ec IsBadReadPtr
• 0x42f1f0 GetCurrentThreadId
• 0x42f1f4 GetCurrentThread
• 0x42f1f8 lstrcmpiA
• 0x42f1fc lstrcmpA
• 0x42f200 GlobalDeleteAtom
• 0x42f208 GlobalFlags
• 0x42f20c TlsGetValue
• 0x42f210 LocalReAlloc
• 0x42f214 TlsSetValue
• 0x42f218 GlobalReAlloc
• 0x42f21c TlsFree
• 0x42f220 GlobalHandle
• 0x42f224 TlsAlloc
• 0x42f228 LocalAlloc
• 0x42f22c GetProcessVersion
• 0x42f230 lstrcpynA
• 0x42f234 GetLastError
• 0x42f248 MulDiv
• 0x42f24c SetLastError
• 0x42f250 LoadLibraryA
• 0x42f254 FreeLibrary
• 0x42f258 GetVersion
• 0x42f25c lstrcatA
• 0x42f260 GlobalAlloc
• 0x42f264 GlobalGetAtomNameA
• 0x42f268 GlobalAddAtomA
• 0x42f26c GlobalFindAtomA
• 0x42f270 lstrcpyA
• 0x42f274 GetModuleHandleA
• 0x42f278 GetProcAddress
• 0x42f27c GlobalUnlock
• 0x42f280 GlobalFree
• 0x42f284 LockResource
• 0x42f288 FindResourceA
• 0x42f28c LoadResource
• 0x42f290 GetModuleFileNameA
• 0x42f294 GlobalLock
• 0x42f298 SetHandleCount
Library USER32.dll:
• 0x42f2d0 GrayStringA
• 0x42f2d4 DestroyMenu
• 0x42f2d8 LoadCursorA
• 0x42f2dc GetSysColorBrush
• 0x42f2e0 GetDesktopWindow
• 0x42f2e4 GetClassNameA
• 0x42f2e8 PtInRect
• 0x42f2ec CharNextA
• 0x42f2f4 SetRect
• 0x42f2f8 GetNextDlgGroupItem
• 0x42f2fc MessageBeep
• 0x42f300 InvalidateRect
• 0x42f304 CharUpperA
• 0x42f308 InflateRect
• 0x42f310 PostThreadMessageA
• 0x42f314 GetDC
• 0x42f318 ClientToScreen
• 0x42f31c LoadStringA
• 0x42f320 wvsprintfA
• 0x42f324 ShowWindow
• 0x42f328 MoveWindow
• 0x42f32c SetWindowTextA
• 0x42f330 IsDialogMessageA
• 0x42f334 UpdateWindow
• 0x42f338 SendDlgItemMessageA
• 0x42f33c MapWindowPoints
• 0x42f340 GetSysColor
• 0x42f344 SetFocus
• 0x42f348 AdjustWindowRectEx
• 0x42f34c ScreenToClient
• 0x42f350 CopyRect
• 0x42f354 DrawTextA
• 0x42f358 GetTopWindow
• 0x42f35c IsChild
• 0x42f360 GetCapture
• 0x42f364 WinHelpA
• 0x42f368 wsprintfA
• 0x42f36c GetClassInfoA
• 0x42f370 RegisterClassA
• 0x42f374 GetMenu
• 0x42f378 GetMenuItemCount
• 0x42f37c GetSubMenu
• 0x42f380 GetMenuItemID
• 0x42f388 GetWindowTextA
• 0x42f38c GetDlgCtrlID
• 0x42f390 DefWindowProcA
• 0x42f394 CreateWindowExA
• 0x42f398 GetClassLongA
• 0x42f39c UnhookWindowsHookEx
• 0x42f3a0 GetPropA
• 0x42f3a4 CallWindowProcA
• 0x42f3a8 RemovePropA
• 0x42f3ac GetMessageTime
• 0x42f3b0 GetMessagePos
• 0x42f3b4 GetForegroundWindow
• 0x42f3b8 SetForegroundWindow
• 0x42f3bc SetWindowLongA
• 0x42f3c4 OffsetRect
• 0x42f3c8 IntersectRect
• 0x42f3d0 GetWindowPlacement
• 0x42f3d4 GetWindowRect
• 0x42f3d8 MapDialogRect
• 0x42f3dc SetWindowPos
• 0x42f3e0 GetWindow
• 0x42f3e8 EndDialog
• 0x42f3ec SetActiveWindow
• 0x42f3f0 IsWindow
• 0x42f3f8 DestroyWindow
• 0x42f3fc GetDlgItem
• 0x42f404 LoadBitmapA
• 0x42f408 GetMenuState
• 0x42f40c ModifyMenuA
• 0x42f410 SetMenuItemBitmaps
• 0x42f414 CheckMenuItem
• 0x42f418 EnableMenuItem
• 0x42f41c GetFocus
• 0x42f420 GetNextDlgTabItem
• 0x42f424 GetActiveWindow
• 0x42f428 GetKeyState
• 0x42f42c CallNextHookEx
• 0x42f430 ValidateRect
• 0x42f434 IsWindowVisible
• 0x42f438 GetCursorPos
• 0x42f43c SetWindowsHookExA
• 0x42f440 GetParent
• 0x42f444 GetLastActivePopup
• 0x42f448 IsWindowEnabled
• 0x42f44c GetWindowLongA
• 0x42f450 MessageBoxA
• 0x42f454 SetCursor
• 0x42f458 TabbedTextOutA
• 0x42f45c EndPaint
• 0x42f460 BeginPaint
• 0x42f464 GetWindowDC
• 0x42f468 ReleaseDC
• 0x42f46c PostMessageA
• 0x42f470 LoadIconA
• 0x42f474 EnableWindow
• 0x42f478 GetClientRect
• 0x42f47c IsIconic
• 0x42f480 GetSystemMenu
• 0x42f484 SendMessageA
• 0x42f488 AppendMenuA
• 0x42f48c DrawIcon
• 0x42f490 PostQuitMessage
• 0x42f494 GetSystemMetrics
• 0x42f498 GetMessageA
• 0x42f49c TranslateMessage
• 0x42f4a0 PeekMessageA
• 0x42f4a4 DispatchMessageA
• 0x42f4ac IsWindowUnicode
• 0x42f4b0 DefDlgProcA
• 0x42f4b4 DrawFocusRect
• 0x42f4b8 ExcludeUpdateRgn
• 0x42f4bc ShowCaret
• 0x42f4c0 HideCaret
• 0x42f4c4 UnregisterClassA
• 0x42f4c8 SetPropA
Library GDI32.dll:
• 0x42f01c SetBkMode
• 0x42f020 SetMapMode
• 0x42f024 SetViewportOrgEx
• 0x42f028 OffsetViewportOrgEx
• 0x42f02c SetViewportExtEx
• 0x42f030 ScaleViewportExtEx
• 0x42f034 SetWindowExtEx
• 0x42f038 ScaleWindowExtEx
• 0x42f03c IntersectClipRect
• 0x42f040 DeleteObject
• 0x42f044 GetStockObject
• 0x42f048 GetDeviceCaps
• 0x42f04c GetViewportExtEx
• 0x42f050 GetWindowExtEx
• 0x42f054 CreateSolidBrush
• 0x42f058 PtVisible
• 0x42f05c RectVisible
• 0x42f060 TextOutA
• 0x42f064 ExtTextOutA
• 0x42f068 Escape
• 0x42f06c GetTextColor
• 0x42f070 GetBkColor
• 0x42f074 DPtoLP
• 0x42f078 LPtoDP
• 0x42f07c GetMapMode
• 0x42f080 PatBlt
• 0x42f084 SelectObject
• 0x42f088 RestoreDC
• 0x42f08c SaveDC
• 0x42f090 DeleteDC
• 0x42f094 GetObjectA
• 0x42f098 SetBkColor
• 0x42f09c SetTextColor
• 0x42f0a0 GetClipBox
• 0x42f0a4 GetTextExtentPointA
• 0x42f0a8 BitBlt
• 0x42f0ac CreateCompatibleDC
• 0x42f0b0 CreateDIBitmap
• 0x42f0b4 CreateBitmap
Library comdlg32.dll:
• 0x42f528 GetFileTitleA
Library WINSPOOL.DRV:
• 0x42f4d0 DocumentPropertiesA
• 0x42f4d4 ClosePrinter
• 0x42f4d8 OpenPrinterA
Library ADVAPI32.dll:
• 0x42f000 RegCloseKey
• 0x42f004 RegSetValueExA
• 0x42f008 RegOpenKeyExA
• 0x42f00c RegCreateKeyExA
Library COMCTL32.dll:
• 0x42f014
Library oledlg.dll:
• 0x42f570
Library ole32.dll:
• 0x42f530 CoTaskMemFree
• 0x42f53c OleInitialize
• 0x42f540 CoGetClassObject
• 0x42f544 CLSIDFromString
• 0x42f548 CoTaskMemAlloc
• 0x42f54c OleUninitialize
• 0x42f554 CLSIDFromProgID
• 0x42f55c OleFlushClipboard
• 0x42f560 CoRevokeClassObject
Library OLEPRO32.DLL:
• 0x42f2c8
Library OLEAUT32.dll:
• 0x42f2a4 SysStringLen
• 0x42f2a8 SysAllocString
• 0x42f2ac VariantChangeType
• 0x42f2b0 VariantCopy
• 0x42f2b8 VariantClear
• 0x42f2bc SysAllocStringLen
• 0x42f2c0 SysFreeString

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 51378 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50003 239.255.255.250 3702
192.168.56.101 58368 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.