3.8
中危

102f5bca5333bdb1de4966711e620b405a61f175f5228f1f2265d0bccdee13a3

9f17bfd983fae4ea7cc7b0c988540f8c.exe

分析耗时

29s

最近分析

文件大小

580.4KB
静态报毒 动态报毒 ADWAREDOMA AI SCORE=80 BAZARLOADER CLOUD CONFIDENCE CRYPTERX ERED FSOT GENCIRC GENERICKDZ GENKRYPTIK H8OA1OEA HIGH CONFIDENCE HTIFGF KCLOUD KRYPT KRYPTIK MALWARE@#UN5A0OU9P6AJ MANSABO OHEG SCORE SUSGEN TRICKBOT UNSAFE UQMAN YHDGYGD8Q9W 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win64/Trickbot.5a81e3af 20190527 0.3.0.5
Avast Win64:CrypterX-gen [Trj] 20210222 21.1.5827.0
Baidu 20190318 1.0.0.2
Kingsoft Win32.Troj.Generic_a.a.(kcloud) 20210222 2017.9.26.565
McAfee Trojan-FSOT!9F17BFD983FA 20210222 6.0.6.653
Tencent Malware.Win32.Gencirc.10cdf579 20210222 1.0.0.1
CrowdStrike win/malicious_confidence_60% (W) 20210203 1.0
静态指标
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1620808807.6875
__exception__
stacktrace:

                
            
            
            
registers.r14: 32573777
registers.r9: 818
registers.rcx: 8791764828160
registers.rsi: 8
registers.r10: 3221225715
registers.rbx: 8791764828160
registers.rdi: 14
registers.r11: 0
registers.r8: 260
registers.rdx: 1238512
registers.rbp: 1238528
registers.r15: 36020096
registers.r12: 2008686432
registers.rsp: 1238264
registers.rax: 0
registers.r13: 0
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
success 0 0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (50 out of 69 个事件)
Time & API Arguments Status Return Repeated
1620808804.8125
NtAllocateVirtualMemory
process_identifier: 1632
region_size: 176128
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x0000000001f10000
success 0 0
1620808804.9845
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feff1e6000
success 0 0
1620808804.9845
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feff1e7000
success 0 0
1620808807.3285
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feff183000
success 0 0
1620808807.3285
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feff183000
success 0 0
1620808807.3285
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feff165000
success 0 0
1620808807.3285
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feff1cf000
success 0 0
1620808807.3285
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feff173000
success 0 0
1620808807.3285
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feff165000
success 0 0
1620808807.3435
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feff183000
success 0 0
1620808807.3435
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feff183000
success 0 0
1620808807.3435
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feff1b0000
success 0 0
1620808807.3435
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feff15c000
success 0 0
1620808807.3435
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feff15f000
success 0 0
1620808807.3435
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feff1aa000
success 0 0
1620808807.3435
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feff15f000
success 0 0
1620808807.3755
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feff169000
success 0 0
1620808807.3755
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feff16b000
success 0 0
1620808807.3905
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feff1b2000
success 0 0
1620808807.3905
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feff181000
success 0 0
1620808807.3905
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feff15e000
success 0 0
1620808807.3905
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feff163000
success 0 0
1620808807.3905
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feff15f000
success 0 0
1620808807.3905
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feff182000
success 0 0
1620808807.3905
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feff185000
success 0 0
1620808807.4685
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feffb1b000
success 0 0
1620808807.4685
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feffb03000
success 0 0
1620808807.4685
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feffae8000
success 0 0
1620808807.4685
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feffaed000
success 0 0
1620808807.4685
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feffaed000
success 0 0
1620808807.4685
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feffb1b000
success 0 0
1620808807.4685
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feffb1b000
success 0 0
1620808807.4685
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feffae8000
success 0 0
1620808807.4845
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feffb2d000
success 0 0
1620808807.4845
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feffb2d000
success 0 0
1620808807.4845
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feffaed000
success 0 0
1620808807.4845
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feffaf1000
success 0 0
1620808807.5005
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feffafb000
success 0 0
1620808807.5005
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feffafb000
success 0 0
1620808807.5005
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feffae3000
success 0 0
1620808807.5005
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feffb00000
success 0 0
1620808807.5155
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feffaf1000
success 0 0
1620808807.5155
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feffafb000
success 0 0
1620808807.5155
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feffb06000
success 0 0
1620808807.5155
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feffaf1000
success 0 0
1620808807.5155
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feffaf1000
success 0 0
1620808807.5315
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feffafc000
success 0 0
1620808807.5315
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feffafb000
success 0 0
1620808807.5315
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feffaed000
success 0 0
1620808807.5315
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
base_address: 0x000007feffafc000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.897056055879278 section {'size_of_data': '0x0002ce00', 'virtual_address': '0x0005b000', 'entropy': 7.897056055879278, 'name': '.data', 'virtual_size': '0x00032ad0'} description A section with a high entropy has been found
entropy 0.31001727115716754 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (3 个事件)
host 172.217.24.14
host 203.208.41.65
host 203.208.41.98
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.160.78:443
File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKDZ.69748
ALYac Trojan.GenericKDZ.69748
Cylance Unsafe
Zillya Trojan.Mansabo.Win32.1883
Sangfor Trojan.Win64.Trickbot.VIS
K7AntiVirus Trojan ( 0056d55a1 )
Alibaba Trojan:Win64/Trickbot.5a81e3af
K7GW Trojan ( 0056d55a1 )
Cybereason malicious.983fae
Arcabit Trojan.Generic.D11074
Cyren W64/Trojan.OHEG-0819
Symantec Trojan.Gen.2
APEX Malicious
Avast Win64:CrypterX-gen [Trj]
Kaspersky HEUR:Trojan.Win32.Mansabo.vho
BitDefender Trojan.GenericKDZ.69748
NANO-Antivirus Trojan.Win64.Mansabo.htifgf
Paloalto generic.ml
AegisLab Trojan.Multi.Generic.4!c
Rising Trojan.Kryptik!1.CB2B (CLOUD)
Ad-Aware Trojan.GenericKDZ.69748
Sophos Mal/Generic-S
Comodo Malware@#un5a0ou9p6aj
F-Secure Trojan.TR/Crypt.Agent.uqman
VIPRE Trojan.Win32.Generic!BT
McAfee-GW-Edition BehavesLike.Win64.AdwareDoma.hh
FireEye Generic.mg.9f17bfd983fae4ea
Emsisoft Trojan.GenericKDZ.69748 (B)
Jiangmin Trojan.Mansabo.buk
eGambit Generic.Malware
Avira TR/Crypt.Agent.uqman
Antiy-AVL Trojan/Win32.Mansabo
Kingsoft Win32.Troj.Generic_a.a.(kcloud)
Gridinsoft Trojan.Win64.Gen.oa!s1
Microsoft Trojan:Win64/Trickbot.VIS!MSR
ZoneAlarm HEUR:Trojan.Win32.Mansabo.vho
GData Trojan.GenericKDZ.69748
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win64.Trickbot.C4187238
McAfee Trojan-FSOT!9F17BFD983FA
MAX malware (ai score=80)
VBA32 Trojan.Win64.Trickbot
Malwarebytes Trojan.MalPack.TRE
ESET-NOD32 Win64/BazarLoader.E
Tencent Malware.Win32.Gencirc.10cdf579
Yandex Trojan.Agent!YHdGYGd8q9w
Ikarus Trojan.Win64.Krypt
MaxSecure Trojan.Malware.1728101.susgen
Fortinet W64/GenKryptik.ERED!tr
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-08-25 20:38:34

Imports

Library MSWSOCK.dll:
0x443570 TransmitFile
Library KERNEL32.dll:
0x443120 SetErrorMode
0x443130 GetFileAttributesA
0x443138 GetFileTime
0x443148 RtlUnwindEx
0x443158 HeapAlloc
0x443160 HeapFree
0x443168 HeapReAlloc
0x443170 GetCommandLineA
0x443178 GetProcessHeap
0x443180 GetStartupInfoA
0x443188 RaiseException
0x443190 RtlPcToFileHeader
0x443198 ExitThread
0x4431a0 CreateThread
0x4431a8 HeapSize
0x4431b0 TerminateProcess
0x4431c8 IsDebuggerPresent
0x4431d0 RtlCaptureContext
0x4431d8 FlsGetValue
0x4431e0 FlsSetValue
0x4431e8 FlsAlloc
0x4431f0 GetACP
0x4431f8 LCMapStringA
0x443200 LCMapStringW
0x443208 GetStdHandle
0x443210 HeapSetInformation
0x443218 HeapCreate
0x443220 RtlVirtualUnwind
0x443248 SetHandleCount
0x443250 GetFileType
0x443260 GetTickCount
0x443270 GetConsoleCP
0x443278 GetConsoleMode
0x443280 GetStringTypeA
0x443288 GetStringTypeW
0x443290 SetStdHandle
0x443298 WriteConsoleA
0x4432a0 GetConsoleOutputCP
0x4432a8 WriteConsoleW
0x4432c0 GetOEMCP
0x4432c8 GetCPInfo
0x4432d0 TlsFree
0x4432d8 LocalReAlloc
0x4432e0 TlsSetValue
0x4432e8 GlobalHandle
0x4432f0 GlobalReAlloc
0x4432f8 TlsAlloc
0x443300 TlsGetValue
0x443308 LocalAlloc
0x443310 GlobalFlags
0x443318 CreateFileA
0x443320 GetFullPathNameA
0x443330 FindFirstFileA
0x443338 FindClose
0x443340 GetCurrentProcess
0x443348 DuplicateHandle
0x443350 GetThreadLocale
0x443358 GetFileSize
0x443360 SetEndOfFile
0x443368 UnlockFile
0x443370 LockFile
0x443378 FlushFileBuffers
0x443380 SetFilePointer
0x443388 WriteFile
0x443390 ReadFile
0x443398 GetModuleFileNameW
0x4433a0 GetCurrentProcessId
0x4433a8 CreateEventA
0x4433b0 SetEvent
0x4433b8 SetThreadPriority
0x4433d0 GetLocaleInfoA
0x4433d8 lstrcmpA
0x4433e0 WaitForSingleObject
0x4433e8 GlobalFree
0x4433f0 GlobalAlloc
0x4433f8 GlobalLock
0x443400 GlobalUnlock
0x443408 MulDiv
0x443410 FreeResource
0x443418 GlobalGetAtomNameA
0x443420 GlobalAddAtomA
0x443428 GlobalFindAtomA
0x443430 GlobalDeleteAtom
0x443438 FreeLibrary
0x443440 LoadLibraryA
0x443448 SetLastError
0x443450 lstrcmpW
0x443458 GetModuleHandleA
0x443460 GetProcAddress
0x443468 GetVersionExA
0x443470 lstrlenA
0x443478 CompareStringW
0x443480 CompareStringA
0x443488 GetVersion
0x443490 MultiByteToWideChar
0x443498 lstrcpyA
0x4434a0 GetModuleFileNameA
0x4434a8 GetLastError
0x4434b0 FormatMessageA
0x4434b8 LocalFree
0x4434c0 Sleep
0x4434c8 CloseHandle
0x4434d0 GetCurrentThreadId
0x4434d8 GetCurrentThread
0x4434e0 SuspendThread
0x4434f0 GetExitCodeThread
0x4434f8 ResumeThread
0x443500 CancelIo
0x443510 ExitProcess
0x443518 WideCharToMultiByte
0x443520 FindResourceA
0x443528 LoadResource
0x443530 LockResource
0x443538 SizeofResource
0x443560 FlsFree
Library USER32.dll:
0x4435c8 UnregisterClassA
0x4435d0 BeginPaint
0x4435d8 ReleaseDC
0x4435e0 GetDC
0x4435e8 ClientToScreen
0x4435f0 GrayStringA
0x4435f8 DrawTextExA
0x443600 DrawTextA
0x443608 TabbedTextOutA
0x443610 GetDesktopWindow
0x443620 GetNextDlgTabItem
0x443628 EndDialog
0x443638 SetCursor
0x443640 GetMessageA
0x443648 TranslateMessage
0x443650 GetActiveWindow
0x443658 GetCursorPos
0x443660 ValidateRect
0x443668 PostQuitMessage
0x443670 IsWindowEnabled
0x443678 ShowWindow
0x443680 SetWindowTextA
0x443688 IsDialogMessageA
0x443698 SendDlgItemMessageA
0x4436a0 GetCapture
0x4436a8 SetWindowsHookExA
0x4436b0 CallNextHookEx
0x4436b8 GetClassLongA
0x4436c0 GetClassNameA
0x4436c8 GetClassLongPtrA
0x4436d0 SetPropA
0x4436d8 GetPropA
0x4436e0 RemovePropA
0x4436e8 IsWindow
0x4436f0 SetFocus
0x443700 GetWindowTextA
0x443708 GetForegroundWindow
0x443710 GetLastActivePopup
0x443718 SetActiveWindow
0x443720 DispatchMessageA
0x443728 GetDlgItem
0x443730 DestroyWindow
0x443738 GetWindowLongPtrA
0x443740 SetWindowLongPtrA
0x443748 UnhookWindowsHookEx
0x443750 GetMessageTime
0x443758 GetMessagePos
0x443760 PeekMessageA
0x443768 MapWindowPoints
0x443770 GetKeyState
0x443778 SetForegroundWindow
0x443780 IsWindowVisible
0x443788 UpdateWindow
0x443790 GetMenu
0x443798 GetSubMenu
0x4437a0 GetMenuItemID
0x4437a8 GetMenuItemCount
0x4437b0 MessageBoxA
0x4437b8 CreateWindowExA
0x4437c0 GetClassInfoExA
0x4437c8 GetClassInfoA
0x4437d0 RegisterClassA
0x4437d8 GetSysColor
0x4437e0 AdjustWindowRectEx
0x4437e8 CopyRect
0x4437f0 PtInRect
0x4437f8 GetDlgCtrlID
0x443800 DefWindowProcA
0x443808 CallWindowProcA
0x443810 GetWindowLongA
0x443818 SetWindowLongA
0x443820 DestroyMenu
0x443828 LoadCursorA
0x443830 GetSysColorBrush
0x443838 WinHelpA
0x443840 EndPaint
0x443848 SetWindowPos
0x443858 GetWindowPlacement
0x443860 GetWindowRect
0x443868 GetWindow
0x443870 SetMenuItemBitmaps
0x443880 LoadBitmapA
0x443888 GetFocus
0x443890 GetParent
0x443898 ModifyMenuA
0x4438a0 GetMenuState
0x4438a8 EnableMenuItem
0x4438b0 CheckMenuItem
0x4438b8 CharUpperA
0x4438c0 PostMessageA
0x4438c8 GetSystemMetrics
0x4438d0 LoadIconA
0x4438d8 KillTimer
0x4438e0 SetTimer
0x4438e8 InvalidateRect
0x4438f0 GetClientRect
0x4438f8 IsIconic
0x443900 DrawIcon
0x443908 SendMessageA
0x443910 EnableWindow
0x443918 GetTopWindow
Library GDI32.dll:
0x443050 SetWindowExtEx
0x443058 ScaleWindowExtEx
0x443060 DeleteDC
0x443068 GetStockObject
0x443070 ScaleViewportExtEx
0x443078 SetViewportExtEx
0x443080 OffsetViewportOrgEx
0x443088 SetViewportOrgEx
0x443090 SelectObject
0x443098 Escape
0x4430a0 ExtTextOutA
0x4430a8 TextOutA
0x4430b0 RectVisible
0x4430b8 CreateBitmap
0x4430c0 DeleteObject
0x4430c8 SetMapMode
0x4430d0 RestoreDC
0x4430d8 SaveDC
0x4430e0 GetDeviceCaps
0x4430e8 GetObjectA
0x4430f0 SetBkColor
0x4430f8 SetTextColor
0x443100 GetClipBox
0x443108 PtVisible
Library comdlg32.dll:
0x4439e0 GetFileTitleA
Library WINSPOOL.DRV:
0x443928 ClosePrinter
0x443930 OpenPrinterA
0x443938 DocumentPropertiesA
Library ADVAPI32.dll:
0x443000 RegCreateKeyExA
0x443008 RegQueryValueA
0x443010 RegEnumKeyA
0x443018 RegDeleteKeyA
0x443020 RegOpenKeyExA
0x443028 RegQueryValueExA
0x443030 RegOpenKeyA
0x443038 RegSetValueExA
0x443040 RegCloseKey
Library SHLWAPI.dll:
0x4435a0 PathFindFileNameA
0x4435a8 PathStripToRootA
0x4435b0 PathFindExtensionA
0x4435b8 PathIsUNCA
Library OLEAUT32.dll:
0x443580 VariantClear
0x443588 VariantChangeType
0x443590 VariantInit
Library WS2_32.dll:
0x443948 bind
0x443950 listen
0x443968 WSACleanup
0x443970 WSAEventSelect
0x443978 WSACloseEvent
0x443980 gethostbyname
0x443988 socket
0x443990 WSAGetLastError
0x443998 WSACreateEvent
0x4439a0 WSASocketA
0x4439a8 htons
0x4439b0 inet_ntoa
0x4439b8 getpeername
0x4439c0 closesocket
0x4439c8 setsockopt
0x4439d0 WSAStartup

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 49236 239.255.255.250 3702
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 57875 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.