6.8
高危
54 个模型检测该样本为恶意！
重新分析
更多

2bea6b69613e7cfcc0aa58ce7fb8ba250611181f69667b07b51b5f7bf3c11a9d

a0b802ef353d5c6815e6c62591a8f838.exe

分析耗时

45s

最近分析

文件大小

833.0KB
静态报毒 动态报毒 0GW@AKSGD4PI AI SCORE=86 AIDETECTVM ALI2000015 ANDROM AXHR BSCOPE CLASSIC CONFIDENCE DELF DELFINJECT DELPHILESS EMYY EMZL FAREIT GORSPYZCF50 HIGH CONFIDENCE HRONKS JXERS KRYPTIK LLQU MALWARE2 MALWARE@#1IHZU1GR63RF SCORE SUSPICIOUS PE UNSAFE X2094 ZELPHIF ZEMD ZUSY 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FPQ!A0B802EF353D 20201023 6.0.6.653
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Malware-gen 20201023 18.4.3895.0
Tencent Win32.Backdoor.Androm.Llqu 20201023 1.0.0.1
Kingsoft 20201023 2013.8.14.323
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619802619.039876
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7389e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7389ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7389b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7389b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7389ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7389aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73895511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7389559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f57f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f54de3
a0b802ef353d5c6815e6c62591a8f838+0x90a4d @ 0x490a4d
a0b802ef353d5c6815e6c62591a8f838+0x89254 @ 0x489254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe2e14ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619802612.664876
NtAllocateVirtualMemory
process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003f0000
success 0 0
1619802612.711876
NtProtectVirtualMemory
process_identifier: 2468
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 77824
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0044f000
success 0 0
1619802612.727876
NtAllocateVirtualMemory
process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x004f0000
success 0 0
1619802612.992876
NtProtectVirtualMemory
process_identifier: 2636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619802613.055876
NtAllocateVirtualMemory
process_identifier: 2636
region_size: 983040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02030000
success 0 0
1619802613.055876
NtAllocateVirtualMemory
process_identifier: 2636
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020e0000
success 0 0
1619802613.055876
NtAllocateVirtualMemory
process_identifier: 2636
region_size: 557056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f70000
success 0 0
1619802613.055876
NtProtectVirtualMemory
process_identifier: 2636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 520192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f72000
success 0 0
1619802616.445876
NtAllocateVirtualMemory
process_identifier: 2636
region_size: 1179648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02210000
success 0 0
1619802616.445876
NtAllocateVirtualMemory
process_identifier: 2636
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x022f0000
success 0 0
1619802619.023876
NtProtectVirtualMemory
process_identifier: 2636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1619802619.023876
NtProtectVirtualMemory
process_identifier: 2636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619802619.023876
NtProtectVirtualMemory
process_identifier: 2636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1619802619.023876
NtProtectVirtualMemory
process_identifier: 2636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619802619.023876
NtProtectVirtualMemory
process_identifier: 2636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1619802619.023876
NtProtectVirtualMemory
process_identifier: 2636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619802619.023876
NtProtectVirtualMemory
process_identifier: 2636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1619802619.023876
NtProtectVirtualMemory
process_identifier: 2636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619802619.023876
NtProtectVirtualMemory
process_identifier: 2636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1619802619.023876
NtProtectVirtualMemory
process_identifier: 2636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619802619.023876
NtProtectVirtualMemory
process_identifier: 2636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1619802619.023876
NtProtectVirtualMemory
process_identifier: 2636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619802619.023876
NtProtectVirtualMemory
process_identifier: 2636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1619802619.023876
NtProtectVirtualMemory
process_identifier: 2636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619802619.023876
NtProtectVirtualMemory
process_identifier: 2636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1619802619.023876
NtProtectVirtualMemory
process_identifier: 2636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619802619.023876
NtProtectVirtualMemory
process_identifier: 2636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1619802619.023876
NtProtectVirtualMemory
process_identifier: 2636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619802619.023876
NtProtectVirtualMemory
process_identifier: 2636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1619802619.023876
NtProtectVirtualMemory
process_identifier: 2636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.347515551095815 section {'size_of_data': '0x00065e00', 'virtual_address': '0x00071000', 'entropy': 7.347515551095815, 'name': '.rsrc', 'virtual_size': '0x00065dbc'} description A section with a high entropy has been found
entropy 0.48978365384615385 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2468 called NtSetContextThread to modify thread in remote process 2636
Time & API Arguments Status Return Repeated
1619802612.773876
NtSetContextThread
thread_handle: 0x00000110
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5354784
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2636
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2468 resumed a thread in remote process 2636
Time & API Arguments Status Return Repeated
1619802612.852876
NtResumeThread
thread_handle: 0x00000110
suspend_count: 1
process_identifier: 2636
success 0 0
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.160.110:443
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619802612.742876
CreateProcessInternalW
thread_identifier: 784
thread_handle: 0x00000110
process_identifier: 2636
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a0b802ef353d5c6815e6c62591a8f838.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000114
inherit_handles: 0
success 1 0
1619802612.742876
NtUnmapViewOfSection
process_identifier: 2636
region_size: 4096
process_handle: 0x00000114
base_address: 0x00400000
success 0 0
1619802612.742876
NtMapViewOfSection
section_handle: 0x0000011c
process_identifier: 2636
commit_size: 1167360
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000114
allocation_type: 0 ()
section_offset: 0
view_size: 1167360
base_address: 0x00400000
success 0 0
1619802612.773876
NtGetContextThread
thread_handle: 0x00000110
success 0 0
1619802612.773876
NtSetContextThread
thread_handle: 0x00000110
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5354784
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2636
success 0 0
1619802612.852876
NtResumeThread
thread_handle: 0x00000110
suspend_count: 1
process_identifier: 2636
success 0 0
File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Delf.FareIt.Gen.12
FireEye Generic.mg.a0b802ef353d5c68
McAfee Fareit-FPQ!A0B802EF353D
Cylance Unsafe
Zillya Backdoor.Androm.Win32.74034
Sangfor Malware
K7AntiVirus Trojan ( 00566aa61 )
Alibaba Trojan:Win32/DelfInject.ali2000015
K7GW Trojan ( 00566aa61 )
Cybereason malicious.f353d5
Cyren W32/Injector.ZEMD-7886
Symantec Trojan.Gen.2
APEX Malicious
Avast Win32:Malware-gen
ClamAV Win.Trojan.Zusy-9305089-0
Kaspersky HEUR:Backdoor.Win32.Androm.gen
BitDefender Trojan.Delf.FareIt.Gen.12
NANO-Antivirus Trojan.Win32.Androm.hronks
Paloalto generic.ml
Tencent Win32.Backdoor.Androm.Llqu
Ad-Aware Trojan.Delf.FareIt.Gen.12
Sophos Mal/Generic-S
Comodo Malware@#1ihzu1gr63rf
DrWeb Trojan.PWS.Stealer.19347
VIPRE Trojan.Win32.Generic!BT
Invincea Mal/Generic-S
McAfee-GW-Edition BehavesLike.Win32.Fareit.cc
Emsisoft Trojan.Delf.FareIt.Gen.12 (B)
SentinelOne DFI - Suspicious PE
Jiangmin Backdoor.Androm.axhr
eGambit Unsafe.AI_Score_68%
Avira TR/Kryptik.jxers
MAX malware (ai score=86)
Microsoft Trojan:Win32/Androm.VD!MTB
AegisLab Trojan.Multi.Generic.4!c
ZoneAlarm HEUR:Backdoor.Win32.Androm.gen
GData Trojan.Delf.FareIt.Gen.12
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2094
BitDefenderTheta Gen:NN.ZelphiF.34570.0GW@aKsGd4pi
VBA32 BScope.Trojan.Crypt
Malwarebytes Trojan.MalPack.DLF
Zoner Trojan.Win32.91654
ESET-NOD32 a variant of Win32/Injector.EMYY
Rising Trojan.Injector!1.CA50 (CLASSIC)
Yandex Trojan.Injector!GORsPyZcf50
Ikarus Trojan.Inject
Fortinet W32/Injector.EMZL!tr
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x466150 VirtualFree
• 0x466154 VirtualAlloc
• 0x466158 LocalFree
• 0x46615c LocalAlloc
• 0x466160 GetVersion
• 0x466164 GetCurrentThreadId
• 0x466170 VirtualQuery
• 0x466174 WideCharToMultiByte
• 0x466178 MultiByteToWideChar
• 0x46617c lstrlenA
• 0x466180 lstrcpynA
• 0x466184 LoadLibraryExA
• 0x466188 GetThreadLocale
• 0x46618c GetStartupInfoA
• 0x466190 GetProcAddress
• 0x466194 GetModuleHandleA
• 0x466198 GetModuleFileNameA
• 0x46619c GetLocaleInfoA
• 0x4661a0 GetCommandLineA
• 0x4661a4 FreeLibrary
• 0x4661a8 FindFirstFileA
• 0x4661ac FindClose
• 0x4661b0 ExitProcess
• 0x4661b4 WriteFile
• 0x4661bc RtlUnwind
• 0x4661c0 RaiseException
• 0x4661c4 GetStdHandle
Library user32.dll:
• 0x4661cc GetKeyboardType
• 0x4661d0 LoadStringA
• 0x4661d4 MessageBoxA
• 0x4661d8 CharNextA
Library advapi32.dll:
• 0x4661e0 RegQueryValueExA
• 0x4661e4 RegOpenKeyExA
• 0x4661e8 RegCloseKey
Library oleaut32.dll:
• 0x4661f0 SysFreeString
• 0x4661f4 SysReAllocStringLen
• 0x4661f8 SysAllocStringLen
Library kernel32.dll:
• 0x466200 TlsSetValue
• 0x466204 TlsGetValue
• 0x466208 LocalAlloc
• 0x46620c GetModuleHandleA
Library advapi32.dll:
• 0x466214 RegQueryValueExA
• 0x466218 RegOpenKeyExA
• 0x46621c RegCloseKey
Library kernel32.dll:
• 0x466224 lstrcpyA
• 0x466228 WriteFile
• 0x46622c WaitForSingleObject
• 0x466230 VirtualQuery
• 0x466234 VirtualProtect
• 0x466238 VirtualAlloc
• 0x46623c Sleep
• 0x466240 SizeofResource
• 0x466244 SetThreadLocale
• 0x466248 SetFilePointer
• 0x46624c SetEvent
• 0x466250 SetErrorMode
• 0x466254 SetEndOfFile
• 0x466258 ResetEvent
• 0x46625c ReadFile
• 0x466260 MulDiv
• 0x466264 LockResource
• 0x466268 LoadResource
• 0x46626c LoadLibraryA
• 0x466278 GlobalUnlock
• 0x46627c GlobalReAlloc
• 0x466280 GlobalHandle
• 0x466284 GlobalLock
• 0x466288 GlobalFree
• 0x46628c GlobalFindAtomA
• 0x466290 GlobalDeleteAtom
• 0x466294 GlobalAlloc
• 0x466298 GlobalAddAtomA
• 0x46629c GetVersionExA
• 0x4662a0 GetVersion
• 0x4662a4 GetTickCount
• 0x4662a8 GetThreadLocale
• 0x4662b0 GetSystemInfo
• 0x4662b4 GetStringTypeExA
• 0x4662b8 GetStdHandle
• 0x4662bc GetProcAddress
• 0x4662c0 GetModuleHandleA
• 0x4662c4 GetModuleFileNameA
• 0x4662c8 GetLocaleInfoA
• 0x4662cc GetLocalTime
• 0x4662d0 GetLastError
• 0x4662d4 GetFullPathNameA
• 0x4662d8 GetDiskFreeSpaceA
• 0x4662dc GetDateFormatA
• 0x4662e0 GetCurrentThreadId
• 0x4662e4 GetCurrentProcessId
• 0x4662e8 GetCPInfo
• 0x4662ec GetACP
• 0x4662f0 FreeResource
• 0x4662f4 InterlockedExchange
• 0x4662f8 FreeLibrary
• 0x4662fc FormatMessageA
• 0x466300 FindResourceA
• 0x466308 EnumCalendarInfoA
• 0x466314 CreateThread
• 0x466318 CreateFileA
• 0x46631c CreateEventA
• 0x466320 CompareStringA
• 0x466324 CloseHandle
Library version.dll:
• 0x46632c VerQueryValueA
• 0x466334 GetFileVersionInfoA
Library gdi32.dll:
• 0x46633c UnrealizeObject
• 0x466340 StretchBlt
• 0x466344 SetWindowOrgEx
• 0x466348 SetViewportOrgEx
• 0x46634c SetTextColor
• 0x466350 SetStretchBltMode
• 0x466354 SetROP2
• 0x466358 SetPixel
• 0x46635c SetDIBColorTable
• 0x466360 SetBrushOrgEx
• 0x466364 SetBkMode
• 0x466368 SetBkColor
• 0x46636c SelectPalette
• 0x466370 SelectObject
• 0x466374 SaveDC
• 0x466378 RestoreDC
• 0x46637c RectVisible
• 0x466380 RealizePalette
• 0x466384 PatBlt
• 0x466388 MoveToEx
• 0x46638c MaskBlt
• 0x466390 LineTo
• 0x466394 IntersectClipRect
• 0x466398 GetWindowOrgEx
• 0x46639c GetTextMetricsA
• 0x4663a8 GetStockObject
• 0x4663ac GetPixel
• 0x4663b0 GetPaletteEntries
• 0x4663b4 GetObjectA
• 0x4663b8 GetDeviceCaps
• 0x4663bc GetDIBits
• 0x4663c0 GetDIBColorTable
• 0x4663c4 GetDCOrgEx
• 0x4663cc GetClipBox
• 0x4663d0 GetBrushOrgEx
• 0x4663d4 GetBitmapBits
• 0x4663d8 ExtTextOutA
• 0x4663dc ExcludeClipRect
• 0x4663e0 DeleteObject
• 0x4663e4 DeleteDC
• 0x4663e8 CreateSolidBrush
• 0x4663ec CreatePenIndirect
• 0x4663f0 CreatePalette
• 0x4663f8 CreateFontIndirectA
• 0x4663fc CreateDIBitmap
• 0x466400 CreateDIBSection
• 0x466404 CreateCompatibleDC
• 0x46640c CreateBrushIndirect
• 0x466410 CreateBitmap
• 0x466414 BitBlt
Library opengl32.dll:
• 0x46641c wglCreateContext
Library user32.dll:
• 0x466424 CreateWindowExA
• 0x466428 WindowFromPoint
• 0x46642c WinHelpA
• 0x466430 WaitMessage
• 0x466434 UpdateWindow
• 0x466438 UnregisterClassA
• 0x46643c UnhookWindowsHookEx
• 0x466440 TranslateMessage
• 0x466448 TrackPopupMenu
• 0x466450 ShowWindow
• 0x466454 ShowScrollBar
• 0x466458 ShowOwnedPopups
• 0x46645c ShowCursor
• 0x466460 SetWindowsHookExA
• 0x466464 SetWindowPos
• 0x466468 SetWindowPlacement
• 0x46646c SetWindowLongA
• 0x466470 SetTimer
• 0x466474 SetScrollRange
• 0x466478 SetScrollPos
• 0x46647c SetScrollInfo
• 0x466480 SetRect
• 0x466484 SetPropA
• 0x466488 SetParent
• 0x46648c SetMenuItemInfoA
• 0x466490 SetMenu
• 0x466494 SetForegroundWindow
• 0x466498 SetFocus
• 0x46649c SetCursor
• 0x4664a0 SetClassLongA
• 0x4664a4 SetCapture
• 0x4664a8 SetActiveWindow
• 0x4664ac SendMessageA
• 0x4664b0 ScrollWindow
• 0x4664b4 ScreenToClient
• 0x4664b8 RemovePropA
• 0x4664bc RemoveMenu
• 0x4664c0 ReleaseDC
• 0x4664c4 ReleaseCapture
• 0x4664d0 RegisterClassA
• 0x4664d4 RedrawWindow
• 0x4664d8 PtInRect
• 0x4664dc PostQuitMessage
• 0x4664e0 PostMessageA
• 0x4664e4 PeekMessageA
• 0x4664e8 OffsetRect
• 0x4664ec OemToCharA
• 0x4664f0 MessageBoxA
• 0x4664f4 MapWindowPoints
• 0x4664f8 MapVirtualKeyA
• 0x4664fc LoadStringA
• 0x466500 LoadKeyboardLayoutA
• 0x466504 LoadIconA
• 0x466508 LoadCursorA
• 0x46650c LoadBitmapA
• 0x466510 KillTimer
• 0x466514 IsZoomed
• 0x466518 IsWindowVisible
• 0x46651c IsWindowEnabled
• 0x466520 IsWindow
• 0x466524 IsRectEmpty
• 0x466528 IsIconic
• 0x46652c IsDialogMessageA
• 0x466530 IsChild
• 0x466534 InvalidateRect
• 0x466538 IntersectRect
• 0x46653c InsertMenuItemA
• 0x466540 InsertMenuA
• 0x466544 InflateRect
• 0x46654c GetWindowTextA
• 0x466550 GetWindowRect
• 0x466554 GetWindowPlacement
• 0x466558 GetWindowLongA
• 0x46655c GetWindowDC
• 0x466560 GetTopWindow
• 0x466564 GetSystemMetrics
• 0x466568 GetSystemMenu
• 0x46656c GetSysColorBrush
• 0x466570 GetSysColor
• 0x466574 GetSubMenu
• 0x466578 GetScrollRange
• 0x46657c GetScrollPos
• 0x466580 GetScrollInfo
• 0x466584 GetPropA
• 0x466588 GetParent
• 0x46658c GetWindow
• 0x466590 GetMenuStringA
• 0x466594 GetMenuState
• 0x466598 GetMenuItemInfoA
• 0x46659c GetMenuItemID
• 0x4665a0 GetMenuItemCount
• 0x4665a4 GetMenu
• 0x4665a8 GetLastActivePopup
• 0x4665ac GetKeyboardState
• 0x4665b4 GetKeyboardLayout
• 0x4665b8 GetKeyState
• 0x4665bc GetKeyNameTextA
• 0x4665c0 GetIconInfo
• 0x4665c4 GetForegroundWindow
• 0x4665c8 GetFocus
• 0x4665cc GetDlgItem
• 0x4665d0 GetDesktopWindow
• 0x4665d4 GetDCEx
• 0x4665d8 GetDC
• 0x4665dc GetCursorPos
• 0x4665e0 GetCursor
• 0x4665e4 GetClientRect
• 0x4665e8 GetClassNameA
• 0x4665ec GetClassInfoA
• 0x4665f0 GetCapture
• 0x4665f4 GetActiveWindow
• 0x4665f8 FrameRect
• 0x4665fc FindWindowA
• 0x466600 FillRect
• 0x466604 EqualRect
• 0x466608 EnumWindows
• 0x46660c EnumThreadWindows
• 0x466610 EndPaint
• 0x466614 EnableWindow
• 0x466618 EnableScrollBar
• 0x46661c EnableMenuItem
• 0x466620 DrawTextA
• 0x466624 DrawMenuBar
• 0x466628 DrawIconEx
• 0x46662c DrawIcon
• 0x466630 DrawFrameControl
• 0x466634 DrawEdge
• 0x466638 DispatchMessageA
• 0x46663c DestroyWindow
• 0x466640 DestroyMenu
• 0x466644 DestroyIcon
• 0x466648 DestroyCursor
• 0x46664c DeleteMenu
• 0x466650 DefWindowProcA
• 0x466654 DefMDIChildProcA
• 0x466658 DefFrameProcA
• 0x46665c CreatePopupMenu
• 0x466660 CreateMenu
• 0x466664 CreateIcon
• 0x466668 ClientToScreen
• 0x46666c CheckMenuItem
• 0x466670 CallWindowProcA
• 0x466674 CallNextHookEx
• 0x466678 BeginPaint
• 0x46667c CharNextA
• 0x466680 CharLowerA
• 0x466684 CharToOemA
• 0x466688 AdjustWindowRectEx
Library kernel32.dll:
• 0x466694 Sleep
Library oleaut32.dll:
• 0x46669c SafeArrayPtrOfIndex
• 0x4666a0 SafeArrayGetUBound
• 0x4666a4 SafeArrayGetLBound
• 0x4666a8 SafeArrayCreate
• 0x4666ac VariantChangeType
• 0x4666b0 VariantCopy
• 0x4666b4 VariantClear
• 0x4666b8 VariantInit
Library comctl32.dll:
• 0x4666c8 ImageList_Write
• 0x4666cc ImageList_Read
• 0x4666dc ImageList_DragMove
• 0x4666e0 ImageList_DragLeave
• 0x4666e4 ImageList_DragEnter
• 0x4666e8 ImageList_EndDrag
• 0x4666ec ImageList_BeginDrag
• 0x4666f0 ImageList_Remove
• 0x4666f4 ImageList_DrawEx
• 0x4666f8 ImageList_Draw
• 0x466708 ImageList_Add
• 0x466710 ImageList_Destroy
• 0x466714 ImageList_Create
• 0x466718 InitCommonControls
Library comdlg32.dll:
• 0x466720 GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 50568 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 62912 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.