6.2
高危
57 个模型检测该样本为恶意！
重新分析
更多

2317f17463f1afca13682f949cc61f1d6bc123e681d12a7d645216a0650eae87

a8aa9233c43c081c7950b05b79a1d1b1.exe

分析耗时

30s

最近分析

文件大小

967.5KB
静态报毒 动态报毒 100% 8G0@AS@AL8BI AGEN AGENTTESLA AI SCORE=86 ALI2000015 ANDROM AUTO AUTV CLASSIC CONFIDENCE DELF DELFINJECT DELPHILESS ELKP ELLX FAREIT HIGH CONFIDENCE HIVVDV KDFU KRYPTIK MALICIOUS PE P+NYBNNM6MS R + MAL R06EC0DI220 SCORE SONBOKLI STATIC AI TROJANX TSCOPE UNSAFE X2059 ZELPHIF ZUSY 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
Avast Win32:TrojanX-gen [Trj] 20201228 21.1.5827.0
Baidu 20190318 1.0.0.2
Kingsoft 20201228 2017.9.26.565
McAfee Fareit-FSK!A8AA9233C43C 20201228 6.0.6.653
Tencent Win32.Trojan.Inject.Auto 20201228 1.0.0.1
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619827711.911
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 35454784
registers.edi: 0
registers.eax: 0
registers.ebp: 35454856
registers.edx: 0
registers.ebx: 0
registers.esi: 0
registers.ecx: 6
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5e e9 6b 3e f7
exception.symbol: a8aa9233c43c081c7950b05b79a1d1b1+0x8f9d8
exception.instruction: div eax
exception.module: a8aa9233c43c081c7950b05b79a1d1b1.exe
exception.exception_code: 0xc0000094
exception.offset: 588248
exception.address: 0x48f9d8
success 0 0
1619827714.89475
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75177f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75174de3
a8aa9233c43c081c7950b05b79a1d1b1+0x58a4d @ 0x458a4d
a8aa9233c43c081c7950b05b79a1d1b1+0x51254 @ 0x451254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfd9314ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619827711.723
NtAllocateVirtualMemory
process_identifier: 2064
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00350000
success 0 0
1619827711.911
NtAllocateVirtualMemory
process_identifier: 2064
region_size: 49152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x006a0000
success 0 0
1619827711.911
NtAllocateVirtualMemory
process_identifier: 2064
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f00000
success 0 0
1619827713.70775
NtProtectVirtualMemory
process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619827713.75375
NtAllocateVirtualMemory
process_identifier: 912
region_size: 1638400
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01e10000
success 0 0
1619827713.75375
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f60000
success 0 0
1619827713.75375
NtAllocateVirtualMemory
process_identifier: 912
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00550000
success 0 0
1619827713.75375
NtProtectVirtualMemory
process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 299008
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00552000
success 0 0
1619827714.17575
NtAllocateVirtualMemory
process_identifier: 912
region_size: 589824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01e10000
success 0 0
1619827714.17575
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01e60000
success 0 0
1619827714.87875
NtProtectVirtualMemory
process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003d2000
success 0 0
1619827714.87875
NtProtectVirtualMemory
process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619827714.87875
NtProtectVirtualMemory
process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003d2000
success 0 0
1619827714.87875
NtProtectVirtualMemory
process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619827714.87875
NtProtectVirtualMemory
process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003d2000
success 0 0
1619827714.87875
NtProtectVirtualMemory
process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619827714.87875
NtProtectVirtualMemory
process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003d2000
success 0 0
1619827714.87875
NtProtectVirtualMemory
process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619827714.87875
NtProtectVirtualMemory
process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003d2000
success 0 0
1619827714.87875
NtProtectVirtualMemory
process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619827714.87875
NtProtectVirtualMemory
process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003d2000
success 0 0
1619827714.87875
NtProtectVirtualMemory
process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619827714.87875
NtProtectVirtualMemory
process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003d2000
success 0 0
1619827714.87875
NtProtectVirtualMemory
process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619827714.87875
NtProtectVirtualMemory
process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003d2000
success 0 0
1619827714.87875
NtProtectVirtualMemory
process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619827714.87875
NtProtectVirtualMemory
process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003d2000
success 0 0
1619827714.87875
NtProtectVirtualMemory
process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619827714.87875
NtProtectVirtualMemory
process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003d2000
success 0 0
1619827714.87875
NtProtectVirtualMemory
process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (4 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (3 个事件)
entropy 7.535134823156276 section {'size_of_data': '0x0000e400', 'virtual_address': '0x00090000', 'entropy': 7.535134823156276, 'name': 'DATA', 'virtual_size': '0x0000e3ec'} description A section with a high entropy has been found
entropy 7.2464670997123415 section {'size_of_data': '0x00046800', 'virtual_address': '0x000b1000', 'entropy': 7.2464670997123415, 'name': '.rsrc', 'virtual_size': '0x000467ac'} description A section with a high entropy has been found
entropy 0.35075012933264355 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2064 called NtSetContextThread to modify thread in remote process 912
Time & API Arguments Status Return Repeated
1619827712.801
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4888848
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 912
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2064 resumed a thread in remote process 912
Time & API Arguments Status Return Repeated
1619827713.489
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 912
success 0 0
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619827712.723
CreateProcessInternalW
thread_identifier: 2544
thread_handle: 0x000000fc
process_identifier: 912
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a8aa9233c43c081c7950b05b79a1d1b1.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619827712.723
NtUnmapViewOfSection
process_identifier: 912
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619827712.723
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 912
commit_size: 700416
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 700416
base_address: 0x00400000
success 0 0
1619827712.801
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1619827712.801
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4888848
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 912
success 0 0
1619827713.489
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 912
success 0 0
File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 个事件)
Elastic malicious (high confidence)
DrWeb Trojan.PWS.Stealer.27207
MicroWorld-eScan Trojan.Delf.FareIt.Gen.13
FireEye Generic.mg.a8aa9233c43c081c
Qihoo-360 Win32/Backdoor.650
ALYac Spyware.AgentTesla
Cylance Unsafe
Sangfor Malware
K7AntiVirus Trojan ( 0056a6721 )
Alibaba Trojan:Win32/DelfInject.ali2000015
K7GW Trojan ( 0056a6721 )
Cybereason malicious.3c43c0
Arcabit Trojan.Delf.FareIt.Gen.13
BitDefenderTheta Gen:NN.ZelphiF.34700.8G0@aS@al8bi
Cyren W32/Injector.KDFU-7886
Symantec Trojan.Gen.2
ESET-NOD32 a variant of Win32/Injector.ELLX
APEX Malicious
Avast Win32:TrojanX-gen [Trj]
ClamAV Win.Trojan.Zusy-9608603-0
Kaspersky HEUR:Backdoor.Win32.Androm.gen
BitDefender Trojan.Delf.FareIt.Gen.13
NANO-Antivirus Trojan.Win32.Stealer.hivvdv
Paloalto generic.ml
Rising Trojan.Injector!1.C561 (CLASSIC)
Ad-Aware Trojan.Delf.FareIt.Gen.13
Emsisoft Trojan.Delf.FareIt.Gen.13 (B)
F-Secure Heuristic.HEUR/AGEN.1136310
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R06EC0DI220
McAfee-GW-Edition BehavesLike.Win32.Fareit.dc
Sophos Mal/Generic-R + Mal/Fareit-AA
SentinelOne Static AI - Malicious PE
Jiangmin Backdoor.Androm.autv
Webroot W32.Injector.Gen
Avira HEUR/AGEN.1136310
Antiy-AVL Trojan/Win32.Sonbokli
Gridinsoft Trojan.Win32.Kryptik.dd!n
Microsoft PWS:Win32/Fareit.AR!MTB
ZoneAlarm HEUR:Backdoor.Win32.Androm.gen
GData Trojan.Delf.FareIt.Gen.13
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2059
Acronis suspicious
McAfee Fareit-FSK!A8AA9233C43C
MAX malware (ai score=86)
VBA32 TScope.Trojan.Delf
Malwarebytes Trojan.MalPack.DLF
TrendMicro-HouseCall TROJ_GEN.R06EC0DI220
Tencent Win32.Trojan.Inject.Auto
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x4a0178 VirtualFree
• 0x4a017c VirtualAlloc
• 0x4a0180 LocalFree
• 0x4a0184 LocalAlloc
• 0x4a0188 GetVersion
• 0x4a018c GetCurrentThreadId
• 0x4a0198 VirtualQuery
• 0x4a019c WideCharToMultiByte
• 0x4a01a0 MultiByteToWideChar
• 0x4a01a4 lstrlenA
• 0x4a01a8 lstrcpynA
• 0x4a01ac LoadLibraryExA
• 0x4a01b0 GetThreadLocale
• 0x4a01b4 GetStartupInfoA
• 0x4a01b8 GetProcAddress
• 0x4a01bc GetModuleHandleA
• 0x4a01c0 GetModuleFileNameA
• 0x4a01c4 GetLocaleInfoA
• 0x4a01c8 GetCommandLineA
• 0x4a01cc FreeLibrary
• 0x4a01d0 FindFirstFileA
• 0x4a01d4 FindClose
• 0x4a01d8 ExitProcess
• 0x4a01dc WriteFile
• 0x4a01e4 RtlUnwind
• 0x4a01e8 RaiseException
• 0x4a01ec GetStdHandle
Library user32.dll:
• 0x4a01f4 GetKeyboardType
• 0x4a01f8 LoadStringA
• 0x4a01fc MessageBoxA
• 0x4a0200 CharNextA
Library advapi32.dll:
• 0x4a0208 RegQueryValueExA
• 0x4a020c RegOpenKeyExA
• 0x4a0210 RegCloseKey
Library oleaut32.dll:
• 0x4a0218 SysFreeString
• 0x4a021c SysReAllocStringLen
• 0x4a0220 SysAllocStringLen
Library kernel32.dll:
• 0x4a0228 TlsSetValue
• 0x4a022c TlsGetValue
• 0x4a0230 LocalAlloc
• 0x4a0234 GetModuleHandleA
Library advapi32.dll:
• 0x4a023c RegQueryValueExA
• 0x4a0240 RegOpenKeyExA
• 0x4a0244 RegCloseKey
Library kernel32.dll:
• 0x4a024c lstrcpyA
• 0x4a0250 WriteFile
• 0x4a0254 WinExec
• 0x4a0258 WaitForSingleObject
• 0x4a025c VirtualQuery
• 0x4a0260 VirtualAlloc
• 0x4a0264 Sleep
• 0x4a0268 SizeofResource
• 0x4a026c SetThreadLocale
• 0x4a0270 SetFilePointer
• 0x4a0274 SetEvent
• 0x4a0278 SetErrorMode
• 0x4a027c SetEndOfFile
• 0x4a0280 SearchPathA
• 0x4a0284 ResetEvent
• 0x4a0288 ReleaseMutex
• 0x4a028c ReadFile
• 0x4a0290 OpenFileMappingA
• 0x4a0294 MultiByteToWideChar
• 0x4a0298 MulDiv
• 0x4a029c LockResource
• 0x4a02a0 LoadResource
• 0x4a02a4 LoadLibraryA
• 0x4a02ac IsDBCSLeadByte
• 0x4a02b4 GlobalUnlock
• 0x4a02b8 GlobalReAlloc
• 0x4a02bc GlobalHandle
• 0x4a02c0 GlobalLock
• 0x4a02c4 GlobalFree
• 0x4a02c8 GlobalFindAtomA
• 0x4a02cc GlobalDeleteAtom
• 0x4a02d0 GlobalAlloc
• 0x4a02d4 GlobalAddAtomA
• 0x4a02d8 GetVersionExA
• 0x4a02dc GetVersion
• 0x4a02e0 GetTickCount
• 0x4a02e4 GetThreadLocale
• 0x4a02ec GetSystemTime
• 0x4a02f0 GetSystemInfo
• 0x4a02f4 GetStringTypeExA
• 0x4a02f8 GetStdHandle
• 0x4a02fc GetProcAddress
• 0x4a0300 GetModuleHandleA
• 0x4a0304 GetModuleFileNameA
• 0x4a0308 GetLocaleInfoA
• 0x4a030c GetLocalTime
• 0x4a0310 GetLastError
• 0x4a0314 GetFullPathNameA
• 0x4a0318 GetDiskFreeSpaceA
• 0x4a031c GetDateFormatA
• 0x4a0320 GetCurrentThreadId
• 0x4a0324 GetCurrentProcessId
• 0x4a032c GetCPInfo
• 0x4a0330 GetACP
• 0x4a0334 FreeResource
• 0x4a033c InterlockedExchange
• 0x4a0344 FreeLibrary
• 0x4a0348 FormatMessageA
• 0x4a034c FindResourceA
• 0x4a0350 FindFirstFileA
• 0x4a0354 FindClose
• 0x4a0364 FatalAppExitA
• 0x4a0368 ExitThread
• 0x4a036c EnumCalendarInfoA
• 0x4a0378 CreateThread
• 0x4a037c CreateMutexA
• 0x4a0380 CreateFileA
• 0x4a0384 CreateEventA
• 0x4a0388 CompareStringA
• 0x4a038c CloseHandle
Library version.dll:
• 0x4a0394 VerQueryValueA
• 0x4a039c GetFileVersionInfoA
Library gdi32.dll:
• 0x4a03a4 UnrealizeObject
• 0x4a03a8 StretchBlt
• 0x4a03ac SetWindowOrgEx
• 0x4a03b0 SetViewportOrgEx
• 0x4a03b4 SetTextColor
• 0x4a03b8 SetStretchBltMode
• 0x4a03bc SetROP2
• 0x4a03c0 SetPixel
• 0x4a03c4 SetDIBColorTable
• 0x4a03c8 SetBrushOrgEx
• 0x4a03cc SetBkMode
• 0x4a03d0 SetBkColor
• 0x4a03d4 SelectPalette
• 0x4a03d8 SelectObject
• 0x4a03dc SaveDC
• 0x4a03e0 RestoreDC
• 0x4a03e4 Rectangle
• 0x4a03e8 RectVisible
• 0x4a03ec RealizePalette
• 0x4a03f0 PatBlt
• 0x4a03f4 MoveToEx
• 0x4a03f8 MaskBlt
• 0x4a03fc LineTo
• 0x4a0400 IntersectClipRect
• 0x4a0404 GetWindowOrgEx
• 0x4a0408 GetTextMetricsA
• 0x4a0414 GetStockObject
• 0x4a0418 GetPixel
• 0x4a041c GetPaletteEntries
• 0x4a0420 GetObjectA
• 0x4a0424 GetDeviceCaps
• 0x4a0428 GetDIBits
• 0x4a042c GetDIBColorTable
• 0x4a0430 GetDCOrgEx
• 0x4a0438 GetClipBox
• 0x4a043c GetBrushOrgEx
• 0x4a0440 GetBitmapBits
• 0x4a0444 ExtTextOutA
• 0x4a0448 ExcludeClipRect
• 0x4a044c DeleteObject
• 0x4a0450 DeleteDC
• 0x4a0454 CreateSolidBrush
• 0x4a0458 CreatePenIndirect
• 0x4a045c CreatePalette
• 0x4a0464 CreateFontIndirectA
• 0x4a0468 CreateDIBitmap
• 0x4a046c CreateDIBSection
• 0x4a0470 CreateCompatibleDC
• 0x4a0478 CreateBrushIndirect
• 0x4a047c CreateBitmap
• 0x4a0480 BitBlt
Library user32.dll:
• 0x4a0488 CreateWindowExA
• 0x4a048c WindowFromPoint
• 0x4a0490 WinHelpA
• 0x4a0494 WaitMessage
• 0x4a0498 UpdateWindow
• 0x4a049c UnregisterClassA
• 0x4a04a0 UnhookWindowsHookEx
• 0x4a04a4 TranslateMessage
• 0x4a04ac TrackPopupMenu
• 0x4a04b4 ShowWindow
• 0x4a04b8 ShowScrollBar
• 0x4a04bc ShowOwnedPopups
• 0x4a04c0 ShowCursor
• 0x4a04c4 SetWindowsHookExA
• 0x4a04c8 SetWindowTextA
• 0x4a04cc SetWindowPos
• 0x4a04d0 SetWindowPlacement
• 0x4a04d4 SetWindowLongA
• 0x4a04d8 SetTimer
• 0x4a04dc SetScrollRange
• 0x4a04e0 SetScrollPos
• 0x4a04e4 SetScrollInfo
• 0x4a04e8 SetRect
• 0x4a04ec SetPropA
• 0x4a04f0 SetParent
• 0x4a04f4 SetMenuItemInfoA
• 0x4a04f8 SetMenu
• 0x4a04fc SetForegroundWindow
• 0x4a0500 SetFocus
• 0x4a0504 SetCursor
• 0x4a0508 SetClassLongA
• 0x4a050c SetCapture
• 0x4a0510 SetActiveWindow
• 0x4a0514 SendMessageA
• 0x4a0518 ScrollWindow
• 0x4a051c ScreenToClient
• 0x4a0520 RemovePropA
• 0x4a0524 RemoveMenu
• 0x4a0528 ReleaseDC
• 0x4a052c ReleaseCapture
• 0x4a0538 RegisterClassA
• 0x4a053c RedrawWindow
• 0x4a0540 PtInRect
• 0x4a0544 PostQuitMessage
• 0x4a0548 PostMessageA
• 0x4a054c PeekMessageA
• 0x4a0550 OffsetRect
• 0x4a0554 OemToCharBuffA
• 0x4a0558 OemToCharA
• 0x4a055c MessageBoxA
• 0x4a0560 MapWindowPoints
• 0x4a0564 MapVirtualKeyA
• 0x4a0568 LoadStringA
• 0x4a056c LoadKeyboardLayoutA
• 0x4a0570 LoadIconA
• 0x4a0574 LoadCursorA
• 0x4a0578 LoadBitmapA
• 0x4a057c KillTimer
• 0x4a0580 IsZoomed
• 0x4a0584 IsWindowVisible
• 0x4a0588 IsWindowEnabled
• 0x4a058c IsWindow
• 0x4a0590 IsRectEmpty
• 0x4a0594 IsIconic
• 0x4a0598 IsDialogMessageA
• 0x4a059c IsChild
• 0x4a05a0 InvalidateRect
• 0x4a05a4 IntersectRect
• 0x4a05a8 InsertMenuItemA
• 0x4a05ac InsertMenuA
• 0x4a05b0 InflateRect
• 0x4a05b8 GetWindowTextA
• 0x4a05bc GetWindowRect
• 0x4a05c0 GetWindowPlacement
• 0x4a05c4 GetWindowLongA
• 0x4a05c8 GetWindowDC
• 0x4a05cc GetTopWindow
• 0x4a05d0 GetSystemMetrics
• 0x4a05d4 GetSystemMenu
• 0x4a05d8 GetSysColorBrush
• 0x4a05dc GetSysColor
• 0x4a05e0 GetSubMenu
• 0x4a05e4 GetScrollRange
• 0x4a05e8 GetScrollPos
• 0x4a05ec GetScrollInfo
• 0x4a05f0 GetPropA
• 0x4a05f4 GetParent
• 0x4a05f8 GetWindow
• 0x4a05fc GetMenuStringA
• 0x4a0600 GetMenuState
• 0x4a0604 GetMenuItemInfoA
• 0x4a0608 GetMenuItemID
• 0x4a060c GetMenuItemCount
• 0x4a0610 GetMenu
• 0x4a0614 GetLastActivePopup
• 0x4a0618 GetKeyboardState
• 0x4a0620 GetKeyboardLayout
• 0x4a0624 GetKeyState
• 0x4a0628 GetKeyNameTextA
• 0x4a062c GetIconInfo
• 0x4a0630 GetForegroundWindow
• 0x4a0634 GetFocus
• 0x4a0638 GetDesktopWindow
• 0x4a063c GetDCEx
• 0x4a0640 GetDC
• 0x4a0644 GetCursorPos
• 0x4a0648 GetCursor
• 0x4a064c GetClientRect
• 0x4a0650 GetClassNameA
• 0x4a0654 GetClassInfoA
• 0x4a0658 GetCapture
• 0x4a065c GetActiveWindow
• 0x4a0660 FrameRect
• 0x4a0664 FindWindowA
• 0x4a0668 FillRect
• 0x4a066c EqualRect
• 0x4a0670 EnumWindows
• 0x4a0674 EnumThreadWindows
• 0x4a0678 EndPaint
• 0x4a067c EnableWindow
• 0x4a0680 EnableScrollBar
• 0x4a0684 EnableMenuItem
• 0x4a0688 DrawTextA
• 0x4a068c DrawMenuBar
• 0x4a0690 DrawIconEx
• 0x4a0694 DrawIcon
• 0x4a0698 DrawFrameControl
• 0x4a069c DrawFocusRect
• 0x4a06a0 DrawEdge
• 0x4a06a4 DispatchMessageA
• 0x4a06a8 DestroyWindow
• 0x4a06ac DestroyMenu
• 0x4a06b0 DestroyIcon
• 0x4a06b4 DestroyCursor
• 0x4a06b8 DeleteMenu
• 0x4a06bc DefWindowProcA
• 0x4a06c0 DefMDIChildProcA
• 0x4a06c4 DefFrameProcA
• 0x4a06c8 CreatePopupMenu
• 0x4a06cc CreateMenu
• 0x4a06d0 CreateIcon
• 0x4a06d4 ClientToScreen
• 0x4a06d8 CheckMenuItem
• 0x4a06dc CallWindowProcA
• 0x4a06e0 CallNextHookEx
• 0x4a06e4 BringWindowToTop
• 0x4a06e8 BeginPaint
• 0x4a06ec CharNextA
• 0x4a06f0 CharLowerA
• 0x4a06f4 CharUpperBuffA
• 0x4a06f8 CharToOemBuffA
• 0x4a06fc CharToOemA
• 0x4a0700 AdjustWindowRectEx
Library kernel32.dll:
• 0x4a070c Sleep
Library oleaut32.dll:
• 0x4a0714 SafeArrayPtrOfIndex
• 0x4a0718 SafeArrayPutElement
• 0x4a071c SafeArrayGetElement
• 0x4a0724 SafeArrayAccessData
• 0x4a0728 SafeArrayGetUBound
• 0x4a072c SafeArrayGetLBound
• 0x4a0730 SafeArrayCreate
• 0x4a0734 VariantChangeType
• 0x4a0738 VariantCopyInd
• 0x4a073c VariantCopy
• 0x4a0740 VariantClear
• 0x4a0744 VariantInit
Library ole32.dll:
• 0x4a074c CoCreateInstance
• 0x4a0750 CoUninitialize
• 0x4a0754 CoInitialize
Library oleaut32.dll:
• 0x4a075c GetErrorInfo
• 0x4a0760 SysFreeString
Library comctl32.dll:
• 0x4a0770 ImageList_Write
• 0x4a0774 ImageList_Read
• 0x4a0784 ImageList_DragMove
• 0x4a0788 ImageList_DragLeave
• 0x4a078c ImageList_DragEnter
• 0x4a0790 ImageList_EndDrag
• 0x4a0794 ImageList_BeginDrag
• 0x4a0798 ImageList_Remove
• 0x4a079c ImageList_DrawEx
• 0x4a07a0 ImageList_Draw
• 0x4a07b0 ImageList_Add
• 0x4a07b8 ImageList_Destroy
• 0x4a07bc ImageList_Create
Library comdlg32.dll:
• 0x4a07c4 ReplaceTextA
• 0x4a07c8 FindTextA
Library user32.dll:
• 0x4a07d0 DdeCmpStringHandles
• 0x4a07d4 DdeFreeStringHandle
• 0x4a07d8 DdeQueryStringA
• 0x4a07e0 DdeGetLastError
• 0x4a07e4 DdeFreeDataHandle
• 0x4a07e8 DdeUnaccessData
• 0x4a07ec DdeAccessData
• 0x4a07f0 DdeCreateDataHandle
• 0x4a07f8 DdeNameService
• 0x4a07fc DdePostAdvise
• 0x4a0800 DdeSetUserHandle
• 0x4a0804 DdeQueryConvInfo
• 0x4a0808 DdeDisconnect
• 0x4a080c DdeConnect
• 0x4a0810 DdeUninitialize
• 0x4a0814 DdeInitializeA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.