5.8
高危
62 个模型检测该样本为恶意！
重新分析
更多

cc71aaff5556a4053df2846a191ff63e54b3b10df75b98a3d8d5edc4c02c7d1b

aa54e572432813a7d322e244339aa7b6.exe

分析耗时

21s

最近分析

文件大小

889.0KB
静态报毒 动态报毒 0NA103G920 3GW@AYOAXXFI AI SCORE=83 AIDETECTVM ALI2000015 APHI CLOUD CONFIDENCE DELF DELFFAREIT DELFINJECT DELPHILESS EMOY FAREIT FAREITIH GENETIC HIGH HIGH CONFIDENCE HNHNSR IYOHV KRYPTIK LNEA LOKIBOT MALWARE1 MALWARE@#1QEKK1SVEF990 NOON QERZ S14938321 SCORE SIGGEN9 SUSPICIOUS PE TROJAN3 TSCOPE UNSAFE X2080 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FVZ!AA54E5724328 20200722 6.0.6.653
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20200722 18.4.3895.0
Kingsoft 20200722 2013.8.14.323
Tencent Win32.Trojan-spy.Noon.Lnea 20200722 1.0.0.1
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619826884.720408
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49151812
registers.edi: 0
registers.eax: 0
registers.ebp: 49151880
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 3068
exception.instruction_r: f7 f0 89 c9 89 c9 89 c9 33 c0 5a 59 59 64 89 10
exception.symbol: aa54e572432813a7d322e244339aa7b6+0x716f0
exception.instruction: div eax
exception.module: aa54e572432813a7d322e244339aa7b6.exe
exception.exception_code: 0xc0000094
exception.offset: 464624
exception.address: 0x4716f0
success 0 0
1619854630.281875
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
aa54e572432813a7d322e244339aa7b6+0xb43f8 @ 0x4b43f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75154b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75155d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff6214ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (28 个事件)
Time & API Arguments Status Return Repeated
1619826884.454408
NtAllocateVirtualMemory
process_identifier: 2404
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619826884.720408
NtProtectVirtualMemory
process_identifier: 2404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 32768
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00471000
success 0 0
1619826884.735408
NtAllocateVirtualMemory
process_identifier: 2404
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x005f0000
success 0 0
1619854629.859875
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619854629.922875
NtAllocateVirtualMemory
process_identifier: 2196
region_size: 458752
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01f40000
success 0 0
1619854629.922875
NtAllocateVirtualMemory
process_identifier: 2196
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f70000
success 0 0
1619854629.922875
NtAllocateVirtualMemory
process_identifier: 2196
region_size: 704512
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01fb0000
success 0 0
1619854629.922875
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 675840
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fb2000
success 0 0
1619854630.266875
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x020c2000
success 0 0
1619854630.266875
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619854630.266875
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x020c2000
success 0 0
1619854630.266875
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619854630.266875
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x020c2000
success 0 0
1619854630.266875
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619854630.266875
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x020c2000
success 0 0
1619854630.266875
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619854630.266875
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x020c2000
success 0 0
1619854630.266875
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619854630.281875
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x020c2000
success 0 0
1619854630.281875
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619854630.281875
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x020c2000
success 0 0
1619854630.281875
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619854630.281875
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x020c2000
success 0 0
1619854630.281875
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619854630.281875
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x020c2000
success 0 0
1619854630.281875
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619854630.281875
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x020c2000
success 0 0
1619854630.281875
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.379558385685125 section {'size_of_data': '0x00059400', 'virtual_address': '0x0008b000', 'entropy': 7.379558385685125, 'name': '.rsrc', 'virtual_size': '0x00059394'} description A section with a high entropy has been found
entropy 0.40202702702702703 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2404 called NtSetContextThread to modify thread in remote process 2196
Time & API Arguments Status Return Repeated
1619826885.438408
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5644768
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2196
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2404 resumed a thread in remote process 2196
Time & API Arguments Status Return Repeated
1619826885.938408
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2196
success 0 0
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619826884.891408
CreateProcessInternalW
thread_identifier: 2764
thread_handle: 0x000000fc
process_identifier: 2196
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\aa54e572432813a7d322e244339aa7b6.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619826884.891408
NtUnmapViewOfSection
process_identifier: 2196
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619826884.907408
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 2196
commit_size: 1458176
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 1458176
base_address: 0x00400000
success 0 0
1619826885.438408
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1619826885.438408
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5644768
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2196
success 0 0
1619826885.938408
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2196
success 0 0
File has been identified by 62 AntiVirus engines on VirusTotal as malicious (50 out of 62 个事件)
Bkav W32.AIDetectVM.malware1
MicroWorld-eScan Trojan.Delf.FareIt.Gen.7
FireEye Generic.mg.aa54e572432813a7
CAT-QuickHeal Trojan.FareitIH.S14938321
McAfee Fareit-FVZ!AA54E5724328
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
AegisLab Trojan.Multi.Generic.4!c
Sangfor Malware
K7AntiVirus Trojan ( 0056a4951 )
Alibaba Trojan:Win32/DelfInject.ali2000015
K7GW Trojan ( 0056a4951 )
Cybereason malicious.6d1087
Arcabit Trojan.Delf.FareIt.Gen.7
TrendMicro TROJ_FRS.0NA103G920
F-Prot W32/Trojan3.APHI
Symantec Infostealer.Lokibot!43
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan-Spy.Win32.Noon.gen
BitDefender Trojan.Delf.FareIt.Gen.7
NANO-Antivirus Trojan.Win32.Kryptik.hnhnsr
SUPERAntiSpyware Trojan.Agent/Gen-DelfFareIt
Avast Win32:Trojan-gen
Rising Trojan.Injector!1.C898 (CLOUD)
Ad-Aware Trojan.Delf.FareIt.Gen.7
Emsisoft Trojan.Delf.FareIt.Gen.7 (B)
Comodo Malware@#1qekk1svef990
F-Secure Trojan.TR/Injector.iyohv
DrWeb Trojan.Siggen9.57321
Zillya Trojan.Injector.Win32.749204
Invincea heuristic
Trapmine malicious.high.ml.score
Sophos Mal/Generic-S
SentinelOne DFI - Suspicious PE
Cyren W32/Trojan.QERZ-4438
Jiangmin TrojanSpy.Noon.pxl
Avira TR/Injector.iyohv
Antiy-AVL Trojan/Win32.Kryptik
Microsoft PWS:Win32/Fareit.AQ!MTB
Endgame malicious (high confidence)
ZoneAlarm HEUR:Trojan-Spy.Win32.Noon.gen
GData Trojan.Delf.FareIt.Gen.7
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2080
Acronis suspicious
BitDefenderTheta Gen:NN.ZelphiF.34136.3GW@ayOaXxfi
ALYac Trojan.Delf.FareIt.Gen.7
MAX malware (ai score=83)
VBA32 TScope.Trojan.Delf
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x47d164 VirtualFree
• 0x47d168 VirtualAlloc
• 0x47d16c LocalFree
• 0x47d170 LocalAlloc
• 0x47d174 GetVersion
• 0x47d178 GetCurrentThreadId
• 0x47d184 VirtualQuery
• 0x47d188 WideCharToMultiByte
• 0x47d18c MultiByteToWideChar
• 0x47d190 lstrlenA
• 0x47d194 lstrcpynA
• 0x47d198 LoadLibraryExA
• 0x47d19c GetThreadLocale
• 0x47d1a0 GetStartupInfoA
• 0x47d1a4 GetProcAddress
• 0x47d1a8 GetModuleHandleA
• 0x47d1ac GetModuleFileNameA
• 0x47d1b0 GetLocaleInfoA
• 0x47d1b4 GetCommandLineA
• 0x47d1b8 FreeLibrary
• 0x47d1bc FindFirstFileA
• 0x47d1c0 FindClose
• 0x47d1c4 ExitProcess
• 0x47d1c8 WriteFile
• 0x47d1d0 RtlUnwind
• 0x47d1d4 RaiseException
• 0x47d1d8 GetStdHandle
Library user32.dll:
• 0x47d1e0 GetKeyboardType
• 0x47d1e4 LoadStringA
• 0x47d1e8 MessageBoxA
• 0x47d1ec CharNextA
Library advapi32.dll:
• 0x47d1f4 RegQueryValueExA
• 0x47d1f8 RegOpenKeyExA
• 0x47d1fc RegCloseKey
Library oleaut32.dll:
• 0x47d204 SysFreeString
• 0x47d208 SysReAllocStringLen
• 0x47d20c SysAllocStringLen
Library kernel32.dll:
• 0x47d214 TlsSetValue
• 0x47d218 TlsGetValue
• 0x47d21c LocalAlloc
• 0x47d220 GetModuleHandleA
Library advapi32.dll:
• 0x47d228 RegQueryValueExA
• 0x47d22c RegOpenKeyExA
• 0x47d230 RegCloseKey
Library kernel32.dll:
• 0x47d238 lstrcpyA
• 0x47d23c WriteFile
• 0x47d240 WaitForSingleObject
• 0x47d244 VirtualQuery
• 0x47d248 VirtualProtectEx
• 0x47d24c VirtualAlloc
• 0x47d250 Sleep
• 0x47d254 SizeofResource
• 0x47d258 SetThreadLocale
• 0x47d25c SetFilePointer
• 0x47d260 SetEvent
• 0x47d264 SetErrorMode
• 0x47d268 SetEndOfFile
• 0x47d26c ResetEvent
• 0x47d270 ReadFile
• 0x47d274 MultiByteToWideChar
• 0x47d278 MulDiv
• 0x47d27c LockResource
• 0x47d280 LoadResource
• 0x47d284 LoadLibraryA
• 0x47d290 GlobalUnlock
• 0x47d294 GlobalSize
• 0x47d298 GlobalReAlloc
• 0x47d29c GlobalHandle
• 0x47d2a0 GlobalLock
• 0x47d2a4 GlobalFree
• 0x47d2a8 GlobalFindAtomA
• 0x47d2ac GlobalDeleteAtom
• 0x47d2b0 GlobalAlloc
• 0x47d2b4 GlobalAddAtomA
• 0x47d2b8 GetVersionExA
• 0x47d2bc GetVersion
• 0x47d2c0 GetUserDefaultLCID
• 0x47d2c4 GetTickCount
• 0x47d2c8 GetThreadLocale
• 0x47d2cc GetSystemInfo
• 0x47d2d0 GetStringTypeExA
• 0x47d2d4 GetStdHandle
• 0x47d2d8 GetProcAddress
• 0x47d2dc GetModuleHandleA
• 0x47d2e0 GetModuleFileNameA
• 0x47d2e4 GetLocaleInfoA
• 0x47d2e8 GetLocalTime
• 0x47d2ec GetLastError
• 0x47d2f0 GetFullPathNameA
• 0x47d2f4 GetDiskFreeSpaceA
• 0x47d2f8 GetDateFormatA
• 0x47d2fc GetCurrentThreadId
• 0x47d300 GetCurrentProcessId
• 0x47d304 GetCurrentProcess
• 0x47d308 GetComputerNameA
• 0x47d30c GetCPInfo
• 0x47d310 GetACP
• 0x47d314 FreeResource
• 0x47d318 InterlockedExchange
• 0x47d31c FreeLibrary
• 0x47d320 FormatMessageA
• 0x47d324 FindResourceA
• 0x47d328 EnumCalendarInfoA
• 0x47d334 CreateThread
• 0x47d338 CreateFileA
• 0x47d33c CreateEventA
• 0x47d340 CopyFileA
• 0x47d344 CompareStringA
• 0x47d348 CloseHandle
Library version.dll:
• 0x47d350 VerQueryValueA
• 0x47d358 GetFileVersionInfoA
Library gdi32.dll:
• 0x47d360 UnrealizeObject
• 0x47d364 StretchBlt
• 0x47d368 SetWindowOrgEx
• 0x47d36c SetWinMetaFileBits
• 0x47d370 SetViewportOrgEx
• 0x47d374 SetTextColor
• 0x47d378 SetStretchBltMode
• 0x47d37c SetROP2
• 0x47d380 SetPixel
• 0x47d384 SetMapMode
• 0x47d388 SetEnhMetaFileBits
• 0x47d38c SetDIBColorTable
• 0x47d390 SetBrushOrgEx
• 0x47d394 SetBkMode
• 0x47d398 SetBkColor
• 0x47d39c SelectPalette
• 0x47d3a0 SelectObject
• 0x47d3a4 SelectClipRgn
• 0x47d3a8 SaveDC
• 0x47d3ac RestoreDC
• 0x47d3b0 Rectangle
• 0x47d3b4 RectVisible
• 0x47d3b8 RealizePalette
• 0x47d3bc Polyline
• 0x47d3c0 PlayEnhMetaFile
• 0x47d3c4 PatBlt
• 0x47d3c8 MoveToEx
• 0x47d3cc MaskBlt
• 0x47d3d0 LineTo
• 0x47d3d4 LPtoDP
• 0x47d3d8 IntersectClipRect
• 0x47d3dc GetWindowOrgEx
• 0x47d3e0 GetWinMetaFileBits
• 0x47d3e4 GetTextMetricsA
• 0x47d3f0 GetStockObject
• 0x47d3f4 GetPixel
• 0x47d3f8 GetPaletteEntries
• 0x47d3fc GetObjectA
• 0x47d40c GetEnhMetaFileBits
• 0x47d410 GetDeviceCaps
• 0x47d414 GetDIBits
• 0x47d418 GetDIBColorTable
• 0x47d41c GetDCOrgEx
• 0x47d424 GetClipBox
• 0x47d428 GetBrushOrgEx
• 0x47d42c GetBitmapBits
• 0x47d430 ExtTextOutA
• 0x47d434 ExcludeClipRect
• 0x47d438 DeleteObject
• 0x47d43c DeleteEnhMetaFile
• 0x47d440 DeleteDC
• 0x47d444 CreateSolidBrush
• 0x47d448 CreatePenIndirect
• 0x47d44c CreatePalette
• 0x47d454 CreateFontIndirectA
• 0x47d458 CreateEnhMetaFileA
• 0x47d45c CreateDIBitmap
• 0x47d460 CreateDIBSection
• 0x47d464 CreateCompatibleDC
• 0x47d46c CreateBrushIndirect
• 0x47d470 CreateBitmap
• 0x47d474 CopyEnhMetaFileA
• 0x47d478 CloseEnhMetaFile
• 0x47d47c BitBlt
Library user32.dll:
• 0x47d484 CreateWindowExA
• 0x47d488 WindowFromPoint
• 0x47d48c WinHelpA
• 0x47d490 WaitMessage
• 0x47d494 UpdateWindow
• 0x47d498 UnregisterClassA
• 0x47d49c UnhookWindowsHookEx
• 0x47d4a0 TranslateMessage
• 0x47d4a8 TrackPopupMenu
• 0x47d4b0 ShowWindow
• 0x47d4b4 ShowScrollBar
• 0x47d4b8 ShowOwnedPopups
• 0x47d4bc ShowCursor
• 0x47d4c0 SetWindowsHookExA
• 0x47d4c4 SetWindowTextA
• 0x47d4c8 SetWindowPos
• 0x47d4cc SetWindowPlacement
• 0x47d4d0 SetWindowLongA
• 0x47d4d4 SetTimer
• 0x47d4d8 SetScrollRange
• 0x47d4dc SetScrollPos
• 0x47d4e0 SetScrollInfo
• 0x47d4e4 SetRect
• 0x47d4e8 SetPropA
• 0x47d4ec SetParent
• 0x47d4f0 SetMenuItemInfoA
• 0x47d4f4 SetMenu
• 0x47d4f8 SetForegroundWindow
• 0x47d4fc SetFocus
• 0x47d500 SetCursor
• 0x47d504 SetClassLongA
• 0x47d508 SetCapture
• 0x47d50c SetActiveWindow
• 0x47d510 SendMessageA
• 0x47d514 ScrollWindow
• 0x47d518 ScreenToClient
• 0x47d51c RemovePropA
• 0x47d520 RemoveMenu
• 0x47d524 ReleaseDC
• 0x47d528 ReleaseCapture
• 0x47d534 RegisterClassA
• 0x47d538 RedrawWindow
• 0x47d53c PtInRect
• 0x47d540 PostQuitMessage
• 0x47d544 PostMessageA
• 0x47d548 PeekMessageA
• 0x47d54c OffsetRect
• 0x47d550 OemToCharA
• 0x47d554 MessageBoxA
• 0x47d558 MapWindowPoints
• 0x47d55c MapVirtualKeyA
• 0x47d560 LoadStringA
• 0x47d564 LoadKeyboardLayoutA
• 0x47d568 LoadIconA
• 0x47d56c LoadCursorA
• 0x47d570 LoadBitmapA
• 0x47d574 KillTimer
• 0x47d578 IsZoomed
• 0x47d57c IsWindowVisible
• 0x47d580 IsWindowEnabled
• 0x47d584 IsWindow
• 0x47d588 IsRectEmpty
• 0x47d58c IsIconic
• 0x47d590 IsDialogMessageA
• 0x47d594 IsChild
• 0x47d598 InvalidateRect
• 0x47d59c IntersectRect
• 0x47d5a0 InsertMenuItemA
• 0x47d5a4 InsertMenuA
• 0x47d5a8 InflateRect
• 0x47d5b0 GetWindowTextA
• 0x47d5b4 GetWindowRect
• 0x47d5b8 GetWindowPlacement
• 0x47d5bc GetWindowLongA
• 0x47d5c0 GetWindowDC
• 0x47d5c4 GetTopWindow
• 0x47d5c8 GetSystemMetrics
• 0x47d5cc GetSystemMenu
• 0x47d5d0 GetSysColorBrush
• 0x47d5d4 GetSysColor
• 0x47d5d8 GetSubMenu
• 0x47d5dc GetScrollRange
• 0x47d5e0 GetScrollPos
• 0x47d5e4 GetScrollInfo
• 0x47d5e8 GetPropA
• 0x47d5ec GetParent
• 0x47d5f0 GetWindow
• 0x47d5f4 GetMessageTime
• 0x47d5f8 GetMenuStringA
• 0x47d5fc GetMenuState
• 0x47d600 GetMenuItemInfoA
• 0x47d604 GetMenuItemID
• 0x47d608 GetMenuItemCount
• 0x47d60c GetMenu
• 0x47d610 GetLastActivePopup
• 0x47d614 GetKeyboardState
• 0x47d61c GetKeyboardLayout
• 0x47d620 GetKeyState
• 0x47d624 GetKeyNameTextA
• 0x47d628 GetIconInfo
• 0x47d62c GetForegroundWindow
• 0x47d630 GetFocus
• 0x47d634 GetDesktopWindow
• 0x47d638 GetDCEx
• 0x47d63c GetDC
• 0x47d640 GetCursorPos
• 0x47d644 GetCursor
• 0x47d648 GetClipboardData
• 0x47d64c GetClientRect
• 0x47d650 GetClassNameA
• 0x47d654 GetClassInfoA
• 0x47d658 GetCapture
• 0x47d65c GetActiveWindow
• 0x47d660 FrameRect
• 0x47d664 FindWindowA
• 0x47d668 FillRect
• 0x47d66c EqualRect
• 0x47d670 EnumWindows
• 0x47d674 EnumThreadWindows
• 0x47d678 EndPaint
• 0x47d67c EnableWindow
• 0x47d680 EnableScrollBar
• 0x47d684 EnableMenuItem
• 0x47d688 DrawTextA
• 0x47d68c DrawMenuBar
• 0x47d690 DrawIconEx
• 0x47d694 DrawIcon
• 0x47d698 DrawFrameControl
• 0x47d69c DrawFocusRect
• 0x47d6a0 DrawEdge
• 0x47d6a4 DispatchMessageA
• 0x47d6a8 DestroyWindow
• 0x47d6ac DestroyMenu
• 0x47d6b0 DestroyIcon
• 0x47d6b4 DestroyCursor
• 0x47d6b8 DeleteMenu
• 0x47d6bc DefWindowProcA
• 0x47d6c0 DefMDIChildProcA
• 0x47d6c4 DefFrameProcA
• 0x47d6c8 CreatePopupMenu
• 0x47d6cc CreateMenu
• 0x47d6d0 CreateIcon
• 0x47d6d4 ClientToScreen
• 0x47d6d8 CheckMenuItem
• 0x47d6dc CallWindowProcA
• 0x47d6e0 CallNextHookEx
• 0x47d6e4 BeginPaint
• 0x47d6e8 CharNextA
• 0x47d6ec CharLowerBuffA
• 0x47d6f0 CharLowerA
• 0x47d6f4 CharUpperBuffA
• 0x47d6f8 CharToOemA
• 0x47d6fc AdjustWindowRectEx
Library kernel32.dll:
• 0x47d708 Sleep
Library oleaut32.dll:
• 0x47d710 SafeArrayPtrOfIndex
• 0x47d714 SafeArrayPutElement
• 0x47d718 SafeArrayGetElement
• 0x47d720 SafeArrayAccessData
• 0x47d724 SafeArrayGetUBound
• 0x47d728 SafeArrayGetLBound
• 0x47d72c SafeArrayCreate
• 0x47d730 VariantChangeType
• 0x47d734 VariantCopyInd
• 0x47d738 VariantCopy
• 0x47d73c VariantClear
• 0x47d740 VariantInit
Library ole32.dll:
• 0x47d74c IsAccelerator
• 0x47d750 OleDraw
• 0x47d758 CoTaskMemFree
• 0x47d75c ProgIDFromCLSID
• 0x47d760 StringFromCLSID
• 0x47d764 CoCreateInstance
• 0x47d768 CoGetClassObject
• 0x47d76c CoUninitialize
• 0x47d770 CoInitialize
• 0x47d774 IsEqualGUID
Library oleaut32.dll:
• 0x47d77c GetErrorInfo
• 0x47d780 GetActiveObject
• 0x47d784 SysFreeString
Library comctl32.dll:
• 0x47d794 ImageList_Write
• 0x47d798 ImageList_Read
• 0x47d7a8 ImageList_DragMove
• 0x47d7ac ImageList_DragLeave
• 0x47d7b0 ImageList_DragEnter
• 0x47d7b4 ImageList_EndDrag
• 0x47d7b8 ImageList_BeginDrag
• 0x47d7bc ImageList_Remove
• 0x47d7c0 ImageList_DrawEx
• 0x47d7c4 ImageList_Draw
• 0x47d7d4 ImageList_Add
• 0x47d7dc ImageList_Destroy
• 0x47d7e0 ImageList_Create
• 0x47d7e4 InitCommonControls
Library comdlg32.dll:
• 0x47d7ec ChooseColorA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 50537 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.