6.2
高危
57 个模型检测该样本为恶意！
重新分析
更多

7ddc15860b3ad79c71728581274d212c38c203fc5747c217ccde359e835d690f

ab67a9feba8c5ec3e11597fcb21c6f29.exe

分析耗时

26s

最近分析

文件大小

768.5KB
静态报毒 动态报毒 AGEN AI SCORE=88 AIDETECTVM ALI2000015 ANDROM BSCOPE BUFNGG CLASSIC CONFIDENCE CRYPTIH CUGE DELFINJECT DELPHILESS EMZL EQEG FAREIT FORMBOOK GENERICKD GENKRYPTIK HIGH CONFIDENCE HRLVEZ IGENT KRADDARE KRYPTIK LNXV MALWARE2 MALWARE@#3HD6GCLKCHVVU S15461267 SCORE SPYBOTNET SUSGEN UNSAFE WGW@AAOGN7EI X2094 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FPQ!AB67A9FEBA8C 20201023 6.0.6.653
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20201023 18.4.3895.0
Tencent Win32.Trojan.Crypt.Lnxv 20201023 1.0.0.1
Kingsoft 20201023 2013.8.14.323
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619828142.42725
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
ab67a9feba8c5ec3e11597fcb21c6f29+0x543f8 @ 0x4543f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfd8914ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (28 个事件)
Time & API Arguments Status Return Repeated
1619828140.03625
NtAllocateVirtualMemory
process_identifier: 360
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003d0000
success 0 0
1619828140.25525
NtProtectVirtualMemory
process_identifier: 360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 81920
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00466000
success 0 0
1619828140.25525
NtAllocateVirtualMemory
process_identifier: 360
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x005e0000
success 0 0
1619828141.59825
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619828141.66125
NtAllocateVirtualMemory
process_identifier: 428
region_size: 1441792
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01e80000
success 0 0
1619828141.66125
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01fa0000
success 0 0
1619828141.66125
NtAllocateVirtualMemory
process_identifier: 428
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00550000
success 0 0
1619828141.66125
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 286720
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00552000
success 0 0
1619828142.36425
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00332000
success 0 0
1619828142.36425
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619828142.38025
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00332000
success 0 0
1619828142.38025
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619828142.38025
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00332000
success 0 0
1619828142.38025
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619828142.38025
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00332000
success 0 0
1619828142.38025
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619828142.38025
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00332000
success 0 0
1619828142.38025
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619828142.38025
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00332000
success 0 0
1619828142.38025
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619828142.38025
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00332000
success 0 0
1619828142.38025
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619828142.38025
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00332000
success 0 0
1619828142.38025
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619828142.38025
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00332000
success 0 0
1619828142.38025
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619828142.38025
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00332000
success 0 0
1619828142.38025
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (5 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.541440876971353 section {'size_of_data': '0x0003c800', 'virtual_address': '0x00089000', 'entropy': 7.541440876971353, 'name': '.rsrc', 'virtual_size': '0x0003c754'} description A section with a high entropy has been found
entropy 0.31530944625407165 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 360 called NtSetContextThread to modify thread in remote process 428
Time & API Arguments Status Return Repeated
1619828140.86425
NtSetContextThread
thread_handle: 0x000000f8
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4864400
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 428
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 360 resumed a thread in remote process 428
Time & API Arguments Status Return Repeated
1619828141.41125
NtResumeThread
thread_handle: 0x000000f8
suspend_count: 1
process_identifier: 428
success 0 0
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619828140.70825
CreateProcessInternalW
thread_identifier: 2196
thread_handle: 0x000000f8
process_identifier: 428
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ab67a9feba8c5ec3e11597fcb21c6f29.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619828140.70825
NtUnmapViewOfSection
process_identifier: 428
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1619828140.70825
NtMapViewOfSection
section_handle: 0x00000104
process_identifier: 428
commit_size: 675840
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 675840
base_address: 0x00400000
success 0 0
1619828140.86425
NtGetContextThread
thread_handle: 0x000000f8
success 0 0
1619828140.86425
NtSetContextThread
thread_handle: 0x000000f8
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4864400
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 428
success 0 0
1619828141.41125
NtResumeThread
thread_handle: 0x000000f8
suspend_count: 1
process_identifier: 428
success 0 0
File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.34333835
FireEye Generic.mg.ab67a9feba8c5ec3
CAT-QuickHeal Trojan.CryptIH.S15461267
McAfee Fareit-FPQ!AB67A9FEBA8C
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
K7AntiVirus Riskware ( 0040eff71 )
Alibaba Trojan:Win32/DelfInject.ali2000015
K7GW Riskware ( 0040eff71 )
CrowdStrike win/malicious_confidence_90% (W)
Arcabit Trojan.Generic.D20BE48B
Cyren W32/Injector.CUGE-8085
Symantec Trojan.Gen.2
APEX Malicious
Avast Win32:Trojan-gen
ClamAV Win.Dropper.Formbook-9257771-0
Kaspersky HEUR:Trojan.Win32.Crypt.gen
BitDefender Trojan.GenericKD.34333835
NANO-Antivirus Trojan.Win32.Crypt.hrlvez
Paloalto generic.ml
AegisLab Trojan.Multi.Generic.4!c
Tencent Win32.Trojan.Crypt.Lnxv
Ad-Aware Trojan.GenericKD.34333835
Emsisoft Trojan.GenericKD.34333835 (B)
Comodo Malware@#3hd6gclkchvvu
F-Secure Heuristic.HEUR/AGEN.1137572
DrWeb BackDoor.SpyBotNET.25
Invincea Mal/Generic-S
McAfee-GW-Edition BehavesLike.Win32.Fareit.bh
Sophos Mal/Generic-S
Jiangmin Trojan.Crypt.dwe
MaxSecure Trojan.Malware.10374761.susgen
Avira HEUR/AGEN.1137572
Antiy-AVL Trojan/Win32.Crypt
Microsoft Trojan:Win32/Androm.VD!MTB
ViRobot Trojan.Win32.S.Agent.786944.R
ZoneAlarm HEUR:Trojan.Win32.Crypt.gen
GData Trojan.GenericKD.34333835
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2094
BitDefenderTheta Gen:NN.ZelphiF.34570.WGW@aaoGn7ei
ALYac Trojan.GenericKD.34333835
MAX malware (ai score=88)
VBA32 BScope.Adware.Kraddare
Malwarebytes Trojan.MalPack.DLF
ESET-NOD32 a variant of Win32/GenKryptik.EQEG
Rising Trojan.Kryptik!1.CA3B (CLASSIC)
Yandex Trojan.Igent.bUfngG.76
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x47d150 VirtualFree
• 0x47d154 VirtualAlloc
• 0x47d158 LocalFree
• 0x47d15c LocalAlloc
• 0x47d160 GetVersion
• 0x47d164 GetCurrentThreadId
• 0x47d170 VirtualQuery
• 0x47d174 WideCharToMultiByte
• 0x47d17c MultiByteToWideChar
• 0x47d180 lstrlenA
• 0x47d184 lstrcpynA
• 0x47d188 LoadLibraryExA
• 0x47d18c GetThreadLocale
• 0x47d190 GetStartupInfoA
• 0x47d194 GetProcAddress
• 0x47d198 GetModuleHandleA
• 0x47d19c GetModuleFileNameA
• 0x47d1a0 GetLocaleInfoA
• 0x47d1a4 GetLastError
• 0x47d1ac GetCommandLineA
• 0x47d1b0 FreeLibrary
• 0x47d1b4 FindFirstFileA
• 0x47d1b8 FindClose
• 0x47d1bc ExitProcess
• 0x47d1c0 WriteFile
• 0x47d1c8 RtlUnwind
• 0x47d1cc RaiseException
• 0x47d1d0 GetStdHandle
Library user32.dll:
• 0x47d1d8 GetKeyboardType
• 0x47d1dc LoadStringA
• 0x47d1e0 MessageBoxA
• 0x47d1e4 CharNextA
Library advapi32.dll:
• 0x47d1ec RegQueryValueExA
• 0x47d1f0 RegOpenKeyExA
• 0x47d1f4 RegCloseKey
Library oleaut32.dll:
• 0x47d1fc SysFreeString
• 0x47d200 SysReAllocStringLen
• 0x47d204 SysAllocStringLen
Library kernel32.dll:
• 0x47d20c TlsSetValue
• 0x47d210 TlsGetValue
• 0x47d214 LocalAlloc
• 0x47d218 GetModuleHandleA
Library advapi32.dll:
• 0x47d220 RegQueryValueExA
• 0x47d224 RegOpenKeyExA
• 0x47d228 RegCloseKey
Library kernel32.dll:
• 0x47d230 lstrcpyA
• 0x47d234 WriteFile
• 0x47d238 WaitForSingleObject
• 0x47d23c VirtualQuery
• 0x47d240 VirtualProtect
• 0x47d244 VirtualAlloc
• 0x47d248 Sleep
• 0x47d24c SizeofResource
• 0x47d250 SetThreadLocale
• 0x47d254 SetFilePointer
• 0x47d258 SetEvent
• 0x47d25c SetErrorMode
• 0x47d260 SetEndOfFile
• 0x47d264 ResetEvent
• 0x47d268 ReadFile
• 0x47d26c MulDiv
• 0x47d270 LockResource
• 0x47d274 LoadResource
• 0x47d278 LoadLibraryA
• 0x47d284 GlobalUnlock
• 0x47d288 GlobalReAlloc
• 0x47d28c GlobalHandle
• 0x47d290 GlobalLock
• 0x47d294 GlobalFree
• 0x47d298 GlobalFindAtomA
• 0x47d29c GlobalDeleteAtom
• 0x47d2a0 GlobalAlloc
• 0x47d2a4 GlobalAddAtomA
• 0x47d2a8 GetVersionExA
• 0x47d2ac GetVersion
• 0x47d2b0 GetTickCount
• 0x47d2b4 GetThreadLocale
• 0x47d2bc GetSystemInfo
• 0x47d2c0 GetStringTypeExA
• 0x47d2c4 GetStdHandle
• 0x47d2c8 GetProcAddress
• 0x47d2cc GetModuleHandleA
• 0x47d2d0 GetModuleFileNameA
• 0x47d2d4 GetLocaleInfoA
• 0x47d2d8 GetLocalTime
• 0x47d2dc GetLastError
• 0x47d2e0 GetFullPathNameA
• 0x47d2e4 GetFileAttributesA
• 0x47d2e8 GetDiskFreeSpaceA
• 0x47d2ec GetDateFormatA
• 0x47d2f0 GetCurrentThreadId
• 0x47d2f4 GetCurrentProcessId
• 0x47d2f8 GetCPInfo
• 0x47d2fc GetACP
• 0x47d300 FreeResource
• 0x47d304 InterlockedExchange
• 0x47d308 FreeLibrary
• 0x47d30c FormatMessageA
• 0x47d310 FindResourceA
• 0x47d314 FindNextFileA
• 0x47d318 FindFirstFileA
• 0x47d31c FindClose
• 0x47d32c EnumCalendarInfoA
• 0x47d338 CreateThread
• 0x47d33c CreateFileA
• 0x47d340 CreateEventA
• 0x47d344 CompareStringA
• 0x47d348 CloseHandle
Library version.dll:
• 0x47d350 VerQueryValueA
• 0x47d358 GetFileVersionInfoA
Library gdi32.dll:
• 0x47d360 UnrealizeObject
• 0x47d364 StretchBlt
• 0x47d368 SetWindowOrgEx
• 0x47d36c SetWindowExtEx
• 0x47d370 SetWinMetaFileBits
• 0x47d374 SetViewportOrgEx
• 0x47d378 SetViewportExtEx
• 0x47d37c SetTextColor
• 0x47d380 SetStretchBltMode
• 0x47d384 SetROP2
• 0x47d388 SetPixel
• 0x47d38c SetMapMode
• 0x47d390 SetEnhMetaFileBits
• 0x47d394 SetDIBColorTable
• 0x47d398 SetBrushOrgEx
• 0x47d39c SetBkMode
• 0x47d3a0 SetBkColor
• 0x47d3a4 SelectPalette
• 0x47d3a8 SelectObject
• 0x47d3ac SaveDC
• 0x47d3b0 RestoreDC
• 0x47d3b4 Rectangle
• 0x47d3b8 RectVisible
• 0x47d3bc RealizePalette
• 0x47d3c0 Polyline
• 0x47d3c4 PolyPolyline
• 0x47d3c8 PlayEnhMetaFile
• 0x47d3cc PatBlt
• 0x47d3d0 MoveToEx
• 0x47d3d4 MaskBlt
• 0x47d3d8 LineTo
• 0x47d3dc IntersectClipRect
• 0x47d3e0 GetWindowOrgEx
• 0x47d3e4 GetWinMetaFileBits
• 0x47d3e8 GetTextMetricsA
• 0x47d3f4 GetStockObject
• 0x47d3f8 GetPixel
• 0x47d3fc GetPaletteEntries
• 0x47d400 GetObjectA
• 0x47d40c GetEnhMetaFileBits
• 0x47d410 GetDeviceCaps
• 0x47d414 GetDIBits
• 0x47d418 GetDIBColorTable
• 0x47d41c GetDCOrgEx
• 0x47d424 GetClipBox
• 0x47d428 GetBrushOrgEx
• 0x47d42c GetBitmapBits
• 0x47d430 ExtCreatePen
• 0x47d434 ExcludeClipRect
• 0x47d438 DeleteObject
• 0x47d43c DeleteEnhMetaFile
• 0x47d440 DeleteDC
• 0x47d444 CreateSolidBrush
• 0x47d448 CreatePenIndirect
• 0x47d44c CreatePalette
• 0x47d454 CreateFontIndirectA
• 0x47d458 CreateDIBitmap
• 0x47d45c CreateDIBSection
• 0x47d460 CreateCompatibleDC
• 0x47d468 CreateBrushIndirect
• 0x47d46c CreateBitmap
• 0x47d470 CopyEnhMetaFileA
• 0x47d474 BitBlt
Library user32.dll:
• 0x47d47c CreateWindowExA
• 0x47d480 WindowFromPoint
• 0x47d484 WinHelpA
• 0x47d488 WaitMessage
• 0x47d48c ValidateRect
• 0x47d490 UpdateWindow
• 0x47d494 UnregisterClassA
• 0x47d498 UnionRect
• 0x47d49c UnhookWindowsHookEx
• 0x47d4a0 TranslateMessage
• 0x47d4a8 TrackPopupMenu
• 0x47d4b0 ShowWindow
• 0x47d4b4 ShowScrollBar
• 0x47d4b8 ShowOwnedPopups
• 0x47d4bc ShowCursor
• 0x47d4c0 SetWindowsHookExA
• 0x47d4c4 SetWindowTextA
• 0x47d4c8 SetWindowPos
• 0x47d4cc SetWindowPlacement
• 0x47d4d0 SetWindowLongA
• 0x47d4d4 SetTimer
• 0x47d4d8 SetScrollRange
• 0x47d4dc SetScrollPos
• 0x47d4e0 SetScrollInfo
• 0x47d4e4 SetRect
• 0x47d4e8 SetPropA
• 0x47d4ec SetParent
• 0x47d4f0 SetMenuItemInfoA
• 0x47d4f4 SetMenu
• 0x47d4f8 SetKeyboardState
• 0x47d4fc SetForegroundWindow
• 0x47d500 SetFocus
• 0x47d504 SetCursor
• 0x47d508 SetClipboardData
• 0x47d50c SetClassLongA
• 0x47d510 SetCapture
• 0x47d514 SetActiveWindow
• 0x47d518 SendMessageA
• 0x47d51c ScrollWindowEx
• 0x47d520 ScrollWindow
• 0x47d524 ScreenToClient
• 0x47d528 RemovePropA
• 0x47d52c RemoveMenu
• 0x47d530 ReleaseDC
• 0x47d534 ReleaseCapture
• 0x47d540 RegisterClassA
• 0x47d544 RedrawWindow
• 0x47d548 PtInRect
• 0x47d54c PostQuitMessage
• 0x47d550 PostMessageA
• 0x47d554 PeekMessageA
• 0x47d558 OpenClipboard
• 0x47d55c OffsetRect
• 0x47d560 OemToCharA
• 0x47d564 MessageBoxA
• 0x47d568 MessageBeep
• 0x47d56c MapWindowPoints
• 0x47d570 MapVirtualKeyA
• 0x47d574 LoadStringA
• 0x47d578 LoadKeyboardLayoutA
• 0x47d57c LoadIconA
• 0x47d580 LoadCursorA
• 0x47d584 LoadBitmapA
• 0x47d588 KillTimer
• 0x47d58c IsZoomed
• 0x47d590 IsWindowVisible
• 0x47d594 IsWindowEnabled
• 0x47d598 IsWindow
• 0x47d59c IsRectEmpty
• 0x47d5a0 IsIconic
• 0x47d5a4 IsDialogMessageA
• 0x47d5a8 IsChild
• 0x47d5ac IsCharAlphaNumericA
• 0x47d5b0 IsCharAlphaA
• 0x47d5b4 InvalidateRect
• 0x47d5b8 IntersectRect
• 0x47d5bc InsertMenuItemA
• 0x47d5c0 InsertMenuA
• 0x47d5c4 InflateRect
• 0x47d5cc GetWindowTextA
• 0x47d5d0 GetWindowRect
• 0x47d5d4 GetWindowPlacement
• 0x47d5d8 GetWindowLongA
• 0x47d5dc GetWindowDC
• 0x47d5e0 GetTopWindow
• 0x47d5e4 GetSystemMetrics
• 0x47d5e8 GetSystemMenu
• 0x47d5ec GetSysColorBrush
• 0x47d5f0 GetSysColor
• 0x47d5f4 GetSubMenu
• 0x47d5f8 GetScrollRange
• 0x47d5fc GetScrollPos
• 0x47d600 GetScrollInfo
• 0x47d604 GetPropA
• 0x47d608 GetParent
• 0x47d60c GetWindow
• 0x47d610 GetMessageTime
• 0x47d614 GetMenuStringA
• 0x47d618 GetMenuState
• 0x47d61c GetMenuItemInfoA
• 0x47d620 GetMenuItemID
• 0x47d624 GetMenuItemCount
• 0x47d628 GetMenu
• 0x47d62c GetLastActivePopup
• 0x47d630 GetKeyboardState
• 0x47d638 GetKeyboardLayout
• 0x47d63c GetKeyState
• 0x47d640 GetKeyNameTextA
• 0x47d644 GetInputState
• 0x47d648 GetIconInfo
• 0x47d64c GetForegroundWindow
• 0x47d650 GetFocus
• 0x47d654 GetDoubleClickTime
• 0x47d658 GetDlgItem
• 0x47d65c GetDesktopWindow
• 0x47d660 GetDCEx
• 0x47d664 GetDC
• 0x47d668 GetCursorPos
• 0x47d66c GetCursor
• 0x47d670 GetClipboardData
• 0x47d674 GetClientRect
• 0x47d678 GetClassNameA
• 0x47d67c GetClassInfoA
• 0x47d680 GetCaretPos
• 0x47d684 GetCapture
• 0x47d688 GetActiveWindow
• 0x47d68c FrameRect
• 0x47d690 FindWindowA
• 0x47d694 FillRect
• 0x47d698 EqualRect
• 0x47d69c EnumWindows
• 0x47d6a0 EnumThreadWindows
• 0x47d6a8 EndPaint
• 0x47d6ac EnableWindow
• 0x47d6b0 EnableScrollBar
• 0x47d6b4 EnableMenuItem
• 0x47d6b8 EmptyClipboard
• 0x47d6bc DrawTextA
• 0x47d6c0 DrawMenuBar
• 0x47d6c4 DrawIconEx
• 0x47d6c8 DrawIcon
• 0x47d6cc DrawFrameControl
• 0x47d6d0 DrawFocusRect
• 0x47d6d4 DrawEdge
• 0x47d6d8 DispatchMessageA
• 0x47d6dc DestroyWindow
• 0x47d6e0 DestroyMenu
• 0x47d6e4 DestroyIcon
• 0x47d6e8 DestroyCursor
• 0x47d6ec DeleteMenu
• 0x47d6f0 DefWindowProcA
• 0x47d6f4 DefMDIChildProcA
• 0x47d6f8 DefFrameProcA
• 0x47d6fc CreatePopupMenu
• 0x47d700 CreateMenu
• 0x47d704 CreateIcon
• 0x47d708 CloseClipboard
• 0x47d70c ClientToScreen
• 0x47d710 CheckMenuItem
• 0x47d714 CallWindowProcA
• 0x47d718 CallNextHookEx
• 0x47d71c BeginPaint
• 0x47d720 CharNextA
• 0x47d724 CharLowerBuffA
• 0x47d728 CharLowerA
• 0x47d72c CharUpperBuffA
• 0x47d730 CharToOemA
• 0x47d734 AdjustWindowRectEx
Library kernel32.dll:
• 0x47d740 Sleep
Library oleaut32.dll:
• 0x47d748 SafeArrayPtrOfIndex
• 0x47d74c SafeArrayGetUBound
• 0x47d750 SafeArrayGetLBound
• 0x47d754 SafeArrayCreate
• 0x47d758 VariantChangeType
• 0x47d75c VariantCopy
• 0x47d760 VariantClear
• 0x47d764 VariantInit
Library comctl32.dll:
• 0x47d774 ImageList_Write
• 0x47d778 ImageList_Read
• 0x47d788 ImageList_DragMove
• 0x47d78c ImageList_DragLeave
• 0x47d790 ImageList_DragEnter
• 0x47d794 ImageList_EndDrag
• 0x47d798 ImageList_BeginDrag
• 0x47d79c ImageList_Remove
• 0x47d7a0 ImageList_DrawEx
• 0x47d7a4 ImageList_Replace
• 0x47d7a8 ImageList_Draw
• 0x47d7b8 ImageList_Add
• 0x47d7c0 ImageList_Destroy
• 0x47d7c4 ImageList_Create
Library comdlg32.dll:
• 0x47d7cc GetSaveFileNameA
• 0x47d7d0 GetOpenFileNameA
Library kernel32.dll:
• 0x47d7d8 MulDiv

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58370 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 62196 239.255.255.250 1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.