7.0
高危
60 个模型检测该样本为恶意！
重新分析
更多

fccd0a4561d5c568a7026b267d80fee5c00bdcb8f07b1d58a65845dbdf039664

ae60e7aaf6538772e7821884169e9044.exe

分析耗时

26s

最近分析

文件大小

1.2MB
静态报毒 动态报毒 100% AI SCORE=83 ATTRIBUTE CLOUD CONFIDENCE DELF DELPHILESS ELUS FAREIT GEN4 HIGH HIGH CONFIDENCE HIGHCONFIDENCE HJZMHP KRYPTIK LPBC MALICIOUS PE MALWARE@#3EMWM84LZEN1I MMSJ PHW@AOBQ5GFI SCORE SIGGEN9 SIMDA SUSGEN THEOIBO TSCOPE UNSAFE WACATAC WUEV5OD9WQC X2059 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FSK!AE60E7AAF653 20200520 6.0.6.653
Alibaba Trojan:Win32/Kryptik.d23620de 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20200520 18.4.3895.0
Tencent Win32.Trojan.Kryptik.Lpbc 20200521 1.0.0.1
Kingsoft 20200521 2013.8.14.323
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1620897883.52775
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 52100928
registers.edi: 0
registers.eax: 0
registers.ebp: 52101000
registers.edx: 0
registers.ebx: 0
registers.esi: 0
registers.ecx: 1969237513
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 56 e9 25 46 f7
exception.symbol: ae60e7aaf6538772e7821884169e9044+0x8f276
exception.instruction: div eax
exception.module: ae60e7aaf6538772e7821884169e9044.exe
exception.exception_code: 0xc0000094
exception.offset: 586358
exception.address: 0x48f276
success 0 0
1620897886.183375
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
ae60e7aaf6538772e7821884169e9044+0x5a3f8 @ 0x45a3f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfd8814ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (27 个事件)
Time & API Arguments Status Return Repeated
1620897883.37175
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003f0000
success 0 0
1620897883.52775
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02020000
success 0 0
1620897883.55875
NtAllocateVirtualMemory
process_identifier: 2292
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x031b0000
success 0 0
1620897885.199375
NtAllocateVirtualMemory
process_identifier: 784
region_size: 786432
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01ee0000
success 0 0
1620897885.215375
NtAllocateVirtualMemory
process_identifier: 784
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f60000
success 0 0
1620897885.215375
NtAllocateVirtualMemory
process_identifier: 784
region_size: 335872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x005b0000
success 0 0
1620897885.230375
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 307200
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005b2000
success 0 0
1620897886.121375
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00322000
success 0 0
1620897886.121375
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620897886.121375
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00322000
success 0 0
1620897886.121375
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1620897886.121375
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00322000
success 0 0
1620897886.121375
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1620897886.121375
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00322000
success 0 0
1620897886.121375
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620897886.121375
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00322000
success 0 0
1620897886.121375
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1620897886.121375
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00322000
success 0 0
1620897886.121375
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1620897886.121375
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00322000
success 0 0
1620897886.121375
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620897886.121375
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00322000
success 0 0
1620897886.121375
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620897886.121375
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00322000
success 0 0
1620897886.121375
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1620897886.121375
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00322000
success 0 0
1620897886.121375
NtProtectVirtualMemory
process_identifier: 784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (7 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (3 个事件)
entropy 7.5026998517206955 section {'size_of_data': '0x0000b000', 'virtual_address': '0x00090000', 'entropy': 7.5026998517206955, 'name': 'DATA', 'virtual_size': '0x0000afec'} description A section with a high entropy has been found
entropy 7.782136299995273 section {'size_of_data': '0x00095200', 'virtual_address': '0x000ad000', 'entropy': 7.782136299995273, 'name': '.rsrc', 'virtual_size': '0x0009507c'} description A section with a high entropy has been found
entropy 0.505524861878453 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 192.119.178.149
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2292 called NtSetContextThread to modify thread in remote process 784
Time & API Arguments Status Return Repeated
1620897884.29375
NtSetContextThread
thread_handle: 0x000000f0
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4534975
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 784
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2292 resumed a thread in remote process 784
Time & API Arguments Status Return Repeated
1620897884.85575
NtResumeThread
thread_handle: 0x000000f0
suspend_count: 1
process_identifier: 784
success 0 0
Generates some ICMP traffic
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1620897884.05875
CreateProcessInternalW
thread_identifier: 368
thread_handle: 0x000000f0
process_identifier: 784
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ae60e7aaf6538772e7821884169e9044.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000f4
inherit_handles: 0
success 1 0
1620897884.05875
NtUnmapViewOfSection
process_identifier: 784
region_size: 4096
process_handle: 0x000000f4
base_address: 0x00400000
success 0 0
1620897884.07475
NtMapViewOfSection
section_handle: 0x000000fc
process_identifier: 784
commit_size: 708608
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000f4
allocation_type: 0 ()
section_offset: 0
view_size: 708608
base_address: 0x00400000
success 0 0
1620897884.29375
NtGetContextThread
thread_handle: 0x000000f0
success 0 0
1620897884.29375
NtSetContextThread
thread_handle: 0x000000f0
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4534975
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 784
success 0 0
1620897884.85575
NtResumeThread
thread_handle: 0x000000f0
suspend_count: 1
process_identifier: 784
success 0 0
File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 个事件)
MicroWorld-eScan Trojan.Delf.FareIt.Gen.6
FireEye Generic.mg.ae60e7aaf6538772
McAfee Fareit-FSK!AE60E7AAF653
Cylance Unsafe
Zillya Dropper.Agent.Win32.426876
Sangfor Malware
K7AntiVirus Trojan ( 005662f61 )
Alibaba Trojan:Win32/Kryptik.d23620de
K7GW Trojan ( 005662f61 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Delf.FareIt.Gen.6
Invincea heuristic
F-Prot W32/Fareit.DLK
Symantec ML.Attribute.HighConfidence
APEX Malicious
Avast Win32:Trojan-gen
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
BitDefender Trojan.Delf.FareIt.Gen.6
NANO-Antivirus Trojan.Win32.Dwn.hjzmhp
Paloalto generic.ml
AegisLab Trojan.Win32.Malicious.4!c
Tencent Win32.Trojan.Kryptik.Lpbc
Ad-Aware Trojan.Delf.FareIt.Gen.6
Sophos Mal/Generic-S
Comodo Malware@#3emwm84lzen1i
F-Secure Backdoor.BDS/Backdoor.Gen4
DrWeb Trojan.Siggen9.44728
VIPRE Trojan.Win32.Simda.ba (v)
TrendMicro Trojan.Win32.WACATAC.THEOIBO
McAfee-GW-Edition BehavesLike.Win32.Fareit.tc
Trapmine malicious.high.ml.score
Emsisoft Trojan.Delf.FareIt.Gen.6 (B)
SentinelOne DFI - Malicious PE
Cyren W32/Fareit.MMSJ-2929
Jiangmin Trojan.Kryptik.aqk
Avira BDS/Backdoor.Gen4
MAX malware (ai score=83)
Antiy-AVL Trojan/Win32.Wacatac
Microsoft PWS:Win32/Fareit.AR!MTB
Endgame malicious (high confidence)
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
GData Trojan.Delf.FareIt.Gen.6
AhnLab-V3 Suspicious/Win.Delphiless.X2059
Acronis suspicious
BitDefenderTheta Gen:NN.ZelphiF.34110.pHW@aOBq5Gfi
ALYac Trojan.Delf.FareIt.Gen.6
VBA32 TScope.Trojan.Delf
Malwarebytes Trojan.MalPack.DLF
ESET-NOD32 a variant of Win32/Injector.ELUS
TrendMicro-HouseCall Trojan.Win32.WACATAC.THEOIBO
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x49c164 VirtualFree
• 0x49c168 VirtualAlloc
• 0x49c16c LocalFree
• 0x49c170 LocalAlloc
• 0x49c174 GetVersion
• 0x49c178 GetCurrentThreadId
• 0x49c184 VirtualQuery
• 0x49c188 WideCharToMultiByte
• 0x49c18c MultiByteToWideChar
• 0x49c190 lstrlenA
• 0x49c194 lstrcpynA
• 0x49c198 LoadLibraryExA
• 0x49c19c GetThreadLocale
• 0x49c1a0 GetStartupInfoA
• 0x49c1a4 GetProcAddress
• 0x49c1a8 GetModuleHandleA
• 0x49c1ac GetModuleFileNameA
• 0x49c1b0 GetLocaleInfoA
• 0x49c1b4 GetCommandLineA
• 0x49c1b8 FreeLibrary
• 0x49c1bc FindFirstFileA
• 0x49c1c0 FindClose
• 0x49c1c4 ExitProcess
• 0x49c1c8 WriteFile
• 0x49c1d0 RtlUnwind
• 0x49c1d4 RaiseException
• 0x49c1d8 GetStdHandle
Library user32.dll:
• 0x49c1e0 GetKeyboardType
• 0x49c1e4 LoadStringA
• 0x49c1e8 MessageBoxA
• 0x49c1ec CharNextA
Library advapi32.dll:
• 0x49c1f4 RegQueryValueExA
• 0x49c1f8 RegOpenKeyExA
• 0x49c1fc RegCloseKey
Library oleaut32.dll:
• 0x49c204 SysFreeString
• 0x49c208 SysReAllocStringLen
• 0x49c20c SysAllocStringLen
Library kernel32.dll:
• 0x49c214 TlsSetValue
• 0x49c218 TlsGetValue
• 0x49c21c LocalAlloc
• 0x49c220 GetModuleHandleA
Library advapi32.dll:
• 0x49c228 RegQueryValueExA
• 0x49c22c RegOpenKeyExA
• 0x49c230 RegCloseKey
Library kernel32.dll:
• 0x49c238 lstrcpyA
• 0x49c23c WriteFile
• 0x49c240 WinExec
• 0x49c248 WaitForSingleObject
• 0x49c24c VirtualQuery
• 0x49c250 VirtualAlloc
• 0x49c254 Sleep
• 0x49c258 SizeofResource
• 0x49c25c SetThreadLocale
• 0x49c260 SetFilePointer
• 0x49c264 SetEvent
• 0x49c268 SetErrorMode
• 0x49c26c SetEndOfFile
• 0x49c270 SearchPathA
• 0x49c274 ResetEvent
• 0x49c278 ReleaseMutex
• 0x49c27c ReadFile
• 0x49c280 OpenFileMappingA
• 0x49c284 MultiByteToWideChar
• 0x49c288 MulDiv
• 0x49c28c LockResource
• 0x49c290 LoadResource
• 0x49c294 LoadLibraryA
• 0x49c29c IsDBCSLeadByte
• 0x49c2a4 GlobalUnlock
• 0x49c2a8 GlobalReAlloc
• 0x49c2ac GlobalMemoryStatus
• 0x49c2b0 GlobalHandle
• 0x49c2b4 GlobalLock
• 0x49c2b8 GlobalFree
• 0x49c2bc GlobalFindAtomA
• 0x49c2c0 GlobalDeleteAtom
• 0x49c2c4 GlobalAlloc
• 0x49c2c8 GlobalAddAtomA
• 0x49c2cc GetVersionExA
• 0x49c2d0 GetVersion
• 0x49c2d4 GetTickCount
• 0x49c2d8 GetThreadLocale
• 0x49c2dc GetTempPathA
• 0x49c2e4 GetSystemTime
• 0x49c2e8 GetSystemInfo
• 0x49c2ec GetStringTypeExA
• 0x49c2f0 GetStdHandle
• 0x49c2f4 GetProcAddress
• 0x49c2f8 GetModuleHandleA
• 0x49c2fc GetModuleFileNameA
• 0x49c300 GetLocaleInfoA
• 0x49c304 GetLocalTime
• 0x49c308 GetLastError
• 0x49c30c GetFullPathNameA
• 0x49c310 GetFileSize
• 0x49c314 GetDiskFreeSpaceA
• 0x49c318 GetDateFormatA
• 0x49c31c GetCurrentThreadId
• 0x49c320 GetCurrentProcessId
• 0x49c328 GetCPInfo
• 0x49c32c GetACP
• 0x49c330 FreeResource
• 0x49c338 InterlockedExchange
• 0x49c340 FreeLibrary
• 0x49c344 FormatMessageA
• 0x49c348 FindResourceA
• 0x49c34c FindFirstFileA
• 0x49c350 FindClose
• 0x49c358 FatalAppExitA
• 0x49c35c ExitThread
• 0x49c360 ExitProcess
• 0x49c364 EnumCalendarInfoA
• 0x49c370 CreateThread
• 0x49c374 CreateMutexA
• 0x49c378 CreateFileA
• 0x49c37c CreateEventA
• 0x49c380 CompareStringA
• 0x49c384 CloseHandle
Library version.dll:
• 0x49c38c VerQueryValueA
• 0x49c394 GetFileVersionInfoA
Library gdi32.dll:
• 0x49c39c UnrealizeObject
• 0x49c3a0 StretchBlt
• 0x49c3a4 SetWindowOrgEx
• 0x49c3a8 SetViewportOrgEx
• 0x49c3ac SetTextColor
• 0x49c3b0 SetStretchBltMode
• 0x49c3b4 SetROP2
• 0x49c3b8 SetPixel
• 0x49c3bc SetDIBColorTable
• 0x49c3c0 SetBrushOrgEx
• 0x49c3c4 SetBkMode
• 0x49c3c8 SetBkColor
• 0x49c3cc SetArcDirection
• 0x49c3d0 SelectPalette
• 0x49c3d4 SelectObject
• 0x49c3d8 SaveDC
• 0x49c3dc RestoreDC
• 0x49c3e0 RectVisible
• 0x49c3e4 RealizePalette
• 0x49c3e8 PatBlt
• 0x49c3ec MoveToEx
• 0x49c3f0 MaskBlt
• 0x49c3f4 LineTo
• 0x49c3f8 IntersectClipRect
• 0x49c3fc GetWindowOrgEx
• 0x49c400 GetTextMetricsA
• 0x49c40c GetStockObject
• 0x49c410 GetPixel
• 0x49c414 GetPaletteEntries
• 0x49c418 GetObjectA
• 0x49c41c GetDeviceCaps
• 0x49c420 GetDIBits
• 0x49c424 GetDIBColorTable
• 0x49c428 GetDCOrgEx
• 0x49c430 GetClipBox
• 0x49c434 GetBrushOrgEx
• 0x49c438 GetBitmapBits
• 0x49c43c ExcludeClipRect
• 0x49c440 DeleteObject
• 0x49c444 DeleteDC
• 0x49c448 CreateSolidBrush
• 0x49c44c CreatePenIndirect
• 0x49c450 CreatePalette
• 0x49c458 CreateFontIndirectA
• 0x49c45c CreateDIBitmap
• 0x49c460 CreateDIBSection
• 0x49c464 CreateCompatibleDC
• 0x49c46c CreateBrushIndirect
• 0x49c470 CreateBitmap
• 0x49c474 BitBlt
Library user32.dll:
• 0x49c47c CreateWindowExA
• 0x49c480 WindowFromPoint
• 0x49c484 WinHelpA
• 0x49c488 WaitMessage
• 0x49c48c UpdateWindow
• 0x49c490 UnregisterClassA
• 0x49c494 UnhookWindowsHookEx
• 0x49c498 TranslateMessage
• 0x49c4a0 TrackPopupMenu
• 0x49c4a8 ShowWindow
• 0x49c4ac ShowScrollBar
• 0x49c4b0 ShowOwnedPopups
• 0x49c4b4 ShowCursor
• 0x49c4b8 SetWindowsHookExA
• 0x49c4bc SetWindowPos
• 0x49c4c0 SetWindowPlacement
• 0x49c4c4 SetWindowLongA
• 0x49c4c8 SetTimer
• 0x49c4cc SetScrollRange
• 0x49c4d0 SetScrollPos
• 0x49c4d4 SetScrollInfo
• 0x49c4d8 SetRect
• 0x49c4dc SetPropA
• 0x49c4e0 SetParent
• 0x49c4e4 SetMenuItemInfoA
• 0x49c4e8 SetMenu
• 0x49c4ec SetForegroundWindow
• 0x49c4f0 SetFocus
• 0x49c4f4 SetCursor
• 0x49c4f8 SetClassLongA
• 0x49c4fc SetCapture
• 0x49c500 SetActiveWindow
• 0x49c504 SendMessageA
• 0x49c508 ScrollWindow
• 0x49c50c ScreenToClient
• 0x49c510 RemovePropA
• 0x49c514 RemoveMenu
• 0x49c518 ReleaseDC
• 0x49c51c ReleaseCapture
• 0x49c528 RegisterClassA
• 0x49c52c RedrawWindow
• 0x49c530 PtInRect
• 0x49c534 PostQuitMessage
• 0x49c538 PostMessageA
• 0x49c53c PeekMessageA
• 0x49c540 OffsetRect
• 0x49c544 OemToCharBuffA
• 0x49c548 OemToCharA
• 0x49c54c MessageBoxA
• 0x49c550 MapWindowPoints
• 0x49c554 MapVirtualKeyA
• 0x49c558 LoadStringA
• 0x49c55c LoadKeyboardLayoutA
• 0x49c560 LoadIconA
• 0x49c564 LoadCursorA
• 0x49c568 LoadBitmapA
• 0x49c56c KillTimer
• 0x49c570 IsZoomed
• 0x49c574 IsWindowVisible
• 0x49c578 IsWindowEnabled
• 0x49c57c IsWindow
• 0x49c580 IsRectEmpty
• 0x49c584 IsIconic
• 0x49c588 IsDialogMessageA
• 0x49c58c IsChild
• 0x49c590 InvalidateRect
• 0x49c594 IntersectRect
• 0x49c598 InsertMenuItemA
• 0x49c59c InsertMenuA
• 0x49c5a0 InflateRect
• 0x49c5a8 GetWindowTextA
• 0x49c5ac GetWindowRect
• 0x49c5b0 GetWindowPlacement
• 0x49c5b4 GetWindowLongA
• 0x49c5b8 GetWindowDC
• 0x49c5bc GetTopWindow
• 0x49c5c0 GetSystemMetrics
• 0x49c5c4 GetSystemMenu
• 0x49c5c8 GetSysColorBrush
• 0x49c5cc GetSysColor
• 0x49c5d0 GetSubMenu
• 0x49c5d4 GetScrollRange
• 0x49c5d8 GetScrollPos
• 0x49c5dc GetScrollInfo
• 0x49c5e0 GetPropA
• 0x49c5e4 GetParent
• 0x49c5e8 GetWindow
• 0x49c5ec GetMenuStringA
• 0x49c5f0 GetMenuState
• 0x49c5f4 GetMenuItemInfoA
• 0x49c5f8 GetMenuItemID
• 0x49c5fc GetMenuItemCount
• 0x49c600 GetMenu
• 0x49c604 GetLastActivePopup
• 0x49c608 GetKeyboardState
• 0x49c610 GetKeyboardLayout
• 0x49c614 GetKeyState
• 0x49c618 GetKeyNameTextA
• 0x49c61c GetIconInfo
• 0x49c620 GetForegroundWindow
• 0x49c624 GetFocus
• 0x49c628 GetDesktopWindow
• 0x49c62c GetDCEx
• 0x49c630 GetDC
• 0x49c634 GetCursorPos
• 0x49c638 GetCursor
• 0x49c63c GetClientRect
• 0x49c640 GetClassNameA
• 0x49c644 GetClassInfoA
• 0x49c648 GetCapture
• 0x49c64c GetActiveWindow
• 0x49c650 FrameRect
• 0x49c654 FindWindowA
• 0x49c658 FillRect
• 0x49c65c EqualRect
• 0x49c660 EnumWindows
• 0x49c664 EnumThreadWindows
• 0x49c668 EndPaint
• 0x49c66c EnableWindow
• 0x49c670 EnableScrollBar
• 0x49c674 EnableMenuItem
• 0x49c678 DrawTextA
• 0x49c67c DrawMenuBar
• 0x49c680 DrawIconEx
• 0x49c684 DrawIcon
• 0x49c688 DrawFrameControl
• 0x49c68c DrawEdge
• 0x49c690 DispatchMessageA
• 0x49c694 DestroyWindow
• 0x49c698 DestroyMenu
• 0x49c69c DestroyIcon
• 0x49c6a0 DestroyCursor
• 0x49c6a4 DeleteMenu
• 0x49c6a8 DefWindowProcA
• 0x49c6ac DefMDIChildProcA
• 0x49c6b0 DefFrameProcA
• 0x49c6b4 CreatePopupMenu
• 0x49c6b8 CreateMenu
• 0x49c6bc CreateIcon
• 0x49c6c0 ClientToScreen
• 0x49c6c4 CheckMenuItem
• 0x49c6c8 CallWindowProcA
• 0x49c6cc CallNextHookEx
• 0x49c6d0 BeginPaint
• 0x49c6d4 CharNextA
• 0x49c6d8 CharLowerA
• 0x49c6dc CharUpperBuffA
• 0x49c6e0 CharToOemBuffA
• 0x49c6e4 CharToOemA
• 0x49c6e8 AdjustWindowRectEx
Library kernel32.dll:
• 0x49c6f4 Sleep
Library oleaut32.dll:
• 0x49c6fc SafeArrayPtrOfIndex
• 0x49c700 SafeArrayPutElement
• 0x49c704 SafeArrayGetElement
• 0x49c70c SafeArrayAccessData
• 0x49c710 SafeArrayGetUBound
• 0x49c714 SafeArrayGetLBound
• 0x49c718 SafeArrayCreate
• 0x49c71c VariantChangeType
• 0x49c720 VariantCopyInd
• 0x49c724 VariantCopy
• 0x49c728 VariantClear
• 0x49c72c VariantInit
Library ole32.dll:
• 0x49c734 CoCreateInstance
• 0x49c738 CoUninitialize
• 0x49c73c CoInitialize
Library oleaut32.dll:
• 0x49c744 GetErrorInfo
• 0x49c748 SysFreeString
Library comctl32.dll:
• 0x49c758 ImageList_Write
• 0x49c75c ImageList_Read
• 0x49c76c ImageList_DragMove
• 0x49c770 ImageList_DragLeave
• 0x49c774 ImageList_DragEnter
• 0x49c778 ImageList_EndDrag
• 0x49c77c ImageList_BeginDrag
• 0x49c780 ImageList_Remove
• 0x49c784 ImageList_DrawEx
• 0x49c788 ImageList_Draw
• 0x49c798 ImageList_Add
• 0x49c7a0 ImageList_Destroy
• 0x49c7a4 ImageList_Create
Library user32.dll:
• 0x49c7ac DdeCmpStringHandles
• 0x49c7b0 DdeFreeStringHandle
• 0x49c7b4 DdeQueryStringA
• 0x49c7bc DdeGetLastError
• 0x49c7c0 DdeFreeDataHandle
• 0x49c7c4 DdeUnaccessData
• 0x49c7c8 DdeAccessData
• 0x49c7cc DdeCreateDataHandle
• 0x49c7d4 DdeNameService
• 0x49c7d8 DdePostAdvise
• 0x49c7dc DdeSetUserHandle
• 0x49c7e0 DdeQueryConvInfo
• 0x49c7e4 DdeDisconnect
• 0x49c7e8 DdeConnect
• 0x49c7ec DdeUninitialize
• 0x49c7f0 DdeInitializeA

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.119.178.149 80 192.168.56.101 49176

UDP

Source Source Port Destination Destination Port
192.168.56.101 49713 114.114.114.114 53
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 49238 239.255.255.250 1900
192.168.56.101 53658 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.