2.8
中危
1 个模型检测该样本为恶意！
重新分析
更多

f1f3a2fc75fdbc6e69c4e1126ac2c83f675ed7d8234d464ff547abbd21b48f2f

b138ef06fc091e4c0dbb4d90f9f3c58c.exe

分析耗时

75s

最近分析

文件大小

1.1MB
静态报毒 动态报毒 MODERATE SCORE
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee 20190724 6.0.6.653
Alibaba 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast 20190724 18.4.3895.0
Tencent 20190724 1.0.0.1
Kingsoft 20190724 2013.8.14.323
CrowdStrike 20190212 1.0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (35 个事件)
Time & API Arguments Status Return Repeated
1620897714.951689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1620897714.983689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00404000
success 0 0
1620897714.983689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x004b2000
success 0 0
1620897714.983689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x004b2000
success 0 0
1620897714.983689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00457000
success 0 0
1620897714.983689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0046b000
success 0 0
1620897714.983689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00404000
success 0 0
1620897714.983689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00404000
success 0 0
1620897714.983689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00404000
success 0 0
1620897714.983689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00404000
success 0 0
1620897714.983689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00404000
success 0 0
1620897714.983689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00404000
success 0 0
1620897714.983689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00404000
success 0 0
1620897714.983689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00404000
success 0 0
1620897714.983689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00404000
success 0 0
1620897714.998689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x004ee000
success 0 0
1620897714.998689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x004ee000
success 0 0
1620897714.998689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75010000
success 0 0
1620897714.998689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75301000
success 0 0
1620897714.998689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x754a1000
success 0 0
1620897714.998689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75900000
success 0 0
1620897714.998689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75951000
success 0 0
1620897714.998689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76091000
success 0 0
1620897714.998689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x764c1000
success 0 0
1620897714.998689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76541000
success 0 0
1620897714.998689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x765e1000
success 0 0
1620897715.014689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x766f1000
success 0 0
1620897715.014689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x768e1000
success 0 0
1620897715.014689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77531000
success 0 0
1620897715.014689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77571000
success 0 0
1620897715.014689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x775a0000
success 0 0
1620897715.014689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x776b1000
success 0 0
1620897715.014689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x768e2000
success 0 0
1620897715.014689
NtProtectVirtualMemory
process_identifier: 2740
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x776b1000
success 0 0
1620897715.108689
NtAllocateVirtualMemory
process_identifier: 2740
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01e70000
success 0 0
Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (5 个事件)
Time & API Arguments Status Return Repeated
1620897717.795689
GetDiskFreeSpaceW
root_path: c:\
sectors_per_cluster: 8
number_of_free_clusters: 4788295
total_number_of_clusters: 8362495
bytes_per_sector: 512
success 1 0
1620897717.795689
GetDiskFreeSpaceW
root_path: c:\
sectors_per_cluster: 8
number_of_free_clusters: 4788295
total_number_of_clusters: 8362495
bytes_per_sector: 512
success 1 0
1620897717.795689
GetDiskFreeSpaceW
root_path: c:\
sectors_per_cluster: 8
number_of_free_clusters: 4788295
total_number_of_clusters: 8362495
bytes_per_sector: 512
success 1 0
1620897717.811689
GetDiskFreeSpaceW
root_path: c:\
sectors_per_cluster: 8
number_of_free_clusters: 4788295
total_number_of_clusters: 8362495
bytes_per_sector: 512
success 1 0
1620897717.826689
GetDiskFreeSpaceExW
root_path: A:\
free_bytes_available: 0
total_number_of_free_bytes: 0
total_number_of_bytes: 140767554760340
failed 0 0
File has been identified by one AntiVirus engine on VirusTotal as malicious (1 个事件)
Trapmine malicious.moderate.ml.score
The binary likely contains encrypted or compressed data indicative of a packer (1 个事件)
entropy 6.851925650991634 section {'size_of_data': '0x00021800', 'virtual_address': '0x00103000', 'entropy': 6.851925650991634, 'name': '.rsrc', 'virtual_size': '0x00021754'} description A section with a high entropy has been found
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x4ee1dc VirtualFree
• 0x4ee1e0 VirtualAlloc
• 0x4ee1e4 LocalFree
• 0x4ee1e8 LocalAlloc
• 0x4ee1ec GetVersion
• 0x4ee1f0 GetCurrentThreadId
• 0x4ee1fc VirtualQuery
• 0x4ee200 WideCharToMultiByte
• 0x4ee208 MultiByteToWideChar
• 0x4ee20c lstrlenA
• 0x4ee210 lstrcpynA
• 0x4ee214 LoadLibraryExA
• 0x4ee218 GetThreadLocale
• 0x4ee21c GetStartupInfoA
• 0x4ee220 GetProcAddress
• 0x4ee224 GetModuleHandleA
• 0x4ee228 GetModuleFileNameA
• 0x4ee22c GetLocaleInfoA
• 0x4ee230 GetLastError
• 0x4ee238 GetCommandLineA
• 0x4ee23c FreeLibrary
• 0x4ee240 FindFirstFileA
• 0x4ee244 FindClose
• 0x4ee248 CreateDirectoryA
• 0x4ee24c ExitProcess
• 0x4ee250 ExitThread
• 0x4ee254 CreateThread
• 0x4ee258 WriteFile
• 0x4ee260 SetFilePointer
• 0x4ee264 SetEndOfFile
• 0x4ee268 RtlUnwind
• 0x4ee26c ReadFile
• 0x4ee270 RaiseException
• 0x4ee274 GetStdHandle
• 0x4ee278 GetFileSize
• 0x4ee27c GetFileType
• 0x4ee280 CreateFileA
• 0x4ee284 CloseHandle
Library user32.dll:
• 0x4ee28c GetKeyboardType
• 0x4ee290 LoadStringA
• 0x4ee294 MessageBoxA
• 0x4ee298 CharNextA
Library advapi32.dll:
• 0x4ee2a0 RegQueryValueExA
• 0x4ee2a4 RegOpenKeyExA
• 0x4ee2a8 RegCloseKey
Library oleaut32.dll:
• 0x4ee2b0 SysFreeString
• 0x4ee2b4 SysReAllocStringLen
• 0x4ee2b8 SysAllocStringLen
Library kernel32.dll:
• 0x4ee2c0 TlsSetValue
• 0x4ee2c4 TlsGetValue
• 0x4ee2c8 LocalAlloc
• 0x4ee2cc GetModuleHandleA
Library advapi32.dll:
• 0x4ee2d8 RegSetValueExA
• 0x4ee2dc RegQueryValueExA
• 0x4ee2e0 RegQueryInfoKeyA
• 0x4ee2e4 RegOpenKeyExA
• 0x4ee2e8 RegEnumKeyA
• 0x4ee2ec RegDeleteValueA
• 0x4ee2f0 RegCreateKeyExA
• 0x4ee2f4 RegCloseKey
• 0x4ee2fc GetUserNameA
• 0x4ee300 FreeSid
Library kernel32.dll:
• 0x4ee30c lstrcpyA
• 0x4ee310 lstrcmpA
• 0x4ee314 _lwrite
• 0x4ee318 _lread
• 0x4ee31c _lopen
• 0x4ee320 _llseek
• 0x4ee324 _lcreat
• 0x4ee328 _lclose
• 0x4ee330 WriteFile
• 0x4ee334 WaitForSingleObject
• 0x4ee338 VirtualQuery
• 0x4ee33c VirtualProtect
• 0x4ee340 VirtualFree
• 0x4ee344 VirtualAlloc
• 0x4ee348 UnmapViewOfFile
• 0x4ee34c TerminateThread
• 0x4ee350 TerminateProcess
• 0x4ee358 SuspendThread
• 0x4ee35c Sleep
• 0x4ee360 SizeofResource
• 0x4ee364 SetVolumeLabelA
• 0x4ee36c SetThreadPriority
• 0x4ee370 SetThreadLocale
• 0x4ee374 SetLastError
• 0x4ee378 SetFileTime
• 0x4ee37c SetFilePointer
• 0x4ee380 SetFileAttributesA
• 0x4ee384 SetEvent
• 0x4ee388 SetErrorMode
• 0x4ee38c SetEndOfFile
• 0x4ee390 ResumeThread
• 0x4ee394 ResetEvent
• 0x4ee398 RemoveDirectoryA
• 0x4ee39c ReleaseMutex
• 0x4ee3a0 ReadProcessMemory
• 0x4ee3a4 ReadFile
• 0x4ee3a8 RaiseException
• 0x4ee3b4 OpenProcess
• 0x4ee3b8 OpenFileMappingA
• 0x4ee3bc MultiByteToWideChar
• 0x4ee3c0 MulDiv
• 0x4ee3c4 MoveFileA
• 0x4ee3c8 MapViewOfFile
• 0x4ee3cc LockResource
• 0x4ee3d0 LocalSize
• 0x4ee3d4 LocalFree
• 0x4ee3dc LocalAlloc
• 0x4ee3e0 LoadResource
• 0x4ee3e4 LoadLibraryExA
• 0x4ee3e8 LoadLibraryA
• 0x4ee3f0 IsBadReadPtr
• 0x4ee3f8 GlobalUnlock
• 0x4ee3fc GlobalReAlloc
• 0x4ee400 GlobalMemoryStatus
• 0x4ee404 GlobalHandle
• 0x4ee408 GlobalLock
• 0x4ee40c GlobalFree
• 0x4ee410 GlobalFindAtomA
• 0x4ee414 GlobalDeleteAtom
• 0x4ee418 GlobalAlloc
• 0x4ee41c GlobalAddAtomA
• 0x4ee424 GetVersionExW
• 0x4ee428 GetVersionExA
• 0x4ee42c GetVersion
• 0x4ee430 GetTickCount
• 0x4ee434 GetThreadPriority
• 0x4ee438 GetThreadLocale
• 0x4ee43c GetThreadContext
• 0x4ee440 GetTempPathA
• 0x4ee444 GetTempFileNameA
• 0x4ee448 GetSystemTime
• 0x4ee44c GetSystemInfo
• 0x4ee450 GetSystemDirectoryA
• 0x4ee454 GetStringTypeExA
• 0x4ee458 GetStdHandle
• 0x4ee45c GetProcAddress
• 0x4ee464 GetPriorityClass
• 0x4ee468 GetModuleHandleW
• 0x4ee46c GetModuleHandleA
• 0x4ee470 GetModuleFileNameW
• 0x4ee474 GetModuleFileNameA
• 0x4ee478 GetLocaleInfoA
• 0x4ee47c GetLocalTime
• 0x4ee480 GetLastError
• 0x4ee484 GetFullPathNameA
• 0x4ee488 GetFileTime
• 0x4ee48c GetFileSize
• 0x4ee490 GetFileAttributesA
• 0x4ee494 GetExitCodeThread
• 0x4ee498 GetExitCodeProcess
• 0x4ee49c GetDriveTypeA
• 0x4ee4a0 GetDiskFreeSpaceA
• 0x4ee4a4 GetDateFormatA
• 0x4ee4a8 GetCurrentThreadId
• 0x4ee4ac GetCurrentThread
• 0x4ee4b0 GetCurrentProcessId
• 0x4ee4b4 GetCurrentProcess
• 0x4ee4b8 GetComputerNameA
• 0x4ee4bc GetCommandLineA
• 0x4ee4c0 GetCPInfo
• 0x4ee4c4 GetACP
• 0x4ee4c8 FreeResource
• 0x4ee4d0 InterlockedExchange
• 0x4ee4d8 FreeLibrary
• 0x4ee4dc FormatMessageA
• 0x4ee4e0 FlushFileBuffers
• 0x4ee4e4 FindResourceA
• 0x4ee4e8 FindNextFileA
• 0x4ee4ec FindFirstFileA
• 0x4ee4f0 FindClose
• 0x4ee504 ExitThread
• 0x4ee508 ExitProcess
• 0x4ee50c EnumCalendarInfoA
• 0x4ee514 DuplicateHandle
• 0x4ee51c DeleteFileA
• 0x4ee524 CreateThread
• 0x4ee528 CreateRemoteThread
• 0x4ee52c CreateProcessA
• 0x4ee530 CreatePipe
• 0x4ee534 CreateMutexA
• 0x4ee538 CreateFileMappingW
• 0x4ee53c CreateFileMappingA
• 0x4ee540 CreateFileW
• 0x4ee544 CreateFileA
• 0x4ee548 CreateEventA
• 0x4ee54c CreateDirectoryA
• 0x4ee550 CopyFileA
• 0x4ee554 CompareStringA
• 0x4ee558 CloseHandle
• 0x4ee55c Beep
• 0x4ee560 AreFileApisANSI
Library version.dll:
• 0x4ee568 VerQueryValueA
• 0x4ee570 GetFileVersionInfoA
Library gdi32.dll:
• 0x4ee578 UnrealizeObject
• 0x4ee57c TextOutA
• 0x4ee580 StretchDIBits
• 0x4ee584 StretchBlt
• 0x4ee588 StartPage
• 0x4ee58c StartDocA
• 0x4ee590 SetWindowOrgEx
• 0x4ee594 SetWinMetaFileBits
• 0x4ee598 SetViewportOrgEx
• 0x4ee59c SetTextColor
• 0x4ee5a0 SetStretchBltMode
• 0x4ee5a4 SetROP2
• 0x4ee5a8 SetPixel
• 0x4ee5ac SetMapMode
• 0x4ee5b0 SetEnhMetaFileBits
• 0x4ee5b4 SetDIBColorTable
• 0x4ee5b8 SetBrushOrgEx
• 0x4ee5bc SetBkMode
• 0x4ee5c0 SetBkColor
• 0x4ee5c4 SelectPalette
• 0x4ee5c8 SelectObject
• 0x4ee5cc SelectClipRgn
• 0x4ee5d0 SaveDC
• 0x4ee5d4 RestoreDC
• 0x4ee5d8 Rectangle
• 0x4ee5dc RectVisible
• 0x4ee5e0 RealizePalette
• 0x4ee5e4 Polyline
• 0x4ee5e8 PlayEnhMetaFile
• 0x4ee5ec PatBlt
• 0x4ee5f0 MoveToEx
• 0x4ee5f4 MaskBlt
• 0x4ee5f8 LineTo
• 0x4ee5fc IntersectClipRect
• 0x4ee600 GetWindowOrgEx
• 0x4ee604 GetWinMetaFileBits
• 0x4ee608 GetTextMetricsA
• 0x4ee60c GetTextFaceA
• 0x4ee610 GetTextExtentPointA
• 0x4ee620 GetStockObject
• 0x4ee624 GetRgnBox
• 0x4ee628 GetPixel
• 0x4ee62c GetPaletteEntries
• 0x4ee630 GetObjectA
• 0x4ee63c GetEnhMetaFileBits
• 0x4ee640 GetDeviceCaps
• 0x4ee644 GetDIBits
• 0x4ee648 GetDIBColorTable
• 0x4ee64c GetDCOrgEx
• 0x4ee654 GetClipBox
• 0x4ee658 GetBrushOrgEx
• 0x4ee65c GetBitmapBits
• 0x4ee660 GdiFlush
• 0x4ee664 ExcludeClipRect
• 0x4ee668 EndPage
• 0x4ee66c EndDoc
• 0x4ee670 DeleteObject
• 0x4ee674 DeleteEnhMetaFile
• 0x4ee678 DeleteDC
• 0x4ee67c CreateSolidBrush
• 0x4ee684 CreateRectRgn
• 0x4ee688 CreatePenIndirect
• 0x4ee68c CreatePen
• 0x4ee690 CreatePalette
• 0x4ee698 CreateFontIndirectA
• 0x4ee69c CreateFontA
• 0x4ee6a0 CreateDIBitmap
• 0x4ee6a4 CreateDIBSection
• 0x4ee6a8 CreateDCA
• 0x4ee6ac CreateCompatibleDC
• 0x4ee6b4 CreateBrushIndirect
• 0x4ee6b8 CreateBitmap
• 0x4ee6bc CopyEnhMetaFileA
• 0x4ee6c0 CombineRgn
• 0x4ee6c4 BitBlt
Library user32.dll:
• 0x4ee6cc CreateWindowExA
• 0x4ee6d0 WindowFromPoint
• 0x4ee6d4 WinHelpA
• 0x4ee6d8 WaitMessage
• 0x4ee6dc UpdateWindow
• 0x4ee6e0 UnregisterClassA
• 0x4ee6e4 UnhookWindowsHookEx
• 0x4ee6e8 TranslateMessage
• 0x4ee6f0 TrackPopupMenu
• 0x4ee6f8 ShowWindow
• 0x4ee6fc ShowScrollBar
• 0x4ee700 ShowOwnedPopups
• 0x4ee704 ShowCursor
• 0x4ee708 SetWindowsHookExA
• 0x4ee70c SetWindowTextA
• 0x4ee710 SetWindowPos
• 0x4ee714 SetWindowPlacement
• 0x4ee718 SetWindowLongA
• 0x4ee71c SetTimer
• 0x4ee720 SetScrollRange
• 0x4ee724 SetScrollPos
• 0x4ee728 SetScrollInfo
• 0x4ee72c SetRect
• 0x4ee730 SetPropA
• 0x4ee734 SetParent
• 0x4ee738 SetMenuItemInfoA
• 0x4ee73c SetMenu
• 0x4ee740 SetForegroundWindow
• 0x4ee744 SetFocus
• 0x4ee748 SetCursor
• 0x4ee74c SetClipboardData
• 0x4ee750 SetClassLongA
• 0x4ee754 SetCapture
• 0x4ee758 SetActiveWindow
• 0x4ee75c SendMessageTimeoutA
• 0x4ee760 SendMessageA
• 0x4ee764 ScrollWindow
• 0x4ee768 ScreenToClient
• 0x4ee76c RemovePropA
• 0x4ee770 RemoveMenu
• 0x4ee774 ReleaseDC
• 0x4ee778 ReleaseCapture
• 0x4ee784 RegisterClassA
• 0x4ee788 RedrawWindow
• 0x4ee78c PtInRect
• 0x4ee790 PostThreadMessageA
• 0x4ee794 PostQuitMessage
• 0x4ee798 PostMessageA
• 0x4ee79c PeekMessageW
• 0x4ee7a0 PeekMessageA
• 0x4ee7a4 OpenClipboard
• 0x4ee7a8 OffsetRect
• 0x4ee7ac OemToCharA
• 0x4ee7b4 MessageBoxA
• 0x4ee7b8 MessageBeep
• 0x4ee7bc MapWindowPoints
• 0x4ee7c0 MapVirtualKeyA
• 0x4ee7c4 LoadStringA
• 0x4ee7c8 LoadKeyboardLayoutA
• 0x4ee7cc LoadImageA
• 0x4ee7d0 LoadIconA
• 0x4ee7d4 LoadCursorA
• 0x4ee7d8 LoadBitmapA
• 0x4ee7dc KillTimer
• 0x4ee7e0 IsZoomed
• 0x4ee7e4 IsWindowVisible
• 0x4ee7e8 IsWindowEnabled
• 0x4ee7ec IsWindow
• 0x4ee7f0 IsRectEmpty
• 0x4ee7f4 IsIconic
• 0x4ee7f8 IsDialogMessageA
• 0x4ee7fc IsChild
• 0x4ee800 InvalidateRect
• 0x4ee804 IntersectRect
• 0x4ee808 InsertMenuItemA
• 0x4ee80c InsertMenuA
• 0x4ee810 InflateRect
• 0x4ee818 GetWindowTextA
• 0x4ee81c GetWindowRect
• 0x4ee820 GetWindowPlacement
• 0x4ee824 GetWindowLongA
• 0x4ee828 GetWindowDC
• 0x4ee82c GetTopWindow
• 0x4ee830 GetSystemMetrics
• 0x4ee834 GetSystemMenu
• 0x4ee838 GetSysColorBrush
• 0x4ee83c GetSysColor
• 0x4ee840 GetSubMenu
• 0x4ee844 GetScrollRange
• 0x4ee848 GetScrollPos
• 0x4ee84c GetScrollInfo
• 0x4ee850 GetPropA
• 0x4ee854 GetParent
• 0x4ee858 GetWindow
• 0x4ee85c GetMessageW
• 0x4ee860 GetMessageA
• 0x4ee864 GetMenuStringA
• 0x4ee868 GetMenuState
• 0x4ee86c GetMenuItemInfoA
• 0x4ee870 GetMenuItemID
• 0x4ee874 GetMenuItemCount
• 0x4ee878 GetMenu
• 0x4ee87c GetLastActivePopup
• 0x4ee880 GetKeyboardState
• 0x4ee888 GetKeyboardLayout
• 0x4ee88c GetKeyState
• 0x4ee890 GetKeyNameTextA
• 0x4ee894 GetIconInfo
• 0x4ee898 GetForegroundWindow
• 0x4ee89c GetFocus
• 0x4ee8a0 GetDlgItem
• 0x4ee8a4 GetDesktopWindow
• 0x4ee8a8 GetDCEx
• 0x4ee8ac GetDC
• 0x4ee8b0 GetCursorPos
• 0x4ee8b4 GetCursor
• 0x4ee8b8 GetClipboardData
• 0x4ee8bc GetClientRect
• 0x4ee8c0 GetClassNameA
• 0x4ee8c4 GetClassInfoA
• 0x4ee8c8 GetCapture
• 0x4ee8cc GetActiveWindow
• 0x4ee8d0 FrameRect
• 0x4ee8d4 FindWindowA
• 0x4ee8d8 FillRect
• 0x4ee8dc EqualRect
• 0x4ee8e0 EnumWindows
• 0x4ee8e4 EnumThreadWindows
• 0x4ee8e8 EndPaint
• 0x4ee8ec EndDeferWindowPos
• 0x4ee8f0 EnableWindow
• 0x4ee8f4 EnableScrollBar
• 0x4ee8f8 EnableMenuItem
• 0x4ee8fc EmptyClipboard
• 0x4ee900 DrawTextExA
• 0x4ee904 DrawTextA
• 0x4ee908 DrawMenuBar
• 0x4ee90c DrawIconEx
• 0x4ee910 DrawIcon
• 0x4ee914 DrawFrameControl
• 0x4ee918 DrawFocusRect
• 0x4ee91c DrawEdge
• 0x4ee920 DispatchMessageA
• 0x4ee924 DestroyWindow
• 0x4ee928 DestroyMenu
• 0x4ee92c DestroyIcon
• 0x4ee930 DestroyCursor
• 0x4ee934 DeleteMenu
• 0x4ee938 DeferWindowPos
• 0x4ee93c DefWindowProcA
• 0x4ee940 DefMDIChildProcA
• 0x4ee944 DefFrameProcA
• 0x4ee948 CreatePopupMenu
• 0x4ee94c CreateMenu
• 0x4ee950 CreateIcon
• 0x4ee954 CloseClipboard
• 0x4ee958 ClientToScreen
• 0x4ee95c CheckMenuItem
• 0x4ee960 CallWindowProcA
• 0x4ee964 CallNextHookEx
• 0x4ee968 BringWindowToTop
• 0x4ee96c BeginPaint
• 0x4ee970 BeginDeferWindowPos
• 0x4ee974 AttachThreadInput
• 0x4ee978 CharNextA
• 0x4ee97c CharLowerBuffA
• 0x4ee980 CharLowerA
• 0x4ee984 CharUpperBuffA
• 0x4ee988 CharToOemA
• 0x4ee98c AdjustWindowRectEx
Library ole32.dll:
• 0x4ee99c CoUninitialize
• 0x4ee9a0 CoInitialize
Library oleaut32.dll:
• 0x4ee9a8 GetErrorInfo
• 0x4ee9ac SysFreeString
Library olepro32.dll:
• 0x4ee9b4 OleLoadPicture
Library comctl32.dll:
• 0x4ee9c4 ImageList_Write
• 0x4ee9c8 ImageList_Read
• 0x4ee9d8 ImageList_DragMove
• 0x4ee9dc ImageList_DragLeave
• 0x4ee9e0 ImageList_DragEnter
• 0x4ee9e4 ImageList_EndDrag
• 0x4ee9e8 ImageList_BeginDrag
• 0x4ee9ec ImageList_Remove
• 0x4ee9f0 ImageList_DrawEx
• 0x4ee9f4 ImageList_Draw
• 0x4eea04 ImageList_Add
• 0x4eea0c ImageList_Destroy
• 0x4eea10 ImageList_Create
• 0x4eea14 InitCommonControls
Library shell32.dll:
• 0x4eea1c ShellExecuteExA
• 0x4eea20 ShellExecuteA
• 0x4eea24 SHGetFileInfoA
• 0x4eea28 SHFileOperationA
Library shell32.dll:
• 0x4eea38 SHBrowseForFolderA
Library comdlg32.dll:
• 0x4eea40 PrintDlgA
• 0x4eea44 GetSaveFileNameA
• 0x4eea48 GetOpenFileNameA
Library wsock32.dll:
• 0x4eea50 WSACleanup
• 0x4eea54 WSAStartup
• 0x4eea58 gethostbyname
• 0x4eea5c socket
• 0x4eea60 setsockopt
• 0x4eea64 sendto
• 0x4eea68 send
• 0x4eea6c select
• 0x4eea70 recvfrom
• 0x4eea74 recv
• 0x4eea78 inet_addr
• 0x4eea7c htons
• 0x4eea80 connect
• 0x4eea84 closesocket
• 0x4eea88 bind
Library kernel32.dll:
• 0x4eea90 RtlUnwind
Library kernel32.dll:
• 0x4eea98 Sleep

Exports

Ordinal Address Name
1 0x44e60c madTraceProcess

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 51809 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 60124 239.255.255.250 3702
192.168.56.101 62194 239.255.255.250 1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.