5.8
高危
58 个模型检测该样本为恶意！
重新分析
更多

d5721cd6f787f4bb734a43f6c321e913a7b74a899e75ebfbc792dd5ee943dd89

b34b2c4f33f6cfb1a63c4f93c96f1240.exe

分析耗时

24s

最近分析

文件大小

942.0KB
静态报毒 动态报毒 100% 6GW@AEHMYZBI AGEN AI SCORE=83 AIDETECTVM AUTO BTHE6I CONFIDENCE CRIDEX DELF DELPHILESS ELDORADO ELTZ ELVZ FAREIT GENERIC@ML HIGH CONFIDENCE HKAUWC IGENT KRYPTIK LOKI MALWARE2 MALWARE@#34YGEKRZTO7E5 OQOE2WSZC7XEV5WD8U8C1W QVM05 R + MAL RDMK SCORE SMAD1 SPYBOTNET SUSGEN SUSPICIOUS PE TSCOPE UNSAFE WACATAC X2059 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FTB!B34B2C4F33F6 20201022 6.0.6.653
Alibaba Trojan:Win32/Cridex.3f8a1e79 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Avast Win32:Malware-gen 20201022 18.4.3895.0
Kingsoft 20201022 2013.8.14.323
Tencent Win32.Trojan.Inject.Auto 20201022 1.0.0.1
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619861119.963822
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 35585860
registers.edi: 0
registers.eax: 0
registers.ebp: 35585928
registers.edx: 45
registers.ebx: 0
registers.esi: 0
registers.ecx: 920
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 e2 6d 00 00 e9
exception.symbol: b34b2c4f33f6cfb1a63c4f93c96f1240+0x94718
exception.instruction: div eax
exception.module: b34b2c4f33f6cfb1a63c4f93c96f1240.exe
exception.exception_code: 0xc0000094
exception.offset: 608024
exception.address: 0x494718
success 0 0
1619886092.398875
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75177f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75174de3
b34b2c4f33f6cfb1a63c4f93c96f1240+0x5aa4d @ 0x45aa4d
b34b2c4f33f6cfb1a63c4f93c96f1240+0x53254 @ 0x453254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff3c14ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619861119.776822
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003d0000
success 0 0
1619861119.963822
NtProtectVirtualMemory
process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 32768
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00494000
success 0 0
1619861119.994822
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00590000
success 0 0
1619886091.382875
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619886091.445875
NtAllocateVirtualMemory
process_identifier: 152
region_size: 1245184
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01e70000
success 0 0
1619886091.445875
NtAllocateVirtualMemory
process_identifier: 152
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f60000
success 0 0
1619886091.445875
NtAllocateVirtualMemory
process_identifier: 152
region_size: 335872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01d40000
success 0 0
1619886091.445875
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 307200
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d42000
success 0 0
1619886091.851875
NtAllocateVirtualMemory
process_identifier: 152
region_size: 851968
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01e70000
success 0 0
1619886091.851875
NtAllocateVirtualMemory
process_identifier: 152
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f00000
success 0 0
1619886092.366875
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e62000
success 0 0
1619886092.366875
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619886092.366875
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e62000
success 0 0
1619886092.366875
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619886092.366875
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e62000
success 0 0
1619886092.366875
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619886092.366875
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e62000
success 0 0
1619886092.366875
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619886092.366875
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e62000
success 0 0
1619886092.366875
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619886092.366875
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e62000
success 0 0
1619886092.366875
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619886092.382875
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e62000
success 0 0
1619886092.382875
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619886092.382875
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e62000
success 0 0
1619886092.382875
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619886092.382875
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e62000
success 0 0
1619886092.382875
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619886092.382875
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e62000
success 0 0
1619886092.382875
NtProtectVirtualMemory
process_identifier: 152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.583592807293186 section {'size_of_data': '0x00040e00', 'virtual_address': '0x000b1000', 'entropy': 7.583592807293186, 'name': '.rsrc', 'virtual_size': '0x00040d08'} description A section with a high entropy has been found
entropy 0.27577045696068014 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 732 called NtSetContextThread to modify thread in remote process 152
Time & API Arguments Status Return Repeated
1619861120.198822
NtSetContextThread
thread_handle: 0x000000ec
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907760
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 152
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 732 resumed a thread in remote process 152
Time & API Arguments Status Return Repeated
1619861120.901822
NtResumeThread
thread_handle: 0x000000ec
suspend_count: 1
process_identifier: 152
success 0 0
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619861120.119822
CreateProcessInternalW
thread_identifier: 2868
thread_handle: 0x000000ec
process_identifier: 152
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\b34b2c4f33f6cfb1a63c4f93c96f1240.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000f0
inherit_handles: 0
success 1 0
1619861120.135822
NtUnmapViewOfSection
process_identifier: 152
region_size: 4096
process_handle: 0x000000f0
base_address: 0x00400000
success 0 0
1619861120.135822
NtMapViewOfSection
section_handle: 0x000000f8
process_identifier: 152
commit_size: 720896
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000f0
allocation_type: 0 ()
section_offset: 0
view_size: 720896
base_address: 0x00400000
success 0 0
1619861120.198822
NtGetContextThread
thread_handle: 0x000000ec
success 0 0
1619861120.198822
NtSetContextThread
thread_handle: 0x000000ec
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907760
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 152
success 0 0
1619861120.901822
NtResumeThread
thread_handle: 0x000000ec
suspend_count: 1
process_identifier: 152
success 0 0
File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
FireEye Generic.mg.b34b2c4f33f6cfb1
McAfee Fareit-FTB!B34B2C4F33F6
Cylance Unsafe
Zillya Trojan.Injector.Win32.732520
Sangfor Malware
K7AntiVirus Trojan ( 005666421 )
Alibaba Trojan:Win32/Cridex.3f8a1e79
K7GW Trojan ( 005666421 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Delf.FareIt.Gen.7
TrendMicro TrojanSpy.Win32.LOKI.SMAD1.hp
Cyren W32/Injector.ABY.gen!Eldorado
Symantec Trojan Horse
APEX Malicious
Avast Win32:Malware-gen
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
BitDefender Trojan.Delf.FareIt.Gen.7
NANO-Antivirus Trojan.Win32.SpyBotNET.hkauwc
Paloalto generic.ml
MicroWorld-eScan Trojan.Delf.FareIt.Gen.7
Rising Trojan.Generic@ML.88 (RDMK:OQoE2WsZC7XEV5wD8u8C1w)
Ad-Aware Trojan.Delf.FareIt.Gen.7
Sophos Mal/Fareit-AA
Comodo Malware@#34ygekrzto7e5
F-Secure Heuristic.HEUR/AGEN.1133569
DrWeb BackDoor.SpyBotNET.17
Invincea Mal/Generic-R + Mal/Fareit-AA
McAfee-GW-Edition BehavesLike.Win32.Fareit.dc
Emsisoft Trojan.Delf.FareIt.Gen.7 (B)
SentinelOne DFI - Suspicious PE
Webroot W32.LOKI.SMAD1
Avira HEUR/AGEN.1133569
Antiy-AVL Trojan/Win32.Wacatac
Microsoft Trojan:Win32/Cridex.VD!MTB
AegisLab Trojan.Multi.Generic.4!c
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
GData Win32.Trojan.Injector.PA
AhnLab-V3 Suspicious/Win.Delphiless.X2059
VBA32 TScope.Trojan.Delf
ALYac Trojan.Delf.FareIt.Gen.7
MAX malware (ai score=83)
Malwarebytes Trojan.Injector
Zoner Trojan.Win32.91758
ESET-NOD32 a variant of Win32/Injector.ELVZ
TrendMicro-HouseCall TrojanSpy.Win32.LOKI.SMAD1.hp
Tencent Win32.Trojan.Inject.Auto
Yandex Trojan.Igent.bTHE6I.39
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x4a0150 VirtualFree
• 0x4a0154 VirtualAlloc
• 0x4a0158 LocalFree
• 0x4a015c LocalAlloc
• 0x4a0160 GetTickCount
• 0x4a0168 GetVersion
• 0x4a016c GetCurrentThreadId
• 0x4a0178 VirtualQuery
• 0x4a017c WideCharToMultiByte
• 0x4a0180 MultiByteToWideChar
• 0x4a0184 lstrlenA
• 0x4a0188 lstrcpynA
• 0x4a018c LoadLibraryExA
• 0x4a0190 GetThreadLocale
• 0x4a0194 GetStartupInfoA
• 0x4a0198 GetProcAddress
• 0x4a019c GetModuleHandleA
• 0x4a01a0 GetModuleFileNameA
• 0x4a01a4 GetLocaleInfoA
• 0x4a01a8 GetCommandLineA
• 0x4a01ac FreeLibrary
• 0x4a01b0 FindFirstFileA
• 0x4a01b4 FindClose
• 0x4a01b8 ExitProcess
• 0x4a01bc WriteFile
• 0x4a01c4 RtlUnwind
• 0x4a01c8 RaiseException
• 0x4a01cc GetStdHandle
Library user32.dll:
• 0x4a01d4 GetKeyboardType
• 0x4a01d8 LoadStringA
• 0x4a01dc MessageBoxA
• 0x4a01e0 CharNextA
Library advapi32.dll:
• 0x4a01e8 RegQueryValueExA
• 0x4a01ec RegOpenKeyExA
• 0x4a01f0 RegCloseKey
Library oleaut32.dll:
• 0x4a01f8 SysFreeString
• 0x4a01fc SysReAllocStringLen
• 0x4a0200 SysAllocStringLen
Library kernel32.dll:
• 0x4a0208 TlsSetValue
• 0x4a020c TlsGetValue
• 0x4a0210 LocalAlloc
• 0x4a0214 GetModuleHandleA
Library advapi32.dll:
• 0x4a021c RegQueryValueExA
• 0x4a0220 RegOpenKeyExA
• 0x4a0224 RegCloseKey
Library kernel32.dll:
• 0x4a022c lstrcpyA
• 0x4a0230 lstrcmpA
• 0x4a0234 WriteFile
• 0x4a0238 WaitForSingleObject
• 0x4a023c VirtualQuery
• 0x4a0240 VirtualProtect
• 0x4a0244 VirtualAlloc
• 0x4a0248 Sleep
• 0x4a024c SizeofResource
• 0x4a0250 SetThreadLocale
• 0x4a0254 SetFilePointer
• 0x4a0258 SetEvent
• 0x4a025c SetErrorMode
• 0x4a0260 SetEndOfFile
• 0x4a0264 ResetEvent
• 0x4a0268 ReadFile
• 0x4a026c MultiByteToWideChar
• 0x4a0270 MulDiv
• 0x4a0274 LockResource
• 0x4a0278 LoadResource
• 0x4a027c LoadLibraryA
• 0x4a0288 GlobalUnlock
• 0x4a028c GlobalReAlloc
• 0x4a0290 GlobalHandle
• 0x4a0294 GlobalLock
• 0x4a0298 GlobalFree
• 0x4a029c GlobalFindAtomA
• 0x4a02a0 GlobalDeleteAtom
• 0x4a02a4 GlobalAlloc
• 0x4a02a8 GlobalAddAtomA
• 0x4a02ac GetVersionExA
• 0x4a02b0 GetVersion
• 0x4a02b4 GetTickCount
• 0x4a02b8 GetThreadLocale
• 0x4a02bc GetTempPathA
• 0x4a02c4 GetSystemTime
• 0x4a02c8 GetSystemInfo
• 0x4a02cc GetStringTypeExA
• 0x4a02d0 GetStdHandle
• 0x4a02d4 GetProcAddress
• 0x4a02d8 GetModuleHandleA
• 0x4a02dc GetModuleFileNameA
• 0x4a02e0 GetLocaleInfoA
• 0x4a02e4 GetLocalTime
• 0x4a02e8 GetLastError
• 0x4a02ec GetFullPathNameA
• 0x4a02f0 GetFileSize
• 0x4a02f4 GetDiskFreeSpaceA
• 0x4a02f8 GetDateFormatA
• 0x4a02fc GetCurrentThreadId
• 0x4a0300 GetCurrentProcessId
• 0x4a0304 GetCPInfo
• 0x4a0308 GetACP
• 0x4a030c FreeResource
• 0x4a0310 InterlockedExchange
• 0x4a0314 FreeLibrary
• 0x4a0318 FormatMessageA
• 0x4a031c FindResourceA
• 0x4a0324 ExitThread
• 0x4a0328 ExitProcess
• 0x4a032c EnumCalendarInfoA
• 0x4a0338 CreateThread
• 0x4a033c CreateFileA
• 0x4a0340 CreateEventA
• 0x4a0344 CompareStringA
• 0x4a0348 CloseHandle
Library version.dll:
• 0x4a0350 VerQueryValueA
• 0x4a0358 GetFileVersionInfoA
Library gdi32.dll:
• 0x4a0360 UnrealizeObject
• 0x4a0364 TextOutA
• 0x4a0368 StretchBlt
• 0x4a036c SetWindowOrgEx
• 0x4a0370 SetWinMetaFileBits
• 0x4a0374 SetViewportOrgEx
• 0x4a0378 SetTextColor
• 0x4a037c SetTextAlign
• 0x4a0380 SetStretchBltMode
• 0x4a0384 SetROP2
• 0x4a0388 SetPixel
• 0x4a038c SetEnhMetaFileBits
• 0x4a0390 SetDIBColorTable
• 0x4a0394 SetBrushOrgEx
• 0x4a0398 SetBkMode
• 0x4a039c SetBkColor
• 0x4a03a0 SelectPalette
• 0x4a03a4 SelectObject
• 0x4a03a8 SelectClipRgn
• 0x4a03ac SaveDC
• 0x4a03b0 RoundRect
• 0x4a03b4 RestoreDC
• 0x4a03b8 Rectangle
• 0x4a03bc RectVisible
• 0x4a03c0 RealizePalette
• 0x4a03c4 Polyline
• 0x4a03c8 Polygon
• 0x4a03cc PlayEnhMetaFile
• 0x4a03d0 Pie
• 0x4a03d4 PatBlt
• 0x4a03d8 MoveToEx
• 0x4a03dc MaskBlt
• 0x4a03e0 LineTo
• 0x4a03e4 LPtoDP
• 0x4a03e8 IntersectClipRect
• 0x4a03ec GetWindowOrgEx
• 0x4a03f0 GetWinMetaFileBits
• 0x4a03f4 GetTextMetricsA
• 0x4a03fc GetTextAlign
• 0x4a0404 GetStockObject
• 0x4a0408 GetPixel
• 0x4a040c GetPaletteEntries
• 0x4a0410 GetObjectA
• 0x4a041c GetEnhMetaFileBits
• 0x4a0420 GetDeviceCaps
• 0x4a0424 GetDIBits
• 0x4a0428 GetDIBColorTable
• 0x4a042c GetDCOrgEx
• 0x4a0434 GetClipBox
• 0x4a0438 GetBrushOrgEx
• 0x4a043c GetBkMode
• 0x4a0440 GetBkColor
• 0x4a0444 GetBitmapBits
• 0x4a0448 ExtSelectClipRgn
• 0x4a044c ExtCreatePen
• 0x4a0450 ExcludeClipRect
• 0x4a0454 Ellipse
• 0x4a0458 DeleteObject
• 0x4a045c DeleteEnhMetaFile
• 0x4a0460 DeleteDC
• 0x4a0464 CreateSolidBrush
• 0x4a0468 CreateRectRgn
• 0x4a046c CreatePolygonRgn
• 0x4a0470 CreatePenIndirect
• 0x4a0474 CreatePalette
• 0x4a047c CreateFontIndirectA
• 0x4a0480 CreateDIBitmap
• 0x4a0484 CreateDIBSection
• 0x4a0488 CreateCompatibleDC
• 0x4a0490 CreateBrushIndirect
• 0x4a0494 CreateBitmap
• 0x4a0498 CopyEnhMetaFileA
• 0x4a049c BitBlt
• 0x4a04a0 Arc
Library user32.dll:
• 0x4a04a8 CreateWindowExA
• 0x4a04ac WindowFromPoint
• 0x4a04b0 WinHelpA
• 0x4a04b4 WaitMessage
• 0x4a04b8 UpdateWindow
• 0x4a04bc UnregisterClassA
• 0x4a04c0 UnhookWindowsHookEx
• 0x4a04c4 TranslateMessage
• 0x4a04cc TrackPopupMenu
• 0x4a04d4 ShowWindow
• 0x4a04d8 ShowScrollBar
• 0x4a04dc ShowOwnedPopups
• 0x4a04e0 ShowCursor
• 0x4a04e4 SetWindowsHookExA
• 0x4a04e8 SetWindowTextA
• 0x4a04ec SetWindowPos
• 0x4a04f0 SetWindowPlacement
• 0x4a04f4 SetWindowLongA
• 0x4a04f8 SetTimer
• 0x4a04fc SetScrollRange
• 0x4a0500 SetScrollPos
• 0x4a0504 SetScrollInfo
• 0x4a0508 SetRect
• 0x4a050c SetPropA
• 0x4a0510 SetParent
• 0x4a0514 SetMenuItemInfoA
• 0x4a0518 SetMenu
• 0x4a051c SetForegroundWindow
• 0x4a0520 SetFocus
• 0x4a0524 SetCursor
• 0x4a0528 SetClassLongA
• 0x4a052c SetCapture
• 0x4a0530 SetActiveWindow
• 0x4a0534 SendMessageA
• 0x4a0538 ScrollWindow
• 0x4a053c ScreenToClient
• 0x4a0540 RemovePropA
• 0x4a0544 RemoveMenu
• 0x4a0548 ReleaseDC
• 0x4a054c ReleaseCapture
• 0x4a0558 RegisterClassA
• 0x4a055c RedrawWindow
• 0x4a0560 PtInRect
• 0x4a0564 PostQuitMessage
• 0x4a0568 PostMessageA
• 0x4a056c PeekMessageA
• 0x4a0570 OffsetRect
• 0x4a0574 OemToCharA
• 0x4a0578 MessageBoxA
• 0x4a057c MapWindowPoints
• 0x4a0580 MapVirtualKeyA
• 0x4a0584 LoadStringA
• 0x4a0588 LoadKeyboardLayoutA
• 0x4a058c LoadIconA
• 0x4a0590 LoadCursorA
• 0x4a0594 LoadBitmapA
• 0x4a0598 KillTimer
• 0x4a059c IsZoomed
• 0x4a05a0 IsWindowVisible
• 0x4a05a4 IsWindowEnabled
• 0x4a05a8 IsWindow
• 0x4a05ac IsRectEmpty
• 0x4a05b0 IsIconic
• 0x4a05b4 IsDialogMessageA
• 0x4a05b8 IsChild
• 0x4a05bc InvalidateRect
• 0x4a05c0 IntersectRect
• 0x4a05c4 InsertMenuItemA
• 0x4a05c8 InsertMenuA
• 0x4a05cc InflateRect
• 0x4a05d4 GetWindowTextA
• 0x4a05d8 GetWindowRect
• 0x4a05dc GetWindowPlacement
• 0x4a05e0 GetWindowLongA
• 0x4a05e4 GetWindowDC
• 0x4a05e8 GetTopWindow
• 0x4a05ec GetSystemMetrics
• 0x4a05f0 GetSystemMenu
• 0x4a05f4 GetSysColorBrush
• 0x4a05f8 GetSysColor
• 0x4a05fc GetSubMenu
• 0x4a0600 GetScrollRange
• 0x4a0604 GetScrollPos
• 0x4a0608 GetScrollInfo
• 0x4a060c GetPropA
• 0x4a0610 GetParent
• 0x4a0614 GetWindow
• 0x4a0618 GetMenuStringA
• 0x4a061c GetMenuState
• 0x4a0620 GetMenuItemInfoA
• 0x4a0624 GetMenuItemID
• 0x4a0628 GetMenuItemCount
• 0x4a062c GetMenu
• 0x4a0630 GetLastActivePopup
• 0x4a0634 GetKeyboardState
• 0x4a063c GetKeyboardLayout
• 0x4a0640 GetKeyState
• 0x4a0644 GetKeyNameTextA
• 0x4a0648 GetIconInfo
• 0x4a064c GetForegroundWindow
• 0x4a0650 GetFocus
• 0x4a0654 GetDesktopWindow
• 0x4a0658 GetDCEx
• 0x4a065c GetDC
• 0x4a0660 GetCursorPos
• 0x4a0664 GetCursor
• 0x4a0668 GetClipboardData
• 0x4a066c GetClientRect
• 0x4a0670 GetClassNameA
• 0x4a0674 GetClassInfoA
• 0x4a0678 GetCapture
• 0x4a067c GetActiveWindow
• 0x4a0680 FrameRect
• 0x4a0684 FindWindowA
• 0x4a0688 FillRect
• 0x4a068c EqualRect
• 0x4a0690 EnumWindows
• 0x4a0694 EnumThreadWindows
• 0x4a0698 EndPaint
• 0x4a069c EnableWindow
• 0x4a06a0 EnableScrollBar
• 0x4a06a4 EnableMenuItem
• 0x4a06a8 DrawTextA
• 0x4a06ac DrawStateA
• 0x4a06b0 DrawMenuBar
• 0x4a06b4 DrawIconEx
• 0x4a06b8 DrawIcon
• 0x4a06bc DrawFrameControl
• 0x4a06c0 DrawEdge
• 0x4a06c4 DispatchMessageA
• 0x4a06c8 DestroyWindow
• 0x4a06cc DestroyMenu
• 0x4a06d0 DestroyIcon
• 0x4a06d4 DestroyCursor
• 0x4a06d8 DeleteMenu
• 0x4a06dc DefWindowProcA
• 0x4a06e0 DefMDIChildProcA
• 0x4a06e4 DefFrameProcA
• 0x4a06e8 CreatePopupMenu
• 0x4a06ec CreateMenu
• 0x4a06f0 CreateIcon
• 0x4a06f4 ClientToScreen
• 0x4a06f8 CheckMenuItem
• 0x4a06fc CallWindowProcA
• 0x4a0700 CallNextHookEx
• 0x4a0704 BeginPaint
• 0x4a0708 CharNextA
• 0x4a070c CharLowerBuffA
• 0x4a0710 CharLowerA
• 0x4a0714 CharUpperBuffA
• 0x4a0718 CharToOemA
• 0x4a071c AdjustWindowRectEx
Library kernel32.dll:
• 0x4a0728 Sleep
Library oleaut32.dll:
• 0x4a0730 SafeArrayPtrOfIndex
• 0x4a0734 SafeArrayPutElement
• 0x4a0738 SafeArrayGetElement
• 0x4a0740 SafeArrayAccessData
• 0x4a0744 SafeArrayGetUBound
• 0x4a0748 SafeArrayGetLBound
• 0x4a074c SafeArrayCreate
• 0x4a0750 VariantChangeType
• 0x4a0754 VariantCopyInd
• 0x4a0758 VariantCopy
• 0x4a075c VariantClear
• 0x4a0760 VariantInit
Library ole32.dll:
• 0x4a0768 CoTaskMemAlloc
• 0x4a076c CoCreateInstance
• 0x4a0770 CoUninitialize
• 0x4a0774 CoInitialize
Library oleaut32.dll:
• 0x4a077c GetErrorInfo
• 0x4a0780 SysFreeString
Library comctl32.dll:
• 0x4a0790 ImageList_Write
• 0x4a0794 ImageList_Read
• 0x4a07a4 ImageList_DragMove
• 0x4a07a8 ImageList_DragLeave
• 0x4a07ac ImageList_DragEnter
• 0x4a07b0 ImageList_EndDrag
• 0x4a07b4 ImageList_BeginDrag
• 0x4a07b8 ImageList_Remove
• 0x4a07bc ImageList_DrawEx
• 0x4a07c0 ImageList_Draw
• 0x4a07d0 ImageList_Add
• 0x4a07d8 ImageList_Destroy
• 0x4a07dc ImageList_Create
• 0x4a07e0 InitCommonControls

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.