7.2
高危
63 个模型检测该样本为恶意！
重新分析
更多

72085a6683fbd36131021d63dff1637225c452606c901a7ebe58bdd7795af521

bf71733cfb5f0cbe96585240ab37de7a.exe

分析耗时

44s

最近分析

文件大小

709.5KB
静态报毒 动态报毒 5Z8AU1 AI SCORE=89 AIDETECTVM ANTIVM AUTO BTLC53 CONFIDENCE DELF DELPHILESS ELZG FAREIT FOXMT GENERICKD HDJK HIGH CONFIDENCE HKKHMX HPLOKI IGENT KTSE LOKI LOKIBOT MALWARE2 MALWARE@#N2RPORVWHXZQ NANOCORE QVM05 R + MAL SCORE SGW@AQMDMVBI SMBD SUSPICIOUS PE TSCOPE TSGENERIC TSPY UNSAFE X2066 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FTB!BF71733CFB5F 20200922 6.0.6.653
Alibaba TrojanSpy:Win32/Fareit.b964f853 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Other:Malware-gen [Trj] 20200922 18.4.3895.0
Kingsoft 20200922 2013.8.14.323
Tencent Win32.Trojan.Inject.Auto 20200922 1.0.0.1
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619868115.768875
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73aae97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73aaea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73aab25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73aab4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73aaac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73aaaed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73aa5511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73aa559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74167f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74164de3
bf71733cfb5f0cbe96585240ab37de7a+0x40a4d @ 0x440a4d
bf71733cfb5f0cbe96585240ab37de7a+0x39254 @ 0x439254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfd0414ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619868109.613
NtAllocateVirtualMemory
process_identifier: 2256
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00360000
success 0 0
1619868109.784
NtProtectVirtualMemory
process_identifier: 2256
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 32768
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0045e000
success 0 0
1619868109.784
NtAllocateVirtualMemory
process_identifier: 2256
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01fb0000
success 0 0
1619868110.268875
NtProtectVirtualMemory
process_identifier: 1688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619868110.299875
NtAllocateVirtualMemory
process_identifier: 1688
region_size: 1769472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01dc0000
success 0 0
1619868110.299875
NtAllocateVirtualMemory
process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f30000
success 0 0
1619868110.315875
NtAllocateVirtualMemory
process_identifier: 1688
region_size: 229376
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00830000
success 0 0
1619868110.315875
NtProtectVirtualMemory
process_identifier: 1688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 118784
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00832000
success 0 0
1619868113.752875
NtAllocateVirtualMemory
process_identifier: 1688
region_size: 1900544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x020c0000
success 0 0
1619868113.752875
NtAllocateVirtualMemory
process_identifier: 1688
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02250000
success 0 0
1619868115.752875
NtProtectVirtualMemory
process_identifier: 1688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00822000
success 0 0
1619868115.752875
NtProtectVirtualMemory
process_identifier: 1688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619868115.752875
NtProtectVirtualMemory
process_identifier: 1688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00822000
success 0 0
1619868115.752875
NtProtectVirtualMemory
process_identifier: 1688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619868115.752875
NtProtectVirtualMemory
process_identifier: 1688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00822000
success 0 0
1619868115.752875
NtProtectVirtualMemory
process_identifier: 1688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619868115.752875
NtProtectVirtualMemory
process_identifier: 1688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00822000
success 0 0
1619868115.752875
NtProtectVirtualMemory
process_identifier: 1688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619868115.752875
NtProtectVirtualMemory
process_identifier: 1688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00822000
success 0 0
1619868115.752875
NtProtectVirtualMemory
process_identifier: 1688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619868115.752875
NtProtectVirtualMemory
process_identifier: 1688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00822000
success 0 0
1619868115.752875
NtProtectVirtualMemory
process_identifier: 1688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619868115.752875
NtProtectVirtualMemory
process_identifier: 1688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00822000
success 0 0
1619868115.752875
NtProtectVirtualMemory
process_identifier: 1688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619868115.752875
NtProtectVirtualMemory
process_identifier: 1688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00822000
success 0 0
1619868115.752875
NtProtectVirtualMemory
process_identifier: 1688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619868115.752875
NtProtectVirtualMemory
process_identifier: 1688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00822000
success 0 0
1619868115.752875
NtProtectVirtualMemory
process_identifier: 1688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619868115.752875
NtProtectVirtualMemory
process_identifier: 1688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00822000
success 0 0
1619868115.752875
NtProtectVirtualMemory
process_identifier: 1688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.275700372691819 section {'size_of_data': '0x00042000', 'virtual_address': '0x00076000', 'entropy': 7.275700372691819, 'name': '.rsrc', 'virtual_size': '0x00041e38'} description A section with a high entropy has been found
entropy 0.3726182074805928 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2256 called NtSetContextThread to modify thread in remote process 1688
Time & API Arguments Status Return Repeated
1619868109.988
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707488
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1688
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2256 resumed a thread in remote process 1688
Time & API Arguments Status Return Repeated
1619868110.097
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 1688
success 0 0
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.24.14:443
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619868109.956
CreateProcessInternalW
thread_identifier: 1300
thread_handle: 0x000000fc
process_identifier: 1688
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\bf71733cfb5f0cbe96585240ab37de7a.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619868109.956
NtUnmapViewOfSection
process_identifier: 1688
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619868109.972
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 1688
commit_size: 520192
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 520192
base_address: 0x00400000
success 0 0
1619868109.988
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1619868109.988
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4707488
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1688
success 0 0
1619868110.097
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 1688
success 0 0
File has been identified by 63 AntiVirus engines on VirusTotal as malicious (50 out of 63 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.43193921
FireEye Generic.mg.bf71733cfb5f0cbe
CAT-QuickHeal Trojan.Multi
McAfee Fareit-FTB!BF71733CFB5F
Cylance Unsafe
Sangfor Malware
K7AntiVirus Riskware ( 0040eff71 )
Alibaba TrojanSpy:Win32/Fareit.b964f853
K7GW Riskware ( 0040eff71 )
Cybereason malicious.b0ce82
Arcabit Trojan.Generic.D2931641
TrendMicro TSPY_HPLOKI.SMBD
Cyren W32/Trojan.HDJK-1417
Symantec Trojan Horse
APEX Malicious
Avast Other:Malware-gen [Trj]
ClamAV Win.Dropper.LokiBot-7899805-0
Kaspersky HEUR:Trojan.Win32.Crypt.gen
BitDefender Trojan.GenericKD.43193921
NANO-Antivirus Trojan.Win32.Nanocore.hkkhmx
Paloalto generic.ml
AegisLab Trojan.Multi.Generic.4!c
Rising Trojan.Injector!1.C6CD (KTSE)
Ad-Aware Trojan.GenericKD.43193921
Sophos Mal/Fareit-AA
Comodo Malware@#n2rporvwhxzq
F-Secure Trojan.TR/Agent.foxmt
DrWeb Trojan.Nanocore.24
VIPRE Trojan.Win32.Generic!BT
Invincea Mal/Generic-R + Mal/Fareit-AA
McAfee-GW-Edition BehavesLike.Win32.Fareit.bc
Emsisoft Trojan.GenericKD.43193921 (B)
SentinelOne DFI - Suspicious PE
Jiangmin Trojan.Crypt.drl
eGambit Unsafe.AI_Score_99%
Avira TR/Agent.foxmt
MAX malware (ai score=89)
Antiy-AVL Trojan/Win32.TSGeneric
Microsoft TrojanSpy:Win32/Loki.MF!MTB
ViRobot Trojan.Win32.S.Agent.726528.K
ZoneAlarm HEUR:Trojan.Win32.Crypt.gen
GData Win32.Malware.AntiVM.5Z8AU1
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2066
Acronis suspicious
BitDefenderTheta Gen:NN.ZelphiF.34254.SGW@aqMDmVbi
ALYac Spyware.LokiBot
VBA32 TScope.Trojan.Delf
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x46a150 VirtualFree
• 0x46a154 VirtualAlloc
• 0x46a158 LocalFree
• 0x46a15c LocalAlloc
• 0x46a160 GetVersion
• 0x46a164 GetCurrentThreadId
• 0x46a170 VirtualQuery
• 0x46a174 WideCharToMultiByte
• 0x46a178 MultiByteToWideChar
• 0x46a17c lstrlenA
• 0x46a180 lstrcpynA
• 0x46a184 LoadLibraryExA
• 0x46a188 GetThreadLocale
• 0x46a18c GetStartupInfoA
• 0x46a190 GetProcAddress
• 0x46a194 GetModuleHandleA
• 0x46a198 GetModuleFileNameA
• 0x46a19c GetLocaleInfoA
• 0x46a1a0 GetCommandLineA
• 0x46a1a4 FreeLibrary
• 0x46a1a8 FindFirstFileA
• 0x46a1ac FindClose
• 0x46a1b0 ExitProcess
• 0x46a1b4 WriteFile
• 0x46a1bc RtlUnwind
• 0x46a1c0 RaiseException
• 0x46a1c4 GetStdHandle
Library user32.dll:
• 0x46a1cc GetKeyboardType
• 0x46a1d0 LoadStringA
• 0x46a1d4 MessageBoxA
• 0x46a1d8 CharNextA
Library advapi32.dll:
• 0x46a1e0 RegQueryValueExA
• 0x46a1e4 RegOpenKeyExA
• 0x46a1e8 RegCloseKey
Library oleaut32.dll:
• 0x46a1f0 SysFreeString
• 0x46a1f4 SysReAllocStringLen
• 0x46a1f8 SysAllocStringLen
Library kernel32.dll:
• 0x46a200 TlsSetValue
• 0x46a204 TlsGetValue
• 0x46a208 LocalAlloc
• 0x46a20c GetModuleHandleA
Library advapi32.dll:
• 0x46a214 RegQueryValueExA
• 0x46a218 RegOpenKeyExA
• 0x46a21c RegCloseKey
Library kernel32.dll:
• 0x46a224 lstrcpyA
• 0x46a228 WriteFile
• 0x46a22c WaitForSingleObject
• 0x46a230 VirtualQuery
• 0x46a234 VirtualAlloc
• 0x46a238 Sleep
• 0x46a23c SizeofResource
• 0x46a240 SetThreadLocale
• 0x46a244 SetFilePointer
• 0x46a248 SetEvent
• 0x46a24c SetErrorMode
• 0x46a250 SetEndOfFile
• 0x46a254 ResetEvent
• 0x46a258 ReadFile
• 0x46a25c MulDiv
• 0x46a260 LockResource
• 0x46a264 LoadResource
• 0x46a268 LoadLibraryA
• 0x46a274 GlobalUnlock
• 0x46a278 GlobalReAlloc
• 0x46a27c GlobalHandle
• 0x46a280 GlobalLock
• 0x46a284 GlobalFree
• 0x46a288 GlobalFindAtomA
• 0x46a28c GlobalDeleteAtom
• 0x46a290 GlobalAlloc
• 0x46a294 GlobalAddAtomA
• 0x46a298 GetVersionExA
• 0x46a29c GetVersion
• 0x46a2a0 GetTickCount
• 0x46a2a4 GetThreadLocale
• 0x46a2ac GetSystemTime
• 0x46a2b0 GetSystemInfo
• 0x46a2b4 GetStringTypeExA
• 0x46a2b8 GetStdHandle
• 0x46a2bc GetProcAddress
• 0x46a2c0 GetModuleHandleA
• 0x46a2c4 GetModuleFileNameA
• 0x46a2c8 GetLocaleInfoA
• 0x46a2cc GetLocalTime
• 0x46a2d0 GetLastError
• 0x46a2d4 GetFullPathNameA
• 0x46a2d8 GetDiskFreeSpaceA
• 0x46a2dc GetDateFormatA
• 0x46a2e0 GetCurrentThreadId
• 0x46a2e4 GetCurrentProcessId
• 0x46a2e8 GetCPInfo
• 0x46a2ec GetACP
• 0x46a2f0 FreeResource
• 0x46a2f4 InterlockedExchange
• 0x46a2f8 FreeLibrary
• 0x46a2fc FormatMessageA
• 0x46a300 FindResourceA
• 0x46a308 ExitThread
• 0x46a30c EnumCalendarInfoA
• 0x46a318 CreateThread
• 0x46a31c CreateFileA
• 0x46a320 CreateEventA
• 0x46a324 CompareStringA
• 0x46a328 CloseHandle
Library version.dll:
• 0x46a330 VerQueryValueA
• 0x46a338 GetFileVersionInfoA
Library gdi32.dll:
• 0x46a340 UnrealizeObject
• 0x46a344 StretchBlt
• 0x46a348 SetWindowOrgEx
• 0x46a34c SetWindowExtEx
• 0x46a350 SetWinMetaFileBits
• 0x46a354 SetViewportOrgEx
• 0x46a358 SetViewportExtEx
• 0x46a35c SetTextColor
• 0x46a360 SetStretchBltMode
• 0x46a364 SetROP2
• 0x46a368 SetPixel
• 0x46a36c SetMapMode
• 0x46a370 SetEnhMetaFileBits
• 0x46a374 SetDIBColorTable
• 0x46a378 SetBrushOrgEx
• 0x46a37c SetBkMode
• 0x46a380 SetBkColor
• 0x46a384 SelectPalette
• 0x46a388 SelectObject
• 0x46a38c SaveDC
• 0x46a390 RestoreDC
• 0x46a394 RectVisible
• 0x46a398 RealizePalette
• 0x46a39c PolyPolyline
• 0x46a3a0 PlayEnhMetaFile
• 0x46a3a4 PatBlt
• 0x46a3a8 MoveToEx
• 0x46a3ac MaskBlt
• 0x46a3b0 LineTo
• 0x46a3b4 IntersectClipRect
• 0x46a3b8 GetWindowOrgEx
• 0x46a3bc GetWinMetaFileBits
• 0x46a3c0 GetTextMetricsA
• 0x46a3cc GetStockObject
• 0x46a3d0 GetPixel
• 0x46a3d4 GetPaletteEntries
• 0x46a3d8 GetObjectA
• 0x46a3e4 GetEnhMetaFileBits
• 0x46a3e8 GetDeviceCaps
• 0x46a3ec GetDIBits
• 0x46a3f0 GetDIBColorTable
• 0x46a3f4 GetDCOrgEx
• 0x46a3fc GetClipBox
• 0x46a400 GetBrushOrgEx
• 0x46a404 GetBkMode
• 0x46a408 GetBitmapBits
• 0x46a40c ExtCreatePen
• 0x46a410 ExcludeClipRect
• 0x46a414 DeleteObject
• 0x46a418 DeleteEnhMetaFile
• 0x46a41c DeleteDC
• 0x46a420 CreateSolidBrush
• 0x46a424 CreatePenIndirect
• 0x46a428 CreatePalette
• 0x46a430 CreateFontIndirectA
• 0x46a434 CreateDIBitmap
• 0x46a438 CreateDIBSection
• 0x46a43c CreateCompatibleDC
• 0x46a444 CreateBrushIndirect
• 0x46a448 CreateBitmap
• 0x46a44c CopyEnhMetaFileA
• 0x46a450 BitBlt
Library user32.dll:
• 0x46a458 CreateWindowExA
• 0x46a45c WindowFromPoint
• 0x46a460 WinHelpA
• 0x46a464 WaitMessage
• 0x46a468 ValidateRect
• 0x46a46c UpdateWindow
• 0x46a470 UnregisterClassA
• 0x46a474 UnionRect
• 0x46a478 UnhookWindowsHookEx
• 0x46a47c TranslateMessage
• 0x46a484 TrackPopupMenu
• 0x46a48c ShowWindow
• 0x46a490 ShowScrollBar
• 0x46a494 ShowOwnedPopups
• 0x46a498 ShowCursor
• 0x46a49c SetWindowsHookExA
• 0x46a4a0 SetWindowTextA
• 0x46a4a4 SetWindowPos
• 0x46a4a8 SetWindowPlacement
• 0x46a4ac SetWindowLongA
• 0x46a4b0 SetTimer
• 0x46a4b4 SetScrollRange
• 0x46a4b8 SetScrollPos
• 0x46a4bc SetScrollInfo
• 0x46a4c0 SetRect
• 0x46a4c4 SetPropA
• 0x46a4c8 SetParent
• 0x46a4cc SetMenuItemInfoA
• 0x46a4d0 SetMenu
• 0x46a4d4 SetKeyboardState
• 0x46a4d8 SetForegroundWindow
• 0x46a4dc SetFocus
• 0x46a4e0 SetCursor
• 0x46a4e4 SetClipboardData
• 0x46a4e8 SetClassLongA
• 0x46a4ec SetCapture
• 0x46a4f0 SetActiveWindow
• 0x46a4f4 SendMessageA
• 0x46a4f8 ScrollWindowEx
• 0x46a4fc ScrollWindow
• 0x46a500 ScreenToClient
• 0x46a504 RemovePropA
• 0x46a508 RemoveMenu
• 0x46a50c ReleaseDC
• 0x46a510 ReleaseCapture
• 0x46a51c RegisterClassA
• 0x46a520 RedrawWindow
• 0x46a524 PtInRect
• 0x46a528 PostQuitMessage
• 0x46a52c PostMessageA
• 0x46a530 PeekMessageA
• 0x46a534 OpenClipboard
• 0x46a538 OffsetRect
• 0x46a53c OemToCharA
• 0x46a540 MessageBoxA
• 0x46a544 MessageBeep
• 0x46a548 MapWindowPoints
• 0x46a54c MapVirtualKeyA
• 0x46a550 LoadStringA
• 0x46a554 LoadKeyboardLayoutA
• 0x46a558 LoadIconA
• 0x46a55c LoadCursorA
• 0x46a560 LoadBitmapA
• 0x46a564 KillTimer
• 0x46a568 IsZoomed
• 0x46a56c IsWindowVisible
• 0x46a570 IsWindowEnabled
• 0x46a574 IsWindow
• 0x46a578 IsRectEmpty
• 0x46a57c IsIconic
• 0x46a580 IsDialogMessageA
• 0x46a584 IsChild
• 0x46a588 IsCharAlphaNumericA
• 0x46a58c IsCharAlphaA
• 0x46a590 InvalidateRect
• 0x46a594 IntersectRect
• 0x46a598 InsertMenuItemA
• 0x46a59c InsertMenuA
• 0x46a5a0 InflateRect
• 0x46a5a8 GetWindowTextA
• 0x46a5ac GetWindowRect
• 0x46a5b0 GetWindowPlacement
• 0x46a5b4 GetWindowLongA
• 0x46a5b8 GetWindowDC
• 0x46a5bc GetTopWindow
• 0x46a5c0 GetSystemMetrics
• 0x46a5c4 GetSystemMenu
• 0x46a5c8 GetSysColorBrush
• 0x46a5cc GetSysColor
• 0x46a5d0 GetSubMenu
• 0x46a5d4 GetScrollRange
• 0x46a5d8 GetScrollPos
• 0x46a5dc GetScrollInfo
• 0x46a5e0 GetPropA
• 0x46a5e4 GetParent
• 0x46a5e8 GetWindow
• 0x46a5ec GetMessageTime
• 0x46a5f0 GetMenuStringA
• 0x46a5f4 GetMenuState
• 0x46a5f8 GetMenuItemInfoA
• 0x46a5fc GetMenuItemID
• 0x46a600 GetMenuItemCount
• 0x46a604 GetMenu
• 0x46a608 GetLastActivePopup
• 0x46a60c GetKeyboardState
• 0x46a614 GetKeyboardLayout
• 0x46a618 GetKeyState
• 0x46a61c GetKeyNameTextA
• 0x46a620 GetIconInfo
• 0x46a624 GetForegroundWindow
• 0x46a628 GetFocus
• 0x46a62c GetDoubleClickTime
• 0x46a630 GetDlgItem
• 0x46a634 GetDesktopWindow
• 0x46a638 GetDCEx
• 0x46a63c GetDC
• 0x46a640 GetCursorPos
• 0x46a644 GetCursor
• 0x46a648 GetClipboardData
• 0x46a64c GetClientRect
• 0x46a650 GetClassNameA
• 0x46a654 GetClassInfoA
• 0x46a658 GetCaretPos
• 0x46a65c GetCapture
• 0x46a660 GetActiveWindow
• 0x46a664 FrameRect
• 0x46a668 FindWindowA
• 0x46a66c FillRect
• 0x46a670 EqualRect
• 0x46a674 EnumWindows
• 0x46a678 EnumThreadWindows
• 0x46a680 EndPaint
• 0x46a684 EnableWindow
• 0x46a688 EnableScrollBar
• 0x46a68c EnableMenuItem
• 0x46a690 EmptyClipboard
• 0x46a694 DrawTextA
• 0x46a698 DrawMenuBar
• 0x46a69c DrawIconEx
• 0x46a6a0 DrawIcon
• 0x46a6a4 DrawFrameControl
• 0x46a6a8 DrawFocusRect
• 0x46a6ac DrawEdge
• 0x46a6b0 DispatchMessageA
• 0x46a6b4 DestroyWindow
• 0x46a6b8 DestroyMenu
• 0x46a6bc DestroyIcon
• 0x46a6c0 DestroyCursor
• 0x46a6c4 DeleteMenu
• 0x46a6c8 DefWindowProcA
• 0x46a6cc DefMDIChildProcA
• 0x46a6d0 DefFrameProcA
• 0x46a6d4 CreatePopupMenu
• 0x46a6d8 CreateMenu
• 0x46a6dc CreateIcon
• 0x46a6e0 CloseClipboard
• 0x46a6e4 ClientToScreen
• 0x46a6e8 CheckMenuItem
• 0x46a6ec CallWindowProcA
• 0x46a6f0 CallNextHookEx
• 0x46a6f4 BeginPaint
• 0x46a6f8 CharNextA
• 0x46a6fc CharLowerBuffA
• 0x46a700 CharLowerA
• 0x46a704 CharUpperBuffA
• 0x46a708 CharToOemA
• 0x46a70c AdjustWindowRectEx
Library kernel32.dll:
• 0x46a718 Sleep
Library oleaut32.dll:
• 0x46a720 SafeArrayPtrOfIndex
• 0x46a724 SafeArrayGetUBound
• 0x46a728 SafeArrayGetLBound
• 0x46a72c SafeArrayCreate
• 0x46a730 VariantChangeType
• 0x46a734 VariantCopy
• 0x46a738 VariantClear
• 0x46a73c VariantInit
Library comctl32.dll:
• 0x46a74c ImageList_Write
• 0x46a750 ImageList_Read
• 0x46a760 ImageList_DragMove
• 0x46a764 ImageList_DragLeave
• 0x46a768 ImageList_DragEnter
• 0x46a76c ImageList_EndDrag
• 0x46a770 ImageList_BeginDrag
• 0x46a774 ImageList_Remove
• 0x46a778 ImageList_DrawEx
• 0x46a77c ImageList_Draw
• 0x46a78c ImageList_Add
• 0x46a794 ImageList_Destroy
• 0x46a798 ImageList_Create
Library comdlg32.dll:
• 0x46a7a0 GetOpenFileNameA
Library kernel32.dll:
• 0x46a7a8 MulDiv

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50568 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.