6.4
高危
60 个模型检测该样本为恶意！
重新分析
更多

073c3d60993b41a1ea5847c06dab48a4bf4e3da87e74d26d8d51a1c11e0dae0c

c610413e42d6a5b3bee1fd9f1d0b566b.exe

分析耗时

50s

最近分析

文件大小

677.0KB
静态报毒 动态报毒 100% AGENTTESLA AI SCORE=84 AIDETECTVM AVSARHER BTOMTW CLASSIC CONFIDENCE DELF DELPHILESS ELXR EMHC FAREIT GDSDA GENCIRC HIGH CONFIDENCE HKYKGF KRYPT KRYPTIK MALWARE2 MALWARE@#1FNXYUCYGH73Q NPXFE QGX@AQX0DTLI QPVX R03BC0DKM20 SCORE SUSGEN TSCOPE UNSAFE X2075 ZELPHIF ZUSY 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FTB!C610413E42D6 20201211 6.0.6.653
Alibaba Trojan:Win32/Obfuscator.580eab3e 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Malware-gen 20201210 21.1.5827.0
Tencent Malware.Win32.Gencirc.118a2105 20201211 1.0.0.1
Kingsoft 20201211 2017.9.26.565
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619928042.105876
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 48430912
registers.edi: 0
registers.eax: 0
registers.ebp: 48430984
registers.edx: 0
registers.ebx: 1983206444
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 d5 7b 00 00 e9
exception.symbol: c610413e42d6a5b3bee1fd9f1d0b566b+0x78e7b
exception.instruction: div eax
exception.module: c610413e42d6a5b3bee1fd9f1d0b566b.exe
exception.exception_code: 0xc0000094
exception.offset: 495227
exception.address: 0x478e7b
success 0 0
1619928044.371374
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7456d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
c610413e42d6a5b3bee1fd9f1d0b566b+0x243f8 @ 0x4243f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x74164b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x74165d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe8014ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (28 个事件)
Time & API Arguments Status Return Repeated
1619928041.777876
NtAllocateVirtualMemory
process_identifier: 364
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619928042.105876
NtProtectVirtualMemory
process_identifier: 364
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 36864
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00478000
success 0 0
1619928042.105876
NtAllocateVirtualMemory
process_identifier: 364
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x005a0000
success 0 0
1619928043.340374
NtProtectVirtualMemory
process_identifier: 1272
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619928043.636374
NtAllocateVirtualMemory
process_identifier: 1272
region_size: 1507328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01e70000
success 0 0
1619928043.636374
NtAllocateVirtualMemory
process_identifier: 1272
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01fa0000
success 0 0
1619928043.636374
NtAllocateVirtualMemory
process_identifier: 1272
region_size: 114688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00450000
success 0 0
1619928043.636374
NtProtectVirtualMemory
process_identifier: 1272
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 69632
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00452000
success 0 0
1619928044.324374
NtProtectVirtualMemory
process_identifier: 1272
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fe2000
success 0 0
1619928044.324374
NtProtectVirtualMemory
process_identifier: 1272
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619928044.340374
NtProtectVirtualMemory
process_identifier: 1272
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fe2000
success 0 0
1619928044.340374
NtProtectVirtualMemory
process_identifier: 1272
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619928044.340374
NtProtectVirtualMemory
process_identifier: 1272
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fe2000
success 0 0
1619928044.340374
NtProtectVirtualMemory
process_identifier: 1272
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619928044.340374
NtProtectVirtualMemory
process_identifier: 1272
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fe2000
success 0 0
1619928044.340374
NtProtectVirtualMemory
process_identifier: 1272
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619928044.340374
NtProtectVirtualMemory
process_identifier: 1272
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fe2000
success 0 0
1619928044.340374
NtProtectVirtualMemory
process_identifier: 1272
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619928044.340374
NtProtectVirtualMemory
process_identifier: 1272
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fe2000
success 0 0
1619928044.340374
NtProtectVirtualMemory
process_identifier: 1272
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619928044.340374
NtProtectVirtualMemory
process_identifier: 1272
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fe2000
success 0 0
1619928044.340374
NtProtectVirtualMemory
process_identifier: 1272
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619928044.340374
NtProtectVirtualMemory
process_identifier: 1272
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fe2000
success 0 0
1619928044.340374
NtProtectVirtualMemory
process_identifier: 1272
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619928044.340374
NtProtectVirtualMemory
process_identifier: 1272
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fe2000
success 0 0
1619928044.340374
NtProtectVirtualMemory
process_identifier: 1272
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619928044.340374
NtProtectVirtualMemory
process_identifier: 1272
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01fe2000
success 0 0
1619928044.340374
NtProtectVirtualMemory
process_identifier: 1272
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 364 called NtSetContextThread to modify thread in remote process 1272
Time & API Arguments Status Return Repeated
1619928042.183876
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4467664
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1272
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 364 resumed a thread in remote process 1272
Time & API Arguments Status Return Repeated
1619928043.136876
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 1272
success 0 0
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.24.14:443
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619928042.168876
CreateProcessInternalW
thread_identifier: 1824
thread_handle: 0x000000fc
process_identifier: 1272
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c610413e42d6a5b3bee1fd9f1d0b566b.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619928042.168876
NtUnmapViewOfSection
process_identifier: 1272
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619928042.183876
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 1272
commit_size: 282624
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 282624
base_address: 0x00400000
success 0 0
1619928042.183876
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1619928042.183876
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4467664
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 1272
success 0 0
1619928043.136876
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 1272
success 0 0
File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Delf.FareIt.Gen.10
FireEye Generic.mg.c610413e42d6a5b3
McAfee Fareit-FTB!C610413E42D6
Cylance Unsafe
Zillya Trojan.Fareit.Win32.35972
Sangfor Malware
K7AntiVirus Trojan ( 0056739d1 )
Alibaba Trojan:Win32/Obfuscator.580eab3e
K7GW Trojan ( 0056739d1 )
Cybereason malicious.2acd75
Arcabit Trojan.Delf.FareIt.Gen.10
Cyren W32/Injector.QPVX-7156
Symantec Trojan.Gen.2
APEX Malicious
Avast Win32:Malware-gen
ClamAV Win.Trojan.Zusy-8004475-0
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
BitDefender Trojan.Delf.FareIt.Gen.10
NANO-Antivirus Trojan.Win32.Zusy.hkykgf
Paloalto generic.ml
Tencent Malware.Win32.Gencirc.118a2105
Ad-Aware Trojan.Delf.FareIt.Gen.10
Emsisoft Trojan.Delf.FareIt.Gen.10 (B)
Comodo Malware@#1fnxyucygh73q
F-Secure Trojan.TR/Injector.npxfe
DrWeb Trojan.PWS.Stealer.25089
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R03BC0DKM20
McAfee-GW-Edition BehavesLike.Win32.Fareit.jh
Sophos Mal/Generic-S
eGambit Unsafe.AI_Score_99%
Avira TR/Injector.npxfe
Antiy-AVL Trojan/Win32.Kryptik
Gridinsoft Trojan.Win32.Kryptik.dd!i
Microsoft Trojan:Win32/Obfuscator.KI!MTB
AegisLab Trojan.Multi.Generic.4!c
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
GData Trojan.Delf.FareIt.Gen.10
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2075
BitDefenderTheta Gen:NN.ZelphiF.34670.QGX@aqx0DTli
ALYac Trojan.Delf.FareIt.Gen.10
MAX malware (ai score=84)
VBA32 TScope.Trojan.Delf
Malwarebytes Spyware.AgentTesla
Zoner Trojan.Win32.92206
ESET-NOD32 a variant of Win32/Injector.EMHC
TrendMicro-HouseCall TROJ_GEN.R03BC0DKM20
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x48413c VirtualFree
• 0x484140 VirtualAlloc
• 0x484144 LocalFree
• 0x484148 LocalAlloc
• 0x48414c GetTickCount
• 0x484154 GetVersion
• 0x484158 GetCurrentThreadId
• 0x484164 VirtualQuery
• 0x484168 WideCharToMultiByte
• 0x48416c MultiByteToWideChar
• 0x484170 lstrlenA
• 0x484174 lstrcpynA
• 0x484178 LoadLibraryExA
• 0x48417c GetThreadLocale
• 0x484180 GetStartupInfoA
• 0x484184 GetProcAddress
• 0x484188 GetModuleHandleA
• 0x48418c GetModuleFileNameA
• 0x484190 GetLocaleInfoA
• 0x484194 GetCommandLineA
• 0x484198 FreeLibrary
• 0x48419c FindFirstFileA
• 0x4841a0 FindClose
• 0x4841a4 ExitProcess
• 0x4841a8 ExitThread
• 0x4841ac CreateThread
• 0x4841b0 WriteFile
• 0x4841b8 RtlUnwind
• 0x4841bc RaiseException
• 0x4841c0 GetStdHandle
Library user32.dll:
• 0x4841c8 GetKeyboardType
• 0x4841cc LoadStringA
• 0x4841d0 MessageBoxA
• 0x4841d4 CharNextA
Library advapi32.dll:
• 0x4841dc RegQueryValueExA
• 0x4841e0 RegOpenKeyExA
• 0x4841e4 RegCloseKey
Library oleaut32.dll:
• 0x4841ec SysFreeString
• 0x4841f0 SysReAllocStringLen
• 0x4841f4 SysAllocStringLen
Library kernel32.dll:
• 0x4841fc TlsSetValue
• 0x484200 TlsGetValue
• 0x484204 LocalAlloc
• 0x484208 GetModuleHandleA
Library advapi32.dll:
• 0x484210 RegQueryValueExA
• 0x484214 RegQueryInfoKeyA
• 0x484218 RegOpenKeyExA
• 0x48421c RegFlushKey
• 0x484220 RegEnumKeyExA
• 0x484224 RegCloseKey
Library kernel32.dll:
• 0x48422c lstrcpyA
• 0x484230 WriteFile
• 0x484238 WaitForSingleObject
• 0x48423c VirtualQuery
• 0x484240 VirtualAlloc
• 0x484244 SuspendThread
• 0x484248 Sleep
• 0x48424c SizeofResource
• 0x484250 SetThreadPriority
• 0x484254 SetThreadLocale
• 0x484258 SetFilePointer
• 0x48425c SetEvent
• 0x484260 SetErrorMode
• 0x484264 SetEndOfFile
• 0x484268 ResumeThread
• 0x48426c ResetEvent
• 0x484270 ReadFile
• 0x484274 MulDiv
• 0x484278 LockResource
• 0x48427c LoadResource
• 0x484280 LoadLibraryA
• 0x48428c GlobalUnlock
• 0x484290 GlobalReAlloc
• 0x484294 GlobalHandle
• 0x484298 GlobalLock
• 0x48429c GlobalFree
• 0x4842a0 GlobalFindAtomA
• 0x4842a4 GlobalDeleteAtom
• 0x4842a8 GlobalAlloc
• 0x4842ac GlobalAddAtomA
• 0x4842b0 GetVersionExA
• 0x4842b4 GetVersion
• 0x4842bc GetTickCount
• 0x4842c0 GetThreadLocale
• 0x4842c4 GetTempPathA
• 0x4842cc GetSystemTime
• 0x4842d0 GetSystemInfo
• 0x4842d4 GetStringTypeExA
• 0x4842d8 GetStdHandle
• 0x4842dc GetProcAddress
• 0x4842e0 GetModuleHandleA
• 0x4842e4 GetModuleFileNameA
• 0x4842e8 GetLocaleInfoA
• 0x4842ec GetLocalTime
• 0x4842f0 GetLastError
• 0x4842f4 GetFullPathNameA
• 0x4842f8 GetFileSize
• 0x4842fc GetFileAttributesA
• 0x484300 GetExitCodeThread
• 0x484304 GetDiskFreeSpaceA
• 0x484308 GetDateFormatA
• 0x48430c GetCurrentThreadId
• 0x484310 GetCurrentProcessId
• 0x484314 GetCPInfo
• 0x484318 GetACP
• 0x48431c FreeResource
• 0x484324 InterlockedExchange
• 0x48432c FreeLibrary
• 0x484330 FormatMessageA
• 0x484334 FindResourceA
• 0x484338 FindFirstFileA
• 0x48433c FindClose
• 0x484348 ExitThread
• 0x48434c EnumCalendarInfoA
• 0x484358 CreateThread
• 0x48435c CreateFileA
• 0x484360 CreateEventA
• 0x484364 CompareStringA
• 0x484368 CloseHandle
Library version.dll:
• 0x484370 VerQueryValueA
• 0x484378 GetFileVersionInfoA
Library gdi32.dll:
• 0x484380 UnrealizeObject
• 0x484384 StretchBlt
• 0x484388 SetWindowOrgEx
• 0x48438c SetWinMetaFileBits
• 0x484390 SetViewportOrgEx
• 0x484394 SetTextColor
• 0x484398 SetStretchBltMode
• 0x48439c SetROP2
• 0x4843a0 SetPixel
• 0x4843a4 SetEnhMetaFileBits
• 0x4843a8 SetDIBColorTable
• 0x4843ac SetBrushOrgEx
• 0x4843b0 SetBkMode
• 0x4843b4 SetBkColor
• 0x4843b8 SelectPalette
• 0x4843bc SelectObject
• 0x4843c0 SaveDC
• 0x4843c4 RestoreDC
• 0x4843c8 Rectangle
• 0x4843cc RectVisible
• 0x4843d0 RealizePalette
• 0x4843d4 Polyline
• 0x4843d8 PlayEnhMetaFile
• 0x4843dc PatBlt
• 0x4843e0 MoveToEx
• 0x4843e4 MaskBlt
• 0x4843e8 LineTo
• 0x4843ec IntersectClipRect
• 0x4843f0 GetWindowOrgEx
• 0x4843f4 GetWinMetaFileBits
• 0x4843f8 GetTextMetricsA
• 0x484404 GetStockObject
• 0x484408 GetPixel
• 0x48440c GetPaletteEntries
• 0x484410 GetObjectA
• 0x48441c GetEnhMetaFileBits
• 0x484420 GetDeviceCaps
• 0x484424 GetDIBits
• 0x484428 GetDIBColorTable
• 0x48442c GetDCOrgEx
• 0x484434 GetClipBox
• 0x484438 GetBrushOrgEx
• 0x48443c GetBitmapBits
• 0x484440 ExcludeClipRect
• 0x484444 DeleteObject
• 0x484448 DeleteEnhMetaFile
• 0x48444c DeleteDC
• 0x484450 CreateSolidBrush
• 0x484454 CreatePenIndirect
• 0x484458 CreatePen
• 0x48445c CreatePalette
• 0x484464 CreateFontIndirectA
• 0x484468 CreateDIBitmap
• 0x48446c CreateDIBSection
• 0x484470 CreateCompatibleDC
• 0x484478 CreateBrushIndirect
• 0x48447c CreateBitmap
• 0x484480 CopyEnhMetaFileA
• 0x484484 BitBlt
Library user32.dll:
• 0x48448c CreateWindowExA
• 0x484490 WindowFromPoint
• 0x484494 WinHelpA
• 0x484498 WaitMessage
• 0x48449c ValidateRect
• 0x4844a0 UpdateWindow
• 0x4844a4 UnregisterClassA
• 0x4844a8 UnhookWindowsHookEx
• 0x4844ac TranslateMessage
• 0x4844b4 TrackPopupMenu
• 0x4844bc ShowWindow
• 0x4844c0 ShowScrollBar
• 0x4844c4 ShowOwnedPopups
• 0x4844c8 ShowCursor
• 0x4844cc SetWindowsHookExA
• 0x4844d0 SetWindowPos
• 0x4844d4 SetWindowPlacement
• 0x4844d8 SetWindowLongA
• 0x4844dc SetTimer
• 0x4844e0 SetScrollRange
• 0x4844e4 SetScrollPos
• 0x4844e8 SetScrollInfo
• 0x4844ec SetRect
• 0x4844f0 SetPropA
• 0x4844f4 SetParent
• 0x4844f8 SetMenuItemInfoA
• 0x4844fc SetMenu
• 0x484500 SetForegroundWindow
• 0x484504 SetFocus
• 0x484508 SetCursor
• 0x48450c SetClassLongA
• 0x484510 SetCapture
• 0x484514 SetActiveWindow
• 0x484518 SendMessageA
• 0x48451c ScrollWindow
• 0x484520 ScreenToClient
• 0x484524 RemovePropA
• 0x484528 RemoveMenu
• 0x48452c ReleaseDC
• 0x484530 ReleaseCapture
• 0x48453c RegisterClassA
• 0x484540 RedrawWindow
• 0x484544 PtInRect
• 0x484548 PostQuitMessage
• 0x48454c PostMessageA
• 0x484550 PeekMessageA
• 0x484554 OffsetRect
• 0x484558 OemToCharA
• 0x484560 MessageBoxA
• 0x484564 MapWindowPoints
• 0x484568 MapVirtualKeyA
• 0x48456c LoadStringA
• 0x484570 LoadKeyboardLayoutA
• 0x484574 LoadIconA
• 0x484578 LoadCursorA
• 0x48457c LoadBitmapA
• 0x484580 KillTimer
• 0x484584 IsZoomed
• 0x484588 IsWindowVisible
• 0x48458c IsWindowEnabled
• 0x484590 IsWindow
• 0x484594 IsRectEmpty
• 0x484598 IsIconic
• 0x48459c IsDialogMessageA
• 0x4845a0 IsChild
• 0x4845a4 InvalidateRect
• 0x4845a8 IntersectRect
• 0x4845ac InsertMenuItemA
• 0x4845b0 InsertMenuA
• 0x4845b4 InflateRect
• 0x4845bc GetWindowTextA
• 0x4845c0 GetWindowRect
• 0x4845c4 GetWindowPlacement
• 0x4845c8 GetWindowLongA
• 0x4845cc GetWindowDC
• 0x4845d0 GetTopWindow
• 0x4845d4 GetSystemMetrics
• 0x4845d8 GetSystemMenu
• 0x4845dc GetSysColorBrush
• 0x4845e0 GetSysColor
• 0x4845e4 GetSubMenu
• 0x4845e8 GetScrollRange
• 0x4845ec GetScrollPos
• 0x4845f0 GetScrollInfo
• 0x4845f4 GetPropA
• 0x4845f8 GetParent
• 0x4845fc GetWindow
• 0x484600 GetMenuStringA
• 0x484604 GetMenuState
• 0x484608 GetMenuItemInfoA
• 0x48460c GetMenuItemID
• 0x484610 GetMenuItemCount
• 0x484614 GetMenu
• 0x484618 GetLastActivePopup
• 0x48461c GetKeyboardState
• 0x484624 GetKeyboardLayout
• 0x484628 GetKeyState
• 0x48462c GetKeyNameTextA
• 0x484630 GetIconInfo
• 0x484634 GetForegroundWindow
• 0x484638 GetFocus
• 0x48463c GetDlgItem
• 0x484640 GetDesktopWindow
• 0x484644 GetDCEx
• 0x484648 GetDC
• 0x48464c GetCursorPos
• 0x484650 GetCursor
• 0x484654 GetClipboardData
• 0x484658 GetClientRect
• 0x48465c GetClassNameA
• 0x484660 GetClassInfoA
• 0x484664 GetCapture
• 0x484668 GetActiveWindow
• 0x48466c FrameRect
• 0x484670 FindWindowA
• 0x484674 FillRect
• 0x484678 EqualRect
• 0x48467c EnumWindows
• 0x484680 EnumThreadWindows
• 0x484684 EndPaint
• 0x484688 EnableWindow
• 0x48468c EnableScrollBar
• 0x484690 EnableMenuItem
• 0x484694 DrawTextA
• 0x484698 DrawMenuBar
• 0x48469c DrawIconEx
• 0x4846a0 DrawIcon
• 0x4846a4 DrawFrameControl
• 0x4846a8 DrawEdge
• 0x4846ac DispatchMessageA
• 0x4846b0 DestroyWindow
• 0x4846b4 DestroyMenu
• 0x4846b8 DestroyIcon
• 0x4846bc DestroyCursor
• 0x4846c0 DeleteMenu
• 0x4846c4 DefWindowProcA
• 0x4846c8 DefMDIChildProcA
• 0x4846cc DefFrameProcA
• 0x4846d0 CreatePopupMenu
• 0x4846d4 CreateMenu
• 0x4846d8 CreateIcon
• 0x4846dc ClientToScreen
• 0x4846e0 CheckMenuItem
• 0x4846e4 CallWindowProcA
• 0x4846e8 CallNextHookEx
• 0x4846ec BeginPaint
• 0x4846f0 CharNextA
• 0x4846f4 CharLowerBuffA
• 0x4846f8 CharLowerA
• 0x4846fc CharUpperBuffA
• 0x484700 CharToOemA
• 0x484704 AdjustWindowRectEx
Library kernel32.dll:
• 0x484710 Sleep
Library oleaut32.dll:
• 0x484718 SafeArrayPtrOfIndex
• 0x48471c SafeArrayGetUBound
• 0x484720 SafeArrayGetLBound
• 0x484724 SafeArrayCreate
• 0x484728 VariantChangeType
• 0x48472c VariantCopy
• 0x484730 VariantClear
• 0x484734 VariantInit
Library comctl32.dll:
• 0x484744 ImageList_Write
• 0x484748 ImageList_Read
• 0x484758 ImageList_DragMove
• 0x48475c ImageList_DragLeave
• 0x484760 ImageList_DragEnter
• 0x484764 ImageList_EndDrag
• 0x484768 ImageList_BeginDrag
• 0x48476c ImageList_Remove
• 0x484770 ImageList_DrawEx
• 0x484774 ImageList_Replace
• 0x484778 ImageList_Draw
• 0x484788 ImageList_Add
• 0x484790 ImageList_Destroy
• 0x484794 ImageList_Create
• 0x484798 InitCommonControls
Library comdlg32.dll:
• 0x4847a0 GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 51379 239.255.255.250 3702
192.168.56.101 55371 239.255.255.250 1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.