7.2
高危
59 个模型检测该样本为恶意！
重新分析
更多

a21c8651404d572a8074ffe3fbe15aadf04f2a85d57333dae44f253a7c0a5e03

ca68d747c741dd5ab35eff7e1e794da3.exe

分析耗时

42s

最近分析

文件大小

770.0KB
静态报毒 动态报毒 AGEN AI SCORE=87 AUTO BTELG1 CLASSIC CONFIDENCE DELF DELPHILESS ELDORADO ELTI ELXR FAREIT GENERICKDZ HIGH CONFIDENCE HJTMNC IGENT LOKIBOT MALWARE@#23UNC76UBWA1K NANOCORE R + MAL R066C0DIK20 SCORE SIMDA STATIC AI SUSGEN SUSPICIOUS PE TRJGEN TSCOPE UNSAFE WG0@A4RZN6BI X2059 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/Injector.7c3f5493 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20201229 21.1.5827.0
Kingsoft 20201229 2017.9.26.565
McAfee Fareit-FSK!CA68D747C741 20201229 6.0.6.653
Tencent Win32.Trojan.Inject.Auto 20201229 1.0.0.1
CrowdStrike win/malicious_confidence_80% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619906565.109375
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 34864960
registers.edi: 0
registers.eax: 0
registers.ebp: 34865032
registers.edx: 18
registers.ebx: 0
registers.esi: 0
registers.ecx: 234
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 57 e9 41 51 f9
exception.symbol: ca68d747c741dd5ab35eff7e1e794da3+0x6e616
exception.instruction: div eax
exception.module: ca68d747c741dd5ab35eff7e1e794da3.exe
exception.exception_code: 0xc0000094
exception.offset: 452118
exception.address: 0x46e616
success 0 0
1619909913.484249
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73aae97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73aaea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73aab25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73aab4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73aaac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73aaaed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73aa5511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73aa559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74167f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74164de3
ca68d747c741dd5ab35eff7e1e794da3+0x58a4d @ 0x458a4d
ca68d747c741dd5ab35eff7e1e794da3+0x51254 @ 0x451254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfcd614ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619906564.656375
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619906565.109375
NtAllocateVirtualMemory
process_identifier: 648
region_size: 40960
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f40000
success 0 0
1619906565.156375
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f90000
success 0 0
1619909909.327249
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619909909.343249
NtAllocateVirtualMemory
process_identifier: 2868
region_size: 983040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01e00000
success 0 0
1619909909.343249
NtAllocateVirtualMemory
process_identifier: 2868
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01eb0000
success 0 0
1619909909.343249
NtAllocateVirtualMemory
process_identifier: 2868
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00570000
success 0 0
1619909909.343249
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 299008
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00572000
success 0 0
1619909909.796249
NtAllocateVirtualMemory
process_identifier: 2868
region_size: 851968
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01ef0000
success 0 0
1619909909.796249
NtAllocateVirtualMemory
process_identifier: 2868
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f80000
success 0 0
1619909913.437249
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619909913.437249
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619909913.437249
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619909913.437249
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619909913.437249
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619909913.437249
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619909913.437249
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619909913.437249
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619909913.437249
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619909913.437249
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619909913.452249
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619909913.452249
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619909913.452249
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619909913.452249
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619909913.452249
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619909913.452249
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619909913.452249
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619909913.452249
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619909913.452249
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619909913.452249
NtProtectVirtualMemory
process_identifier: 2868
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (3 个事件)
entropy 7.698765419698968 section {'size_of_data': '0x0000ae00', 'virtual_address': '0x0006f000', 'entropy': 7.698765419698968, 'name': 'DATA', 'virtual_size': '0x0000ac6c'} description A section with a high entropy has been found
entropy 7.34408332985497 section {'size_of_data': '0x0003da00', 'virtual_address': '0x00088000', 'entropy': 7.34408332985497, 'name': '.rsrc', 'virtual_size': '0x0003d8f0'} description A section with a high entropy has been found
entropy 0.37711313394018203 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 648 called NtSetContextThread to modify thread in remote process 2868
Time & API Arguments Status Return Repeated
1619906565.875375
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4894144
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2868
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 648 resumed a thread in remote process 2868
Time & API Arguments Status Return Repeated
1619906566.047375
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 2868
success 0 0
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.24.14:443
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619906565.719375
CreateProcessInternalW
thread_identifier: 520
thread_handle: 0x00000108
process_identifier: 2868
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ca68d747c741dd5ab35eff7e1e794da3.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x0000010c
inherit_handles: 0
success 1 0
1619906565.719375
NtUnmapViewOfSection
process_identifier: 2868
region_size: 4096
process_handle: 0x0000010c
base_address: 0x00400000
success 0 0
1619906565.734375
NtMapViewOfSection
section_handle: 0x00000120
process_identifier: 2868
commit_size: 704512
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x0000010c
allocation_type: 0 ()
section_offset: 0
view_size: 704512
base_address: 0x00400000
success 0 0
1619906565.875375
NtGetContextThread
thread_handle: 0x00000108
success 0 0
1619906565.875375
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4894144
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2868
success 0 0
1619906566.047375
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 2868
success 0 0
File has been identified by 59 AntiVirus engines on VirusTotal as malicious (50 out of 59 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKDZ.66912
FireEye Generic.mg.ca68d747c741dd5a
ALYac Trojan.GenericKDZ.66912
Cylance Unsafe
Sangfor Malware
K7AntiVirus Riskware ( 0040eff71 )
Alibaba Trojan:Win32/Injector.7c3f5493
K7GW Riskware ( 0040eff71 )
Cybereason malicious.7c741d
Arcabit Trojan.Generic.D10560
BitDefenderTheta Gen:NN.ZelphiF.34700.WG0@a4rZn6bi
Cyren W32/Delf.KP.gen!Eldorado
Symantec Trojan Horse
TrendMicro-HouseCall TROJ_GEN.R066C0DIK20
Avast Win32:Trojan-gen
ClamAV Win.Dropper.LokiBot-7744093-0
Kaspersky HEUR:Trojan.Win32.Crypt.gen
BitDefender Trojan.GenericKDZ.66912
NANO-Antivirus Trojan.Win32.TrjGen.hjtmnc
Paloalto generic.ml
APEX Malicious
Rising Trojan.Injector!1.CB27 (CLASSIC)
Ad-Aware Trojan.GenericKDZ.66912
Emsisoft Trojan.GenericKDZ.66912 (B)
Comodo Malware@#23unc76ubwa1k
F-Secure Heuristic.HEUR/AGEN.1136310
DrWeb Trojan.Nanocore.665
VIPRE Trojan.Win32.Simda.ba (v)
TrendMicro TROJ_GEN.R066C0DIK20
McAfee-GW-Edition BehavesLike.Win32.Fareit.bc
Sophos Mal/Generic-R + Mal/Fareit-AA
Ikarus Trojan.Inject
Jiangmin Trojan.Crypt.dcp
eGambit Unsafe.AI_Score_99%
Avira HEUR/AGEN.1136310
Antiy-AVL Trojan/Win32.Crypt
Gridinsoft Trojan.Win32.Packed.dd!n
Microsoft PWS:Win32/Fareit.ART!MTB
ZoneAlarm HEUR:Trojan.Win32.Crypt.gen
GData Trojan.GenericKDZ.66912
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2059
Acronis suspicious
McAfee Fareit-FSK!CA68D747C741
MAX malware (ai score=87)
VBA32 TScope.Trojan.Delf
Malwarebytes Trojan.MalPack.DLF
Zoner Trojan.Win32.90608
ESET-NOD32 a variant of Win32/Injector.ELTI
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x47b150 VirtualFree
• 0x47b154 VirtualAlloc
• 0x47b158 LocalFree
• 0x47b15c LocalAlloc
• 0x47b160 GetVersion
• 0x47b164 GetCurrentThreadId
• 0x47b170 VirtualQuery
• 0x47b174 WideCharToMultiByte
• 0x47b17c MultiByteToWideChar
• 0x47b180 lstrlenA
• 0x47b184 lstrcpynA
• 0x47b188 LoadLibraryExA
• 0x47b18c GetThreadLocale
• 0x47b190 GetStartupInfoA
• 0x47b194 GetProcAddress
• 0x47b198 GetModuleHandleA
• 0x47b19c GetModuleFileNameA
• 0x47b1a0 GetLocaleInfoA
• 0x47b1a4 GetLastError
• 0x47b1ac GetCommandLineA
• 0x47b1b0 FreeLibrary
• 0x47b1b4 FindFirstFileA
• 0x47b1b8 FindClose
• 0x47b1bc ExitProcess
• 0x47b1c0 WriteFile
• 0x47b1c8 RtlUnwind
• 0x47b1cc RaiseException
• 0x47b1d0 GetStdHandle
Library user32.dll:
• 0x47b1d8 GetKeyboardType
• 0x47b1dc LoadStringA
• 0x47b1e0 MessageBoxA
• 0x47b1e4 CharNextA
Library advapi32.dll:
• 0x47b1ec RegQueryValueExA
• 0x47b1f0 RegOpenKeyExA
• 0x47b1f4 RegCloseKey
Library oleaut32.dll:
• 0x47b1fc SysFreeString
• 0x47b200 SysReAllocStringLen
• 0x47b204 SysAllocStringLen
Library kernel32.dll:
• 0x47b20c TlsSetValue
• 0x47b210 TlsGetValue
• 0x47b214 LocalAlloc
• 0x47b218 GetModuleHandleA
Library advapi32.dll:
• 0x47b220 RegQueryValueExA
• 0x47b224 RegOpenKeyExA
• 0x47b228 RegCloseKey
Library kernel32.dll:
• 0x47b230 lstrcpyA
• 0x47b234 WriteFile
• 0x47b238 WaitForSingleObject
• 0x47b23c VirtualQuery
• 0x47b240 VirtualAlloc
• 0x47b244 Sleep
• 0x47b248 SizeofResource
• 0x47b24c SetThreadLocale
• 0x47b250 SetFilePointer
• 0x47b254 SetEvent
• 0x47b258 SetErrorMode
• 0x47b25c SetEndOfFile
• 0x47b260 ResetEvent
• 0x47b264 ReadFile
• 0x47b268 MulDiv
• 0x47b26c LockResource
• 0x47b270 LoadResource
• 0x47b274 LoadLibraryA
• 0x47b280 GlobalUnlock
• 0x47b284 GlobalReAlloc
• 0x47b288 GlobalHandle
• 0x47b28c GlobalLock
• 0x47b290 GlobalFree
• 0x47b294 GlobalFindAtomA
• 0x47b298 GlobalDeleteAtom
• 0x47b29c GlobalAlloc
• 0x47b2a0 GlobalAddAtomA
• 0x47b2a8 GetVersionExA
• 0x47b2ac GetVersion
• 0x47b2b0 GetTickCount
• 0x47b2b4 GetThreadLocale
• 0x47b2bc GetSystemTime
• 0x47b2c0 GetSystemInfo
• 0x47b2c4 GetStringTypeExA
• 0x47b2c8 GetStdHandle
• 0x47b2cc GetProcAddress
• 0x47b2d0 GetModuleHandleA
• 0x47b2d4 GetModuleFileNameA
• 0x47b2d8 GetLogicalDrives
• 0x47b2dc GetLocaleInfoA
• 0x47b2e0 GetLocalTime
• 0x47b2e4 GetLastError
• 0x47b2e8 GetFullPathNameA
• 0x47b2ec GetFileAttributesA
• 0x47b2f0 GetDriveTypeA
• 0x47b2f4 GetDiskFreeSpaceA
• 0x47b2f8 GetDateFormatA
• 0x47b2fc GetCurrentThreadId
• 0x47b300 GetCurrentProcessId
• 0x47b304 GetCPInfo
• 0x47b308 GetACP
• 0x47b30c FreeResource
• 0x47b310 InterlockedExchange
• 0x47b314 FreeLibrary
• 0x47b318 FormatMessageA
• 0x47b31c FindResourceA
• 0x47b320 FindNextFileA
• 0x47b324 FindFirstFileA
• 0x47b328 FindClose
• 0x47b338 ExitThread
• 0x47b33c ExitProcess
• 0x47b340 EnumCalendarInfoA
• 0x47b34c CreateThread
• 0x47b350 CreateFileA
• 0x47b354 CreateEventA
• 0x47b358 CompareStringA
• 0x47b35c CloseHandle
Library mpr.dll:
• 0x47b364 WNetGetConnectionA
Library version.dll:
• 0x47b36c VerQueryValueA
• 0x47b374 GetFileVersionInfoA
Library gdi32.dll:
• 0x47b37c UnrealizeObject
• 0x47b380 StretchBlt
• 0x47b384 SetWindowOrgEx
• 0x47b388 SetWindowExtEx
• 0x47b38c SetWinMetaFileBits
• 0x47b390 SetViewportOrgEx
• 0x47b394 SetViewportExtEx
• 0x47b398 SetTextColor
• 0x47b39c SetStretchBltMode
• 0x47b3a0 SetROP2
• 0x47b3a4 SetPixel
• 0x47b3a8 SetMapMode
• 0x47b3ac SetEnhMetaFileBits
• 0x47b3b0 SetDIBColorTable
• 0x47b3b4 SetBrushOrgEx
• 0x47b3b8 SetBkMode
• 0x47b3bc SetBkColor
• 0x47b3c0 SelectPalette
• 0x47b3c4 SelectObject
• 0x47b3c8 SaveDC
• 0x47b3cc RestoreDC
• 0x47b3d0 Rectangle
• 0x47b3d4 RectVisible
• 0x47b3d8 RealizePalette
• 0x47b3dc Polyline
• 0x47b3e0 PolyPolyline
• 0x47b3e4 PlayEnhMetaFile
• 0x47b3e8 PatBlt
• 0x47b3ec MoveToEx
• 0x47b3f0 MaskBlt
• 0x47b3f4 LineTo
• 0x47b3f8 IntersectClipRect
• 0x47b3fc GetWindowOrgEx
• 0x47b400 GetWinMetaFileBits
• 0x47b404 GetTextMetricsA
• 0x47b410 GetStockObject
• 0x47b414 GetPixel
• 0x47b418 GetPaletteEntries
• 0x47b41c GetObjectA
• 0x47b428 GetEnhMetaFileBits
• 0x47b42c GetDeviceCaps
• 0x47b430 GetDIBits
• 0x47b434 GetDIBColorTable
• 0x47b438 GetDCOrgEx
• 0x47b440 GetClipBox
• 0x47b444 GetBrushOrgEx
• 0x47b448 GetBitmapBits
• 0x47b44c ExtTextOutA
• 0x47b450 ExtCreatePen
• 0x47b454 ExcludeClipRect
• 0x47b458 DeleteObject
• 0x47b45c DeleteEnhMetaFile
• 0x47b460 DeleteDC
• 0x47b464 CreateSolidBrush
• 0x47b468 CreatePenIndirect
• 0x47b46c CreatePen
• 0x47b470 CreatePalette
• 0x47b478 CreateFontIndirectA
• 0x47b47c CreateDIBitmap
• 0x47b480 CreateDIBSection
• 0x47b484 CreateCompatibleDC
• 0x47b48c CreateBrushIndirect
• 0x47b490 CreateBitmap
• 0x47b494 CopyEnhMetaFileA
• 0x47b498 BitBlt
Library user32.dll:
• 0x47b4a0 CreateWindowExA
• 0x47b4a4 WindowFromPoint
• 0x47b4a8 WinHelpA
• 0x47b4ac WaitMessage
• 0x47b4b0 ValidateRect
• 0x47b4b4 UpdateWindow
• 0x47b4b8 UnregisterClassA
• 0x47b4bc UnionRect
• 0x47b4c0 UnhookWindowsHookEx
• 0x47b4c4 TranslateMessage
• 0x47b4cc TrackPopupMenu
• 0x47b4d4 ShowWindow
• 0x47b4d8 ShowScrollBar
• 0x47b4dc ShowOwnedPopups
• 0x47b4e0 ShowCursor
• 0x47b4e4 SetWindowsHookExA
• 0x47b4e8 SetWindowTextA
• 0x47b4ec SetWindowPos
• 0x47b4f0 SetWindowPlacement
• 0x47b4f4 SetWindowLongA
• 0x47b4f8 SetTimer
• 0x47b4fc SetScrollRange
• 0x47b500 SetScrollPos
• 0x47b504 SetScrollInfo
• 0x47b508 SetRect
• 0x47b50c SetPropA
• 0x47b510 SetParent
• 0x47b514 SetMenuItemInfoA
• 0x47b518 SetMenu
• 0x47b51c SetKeyboardState
• 0x47b520 SetForegroundWindow
• 0x47b524 SetFocus
• 0x47b528 SetCursor
• 0x47b52c SetClipboardData
• 0x47b530 SetClassLongA
• 0x47b534 SetCapture
• 0x47b538 SetActiveWindow
• 0x47b53c SendMessageA
• 0x47b540 ScrollWindowEx
• 0x47b544 ScrollWindow
• 0x47b548 ScreenToClient
• 0x47b54c RemovePropA
• 0x47b550 RemoveMenu
• 0x47b554 ReleaseDC
• 0x47b558 ReleaseCapture
• 0x47b564 RegisterClassA
• 0x47b568 RedrawWindow
• 0x47b56c PtInRect
• 0x47b570 PostQuitMessage
• 0x47b574 PostMessageA
• 0x47b578 PeekMessageA
• 0x47b57c OpenClipboard
• 0x47b580 OffsetRect
• 0x47b584 OemToCharA
• 0x47b588 MessageBoxA
• 0x47b58c MessageBeep
• 0x47b590 MapWindowPoints
• 0x47b594 MapVirtualKeyA
• 0x47b598 LoadStringA
• 0x47b59c LoadKeyboardLayoutA
• 0x47b5a0 LoadIconA
• 0x47b5a4 LoadCursorA
• 0x47b5a8 LoadBitmapA
• 0x47b5ac KillTimer
• 0x47b5b0 IsZoomed
• 0x47b5b4 IsWindowVisible
• 0x47b5b8 IsWindowEnabled
• 0x47b5bc IsWindow
• 0x47b5c0 IsRectEmpty
• 0x47b5c4 IsIconic
• 0x47b5c8 IsDialogMessageA
• 0x47b5cc IsChild
• 0x47b5d0 IsCharAlphaNumericA
• 0x47b5d4 IsCharAlphaA
• 0x47b5d8 InvalidateRect
• 0x47b5dc IntersectRect
• 0x47b5e0 InsertMenuItemA
• 0x47b5e4 InsertMenuA
• 0x47b5e8 InflateRect
• 0x47b5f0 GetWindowTextA
• 0x47b5f4 GetWindowRect
• 0x47b5f8 GetWindowPlacement
• 0x47b5fc GetWindowLongA
• 0x47b600 GetWindowDC
• 0x47b604 GetTopWindow
• 0x47b608 GetSystemMetrics
• 0x47b60c GetSystemMenu
• 0x47b610 GetSysColorBrush
• 0x47b614 GetSysColor
• 0x47b618 GetSubMenu
• 0x47b61c GetScrollRange
• 0x47b620 GetScrollPos
• 0x47b624 GetScrollInfo
• 0x47b628 GetPropA
• 0x47b62c GetParent
• 0x47b630 GetWindow
• 0x47b634 GetMessageTime
• 0x47b638 GetMenuStringA
• 0x47b63c GetMenuState
• 0x47b640 GetMenuItemInfoA
• 0x47b644 GetMenuItemID
• 0x47b648 GetMenuItemCount
• 0x47b64c GetMenu
• 0x47b650 GetLastActivePopup
• 0x47b654 GetKeyboardState
• 0x47b65c GetKeyboardLayout
• 0x47b660 GetKeyState
• 0x47b664 GetKeyNameTextA
• 0x47b668 GetIconInfo
• 0x47b66c GetForegroundWindow
• 0x47b670 GetFocus
• 0x47b674 GetDoubleClickTime
• 0x47b678 GetDesktopWindow
• 0x47b67c GetDCEx
• 0x47b680 GetDC
• 0x47b684 GetCursorPos
• 0x47b688 GetCursor
• 0x47b68c GetClipboardData
• 0x47b690 GetClientRect
• 0x47b694 GetClassNameA
• 0x47b698 GetClassInfoA
• 0x47b69c GetCaretPos
• 0x47b6a0 GetCapture
• 0x47b6a4 GetActiveWindow
• 0x47b6a8 FrameRect
• 0x47b6ac FindWindowA
• 0x47b6b0 FillRect
• 0x47b6b4 EqualRect
• 0x47b6b8 EnumWindows
• 0x47b6bc EnumThreadWindows
• 0x47b6c4 EndPaint
• 0x47b6c8 EnableWindow
• 0x47b6cc EnableScrollBar
• 0x47b6d0 EnableMenuItem
• 0x47b6d4 EmptyClipboard
• 0x47b6d8 DrawTextA
• 0x47b6dc DrawMenuBar
• 0x47b6e0 DrawIconEx
• 0x47b6e4 DrawIcon
• 0x47b6e8 DrawFrameControl
• 0x47b6ec DrawFocusRect
• 0x47b6f0 DrawEdge
• 0x47b6f4 DispatchMessageA
• 0x47b6f8 DestroyWindow
• 0x47b6fc DestroyMenu
• 0x47b700 DestroyIcon
• 0x47b704 DestroyCursor
• 0x47b708 DeleteMenu
• 0x47b70c DefWindowProcA
• 0x47b710 DefMDIChildProcA
• 0x47b714 DefFrameProcA
• 0x47b718 CreatePopupMenu
• 0x47b71c CreateMenu
• 0x47b720 CreateIcon
• 0x47b724 CloseClipboard
• 0x47b728 ClientToScreen
• 0x47b72c CheckMenuItem
• 0x47b730 CallWindowProcA
• 0x47b734 CallNextHookEx
• 0x47b738 BeginPaint
• 0x47b73c CharNextA
• 0x47b740 CharLowerBuffA
• 0x47b744 CharLowerA
• 0x47b748 CharUpperBuffA
• 0x47b74c CharToOemA
• 0x47b750 AdjustWindowRectEx
Library kernel32.dll:
• 0x47b75c Sleep
Library oleaut32.dll:
• 0x47b764 SafeArrayPtrOfIndex
• 0x47b768 SafeArrayGetUBound
• 0x47b76c SafeArrayGetLBound
• 0x47b770 SafeArrayCreate
• 0x47b774 VariantChangeType
• 0x47b778 VariantCopy
• 0x47b77c VariantClear
• 0x47b780 VariantInit
Library comctl32.dll:
• 0x47b790 ImageList_Write
• 0x47b794 ImageList_Read
• 0x47b7a4 ImageList_DragMove
• 0x47b7a8 ImageList_DragLeave
• 0x47b7ac ImageList_DragEnter
• 0x47b7b0 ImageList_EndDrag
• 0x47b7b4 ImageList_BeginDrag
• 0x47b7b8 ImageList_Remove
• 0x47b7bc ImageList_DrawEx
• 0x47b7c0 ImageList_Draw
• 0x47b7d0 ImageList_Add
• 0x47b7d8 ImageList_Destroy
• 0x47b7dc ImageList_Create
• 0x47b7e0 InitCommonControls
Library kernel32.dll:
• 0x47b7e8 MulDiv

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50568 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.