6.2
高危
58 个模型检测该样本为恶意！
重新分析
更多

e94d73fbdb8045ac86a6fe1387733eda8fdd08629c9b50e6820ef94a1a675d90

cfa55aef83a631d97e0b6dcd71b92bb9.exe

分析耗时

25s

最近分析

文件大小

837.5KB
静态报毒 动态报毒 0G0@AE1BGRII 100% 5SMRILKBO3W AGEN AI SCORE=88 AIDETECTVM ALI2000015 AUTOG CERBU CLASSIC CONFIDENCE DELF DELFINJECT DELPHILESS DOWNLOADER33 EMHC ERRV EVKS FAREIT GDSDA GENERICKD HIGH CONFIDENCE HKWJCM KRYPTIK MALWARE1 MALWARE@#36M94E08TVPFL QVM05 R03BC0DJT20 S + TROJ SCORE SUSGEN TCVT TSCOPE UNSAFE WACATAC X2066 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FTB!CFA55AEF83A6 20201211 6.0.6.653
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
Avast Win32:Trojan-gen 20201210 21.1.5827.0
Baidu 20190318 1.0.0.2
Kingsoft 20201211 2017.9.26.565
Tencent Win32.Trojan.Kryptik.Tcvt 20201211 1.0.0.1
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619912729.960999
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 48692788
registers.edi: 0
registers.eax: 0
registers.ebp: 48693128
registers.edx: 25
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 2e 79 00 00 e9
exception.symbol: cfa55aef83a631d97e0b6dcd71b92bb9+0x606da
exception.instruction: div eax
exception.module: cfa55aef83a631d97e0b6dcd71b92bb9.exe
exception.exception_code: 0xc0000094
exception.offset: 394970
exception.address: 0x4606da
success 0 0
1619912732.101876
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75137f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75134de3
cfa55aef83a631d97e0b6dcd71b92bb9+0x5aa4d @ 0x45aa4d
cfa55aef83a631d97e0b6dcd71b92bb9+0x53254 @ 0x453254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff4f14ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619912729.867999
NtAllocateVirtualMemory
process_identifier: 420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619912729.960999
NtProtectVirtualMemory
process_identifier: 420
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 32768
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00460000
success 0 0
1619912729.960999
NtAllocateVirtualMemory
process_identifier: 420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x005d0000
success 0 0
1619912730.992876
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619912731.038876
NtAllocateVirtualMemory
process_identifier: 2244
region_size: 1441792
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01e10000
success 0 0
1619912731.038876
NtAllocateVirtualMemory
process_identifier: 2244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f30000
success 0 0
1619912731.038876
NtAllocateVirtualMemory
process_identifier: 2244
region_size: 335872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00510000
success 0 0
1619912731.038876
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 311296
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00512000
success 0 0
1619912731.398876
NtAllocateVirtualMemory
process_identifier: 2244
region_size: 1572864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01fa0000
success 0 0
1619912731.398876
NtAllocateVirtualMemory
process_identifier: 2244
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020e0000
success 0 0
1619912732.023876
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f92000
success 0 0
1619912732.023876
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619912732.023876
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f92000
success 0 0
1619912732.023876
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619912732.023876
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f92000
success 0 0
1619912732.023876
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619912732.023876
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f92000
success 0 0
1619912732.023876
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619912732.038876
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f92000
success 0 0
1619912732.038876
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619912732.038876
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f92000
success 0 0
1619912732.038876
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619912732.038876
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f92000
success 0 0
1619912732.038876
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619912732.038876
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f92000
success 0 0
1619912732.038876
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619912732.038876
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f92000
success 0 0
1619912732.038876
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619912732.038876
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f92000
success 0 0
1619912732.038876
NtProtectVirtualMemory
process_identifier: 2244
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (5 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 6.88760465352036 section {'size_of_data': '0x0005f200', 'virtual_address': '0x00079000', 'entropy': 6.88760465352036, 'name': '.rsrc', 'virtual_size': '0x0005f120'} description A section with a high entropy has been found
entropy 0.4548714883442917 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 420 called NtSetContextThread to modify thread in remote process 2244
Time & API Arguments Status Return Repeated
1619912730.132999
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4908592
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2244
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 420 resumed a thread in remote process 2244
Time & API Arguments Status Return Repeated
1619912730.788999
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2244
success 0 0
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619912730.117999
CreateProcessInternalW
thread_identifier: 2292
thread_handle: 0x000000fc
process_identifier: 2244
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\cfa55aef83a631d97e0b6dcd71b92bb9.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619912730.117999
NtUnmapViewOfSection
process_identifier: 2244
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619912730.117999
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 2244
commit_size: 720896
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 720896
base_address: 0x00400000
success 0 0
1619912730.132999
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1619912730.132999
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4908592
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2244
success 0 0
1619912730.788999
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2244
success 0 0
File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
DrWeb Trojan.DownLoader33.51882
MicroWorld-eScan Trojan.GenericKD.33946417
FireEye Generic.mg.cfa55aef83a631d9
Qihoo-360 HEUR/QVM05.1.DA5B.Malware.Gen
McAfee Fareit-FTB!CFA55AEF83A6
Cylance Unsafe
Zillya Trojan.Injector.Win32.740458
Sangfor Malware
K7AntiVirus Trojan ( 005680341 )
Alibaba Trojan:Win32/DelfInject.ali2000015
K7GW Trojan ( 005680341 )
Cybereason malicious.d70d2e
Arcabit Trojan.Generic.D205FB31
BitDefenderTheta Gen:NN.ZelphiF.34670.0G0@ae1bGrii
Cyren W32/Trojan.EVKS-5070
Symantec Trojan.Gen.2
ESET-NOD32 a variant of Win32/Injector.EMHC
APEX Malicious
Avast Win32:Trojan-gen
ClamAV Win.Malware.Errv-7996272-0
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
BitDefender Trojan.GenericKD.33946417
NANO-Antivirus Trojan.Win32.Cerbu.hkwjcm
Paloalto generic.ml
Rising Trojan.Injector!1.C77F (CLASSIC)
Ad-Aware Trojan.GenericKD.33946417
Sophos Mal/Generic-S + Troj/AutoG-IC
Comodo Malware@#36m94e08tvpfl
F-Secure Heuristic.HEUR/AGEN.1137421
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R03BC0DJT20
McAfee-GW-Edition BehavesLike.Win32.Fareit.ch
Emsisoft Trojan.GenericKD.33946417 (B)
Avira HEUR/AGEN.1137421
Antiy-AVL Trojan/Win32.Kryptik
Gridinsoft Ransom.Win32.Wacatac.vb
Microsoft PWS:Win32/Fareit.SM!MTB
AegisLab Trojan.Multi.Generic.4!c
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
GData Trojan.GenericKD.33946417
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2066
VBA32 TScope.Trojan.Delf
ALYac Trojan.GenericKD.33946417
MAX malware (ai score=88)
Malwarebytes Trojan.MalPack.DLF
TrendMicro-HouseCall TROJ_GEN.R03BC0DJT20
Tencent Win32.Trojan.Kryptik.Tcvt
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x46c13c VirtualFree
• 0x46c140 VirtualAlloc
• 0x46c144 LocalFree
• 0x46c148 LocalAlloc
• 0x46c14c GetVersion
• 0x46c150 GetCurrentThreadId
• 0x46c15c VirtualQuery
• 0x46c160 WideCharToMultiByte
• 0x46c164 MultiByteToWideChar
• 0x46c168 lstrlenA
• 0x46c16c lstrcpynA
• 0x46c170 LoadLibraryExA
• 0x46c174 GetThreadLocale
• 0x46c178 GetStartupInfoA
• 0x46c17c GetProcAddress
• 0x46c180 GetModuleHandleA
• 0x46c184 GetModuleFileNameA
• 0x46c188 GetLocaleInfoA
• 0x46c18c GetCommandLineA
• 0x46c190 FreeLibrary
• 0x46c194 FindFirstFileA
• 0x46c198 FindClose
• 0x46c19c ExitProcess
• 0x46c1a0 WriteFile
• 0x46c1a8 RtlUnwind
• 0x46c1ac RaiseException
• 0x46c1b0 GetStdHandle
Library user32.dll:
• 0x46c1b8 GetKeyboardType
• 0x46c1bc LoadStringA
• 0x46c1c0 MessageBoxA
• 0x46c1c4 CharNextA
Library advapi32.dll:
• 0x46c1cc RegQueryValueExA
• 0x46c1d0 RegOpenKeyExA
• 0x46c1d4 RegCloseKey
Library oleaut32.dll:
• 0x46c1dc SysFreeString
• 0x46c1e0 SysReAllocStringLen
• 0x46c1e4 SysAllocStringLen
Library kernel32.dll:
• 0x46c1ec TlsSetValue
• 0x46c1f0 TlsGetValue
• 0x46c1f4 LocalAlloc
• 0x46c1f8 GetModuleHandleA
Library advapi32.dll:
• 0x46c200 RegQueryValueExA
• 0x46c204 RegOpenKeyExA
• 0x46c208 RegCloseKey
Library kernel32.dll:
• 0x46c210 lstrcpyA
• 0x46c214 WriteFile
• 0x46c21c WaitForSingleObject
• 0x46c220 VirtualQuery
• 0x46c224 VirtualAlloc
• 0x46c228 Sleep
• 0x46c22c SizeofResource
• 0x46c230 SetThreadLocale
• 0x46c234 SetFilePointer
• 0x46c238 SetEvent
• 0x46c23c SetErrorMode
• 0x46c240 SetEndOfFile
• 0x46c244 ResetEvent
• 0x46c248 ReadFile
• 0x46c24c MulDiv
• 0x46c250 LockResource
• 0x46c254 LoadResource
• 0x46c258 LoadLibraryA
• 0x46c264 GlobalUnlock
• 0x46c268 GlobalReAlloc
• 0x46c26c GlobalHandle
• 0x46c270 GlobalLock
• 0x46c274 GlobalFree
• 0x46c278 GlobalFindAtomA
• 0x46c27c GlobalDeleteAtom
• 0x46c280 GlobalAlloc
• 0x46c284 GlobalAddAtomA
• 0x46c288 GetVersionExA
• 0x46c28c GetVersion
• 0x46c290 GetTickCount
• 0x46c294 GetThreadLocale
• 0x46c29c GetSystemTime
• 0x46c2a0 GetSystemInfo
• 0x46c2a4 GetStringTypeExA
• 0x46c2a8 GetStdHandle
• 0x46c2ac GetProcAddress
• 0x46c2b0 GetModuleHandleA
• 0x46c2b4 GetModuleFileNameA
• 0x46c2b8 GetLocaleInfoA
• 0x46c2bc GetLocalTime
• 0x46c2c0 GetLastError
• 0x46c2c4 GetFullPathNameA
• 0x46c2c8 GetFileAttributesA
• 0x46c2cc GetDiskFreeSpaceA
• 0x46c2d0 GetDateFormatA
• 0x46c2d4 GetCurrentThreadId
• 0x46c2d8 GetCurrentProcessId
• 0x46c2dc GetCPInfo
• 0x46c2e0 GetACP
• 0x46c2e4 FreeResource
• 0x46c2e8 InterlockedExchange
• 0x46c2ec FreeLibrary
• 0x46c2f0 FormatMessageA
• 0x46c2f4 FindResourceA
• 0x46c2f8 FindFirstFileA
• 0x46c2fc FindClose
• 0x46c308 ExitThread
• 0x46c30c EnumCalendarInfoA
• 0x46c318 CreateThread
• 0x46c31c CreateFileA
• 0x46c320 CreateEventA
• 0x46c324 CompareStringA
• 0x46c328 CloseHandle
Library version.dll:
• 0x46c330 VerQueryValueA
• 0x46c338 GetFileVersionInfoA
Library gdi32.dll:
• 0x46c340 UnrealizeObject
• 0x46c344 StretchBlt
• 0x46c348 SetWindowOrgEx
• 0x46c34c SetWinMetaFileBits
• 0x46c350 SetViewportOrgEx
• 0x46c354 SetTextColor
• 0x46c358 SetStretchBltMode
• 0x46c35c SetROP2
• 0x46c360 SetPixel
• 0x46c364 SetEnhMetaFileBits
• 0x46c368 SetDIBColorTable
• 0x46c36c SetBrushOrgEx
• 0x46c370 SetBkMode
• 0x46c374 SetBkColor
• 0x46c378 SelectPalette
• 0x46c37c SelectObject
• 0x46c380 SelectClipRgn
• 0x46c384 SaveDC
• 0x46c388 RestoreDC
• 0x46c38c Rectangle
• 0x46c390 RectVisible
• 0x46c394 RealizePalette
• 0x46c398 Polyline
• 0x46c39c PlayEnhMetaFile
• 0x46c3a0 PatBlt
• 0x46c3a4 MoveToEx
• 0x46c3a8 MaskBlt
• 0x46c3ac LineTo
• 0x46c3b0 IntersectClipRect
• 0x46c3b4 GetWindowOrgEx
• 0x46c3b8 GetWinMetaFileBits
• 0x46c3bc GetTextMetricsA
• 0x46c3c8 GetStockObject
• 0x46c3cc GetPixel
• 0x46c3d0 GetPaletteEntries
• 0x46c3d4 GetObjectA
• 0x46c3e0 GetEnhMetaFileBits
• 0x46c3e4 GetDeviceCaps
• 0x46c3e8 GetDIBits
• 0x46c3ec GetDIBColorTable
• 0x46c3f0 GetDCOrgEx
• 0x46c3f8 GetClipBox
• 0x46c3fc GetBrushOrgEx
• 0x46c400 GetBitmapBits
• 0x46c404 ExcludeClipRect
• 0x46c408 DeleteObject
• 0x46c40c DeleteEnhMetaFile
• 0x46c410 DeleteDC
• 0x46c414 CreateSolidBrush
• 0x46c418 CreatePenIndirect
• 0x46c41c CreatePen
• 0x46c420 CreatePalette
• 0x46c428 CreateFontIndirectA
• 0x46c42c CreateDIBitmap
• 0x46c430 CreateDIBSection
• 0x46c434 CreateCompatibleDC
• 0x46c43c CreateBrushIndirect
• 0x46c440 CreateBitmap
• 0x46c444 CopyEnhMetaFileA
• 0x46c448 BitBlt
Library user32.dll:
• 0x46c450 CreateWindowExA
• 0x46c454 WindowFromPoint
• 0x46c458 WinHelpA
• 0x46c45c WaitMessage
• 0x46c460 ValidateRect
• 0x46c464 UpdateWindow
• 0x46c468 UnregisterClassA
• 0x46c46c UnhookWindowsHookEx
• 0x46c470 TranslateMessage
• 0x46c478 TrackPopupMenu
• 0x46c480 ShowWindow
• 0x46c484 ShowScrollBar
• 0x46c488 ShowOwnedPopups
• 0x46c48c ShowCursor
• 0x46c490 SetWindowsHookExA
• 0x46c494 SetWindowTextA
• 0x46c498 SetWindowPos
• 0x46c49c SetWindowPlacement
• 0x46c4a0 SetWindowLongA
• 0x46c4a4 SetTimer
• 0x46c4a8 SetScrollRange
• 0x46c4ac SetScrollPos
• 0x46c4b0 SetScrollInfo
• 0x46c4b4 SetRect
• 0x46c4b8 SetPropA
• 0x46c4bc SetParent
• 0x46c4c0 SetMenuItemInfoA
• 0x46c4c4 SetMenu
• 0x46c4c8 SetForegroundWindow
• 0x46c4cc SetFocus
• 0x46c4d0 SetCursor
• 0x46c4d4 SetClassLongA
• 0x46c4d8 SetCapture
• 0x46c4dc SetActiveWindow
• 0x46c4e0 SendMessageA
• 0x46c4e4 ScrollWindow
• 0x46c4e8 ScreenToClient
• 0x46c4ec RemovePropA
• 0x46c4f0 RemoveMenu
• 0x46c4f4 ReleaseDC
• 0x46c4f8 ReleaseCapture
• 0x46c504 RegisterClassA
• 0x46c508 RedrawWindow
• 0x46c50c PtInRect
• 0x46c510 PostQuitMessage
• 0x46c514 PostMessageA
• 0x46c518 PeekMessageA
• 0x46c51c OffsetRect
• 0x46c520 OemToCharA
• 0x46c524 MessageBoxA
• 0x46c528 MapWindowPoints
• 0x46c52c MapVirtualKeyA
• 0x46c530 LoadStringA
• 0x46c534 LoadKeyboardLayoutA
• 0x46c538 LoadIconA
• 0x46c53c LoadCursorA
• 0x46c540 LoadBitmapA
• 0x46c544 KillTimer
• 0x46c548 IsZoomed
• 0x46c54c IsWindowVisible
• 0x46c550 IsWindowEnabled
• 0x46c554 IsWindow
• 0x46c558 IsRectEmpty
• 0x46c55c IsIconic
• 0x46c560 IsDialogMessageA
• 0x46c564 IsChild
• 0x46c568 InvalidateRect
• 0x46c56c IntersectRect
• 0x46c570 InsertMenuItemA
• 0x46c574 InsertMenuA
• 0x46c578 InflateRect
• 0x46c580 GetWindowTextA
• 0x46c584 GetWindowRect
• 0x46c588 GetWindowPlacement
• 0x46c58c GetWindowLongA
• 0x46c590 GetWindowDC
• 0x46c594 GetTopWindow
• 0x46c598 GetSystemMetrics
• 0x46c59c GetSystemMenu
• 0x46c5a0 GetSysColorBrush
• 0x46c5a4 GetSysColor
• 0x46c5a8 GetSubMenu
• 0x46c5ac GetScrollRange
• 0x46c5b0 GetScrollPos
• 0x46c5b4 GetScrollInfo
• 0x46c5b8 GetPropA
• 0x46c5bc GetParent
• 0x46c5c0 GetWindow
• 0x46c5c4 GetMenuStringA
• 0x46c5c8 GetMenuState
• 0x46c5cc GetMenuItemInfoA
• 0x46c5d0 GetMenuItemID
• 0x46c5d4 GetMenuItemCount
• 0x46c5d8 GetMenu
• 0x46c5dc GetLastActivePopup
• 0x46c5e0 GetKeyboardState
• 0x46c5e8 GetKeyboardLayout
• 0x46c5ec GetKeyState
• 0x46c5f0 GetKeyNameTextA
• 0x46c5f4 GetIconInfo
• 0x46c5f8 GetForegroundWindow
• 0x46c5fc GetFocus
• 0x46c600 GetDlgItem
• 0x46c604 GetDesktopWindow
• 0x46c608 GetDCEx
• 0x46c60c GetDC
• 0x46c610 GetCursorPos
• 0x46c614 GetCursor
• 0x46c618 GetClipboardData
• 0x46c61c GetClientRect
• 0x46c620 GetClassNameA
• 0x46c624 GetClassInfoA
• 0x46c628 GetCapture
• 0x46c62c GetActiveWindow
• 0x46c630 FrameRect
• 0x46c634 FindWindowA
• 0x46c638 FillRect
• 0x46c63c EqualRect
• 0x46c640 EnumWindows
• 0x46c644 EnumThreadWindows
• 0x46c648 EndPaint
• 0x46c64c EndDeferWindowPos
• 0x46c650 EnableWindow
• 0x46c654 EnableScrollBar
• 0x46c658 EnableMenuItem
• 0x46c65c DrawTextA
• 0x46c660 DrawMenuBar
• 0x46c664 DrawIconEx
• 0x46c668 DrawIcon
• 0x46c66c DrawFrameControl
• 0x46c670 DrawEdge
• 0x46c674 DispatchMessageA
• 0x46c678 DestroyWindow
• 0x46c67c DestroyMenu
• 0x46c680 DestroyIcon
• 0x46c684 DestroyCursor
• 0x46c688 DeleteMenu
• 0x46c68c DeferWindowPos
• 0x46c690 DefWindowProcA
• 0x46c694 DefMDIChildProcA
• 0x46c698 DefFrameProcA
• 0x46c69c CreatePopupMenu
• 0x46c6a0 CreateMenu
• 0x46c6a4 CreateIcon
• 0x46c6a8 ClientToScreen
• 0x46c6ac CheckMenuItem
• 0x46c6b0 CallWindowProcA
• 0x46c6b4 CallNextHookEx
• 0x46c6b8 BeginPaint
• 0x46c6bc BeginDeferWindowPos
• 0x46c6c0 CharNextA
• 0x46c6c4 CharLowerBuffA
• 0x46c6c8 CharLowerA
• 0x46c6cc CharToOemA
• 0x46c6d0 AdjustWindowRectEx
Library kernel32.dll:
• 0x46c6dc Sleep
Library oleaut32.dll:
• 0x46c6e4 SafeArrayPtrOfIndex
• 0x46c6e8 SafeArrayGetUBound
• 0x46c6ec SafeArrayGetLBound
• 0x46c6f0 SafeArrayCreate
• 0x46c6f4 VariantChangeType
• 0x46c6f8 VariantCopy
• 0x46c6fc VariantClear
• 0x46c700 VariantInit
Library comctl32.dll:
• 0x46c710 ImageList_Write
• 0x46c714 ImageList_Read
• 0x46c724 ImageList_DragMove
• 0x46c728 ImageList_DragLeave
• 0x46c72c ImageList_DragEnter
• 0x46c730 ImageList_EndDrag
• 0x46c734 ImageList_BeginDrag
• 0x46c738 ImageList_Remove
• 0x46c73c ImageList_DrawEx
• 0x46c740 ImageList_Replace
• 0x46c744 ImageList_Draw
• 0x46c754 ImageList_Add
• 0x46c75c ImageList_Destroy
• 0x46c760 ImageList_Create
• 0x46c764 InitCommonControls
Library comdlg32.dll:
• 0x46c76c GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.