5.6
高危
38 个模型检测该样本为恶意！
重新分析
更多

5c9b22633bb9c7f20fcd928e0093ac5debd1dabd7f42daa479725b5f2db38e91

d15eff3ce503230404b143cbe4a9d84b.exe

分析耗时

23s

最近分析

文件大小

988.5KB
静态报毒 动态报毒 AGEN ALI2000015 CONFIDENCE DELFINJECT DELPHILESS ELDORADO EMOL EMOY FAREIT GENETIC HIGH CONFIDENCE HMKBXP INJUKE MALWARE@#376HZ4KJIWN7N QVM05 R007C0DKG20 RATX SCORE X2085 ZUSY 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee 20201211 6.0.6.653
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Avast Win32:RATX-gen [Trj] 20201210 21.1.5827.0
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
Kingsoft 20201211 2017.9.26.565
Tencent 20201211 1.0.0.1
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (3 个事件)
Time & API Arguments Status Return Repeated
1619944186.27475
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49741636
registers.edi: 0
registers.eax: 0
registers.ebp: 49741704
registers.edx: 0
registers.ebx: 0
registers.esi: 0
registers.ecx: 1969237513
exception.instruction_r: f7 f0 89 ff 89 ff 89 ff 89 ff 33 c0 5a 59 59 64
exception.symbol: d15eff3ce503230404b143cbe4a9d84b+0x6f991
exception.instruction: div eax
exception.module: d15eff3ce503230404b143cbe4a9d84b.exe
exception.exception_code: 0xc0000094
exception.offset: 457105
exception.address: 0x46f991
success 0 0
1619944188.040375
__exception__
stacktrace: 
d15eff3ce503230404b143cbe4a9d84b+0x90a4d @ 0x490a4d
d15eff3ce503230404b143cbe4a9d84b+0x89254 @ 0x489254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1636708
registers.edi: 4793763
registers.eax: 4743709
registers.ebp: 1636764
registers.edx: 4749402
registers.ebx: 0
registers.esi: 4294963200
registers.ecx: 4743695
exception.instruction_r: 66 81 3e 4d 5a 75 f3 0f b7 7e 3c 03 fe 8b 6f 78
exception.symbol: d15eff3ce503230404b143cbe4a9d84b+0x86229
exception.instruction: cmp word ptr [esi], 0x5a4d
exception.module: d15eff3ce503230404b143cbe4a9d84b.exe
exception.exception_code: 0xc0000005
exception.offset: 549417
exception.address: 0x486229
success 0 0
1619944188.071375
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75157f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75154de3
d15eff3ce503230404b143cbe4a9d84b+0x90a4d @ 0x490a4d
d15eff3ce503230404b143cbe4a9d84b+0x89254 @ 0x489254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff5814ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619944186.18075
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01e00000
success 0 0
1619944186.27475
NtProtectVirtualMemory
process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 36864
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0046f000
success 0 0
1619944186.27475
NtAllocateVirtualMemory
process_identifier: 732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01ed0000
success 0 0
1619944186.946375
NtProtectVirtualMemory
process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619944187.008375
NtAllocateVirtualMemory
process_identifier: 2216
region_size: 1114112
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01ea0000
success 0 0
1619944187.008375
NtAllocateVirtualMemory
process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f70000
success 0 0
1619944187.008375
NtAllocateVirtualMemory
process_identifier: 2216
region_size: 557056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01ea0000
success 0 0
1619944187.024375
NtProtectVirtualMemory
process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 520192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ea2000
success 0 0
1619944187.399375
NtAllocateVirtualMemory
process_identifier: 2216
region_size: 2097152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x023e0000
success 0 0
1619944187.399375
NtAllocateVirtualMemory
process_identifier: 2216
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x025a0000
success 0 0
1619944188.040375
NtProtectVirtualMemory
process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1619944188.040375
NtProtectVirtualMemory
process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619944188.040375
NtProtectVirtualMemory
process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1619944188.040375
NtProtectVirtualMemory
process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619944188.040375
NtProtectVirtualMemory
process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1619944188.040375
NtProtectVirtualMemory
process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619944188.040375
NtProtectVirtualMemory
process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1619944188.040375
NtProtectVirtualMemory
process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619944188.040375
NtProtectVirtualMemory
process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1619944188.040375
NtProtectVirtualMemory
process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619944188.040375
NtProtectVirtualMemory
process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1619944188.040375
NtProtectVirtualMemory
process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619944188.040375
NtProtectVirtualMemory
process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1619944188.040375
NtProtectVirtualMemory
process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619944188.040375
NtProtectVirtualMemory
process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1619944188.040375
NtProtectVirtualMemory
process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619944188.040375
NtProtectVirtualMemory
process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1619944188.040375
NtProtectVirtualMemory
process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619944188.040375
NtProtectVirtualMemory
process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02022000
success 0 0
1619944188.040375
NtProtectVirtualMemory
process_identifier: 2216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.274018954024378 section {'size_of_data': '0x00073800', 'virtual_address': '0x0008a000', 'entropy': 7.274018954024378, 'name': '.rsrc', 'virtual_size': '0x00073798'} description A section with a high entropy has been found
entropy 0.46784810126582277 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 732 called NtSetContextThread to modify thread in remote process 2216
Time & API Arguments Status Return Repeated
1619944186.49375
NtSetContextThread
thread_handle: 0x00000100
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5358464
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2216
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 732 resumed a thread in remote process 2216
Time & API Arguments Status Return Repeated
1619944186.75875
NtResumeThread
thread_handle: 0x00000100
suspend_count: 1
process_identifier: 2216
success 0 0
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619944186.43075
CreateProcessInternalW
thread_identifier: 520
thread_handle: 0x00000100
process_identifier: 2216
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\d15eff3ce503230404b143cbe4a9d84b.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000104
inherit_handles: 0
success 1 0
1619944186.43075
NtUnmapViewOfSection
process_identifier: 2216
region_size: 4096
process_handle: 0x00000104
base_address: 0x00400000
success 0 0
1619944186.44675
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 2216
commit_size: 1171456
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000104
allocation_type: 0 ()
section_offset: 0
view_size: 1171456
base_address: 0x00400000
success 0 0
1619944186.49375
NtGetContextThread
thread_handle: 0x00000100
success 0 0
1619944186.49375
NtSetContextThread
thread_handle: 0x00000100
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5358464
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2216
success 0 0
1619944186.75875
NtResumeThread
thread_handle: 0x00000100
suspend_count: 1
process_identifier: 2216
success 0 0
File has been identified by 38 AntiVirus engines on VirusTotal as malicious (38 个事件)
Elastic malicious (high confidence)
Qihoo-360 Generic/HEUR/QVM05.1.6522.Malware.Gen
Malwarebytes Spyware.Agent
VIPRE Trojan.Win32.Generic!BT
AegisLab Trojan.Win32.Injuke.4!c
K7AntiVirus Trojan ( 0056eb231 )
K7GW Trojan ( 0056eb231 )
CrowdStrike win/malicious_confidence_90% (W)
Cyren W32/Injector.ABY.gen!Eldorado
APEX Malicious
Avast Win32:RATX-gen [Trj]
Kaspersky HEUR:Trojan.Win32.Injuke.gen
Alibaba Trojan:Win32/DelfInject.ali2000015
NANO-Antivirus Trojan.Win32.Injuke.hmkbxp
Emsisoft Gen:Variant.Zusy.308671 (B)
Comodo Malware@#376hz4kjiwn7n
F-Secure Heuristic.HEUR/AGEN.1136862
DrWeb Trojan.PWS.Stealer.28799
Zillya Trojan.Injector.Win32.748630
TrendMicro TROJ_GEN.R007C0DKG20
McAfee-GW-Edition BehavesLike.Win32.Fareit.dc
Sophos Mal/Generic-S
Ikarus Trojan.Inject
Webroot W32.Trojan.Gen
Avira HEUR/AGEN.1136862
Antiy-AVL Trojan/Win32.Injuke
Arcabit Trojan.Zusy.D4B5BF
ZoneAlarm HEUR:Trojan.Win32.Injuke.gen
Microsoft PWS:Win32/Fareit.ART!MTB
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2085
Acronis suspicious
Panda Trj/Genetic.gen
ESET-NOD32 a variant of Win32/Injector.EMOL
Fortinet W32/Injector.EMOY!tr
AVG Win32:RATX-gen [Trj]
Cybereason malicious.5b6619
Paloalto generic.ml
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x47c164 VirtualFree
• 0x47c168 VirtualAlloc
• 0x47c16c LocalFree
• 0x47c170 LocalAlloc
• 0x47c174 GetVersion
• 0x47c178 GetCurrentThreadId
• 0x47c184 VirtualQuery
• 0x47c188 WideCharToMultiByte
• 0x47c18c MultiByteToWideChar
• 0x47c190 lstrlenA
• 0x47c194 lstrcpynA
• 0x47c198 LoadLibraryExA
• 0x47c19c GetThreadLocale
• 0x47c1a0 GetStartupInfoA
• 0x47c1a4 GetProcAddress
• 0x47c1a8 GetModuleHandleA
• 0x47c1ac GetModuleFileNameA
• 0x47c1b0 GetLocaleInfoA
• 0x47c1b4 GetCommandLineA
• 0x47c1b8 FreeLibrary
• 0x47c1bc FindFirstFileA
• 0x47c1c0 FindClose
• 0x47c1c4 ExitProcess
• 0x47c1c8 WriteFile
• 0x47c1d0 RtlUnwind
• 0x47c1d4 RaiseException
• 0x47c1d8 GetStdHandle
Library user32.dll:
• 0x47c1e0 GetKeyboardType
• 0x47c1e4 LoadStringA
• 0x47c1e8 MessageBoxA
• 0x47c1ec CharNextA
Library advapi32.dll:
• 0x47c1f4 RegQueryValueExA
• 0x47c1f8 RegOpenKeyExA
• 0x47c1fc RegCloseKey
Library oleaut32.dll:
• 0x47c204 SysFreeString
• 0x47c208 SysReAllocStringLen
• 0x47c20c SysAllocStringLen
Library kernel32.dll:
• 0x47c214 TlsSetValue
• 0x47c218 TlsGetValue
• 0x47c21c LocalAlloc
• 0x47c220 GetModuleHandleA
Library advapi32.dll:
• 0x47c228 RegQueryValueExA
• 0x47c22c RegOpenKeyExA
• 0x47c230 RegCloseKey
Library kernel32.dll:
• 0x47c238 lstrcpyA
• 0x47c23c WriteFile
• 0x47c240 WaitForSingleObject
• 0x47c244 VirtualQuery
• 0x47c248 VirtualProtectEx
• 0x47c24c VirtualAlloc
• 0x47c250 Sleep
• 0x47c254 SizeofResource
• 0x47c258 SetThreadLocale
• 0x47c25c SetFilePointer
• 0x47c260 SetEvent
• 0x47c264 SetErrorMode
• 0x47c268 SetEndOfFile
• 0x47c26c ResetEvent
• 0x47c270 ReadFile
• 0x47c274 MultiByteToWideChar
• 0x47c278 MulDiv
• 0x47c27c LockResource
• 0x47c280 LoadResource
• 0x47c284 LoadLibraryA
• 0x47c290 GlobalUnlock
• 0x47c294 GlobalSize
• 0x47c298 GlobalReAlloc
• 0x47c29c GlobalHandle
• 0x47c2a0 GlobalLock
• 0x47c2a4 GlobalFree
• 0x47c2a8 GlobalFindAtomA
• 0x47c2ac GlobalDeleteAtom
• 0x47c2b0 GlobalAlloc
• 0x47c2b4 GlobalAddAtomA
• 0x47c2b8 GetVersionExA
• 0x47c2bc GetVersion
• 0x47c2c0 GetUserDefaultLCID
• 0x47c2c4 GetTickCount
• 0x47c2c8 GetThreadLocale
• 0x47c2cc GetSystemInfo
• 0x47c2d0 GetStringTypeExA
• 0x47c2d4 GetStdHandle
• 0x47c2d8 GetProcAddress
• 0x47c2dc GetModuleHandleA
• 0x47c2e0 GetModuleFileNameA
• 0x47c2e4 GetLocaleInfoA
• 0x47c2e8 GetLocalTime
• 0x47c2ec GetLastError
• 0x47c2f0 GetFullPathNameA
• 0x47c2f4 GetFileAttributesA
• 0x47c2f8 GetDiskFreeSpaceA
• 0x47c2fc GetDateFormatA
• 0x47c300 GetCurrentThreadId
• 0x47c304 GetCurrentProcessId
• 0x47c308 GetCurrentProcess
• 0x47c30c GetComputerNameA
• 0x47c310 GetCPInfo
• 0x47c314 GetACP
• 0x47c318 FreeResource
• 0x47c31c InterlockedExchange
• 0x47c320 FreeLibrary
• 0x47c324 FormatMessageA
• 0x47c328 FindResourceA
• 0x47c32c FindFirstFileA
• 0x47c330 FindClose
• 0x47c33c EnumCalendarInfoA
• 0x47c348 CreateThread
• 0x47c34c CreateFileA
• 0x47c350 CreateEventA
• 0x47c354 CompareStringA
• 0x47c358 CloseHandle
Library version.dll:
• 0x47c360 VerQueryValueA
• 0x47c368 GetFileVersionInfoA
Library gdi32.dll:
• 0x47c370 UnrealizeObject
• 0x47c374 StretchBlt
• 0x47c378 SetWindowOrgEx
• 0x47c37c SetWinMetaFileBits
• 0x47c380 SetViewportOrgEx
• 0x47c384 SetTextColor
• 0x47c388 SetStretchBltMode
• 0x47c38c SetROP2
• 0x47c390 SetPixel
• 0x47c394 SetMapMode
• 0x47c398 SetEnhMetaFileBits
• 0x47c39c SetDIBColorTable
• 0x47c3a0 SetBrushOrgEx
• 0x47c3a4 SetBkMode
• 0x47c3a8 SetBkColor
• 0x47c3ac SetArcDirection
• 0x47c3b0 SelectPalette
• 0x47c3b4 SelectObject
• 0x47c3b8 SelectClipRgn
• 0x47c3bc SaveDC
• 0x47c3c0 RestoreDC
• 0x47c3c4 Rectangle
• 0x47c3c8 RectVisible
• 0x47c3cc RealizePalette
• 0x47c3d0 Polyline
• 0x47c3d4 PlayEnhMetaFile
• 0x47c3d8 PatBlt
• 0x47c3dc MoveToEx
• 0x47c3e0 MaskBlt
• 0x47c3e4 LineTo
• 0x47c3e8 LPtoDP
• 0x47c3ec IntersectClipRect
• 0x47c3f0 GetWindowOrgEx
• 0x47c3f4 GetWinMetaFileBits
• 0x47c3f8 GetTextMetricsA
• 0x47c404 GetStockObject
• 0x47c408 GetPixel
• 0x47c40c GetPaletteEntries
• 0x47c410 GetObjectA
• 0x47c420 GetEnhMetaFileBits
• 0x47c424 GetDeviceCaps
• 0x47c428 GetDIBits
• 0x47c42c GetDIBColorTable
• 0x47c430 GetDCOrgEx
• 0x47c438 GetClipRgn
• 0x47c43c GetClipBox
• 0x47c440 GetBrushOrgEx
• 0x47c444 GetBitmapBits
• 0x47c448 ExcludeClipRect
• 0x47c44c DeleteObject
• 0x47c450 DeleteEnhMetaFile
• 0x47c454 DeleteDC
• 0x47c458 CreateSolidBrush
• 0x47c45c CreateRectRgn
• 0x47c460 CreatePenIndirect
• 0x47c464 CreatePen
• 0x47c468 CreatePalette
• 0x47c470 CreateFontIndirectA
• 0x47c474 CreateEnhMetaFileA
• 0x47c478 CreateDIBitmap
• 0x47c47c CreateDIBSection
• 0x47c480 CreateCompatibleDC
• 0x47c488 CreateBrushIndirect
• 0x47c48c CreateBitmap
• 0x47c490 CopyEnhMetaFileA
• 0x47c494 CloseEnhMetaFile
• 0x47c498 BitBlt
Library user32.dll:
• 0x47c4a0 CreateWindowExA
• 0x47c4a4 WindowFromPoint
• 0x47c4a8 WinHelpA
• 0x47c4ac WaitMessage
• 0x47c4b0 ValidateRect
• 0x47c4b4 UpdateWindow
• 0x47c4b8 UnregisterClassA
• 0x47c4bc UnhookWindowsHookEx
• 0x47c4c0 TranslateMessage
• 0x47c4c8 TrackPopupMenu
• 0x47c4d0 ShowWindow
• 0x47c4d4 ShowScrollBar
• 0x47c4d8 ShowOwnedPopups
• 0x47c4dc ShowCursor
• 0x47c4e0 SetWindowsHookExA
• 0x47c4e4 SetWindowPos
• 0x47c4e8 SetWindowPlacement
• 0x47c4ec SetWindowLongA
• 0x47c4f0 SetTimer
• 0x47c4f4 SetScrollRange
• 0x47c4f8 SetScrollPos
• 0x47c4fc SetScrollInfo
• 0x47c500 SetRect
• 0x47c504 SetPropA
• 0x47c508 SetParent
• 0x47c50c SetMenuItemInfoA
• 0x47c510 SetMenu
• 0x47c514 SetForegroundWindow
• 0x47c518 SetFocus
• 0x47c51c SetCursor
• 0x47c520 SetClassLongA
• 0x47c524 SetCapture
• 0x47c528 SetActiveWindow
• 0x47c52c SendMessageA
• 0x47c530 ScrollWindow
• 0x47c534 ScreenToClient
• 0x47c538 RemovePropA
• 0x47c53c RemoveMenu
• 0x47c540 ReleaseDC
• 0x47c544 ReleaseCapture
• 0x47c550 RegisterClassA
• 0x47c554 RedrawWindow
• 0x47c558 PtInRect
• 0x47c55c PostQuitMessage
• 0x47c560 PostMessageA
• 0x47c564 PeekMessageA
• 0x47c568 OffsetRect
• 0x47c56c OemToCharA
• 0x47c570 MessageBoxA
• 0x47c574 MapWindowPoints
• 0x47c578 MapVirtualKeyA
• 0x47c57c LoadStringA
• 0x47c580 LoadKeyboardLayoutA
• 0x47c584 LoadIconA
• 0x47c588 LoadCursorA
• 0x47c58c LoadBitmapA
• 0x47c590 KillTimer
• 0x47c594 IsZoomed
• 0x47c598 IsWindowVisible
• 0x47c59c IsWindowEnabled
• 0x47c5a0 IsWindow
• 0x47c5a4 IsRectEmpty
• 0x47c5a8 IsIconic
• 0x47c5ac IsDialogMessageA
• 0x47c5b0 IsChild
• 0x47c5b4 InvalidateRect
• 0x47c5b8 IntersectRect
• 0x47c5bc InsertMenuItemA
• 0x47c5c0 InsertMenuA
• 0x47c5c4 InflateRect
• 0x47c5cc GetWindowTextA
• 0x47c5d0 GetWindowRect
• 0x47c5d4 GetWindowPlacement
• 0x47c5d8 GetWindowLongA
• 0x47c5dc GetWindowDC
• 0x47c5e0 GetTopWindow
• 0x47c5e4 GetSystemMetrics
• 0x47c5e8 GetSystemMenu
• 0x47c5ec GetSysColorBrush
• 0x47c5f0 GetSysColor
• 0x47c5f4 GetSubMenu
• 0x47c5f8 GetScrollRange
• 0x47c5fc GetScrollPos
• 0x47c600 GetScrollInfo
• 0x47c604 GetPropA
• 0x47c608 GetParent
• 0x47c60c GetWindow
• 0x47c610 GetMessageTime
• 0x47c614 GetMenuStringA
• 0x47c618 GetMenuState
• 0x47c61c GetMenuItemInfoA
• 0x47c620 GetMenuItemID
• 0x47c624 GetMenuItemCount
• 0x47c628 GetMenu
• 0x47c62c GetLastActivePopup
• 0x47c630 GetKeyboardState
• 0x47c638 GetKeyboardLayout
• 0x47c63c GetKeyState
• 0x47c640 GetKeyNameTextA
• 0x47c644 GetIconInfo
• 0x47c648 GetForegroundWindow
• 0x47c64c GetFocus
• 0x47c650 GetDlgItem
• 0x47c654 GetDesktopWindow
• 0x47c658 GetDCEx
• 0x47c65c GetDC
• 0x47c660 GetCursorPos
• 0x47c664 GetCursor
• 0x47c668 GetClipboardData
• 0x47c66c GetClientRect
• 0x47c670 GetClassNameA
• 0x47c674 GetClassInfoA
• 0x47c678 GetCapture
• 0x47c67c GetActiveWindow
• 0x47c680 FrameRect
• 0x47c684 FindWindowA
• 0x47c688 FillRect
• 0x47c68c EqualRect
• 0x47c690 EnumWindows
• 0x47c694 EnumThreadWindows
• 0x47c698 EndPaint
• 0x47c69c EnableWindow
• 0x47c6a0 EnableScrollBar
• 0x47c6a4 EnableMenuItem
• 0x47c6a8 DrawTextA
• 0x47c6ac DrawMenuBar
• 0x47c6b0 DrawIconEx
• 0x47c6b4 DrawIcon
• 0x47c6b8 DrawFrameControl
• 0x47c6bc DrawFocusRect
• 0x47c6c0 DrawEdge
• 0x47c6c4 DispatchMessageA
• 0x47c6c8 DestroyWindow
• 0x47c6cc DestroyMenu
• 0x47c6d0 DestroyIcon
• 0x47c6d4 DestroyCursor
• 0x47c6d8 DeleteMenu
• 0x47c6dc DefWindowProcA
• 0x47c6e0 DefMDIChildProcA
• 0x47c6e4 DefFrameProcA
• 0x47c6e8 CreatePopupMenu
• 0x47c6ec CreateMenu
• 0x47c6f0 CreateIcon
• 0x47c6f4 ClientToScreen
• 0x47c6f8 CheckMenuItem
• 0x47c6fc CallWindowProcA
• 0x47c700 CallNextHookEx
• 0x47c704 BeginPaint
• 0x47c708 CharNextA
• 0x47c70c CharLowerBuffA
• 0x47c710 CharLowerA
• 0x47c714 CharToOemA
• 0x47c718 AdjustWindowRectEx
Library kernel32.dll:
• 0x47c724 Sleep
Library oleaut32.dll:
• 0x47c72c SafeArrayPtrOfIndex
• 0x47c730 SafeArrayGetUBound
• 0x47c734 SafeArrayGetLBound
• 0x47c738 SafeArrayCreate
• 0x47c73c VariantChangeType
• 0x47c740 VariantCopy
• 0x47c744 VariantClear
• 0x47c748 VariantInit
Library ole32.dll:
• 0x47c754 IsAccelerator
• 0x47c758 OleDraw
• 0x47c760 CoTaskMemFree
• 0x47c764 ProgIDFromCLSID
• 0x47c768 StringFromCLSID
• 0x47c76c CoCreateInstance
• 0x47c770 CoGetClassObject
• 0x47c774 CoUninitialize
• 0x47c778 CoInitialize
• 0x47c77c IsEqualGUID
Library oleaut32.dll:
• 0x47c784 GetErrorInfo
• 0x47c788 GetActiveObject
• 0x47c78c SysFreeString
Library comctl32.dll:
• 0x47c79c ImageList_Write
• 0x47c7a0 ImageList_Read
• 0x47c7b0 ImageList_DragMove
• 0x47c7b4 ImageList_DragLeave
• 0x47c7b8 ImageList_DragEnter
• 0x47c7bc ImageList_EndDrag
• 0x47c7c0 ImageList_BeginDrag
• 0x47c7c4 ImageList_Remove
• 0x47c7c8 ImageList_DrawEx
• 0x47c7cc ImageList_Replace
• 0x47c7d0 ImageList_Draw
• 0x47c7e0 ImageList_Add
• 0x47c7e8 ImageList_Destroy
• 0x47c7ec ImageList_Create
• 0x47c7f0 InitCommonControls
Library comdlg32.dll:
• 0x47c7f8 GetSaveFileNameA
• 0x47c7fc GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.