5.8
高危
56 个模型检测该样本为恶意！
重新分析
更多

268016b6a5ef2e4488d899815b0d2b24c95a99e4b4fed5c946a4e1d947f5c26d

d8d8f55b1084a0f7d585f2a79e4dc51c.exe

分析耗时

25s

最近分析

文件大小

738.0KB
静态报毒 动态报毒 AGENTTESLA AI SCORE=100 AIDETECTVM AUTOIT CLOUD CONFIDENCE DATASTEALER DELF DELPHILESS EHRJI EMTN EMUK FAREIT GDRPD@0 GENERICIH GENERICKD GENOME HIGH CONFIDENCE HPCZGG KRYPTIK LOKIBOT MALWARE2 NANOCORE PHYA QVM05 S15398965 SUSGEN SUSPICIOUS PE TSCOPE UGW@AE UNSAFE USXVPGT20 WACATAC X2091 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FPQ!D8D8F55B1084 20200818 6.0.6.653
Alibaba Trojan:Win32/DataStealer.57d6023d 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20200818 18.4.3895.0
Tencent 20200818 1.0.0.1
Kingsoft 20200818 2013.8.14.323
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619969112.324875
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75177f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75174de3
d8d8f55b1084a0f7d585f2a79e4dc51c+0x58a4d @ 0x458a4d
d8d8f55b1084a0f7d585f2a79e4dc51c+0x51254 @ 0x451254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfda814ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619969110.37175
NtAllocateVirtualMemory
process_identifier: 2760
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00590000
success 0 0
1619969110.54375
NtAllocateVirtualMemory
process_identifier: 2760
region_size: 77824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x005c0000
success 0 0
1619969110.55975
NtAllocateVirtualMemory
process_identifier: 2760
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x005f0000
success 0 0
1619969111.449875
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619969111.496875
NtAllocateVirtualMemory
process_identifier: 520
region_size: 1572864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01d90000
success 0 0
1619969111.496875
NtAllocateVirtualMemory
process_identifier: 520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01ed0000
success 0 0
1619969111.496875
NtAllocateVirtualMemory
process_identifier: 520
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01d90000
success 0 0
1619969111.496875
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 299008
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01d92000
success 0 0
1619969111.809875
NtAllocateVirtualMemory
process_identifier: 520
region_size: 1376256
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02010000
success 0 0
1619969111.809875
NtAllocateVirtualMemory
process_identifier: 520
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02120000
success 0 0
1619969112.309875
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00522000
success 0 0
1619969112.309875
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619969112.309875
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00522000
success 0 0
1619969112.309875
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619969112.309875
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00522000
success 0 0
1619969112.309875
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619969112.309875
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00522000
success 0 0
1619969112.309875
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619969112.309875
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00522000
success 0 0
1619969112.309875
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619969112.309875
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00522000
success 0 0
1619969112.309875
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619969112.309875
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00522000
success 0 0
1619969112.309875
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619969112.309875
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00522000
success 0 0
1619969112.309875
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619969112.309875
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00522000
success 0 0
1619969112.309875
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619969112.309875
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00522000
success 0 0
1619969112.309875
NtProtectVirtualMemory
process_identifier: 520
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.566608736948468 section {'size_of_data': '0x0003e200', 'virtual_address': '0x00080000', 'entropy': 7.566608736948468, 'name': '.rsrc', 'virtual_size': '0x0003e01c'} description A section with a high entropy has been found
entropy 0.33717774762550884 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2760 called NtSetContextThread to modify thread in remote process 520
Time & API Arguments Status Return Repeated
1619969110.68475
NtSetContextThread
thread_handle: 0x000000f8
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4893216
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 520
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2760 resumed a thread in remote process 520
Time & API Arguments Status Return Repeated
1619969111.27775
NtResumeThread
thread_handle: 0x000000f8
suspend_count: 1
process_identifier: 520
success 0 0
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619969110.63775
CreateProcessInternalW
thread_identifier: 2364
thread_handle: 0x000000f8
process_identifier: 520
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\d8d8f55b1084a0f7d585f2a79e4dc51c.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619969110.63775
NtUnmapViewOfSection
process_identifier: 520
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1619969110.65275
NtMapViewOfSection
section_handle: 0x00000104
process_identifier: 520
commit_size: 704512
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 704512
base_address: 0x00400000
success 0 0
1619969110.68475
NtGetContextThread
thread_handle: 0x000000f8
success 0 0
1619969110.68475
NtSetContextThread
thread_handle: 0x000000f8
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4893216
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 520
success 0 0
1619969111.27775
NtResumeThread
thread_handle: 0x000000f8
suspend_count: 1
process_identifier: 520
success 0 0
File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.43560895
FireEye Generic.mg.d8d8f55b1084a0f7
CAT-QuickHeal Trojan.GenericIH.S15398965
McAfee Fareit-FPQ!D8D8F55B1084
Malwarebytes Spyware.LokiBot
Zillya Trojan.Injector.Win32.754865
K7AntiVirus Trojan ( 0056b6131 )
Alibaba Trojan:Win32/DataStealer.57d6023d
K7GW Trojan ( 0056b6131 )
CrowdStrike win/malicious_confidence_90% (W)
Invincea heuristic
F-Prot W32/Injector.JGW
Symantec Trojan.Gen.MBT
APEX Malicious
Paloalto generic.ml
ClamAV Win.Dropper.Nanocore-9235748-0
GData Trojan.GenericKD.43560895
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
BitDefender Trojan.GenericKD.43560895
NANO-Antivirus Trojan.Win32.Kryptik.hpczgg
ViRobot Trojan.Win32.Z.Pws.755712
Avast Win32:Trojan-gen
Ad-Aware Trojan.GenericKD.43560895
Emsisoft Trojan.GenericKD.43560895 (B)
Comodo TrojWare.Win32.Genome.gdrpd@0
DrWeb Trojan.PWS.Stealer.19347
VIPRE Trojan.Win32.Generic!BT
TrendMicro Trojan.Win32.WACATAC.USXVPGT20
Sophos Mal/Generic-S
Ikarus Trojan-Dropper.Win32.Autoit
Cyren W32/Injector.PHYA-6947
Jiangmin Trojan.Kryptik.byu
Antiy-AVL Trojan/Win32.Kryptik
Arcabit Trojan.Generic.D298AFBF
AegisLab Trojan.Multi.Generic.4!c
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
Microsoft Trojan:Win32/DataStealer.VD!MTB
AhnLab-V3 Suspicious/Win.Delphiless.X2091
Acronis suspicious
BitDefenderTheta Gen:NN.ZelphiF.34152.UGW@ae!Ehrji
ALYac Spyware.AgentTesla
MAX malware (ai score=100)
VBA32 TScope.Trojan.Delf
Cylance Unsafe
Zoner Trojan.Win32.91606
ESET-NOD32 a variant of Win32/Injector.EMUK
TrendMicro-HouseCall Trojan.Win32.WACATAC.USXVPGT20
Rising Trojan.Injector!1.C99D (CLOUD)
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x47413c VirtualFree
• 0x474140 VirtualAlloc
• 0x474144 LocalFree
• 0x474148 LocalAlloc
• 0x47414c GetVersion
• 0x474150 GetCurrentThreadId
• 0x47415c VirtualQuery
• 0x474160 WideCharToMultiByte
• 0x474164 MultiByteToWideChar
• 0x474168 lstrlenA
• 0x47416c lstrcpynA
• 0x474170 LoadLibraryExA
• 0x474174 GetThreadLocale
• 0x474178 GetStartupInfoA
• 0x47417c GetProcAddress
• 0x474180 GetModuleHandleA
• 0x474184 GetModuleFileNameA
• 0x474188 GetLocaleInfoA
• 0x47418c GetCommandLineA
• 0x474190 FreeLibrary
• 0x474194 FindFirstFileA
• 0x474198 FindClose
• 0x47419c ExitProcess
• 0x4741a0 WriteFile
• 0x4741a8 RtlUnwind
• 0x4741ac RaiseException
• 0x4741b0 GetStdHandle
Library user32.dll:
• 0x4741b8 GetKeyboardType
• 0x4741bc LoadStringA
• 0x4741c0 MessageBoxA
• 0x4741c4 CharNextA
Library advapi32.dll:
• 0x4741cc RegQueryValueExA
• 0x4741d0 RegOpenKeyExA
• 0x4741d4 RegCloseKey
Library oleaut32.dll:
• 0x4741dc SysFreeString
• 0x4741e0 SysReAllocStringLen
• 0x4741e4 SysAllocStringLen
Library kernel32.dll:
• 0x4741ec TlsSetValue
• 0x4741f0 TlsGetValue
• 0x4741f4 LocalAlloc
• 0x4741f8 GetModuleHandleA
Library advapi32.dll:
• 0x474200 RegQueryValueExA
• 0x474204 RegOpenKeyExA
• 0x474208 RegCloseKey
Library kernel32.dll:
• 0x474210 lstrcpyA
• 0x474214 WriteFile
• 0x474218 WaitForSingleObject
• 0x47421c VirtualQuery
• 0x474220 VirtualAlloc
• 0x474224 Sleep
• 0x474228 SizeofResource
• 0x47422c SetThreadLocale
• 0x474230 SetFilePointer
• 0x474234 SetEvent
• 0x474238 SetErrorMode
• 0x47423c SetEndOfFile
• 0x474240 ResetEvent
• 0x474244 ReadFile
• 0x474248 MulDiv
• 0x47424c LockResource
• 0x474250 LoadResource
• 0x474254 LoadLibraryA
• 0x474260 GlobalUnlock
• 0x474264 GlobalReAlloc
• 0x474268 GlobalHandle
• 0x47426c GlobalLock
• 0x474270 GlobalFree
• 0x474274 GlobalFindAtomA
• 0x474278 GlobalDeleteAtom
• 0x47427c GlobalAlloc
• 0x474280 GlobalAddAtomA
• 0x474284 GetVersionExA
• 0x474288 GetVersion
• 0x47428c GetTickCount
• 0x474290 GetThreadLocale
• 0x474294 GetSystemInfo
• 0x474298 GetStringTypeExA
• 0x47429c GetStdHandle
• 0x4742a0 GetProcAddress
• 0x4742a4 GetModuleHandleA
• 0x4742a8 GetModuleFileNameA
• 0x4742ac GetLocaleInfoA
• 0x4742b0 GetLocalTime
• 0x4742b4 GetLastError
• 0x4742b8 GetFullPathNameA
• 0x4742bc GetDiskFreeSpaceA
• 0x4742c0 GetDateFormatA
• 0x4742c4 GetCurrentThreadId
• 0x4742c8 GetCurrentProcessId
• 0x4742cc GetCPInfo
• 0x4742d0 GetACP
• 0x4742d4 FreeResource
• 0x4742d8 InterlockedExchange
• 0x4742dc FreeLibrary
• 0x4742e0 FormatMessageA
• 0x4742e4 FindResourceA
• 0x4742e8 EnumCalendarInfoA
• 0x4742f4 CreateThread
• 0x4742f8 CreateFileA
• 0x4742fc CreateEventA
• 0x474300 CompareStringA
• 0x474304 CloseHandle
Library version.dll:
• 0x47430c VerQueryValueA
• 0x474314 GetFileVersionInfoA
Library gdi32.dll:
• 0x47431c UnrealizeObject
• 0x474320 StretchBlt
• 0x474324 SetWindowOrgEx
• 0x474328 SetViewportOrgEx
• 0x47432c SetTextColor
• 0x474330 SetStretchBltMode
• 0x474334 SetROP2
• 0x474338 SetPixel
• 0x47433c SetDIBColorTable
• 0x474340 SetBrushOrgEx
• 0x474344 SetBkMode
• 0x474348 SetBkColor
• 0x47434c SelectPalette
• 0x474350 SelectObject
• 0x474354 SaveDC
• 0x474358 RestoreDC
• 0x47435c Rectangle
• 0x474360 RectVisible
• 0x474364 RealizePalette
• 0x474368 PtVisible
• 0x47436c PatBlt
• 0x474370 MoveToEx
• 0x474374 MaskBlt
• 0x474378 LineTo
• 0x47437c IntersectClipRect
• 0x474380 GetWindowOrgEx
• 0x474384 GetTextMetricsA
• 0x474390 GetStockObject
• 0x474394 GetPixel
• 0x474398 GetPaletteEntries
• 0x47439c GetObjectA
• 0x4743a0 GetDeviceCaps
• 0x4743a4 GetDIBits
• 0x4743a8 GetDIBColorTable
• 0x4743ac GetDCOrgEx
• 0x4743b4 GetClipBox
• 0x4743b8 GetBrushOrgEx
• 0x4743bc GetBitmapBits
• 0x4743c0 ExcludeClipRect
• 0x4743c4 DeleteObject
• 0x4743c8 DeleteDC
• 0x4743cc CreateSolidBrush
• 0x4743d0 CreatePenIndirect
• 0x4743d4 CreatePen
• 0x4743d8 CreatePalette
• 0x4743e0 CreateFontIndirectA
• 0x4743e4 CreateDIBitmap
• 0x4743e8 CreateDIBSection
• 0x4743ec CreateCompatibleDC
• 0x4743f4 CreateBrushIndirect
• 0x4743f8 CreateBitmap
• 0x4743fc BitBlt
Library user32.dll:
• 0x474404 CreateWindowExA
• 0x474408 WindowFromPoint
• 0x47440c WinHelpA
• 0x474410 WaitMessage
• 0x474414 ValidateRect
• 0x474418 UpdateWindow
• 0x47441c UnregisterClassA
• 0x474420 UnhookWindowsHookEx
• 0x474424 TranslateMessage
• 0x47442c TrackPopupMenu
• 0x474434 ShowWindow
• 0x474438 ShowScrollBar
• 0x47443c ShowOwnedPopups
• 0x474440 ShowCursor
• 0x474444 SetWindowsHookExA
• 0x474448 SetWindowTextA
• 0x47444c SetWindowPos
• 0x474450 SetWindowPlacement
• 0x474454 SetWindowLongA
• 0x474458 SetTimer
• 0x47445c SetScrollRange
• 0x474460 SetScrollPos
• 0x474464 SetScrollInfo
• 0x474468 SetRect
• 0x47446c SetPropA
• 0x474470 SetParent
• 0x474474 SetMenuItemInfoA
• 0x474478 SetMenu
• 0x47447c SetForegroundWindow
• 0x474480 SetFocus
• 0x474484 SetCursor
• 0x474488 SetClassLongA
• 0x47448c SetCapture
• 0x474490 SetActiveWindow
• 0x474494 SendMessageA
• 0x474498 ScrollWindow
• 0x47449c ScreenToClient
• 0x4744a0 RemovePropA
• 0x4744a4 RemoveMenu
• 0x4744a8 ReleaseDC
• 0x4744ac ReleaseCapture
• 0x4744b8 RegisterClassA
• 0x4744bc RedrawWindow
• 0x4744c0 PtInRect
• 0x4744c4 PostQuitMessage
• 0x4744c8 PostMessageA
• 0x4744cc PeekMessageA
• 0x4744d0 OffsetRect
• 0x4744d4 OemToCharA
• 0x4744d8 MessageBoxA
• 0x4744dc MessageBeep
• 0x4744e0 MapWindowPoints
• 0x4744e4 MapVirtualKeyA
• 0x4744e8 LoadStringA
• 0x4744ec LoadKeyboardLayoutA
• 0x4744f0 LoadIconA
• 0x4744f4 LoadCursorA
• 0x4744f8 LoadBitmapA
• 0x4744fc KillTimer
• 0x474500 IsZoomed
• 0x474504 IsWindowVisible
• 0x474508 IsWindowEnabled
• 0x47450c IsWindow
• 0x474510 IsRectEmpty
• 0x474514 IsIconic
• 0x474518 IsDialogMessageA
• 0x47451c IsChild
• 0x474520 InvalidateRect
• 0x474524 IntersectRect
• 0x474528 InsertMenuItemA
• 0x47452c InsertMenuA
• 0x474530 InflateRect
• 0x474538 GetWindowTextA
• 0x47453c GetWindowRect
• 0x474540 GetWindowPlacement
• 0x474544 GetWindowLongA
• 0x474548 GetWindowDC
• 0x47454c GetTopWindow
• 0x474550 GetSystemMetrics
• 0x474554 GetSystemMenu
• 0x474558 GetSysColorBrush
• 0x47455c GetSysColor
• 0x474560 GetSubMenu
• 0x474564 GetScrollRange
• 0x474568 GetScrollPos
• 0x47456c GetScrollInfo
• 0x474570 GetPropA
• 0x474574 GetParent
• 0x474578 GetWindow
• 0x47457c GetMenuStringA
• 0x474580 GetMenuState
• 0x474584 GetMenuItemInfoA
• 0x474588 GetMenuItemID
• 0x47458c GetMenuItemCount
• 0x474590 GetMenu
• 0x474594 GetLastActivePopup
• 0x474598 GetKeyboardState
• 0x4745a0 GetKeyboardLayout
• 0x4745a4 GetKeyState
• 0x4745a8 GetKeyNameTextA
• 0x4745ac GetIconInfo
• 0x4745b0 GetForegroundWindow
• 0x4745b4 GetFocus
• 0x4745b8 GetDlgItem
• 0x4745bc GetDesktopWindow
• 0x4745c0 GetDCEx
• 0x4745c4 GetDC
• 0x4745c8 GetCursorPos
• 0x4745cc GetCursor
• 0x4745d0 GetClientRect
• 0x4745d4 GetClassNameA
• 0x4745d8 GetClassInfoA
• 0x4745dc GetCapture
• 0x4745e0 GetActiveWindow
• 0x4745e4 FrameRect
• 0x4745e8 FindWindowA
• 0x4745ec FillRect
• 0x4745f0 EqualRect
• 0x4745f4 EnumWindows
• 0x4745f8 EnumThreadWindows
• 0x4745fc EndPaint
• 0x474600 EnableWindow
• 0x474604 EnableScrollBar
• 0x474608 EnableMenuItem
• 0x47460c DrawTextA
• 0x474610 DrawMenuBar
• 0x474614 DrawIconEx
• 0x474618 DrawIcon
• 0x47461c DrawFrameControl
• 0x474620 DrawFocusRect
• 0x474624 DrawEdge
• 0x474628 DispatchMessageA
• 0x47462c DestroyWindow
• 0x474630 DestroyMenu
• 0x474634 DestroyIcon
• 0x474638 DestroyCursor
• 0x47463c DeleteMenu
• 0x474640 DefWindowProcA
• 0x474644 DefMDIChildProcA
• 0x474648 DefFrameProcA
• 0x47464c CreatePopupMenu
• 0x474650 CreateMenu
• 0x474654 CreateIcon
• 0x474658 ClientToScreen
• 0x47465c CheckMenuItem
• 0x474660 CallWindowProcA
• 0x474664 CallNextHookEx
• 0x474668 BeginPaint
• 0x47466c CharNextA
• 0x474670 CharLowerA
• 0x474674 CharToOemA
• 0x474678 AdjustWindowRectEx
Library kernel32.dll:
• 0x474684 Sleep
Library oleaut32.dll:
• 0x47468c SafeArrayPtrOfIndex
• 0x474690 SafeArrayGetUBound
• 0x474694 SafeArrayGetLBound
• 0x474698 SafeArrayCreate
• 0x47469c VariantChangeType
• 0x4746a0 VariantCopy
• 0x4746a4 VariantClear
• 0x4746a8 VariantInit
Library comctl32.dll:
• 0x4746b8 ImageList_Write
• 0x4746bc ImageList_Read
• 0x4746cc ImageList_DragMove
• 0x4746d0 ImageList_DragLeave
• 0x4746d4 ImageList_DragEnter
• 0x4746d8 ImageList_EndDrag
• 0x4746dc ImageList_BeginDrag
• 0x4746e0 ImageList_Remove
• 0x4746e4 ImageList_DrawEx
• 0x4746e8 ImageList_Replace
• 0x4746ec ImageList_Draw
• 0x4746fc ImageList_Add
• 0x474704 ImageList_Destroy
• 0x474708 ImageList_Create
• 0x47470c InitCommonControls
Library comdlg32.dll:
• 0x474714 GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58370 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 62192 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.