6.2
高危
60 个模型检测该样本为恶意！
重新分析
更多

9704baea17754bbf1de8f944e4a1b0d0f2868c165acb6678e7253541c4c6af48

dd1e81ec7d66b2d139f29cea8ca92d11.exe

分析耗时

21s

最近分析

文件大小

693.0KB
静态报毒 动态报毒 0NA103FD20 AGEN AGENTTESLA AI SCORE=81 AIDETECT AVSARHER BTOMTW CLOUD COMET CONFIDENCE DELF DELPHILESS ELXR EMJE FAREIT FORMBOOK GENCIRC GENERICKDZ HESV HIGH CONFIDENCE HLBHCU HWUBINSA KRYPTIK MALWARE1 MALWARE@#3L8J7I2UIB6QJ OVLQ RGW@AQL9@DFI SAVE SCORE STATIC AI SUSGEN SUSPICIOUS PE TSCOPE UNSAFE X2066 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/Kryptik.dc8032bb 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20210301 21.1.5827.0
Tencent Malware.Win32.Gencirc.11b214d5 20210301 1.0.0.1
Kingsoft 20210301 2017.9.26.565
McAfee Fareit-FTB!DD1E81EC7D66 20210301 6.0.6.653
CrowdStrike win/malicious_confidence_60% (D) 20210203 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619953785.879626
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75177f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75174de3
dd1e81ec7d66b2d139f29cea8ca92d11+0x54a4d @ 0x454a4d
dd1e81ec7d66b2d139f29cea8ca92d11+0x4d254 @ 0x44d254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff4414ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619948411.692226
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008d0000
success 0 0
1619948411.848226
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 32768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01e80000
success 0 0
1619948411.848226
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01ea0000
success 0 0
1619953784.442626
NtProtectVirtualMemory
process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619953784.520626
NtAllocateVirtualMemory
process_identifier: 2264
region_size: 1769472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02050000
success 0 0
1619953784.520626
NtAllocateVirtualMemory
process_identifier: 2264
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x021c0000
success 0 0
1619953784.520626
NtAllocateVirtualMemory
process_identifier: 2264
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00500000
success 0 0
1619953784.520626
NtProtectVirtualMemory
process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 286720
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00502000
success 0 0
1619953784.989626
NtAllocateVirtualMemory
process_identifier: 2264
region_size: 1179648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01ef0000
success 0 0
1619953784.989626
NtAllocateVirtualMemory
process_identifier: 2264
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01fd0000
success 0 0
1619953785.817626
NtProtectVirtualMemory
process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ee2000
success 0 0
1619953785.817626
NtProtectVirtualMemory
process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619953785.817626
NtProtectVirtualMemory
process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ee2000
success 0 0
1619953785.817626
NtProtectVirtualMemory
process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619953785.817626
NtProtectVirtualMemory
process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ee2000
success 0 0
1619953785.817626
NtProtectVirtualMemory
process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619953785.817626
NtProtectVirtualMemory
process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ee2000
success 0 0
1619953785.817626
NtProtectVirtualMemory
process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619953785.817626
NtProtectVirtualMemory
process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ee2000
success 0 0
1619953785.817626
NtProtectVirtualMemory
process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619953785.832626
NtProtectVirtualMemory
process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ee2000
success 0 0
1619953785.832626
NtProtectVirtualMemory
process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619953785.832626
NtProtectVirtualMemory
process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ee2000
success 0 0
1619953785.832626
NtProtectVirtualMemory
process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619953785.832626
NtProtectVirtualMemory
process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ee2000
success 0 0
1619953785.832626
NtProtectVirtualMemory
process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619953785.832626
NtProtectVirtualMemory
process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ee2000
success 0 0
1619953785.832626
NtProtectVirtualMemory
process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619953785.832626
NtProtectVirtualMemory
process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ee2000
success 0 0
1619953785.832626
NtProtectVirtualMemory
process_identifier: 2264
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (3 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.738635251346068 section {'size_of_data': '0x00036600', 'virtual_address': '0x0007d000', 'entropy': 7.738635251346068, 'name': '.rsrc', 'virtual_size': '0x000365d8'} description A section with a high entropy has been found
entropy 0.3143063583815029 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 3040 called NtSetContextThread to modify thread in remote process 2264
Time & API Arguments Status Return Repeated
1619948412.348226
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4865328
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2264
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 3040 resumed a thread in remote process 2264
Time & API Arguments Status Return Repeated
1619948412.661226
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2264
success 0 0
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619948412.239226
CreateProcessInternalW
thread_identifier: 284
thread_handle: 0x000000fc
process_identifier: 2264
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\dd1e81ec7d66b2d139f29cea8ca92d11.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619948412.239226
NtUnmapViewOfSection
process_identifier: 2264
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619948412.254226
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 2264
commit_size: 675840
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 675840
base_address: 0x00400000
success 0 0
1619948412.348226
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1619948412.348226
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4865328
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2264
success 0 0
1619948412.661226
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2264
success 0 0
File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 个事件)
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKDZ.67855
ALYac Trojan.GenericKDZ.67855
Cylance Unsafe
Zillya Trojan.Injector.Win32.742052
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 00568adb1 )
Alibaba Trojan:Win32/Kryptik.dc8032bb
K7GW Trojan ( 00568adb1 )
Cybereason malicious.c7d66b
Arcabit Trojan.Generic.D1090F
BitDefenderTheta Gen:NN.ZelphiF.34590.RGW@aqL9@dfi
Cyren W32/Injector.OVLQ-4126
Symantec Trojan.Gen.2
APEX Malicious
Avast Win32:Trojan-gen
ClamAV Win.Malware.AgentTesla-8022099-1
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
BitDefender Trojan.GenericKDZ.67855
NANO-Antivirus Trojan.Win32.Comet.hlbhcu
Paloalto generic.ml
Tencent Malware.Win32.Gencirc.11b214d5
Ad-Aware Trojan.GenericKDZ.67855
Sophos Mal/Generic-S
Comodo Malware@#3l8j7i2uib6qj
F-Secure Heuristic.HEUR/AGEN.1137421
DrWeb BackDoor.Comet.3628
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_FRS.0NA103FD20
McAfee-GW-Edition BehavesLike.Win32.Fareit.jc
FireEye Generic.mg.dd1e81ec7d66b2d1
Emsisoft Trojan.GenericKDZ.67855 (B)
SentinelOne Static AI - Suspicious PE
Jiangmin Trojan.Hesv.gov
Avira HEUR/AGEN.1137421
MAX malware (ai score=81)
Antiy-AVL Trojan/Win32.Kryptik
Gridinsoft Trojan.Win32.Kryptik.oa
Microsoft Trojan:Win32/FormBook.CR!MTB
AegisLab Trojan.Win32.Kryptik.4!c
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
GData Trojan.GenericKDZ.67855
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2066
Acronis suspicious
McAfee Fareit-FTB!DD1E81EC7D66
VBA32 TScope.Trojan.Delf
Malwarebytes Trojan.MalPack.DLF
ESET-NOD32 a variant of Win32/Injector.EMJE
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x47013c VirtualFree
• 0x470140 VirtualAlloc
• 0x470144 LocalFree
• 0x470148 LocalAlloc
• 0x47014c GetVersion
• 0x470150 GetCurrentThreadId
• 0x47015c VirtualQuery
• 0x470160 WideCharToMultiByte
• 0x470164 MultiByteToWideChar
• 0x470168 lstrlenA
• 0x47016c lstrcpynA
• 0x470170 LoadLibraryExA
• 0x470174 GetThreadLocale
• 0x470178 GetStartupInfoA
• 0x47017c GetProcAddress
• 0x470180 GetModuleHandleA
• 0x470184 GetModuleFileNameA
• 0x470188 GetLocaleInfoA
• 0x47018c GetCommandLineA
• 0x470190 FreeLibrary
• 0x470194 FindFirstFileA
• 0x470198 FindClose
• 0x47019c ExitProcess
• 0x4701a0 WriteFile
• 0x4701a8 RtlUnwind
• 0x4701ac RaiseException
• 0x4701b0 GetStdHandle
Library user32.dll:
• 0x4701b8 GetKeyboardType
• 0x4701bc LoadStringA
• 0x4701c0 MessageBoxA
• 0x4701c4 CharNextA
Library advapi32.dll:
• 0x4701cc RegQueryValueExA
• 0x4701d0 RegOpenKeyExA
• 0x4701d4 RegCloseKey
Library oleaut32.dll:
• 0x4701dc SysFreeString
• 0x4701e0 SysReAllocStringLen
• 0x4701e4 SysAllocStringLen
Library kernel32.dll:
• 0x4701ec TlsSetValue
• 0x4701f0 TlsGetValue
• 0x4701f4 LocalAlloc
• 0x4701f8 GetModuleHandleA
Library advapi32.dll:
• 0x470200 RegQueryValueExA
• 0x470204 RegOpenKeyExA
• 0x470208 RegCloseKey
Library kernel32.dll:
• 0x470210 lstrcpyA
• 0x470214 WriteFile
• 0x47021c WaitForSingleObject
• 0x470220 VirtualQuery
• 0x470224 VirtualAlloc
• 0x470228 Sleep
• 0x47022c SizeofResource
• 0x470230 SetThreadLocale
• 0x470234 SetFilePointer
• 0x470238 SetEvent
• 0x47023c SetErrorMode
• 0x470240 SetEndOfFile
• 0x470244 ResetEvent
• 0x470248 ReadFile
• 0x47024c MulDiv
• 0x470250 LockResource
• 0x470254 LoadResource
• 0x470258 LoadLibraryA
• 0x470264 GlobalUnlock
• 0x470268 GlobalReAlloc
• 0x47026c GlobalHandle
• 0x470270 GlobalLock
• 0x470274 GlobalFree
• 0x470278 GlobalFindAtomA
• 0x47027c GlobalDeleteAtom
• 0x470280 GlobalAlloc
• 0x470284 GlobalAddAtomA
• 0x470288 GetVersionExA
• 0x47028c GetVersion
• 0x470294 GetTickCount
• 0x470298 GetThreadLocale
• 0x47029c GetTempPathA
• 0x4702a4 GetSystemTime
• 0x4702a8 GetSystemInfo
• 0x4702ac GetStringTypeExA
• 0x4702b0 GetStdHandle
• 0x4702b4 GetProcAddress
• 0x4702b8 GetModuleHandleA
• 0x4702bc GetModuleFileNameA
• 0x4702c0 GetLocaleInfoA
• 0x4702c4 GetLocalTime
• 0x4702c8 GetLastError
• 0x4702cc GetFullPathNameA
• 0x4702d0 GetFileSize
• 0x4702d4 GetFileAttributesA
• 0x4702d8 GetDiskFreeSpaceA
• 0x4702dc GetDateFormatA
• 0x4702e0 GetCurrentThreadId
• 0x4702e4 GetCurrentProcessId
• 0x4702e8 GetCPInfo
• 0x4702ec GetACP
• 0x4702f0 FreeResource
• 0x4702f4 InterlockedExchange
• 0x4702f8 FreeLibrary
• 0x4702fc FormatMessageA
• 0x470300 FindResourceA
• 0x470304 FindFirstFileA
• 0x470308 FindClose
• 0x470314 ExitThread
• 0x470318 EnumCalendarInfoA
• 0x470324 CreateThread
• 0x470328 CreateFileA
• 0x47032c CreateEventA
• 0x470330 CompareStringA
• 0x470334 CloseHandle
Library version.dll:
• 0x47033c VerQueryValueA
• 0x470344 GetFileVersionInfoA
Library gdi32.dll:
• 0x47034c UnrealizeObject
• 0x470350 StretchBlt
• 0x470354 SetWindowOrgEx
• 0x470358 SetWinMetaFileBits
• 0x47035c SetViewportOrgEx
• 0x470360 SetTextColor
• 0x470364 SetStretchBltMode
• 0x470368 SetROP2
• 0x47036c SetPixel
• 0x470370 SetEnhMetaFileBits
• 0x470374 SetDIBColorTable
• 0x470378 SetBrushOrgEx
• 0x47037c SetBkMode
• 0x470380 SetBkColor
• 0x470384 SelectPalette
• 0x470388 SelectObject
• 0x47038c SaveDC
• 0x470390 RestoreDC
• 0x470394 Rectangle
• 0x470398 RectVisible
• 0x47039c RealizePalette
• 0x4703a0 Polyline
• 0x4703a4 PlayEnhMetaFile
• 0x4703a8 PatBlt
• 0x4703ac MoveToEx
• 0x4703b0 MaskBlt
• 0x4703b4 LineTo
• 0x4703b8 IntersectClipRect
• 0x4703bc GetWindowOrgEx
• 0x4703c0 GetWinMetaFileBits
• 0x4703c4 GetTextMetricsA
• 0x4703d0 GetStockObject
• 0x4703d4 GetPixel
• 0x4703d8 GetPaletteEntries
• 0x4703dc GetObjectA
• 0x4703e8 GetEnhMetaFileBits
• 0x4703ec GetDeviceCaps
• 0x4703f0 GetDIBits
• 0x4703f4 GetDIBColorTable
• 0x4703f8 GetDCOrgEx
• 0x470400 GetClipBox
• 0x470404 GetBrushOrgEx
• 0x470408 GetBitmapBits
• 0x47040c ExcludeClipRect
• 0x470410 DeleteObject
• 0x470414 DeleteEnhMetaFile
• 0x470418 DeleteDC
• 0x47041c CreateSolidBrush
• 0x470420 CreatePenIndirect
• 0x470424 CreatePalette
• 0x47042c CreateFontIndirectA
• 0x470430 CreateDIBitmap
• 0x470434 CreateDIBSection
• 0x470438 CreateCompatibleDC
• 0x470440 CreateBrushIndirect
• 0x470444 CreateBitmap
• 0x470448 CopyEnhMetaFileA
• 0x47044c BitBlt
Library user32.dll:
• 0x470454 CreateWindowExA
• 0x470458 WindowFromPoint
• 0x47045c WinHelpA
• 0x470460 WaitMessage
• 0x470464 UpdateWindow
• 0x470468 UnregisterClassA
• 0x47046c UnhookWindowsHookEx
• 0x470470 TranslateMessage
• 0x470478 TrackPopupMenu
• 0x470480 ShowWindow
• 0x470484 ShowScrollBar
• 0x470488 ShowOwnedPopups
• 0x47048c ShowCursor
• 0x470490 SetWindowsHookExA
• 0x470494 SetWindowPos
• 0x470498 SetWindowPlacement
• 0x47049c SetWindowLongA
• 0x4704a0 SetTimer
• 0x4704a4 SetScrollRange
• 0x4704a8 SetScrollPos
• 0x4704ac SetScrollInfo
• 0x4704b0 SetRect
• 0x4704b4 SetPropA
• 0x4704b8 SetParent
• 0x4704bc SetMenuItemInfoA
• 0x4704c0 SetMenu
• 0x4704c4 SetForegroundWindow
• 0x4704c8 SetFocus
• 0x4704cc SetCursor
• 0x4704d0 SetClassLongA
• 0x4704d4 SetCapture
• 0x4704d8 SetActiveWindow
• 0x4704dc SendMessageA
• 0x4704e0 ScrollWindow
• 0x4704e4 ScreenToClient
• 0x4704e8 RemovePropA
• 0x4704ec RemoveMenu
• 0x4704f0 ReleaseDC
• 0x4704f4 ReleaseCapture
• 0x470500 RegisterClassA
• 0x470504 RedrawWindow
• 0x470508 PtInRect
• 0x47050c PostQuitMessage
• 0x470510 PostMessageA
• 0x470514 PeekMessageA
• 0x470518 OffsetRect
• 0x47051c OemToCharA
• 0x470520 MessageBoxA
• 0x470524 MapWindowPoints
• 0x470528 MapVirtualKeyA
• 0x47052c LoadStringA
• 0x470530 LoadKeyboardLayoutA
• 0x470534 LoadIconA
• 0x470538 LoadCursorA
• 0x47053c LoadBitmapA
• 0x470540 KillTimer
• 0x470544 IsZoomed
• 0x470548 IsWindowVisible
• 0x47054c IsWindowEnabled
• 0x470550 IsWindow
• 0x470554 IsRectEmpty
• 0x470558 IsIconic
• 0x47055c IsDialogMessageA
• 0x470560 IsChild
• 0x470564 InvalidateRect
• 0x470568 IntersectRect
• 0x47056c InsertMenuItemA
• 0x470570 InsertMenuA
• 0x470574 InflateRect
• 0x47057c GetWindowTextA
• 0x470580 GetWindowRect
• 0x470584 GetWindowPlacement
• 0x470588 GetWindowLongA
• 0x47058c GetWindowDC
• 0x470590 GetTopWindow
• 0x470594 GetSystemMetrics
• 0x470598 GetSystemMenu
• 0x47059c GetSysColorBrush
• 0x4705a0 GetSysColor
• 0x4705a4 GetSubMenu
• 0x4705a8 GetScrollRange
• 0x4705ac GetScrollPos
• 0x4705b0 GetScrollInfo
• 0x4705b4 GetPropA
• 0x4705b8 GetParent
• 0x4705bc GetWindow
• 0x4705c0 GetMenuStringA
• 0x4705c4 GetMenuState
• 0x4705c8 GetMenuItemInfoA
• 0x4705cc GetMenuItemID
• 0x4705d0 GetMenuItemCount
• 0x4705d4 GetMenu
• 0x4705d8 GetLastActivePopup
• 0x4705dc GetKeyboardState
• 0x4705e4 GetKeyboardLayout
• 0x4705e8 GetKeyState
• 0x4705ec GetKeyNameTextA
• 0x4705f0 GetIconInfo
• 0x4705f4 GetForegroundWindow
• 0x4705f8 GetFocus
• 0x4705fc GetDlgItem
• 0x470600 GetDesktopWindow
• 0x470604 GetDCEx
• 0x470608 GetDC
• 0x47060c GetCursorPos
• 0x470610 GetCursor
• 0x470614 GetClipboardData
• 0x470618 GetClientRect
• 0x47061c GetClassNameA
• 0x470620 GetClassInfoA
• 0x470624 GetCapture
• 0x470628 GetActiveWindow
• 0x47062c FrameRect
• 0x470630 FindWindowA
• 0x470634 FillRect
• 0x470638 EqualRect
• 0x47063c EnumWindows
• 0x470640 EnumThreadWindows
• 0x470644 EndPaint
• 0x470648 EnableWindow
• 0x47064c EnableScrollBar
• 0x470650 EnableMenuItem
• 0x470654 DrawTextA
• 0x470658 DrawMenuBar
• 0x47065c DrawIconEx
• 0x470660 DrawIcon
• 0x470664 DrawFrameControl
• 0x470668 DrawEdge
• 0x47066c DispatchMessageA
• 0x470670 DestroyWindow
• 0x470674 DestroyMenu
• 0x470678 DestroyIcon
• 0x47067c DestroyCursor
• 0x470680 DeleteMenu
• 0x470684 DefWindowProcA
• 0x470688 DefMDIChildProcA
• 0x47068c DefFrameProcA
• 0x470690 CreatePopupMenu
• 0x470694 CreateMenu
• 0x470698 CreateIcon
• 0x47069c ClientToScreen
• 0x4706a0 CheckMenuItem
• 0x4706a4 CallWindowProcA
• 0x4706a8 CallNextHookEx
• 0x4706ac BeginPaint
• 0x4706b0 CharNextA
• 0x4706b4 CharLowerBuffA
• 0x4706b8 CharLowerA
• 0x4706bc CharToOemA
• 0x4706c0 AdjustWindowRectEx
Library kernel32.dll:
• 0x4706cc Sleep
Library oleaut32.dll:
• 0x4706d4 SafeArrayPtrOfIndex
• 0x4706d8 SafeArrayGetUBound
• 0x4706dc SafeArrayGetLBound
• 0x4706e0 SafeArrayCreate
• 0x4706e4 VariantChangeType
• 0x4706e8 VariantCopy
• 0x4706ec VariantClear
• 0x4706f0 VariantInit
Library comctl32.dll:
• 0x470700 ImageList_Write
• 0x470704 ImageList_Read
• 0x470714 ImageList_DragMove
• 0x470718 ImageList_DragLeave
• 0x47071c ImageList_DragEnter
• 0x470720 ImageList_EndDrag
• 0x470724 ImageList_BeginDrag
• 0x470728 ImageList_Remove
• 0x47072c ImageList_DrawEx
• 0x470730 ImageList_Replace
• 0x470734 ImageList_Draw
• 0x470744 ImageList_Add
• 0x47074c ImageList_Destroy
• 0x470750 ImageList_Create
• 0x470754 InitCommonControls
Library comdlg32.dll:
• 0x47075c GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 62192 239.255.255.250 3702
192.168.56.101 65005 239.255.255.250 3702
192.168.56.101 65007 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.