10.2
0-day
55 个模型检测该样本为恶意！
重新分析
更多

89afc8556420dc6ce287d7911e2aed787479e26d9d91efe5840e30029a7335e3

e0456f03260e76413b012a81715de84a.exe

分析耗时

74s

最近分析

文件大小

1.0MB
静态报毒 动态报毒 100% AGEN AI SCORE=88 AIDETECTVM AUTO BTTWK3 CHW@ACF6MPII CIPQ CONFIDENCE DELF DELPHILESS ELFW ELHP FAREIT GENERICKDZ HICOFT HIGH CONFIDENCE IGENT KRYPTIK LOKI LOKIBOT MALICIOUS PE MALWARE1 MALWARE@#3NYYY2UJDT1M PUTTY R + MAL SCORE SIGGEN2 SMDF STATIC AI TSCOPE UNSAFE WACATAC X2059 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FRQ!E0456F03260E 20201229 6.0.6.653
Alibaba TrojanSpy:Win32/Lokibot.5117f530 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Kingsoft 20201229 2017.9.26.565
Tencent Win32.Backdoor.Fareit.Auto 20201229 1.0.0.1
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
Queries for the computername (3 个事件)
Time & API Arguments Status Return Repeated
1619952144.723625
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619952150.505625
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1619952155.755625
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Tries to locate where the browsers are installed (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619952143.114625
GlobalMemoryStatusEx
success 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619948410.600943
__exception__
stacktrace: 
e0456f03260e76413b012a81715de84a+0x72b62 @ 0x472b62
e0456f03260e76413b012a81715de84a+0x3f2f @ 0x403f2f
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1637912
registers.edi: 4664212
registers.eax: 0
registers.ebp: 1638204
registers.edx: 2130566132
registers.ebx: 0
registers.esi: 71
registers.ecx: 3237150720
exception.instruction_r: f7 f0 90 33 c0 5a 59 59 64 89 10 eb 16 e9 de 0f
exception.symbol: e0456f03260e76413b012a81715de84a+0x72908
exception.instruction: div eax
exception.module: e0456f03260e76413b012a81715de84a.exe
exception.exception_code: 0xc0000094
exception.offset: 469256
exception.address: 0x472908
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (3 个事件)
Time & API Arguments Status Return Repeated
1619948410.210943
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619948410.694943
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00610000
success 0 0
1619948410.710943
NtAllocateVirtualMemory
process_identifier: 2772
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f70000
success 0 0
Steals private information from local Internet browsers (19 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Web Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Web Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Web Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 个事件)
Moves the original executable to a new location (1 个事件)
Time & API Arguments Status Return Repeated
1619952155.723625
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\e0456f03260e76413b012a81715de84a.exe
newfilepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\6ED2B0\0019EA.exe
newfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\6ED2B0\0019EA.exe
flags: 1
oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\e0456f03260e76413b012a81715de84a.exe
success 1 0
Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)
Time & API Arguments Status Return Repeated
1619952150.427625
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Harvests credentials from local FTP client softwares (22 个事件)
file C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\FTPGetter\servers.xml
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\wcx_ftp.ini
file C:\Windows\wcx_ftp.ini
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\GHISLER\wcx_ftp.ini
file C:\Users\Administrator.Oskar-PC\wcx_ftp.ini
file C:\Windows\32BitFtp.ini
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Program Files (x86)\FileZilla\Filezilla.xml
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\filezilla.xml
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\recentservers.xml
registry HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry HKEY_CURRENT_USER\Software\Martin Prikryl
registry HKEY_LOCAL_MACHINE\Software\Martin Prikryl
Harvests information related to installed instant messenger clients (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\.purple\accounts.xml
Harvests credentials from local email clients (3 个事件)
registry HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird
registry HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2772 called NtSetContextThread to modify thread in remote process 2616
Time & API Arguments Status Return Repeated
1619948410.991943
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4274654
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2616
success 0 0
Putty Files, Registry Keys and/or Mutexes Detected
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2772 resumed a thread in remote process 2616
Time & API Arguments Status Return Repeated
1619948411.366943
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 2616
success 0 0
Executed a process and injected code into it, probably while unpacking (7 个事件)
Time & API Arguments Status Return Repeated
1619948410.944943
CreateProcessInternalW
thread_identifier: 2424
thread_handle: 0x00000108
process_identifier: 2616
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\e0456f03260e76413b012a81715de84a.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x0000010c
inherit_handles: 0
success 1 0
1619948410.944943
NtUnmapViewOfSection
process_identifier: 2616
region_size: 4096
process_handle: 0x0000010c
base_address: 0x00400000
success 0 0
1619948410.960943
NtMapViewOfSection
section_handle: 0x00000114
process_identifier: 2616
commit_size: 663552
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x0000010c
allocation_type: 0 ()
section_offset: 0
view_size: 663552
base_address: 0x00400000
success 0 0
1619948410.991943
NtGetContextThread
thread_handle: 0x00000108
success 0 0
1619948410.991943
NtSetContextThread
thread_handle: 0x00000108
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4274654
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2616
success 0 0
1619948411.366943
NtResumeThread
thread_handle: 0x00000108
suspend_count: 1
process_identifier: 2616
success 0 0
1619952143.630625
NtResumeThread
thread_handle: 0x00000110
suspend_count: 1
process_identifier: 2616
success 0 0
File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
DrWeb Trojan.PWS.Siggen2.46041
MicroWorld-eScan Trojan.GenericKDZ.65829
FireEye Generic.mg.e0456f03260e7641
McAfee Fareit-FRQ!E0456F03260E
Cylance Unsafe
Sangfor Malware
K7AntiVirus Riskware ( 0040eff71 )
Alibaba TrojanSpy:Win32/Lokibot.5117f530
K7GW Riskware ( 0040eff71 )
Cybereason malicious.3260e7
Arcabit Trojan.Generic.D10125
BitDefenderTheta Gen:NN.ZelphiF.34700.cHW@aCf6mPii
Cyren W32/Injector.CIPQ-8676
Symantec Trojan Horse
APEX Malicious
Paloalto generic.ml
ClamAV Win.Dropper.LokiBot-7647565-0
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
BitDefender Trojan.GenericKDZ.65829
NANO-Antivirus Trojan.Win32.Kryptik.hicoft
AegisLab Trojan.Win32.Kryptik.4!c
Ad-Aware Trojan.GenericKDZ.65829
Emsisoft Trojan.GenericKDZ.65829 (B)
Comodo Malware@#3nyyy2ujdt1m
F-Secure Heuristic.HEUR/AGEN.1111011
VIPRE Trojan.Win32.Generic!BT
TrendMicro TrojanSpy.Win32.LOKI.SMDF.hp
McAfee-GW-Edition BehavesLike.Win32.Trojan.th
Sophos Mal/Generic-R + Mal/Fareit-V
SentinelOne Static AI - Malicious PE
Jiangmin Trojan.Kryptik.ajz
Avira HEUR/AGEN.1111011
Antiy-AVL Trojan/Win32.Wacatac
Gridinsoft Trojan.Win32.Injector.ba!s1
Microsoft TrojanSpy:Win32/Lokibot!MTB
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
GData Trojan.GenericKDZ.65829
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2059
ALYac Trojan.Kryptik.gen
MAX malware (ai score=88)
VBA32 TScope.Trojan.Delf
Malwarebytes Trojan.MalPack.DLF
Zoner Trojan.Win32.88976
ESET-NOD32 a variant of Win32/Injector.ELHP
TrendMicro-HouseCall TrojanSpy.Win32.LOKI.SMDF.hp
Tencent Win32.Backdoor.Fareit.Auto
Yandex Trojan.Igent.bTtwk3.66
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-03-04 21:08:32

Imports

Library kernel32.dll:
• 0x48018c VirtualFree
• 0x480190 VirtualAlloc
• 0x480194 LocalFree
• 0x480198 LocalAlloc
• 0x48019c GetVersion
• 0x4801a0 GetCurrentThreadId
• 0x4801ac VirtualQuery
• 0x4801b0 WideCharToMultiByte
• 0x4801b8 MultiByteToWideChar
• 0x4801bc lstrlenA
• 0x4801c0 lstrcpynA
• 0x4801c4 LoadLibraryExA
• 0x4801c8 GetThreadLocale
• 0x4801cc GetStartupInfoA
• 0x4801d0 GetProcAddress
• 0x4801d4 GetModuleHandleA
• 0x4801d8 GetModuleFileNameA
• 0x4801dc GetLocaleInfoA
• 0x4801e0 GetLastError
• 0x4801e8 GetCommandLineA
• 0x4801ec FreeLibrary
• 0x4801f0 FindFirstFileA
• 0x4801f4 FindClose
• 0x4801f8 ExitProcess
• 0x4801fc WriteFile
• 0x480204 RtlUnwind
• 0x480208 RaiseException
• 0x48020c GetStdHandle
Library user32.dll:
• 0x480214 GetKeyboardType
• 0x480218 LoadStringA
• 0x48021c MessageBoxA
• 0x480220 CharNextA
Library advapi32.dll:
• 0x480228 RegQueryValueExA
• 0x48022c RegOpenKeyExA
• 0x480230 RegCloseKey
Library oleaut32.dll:
• 0x480238 SysFreeString
• 0x48023c SysReAllocStringLen
• 0x480240 SysAllocStringLen
Library kernel32.dll:
• 0x480248 TlsSetValue
• 0x48024c TlsGetValue
• 0x480250 LocalAlloc
• 0x480254 GetModuleHandleA
Library advapi32.dll:
• 0x48025c RegQueryValueExA
• 0x480260 RegOpenKeyExA
• 0x480264 RegCloseKey
Library kernel32.dll:
• 0x48026c lstrcpyA
• 0x480270 WriteFile
• 0x480274 WinExec
• 0x480278 WaitForSingleObject
• 0x48027c VirtualQuery
• 0x480280 VirtualFree
• 0x480284 VirtualAllocEx
• 0x480288 VirtualAlloc
• 0x48028c Sleep
• 0x480290 SizeofResource
• 0x480294 SetThreadLocale
• 0x480298 SetFilePointer
• 0x48029c SetEvent
• 0x4802a0 SetErrorMode
• 0x4802a4 SetEndOfFile
• 0x4802a8 ResetEvent
• 0x4802ac ReadFile
• 0x4802b0 MultiByteToWideChar
• 0x4802b4 MulDiv
• 0x4802b8 LockResource
• 0x4802bc LoadResource
• 0x4802c0 LoadLibraryA
• 0x4802cc GlobalUnlock
• 0x4802d0 GlobalSize
• 0x4802d4 GlobalReAlloc
• 0x4802d8 GlobalHandle
• 0x4802dc GlobalLock
• 0x4802e0 GlobalFree
• 0x4802e4 GlobalFindAtomA
• 0x4802e8 GlobalDeleteAtom
• 0x4802ec GlobalAlloc
• 0x4802f0 GlobalAddAtomA
• 0x4802f8 GetVersionExA
• 0x4802fc GetVersion
• 0x480300 GetUserDefaultLCID
• 0x480304 GetTickCount
• 0x480308 GetThreadLocale
• 0x48030c GetSystemInfo
• 0x480310 GetStringTypeExA
• 0x480314 GetStdHandle
• 0x480318 GetProcAddress
• 0x48031c GetModuleHandleA
• 0x480320 GetModuleFileNameA
• 0x480324 GetLogicalDrives
• 0x480328 GetLocaleInfoA
• 0x48032c GetLocalTime
• 0x480330 GetLastError
• 0x480334 GetFullPathNameA
• 0x480338 GetFileAttributesA
• 0x48033c GetDriveTypeA
• 0x480340 GetDiskFreeSpaceA
• 0x480344 GetDateFormatA
• 0x480348 GetCurrentThreadId
• 0x48034c GetCurrentProcessId
• 0x480350 GetCurrentProcess
• 0x480354 GetComputerNameA
• 0x480358 GetCPInfo
• 0x48035c GetACP
• 0x480360 FreeResource
• 0x480364 InterlockedExchange
• 0x480368 FreeLibrary
• 0x48036c FormatMessageA
• 0x480370 FindResourceA
• 0x480374 FindNextFileA
• 0x480378 FindFirstFileA
• 0x48037c FindClose
• 0x480388 EnumCalendarInfoA
• 0x480394 CreateThread
• 0x480398 CreateFileA
• 0x48039c CreateEventA
• 0x4803a0 CompareStringA
• 0x4803a4 CloseHandle
Library mpr.dll:
• 0x4803ac WNetGetConnectionA
Library version.dll:
• 0x4803b4 VerQueryValueA
• 0x4803bc GetFileVersionInfoA
Library gdi32.dll:
• 0x4803c4 UnrealizeObject
• 0x4803c8 StretchBlt
• 0x4803cc SetWindowOrgEx
• 0x4803d0 SetWinMetaFileBits
• 0x4803d4 SetViewportOrgEx
• 0x4803d8 SetTextColor
• 0x4803dc SetStretchBltMode
• 0x4803e0 SetROP2
• 0x4803e4 SetPixel
• 0x4803e8 SetMapMode
• 0x4803ec SetEnhMetaFileBits
• 0x4803f0 SetDIBColorTable
• 0x4803f4 SetBrushOrgEx
• 0x4803f8 SetBkMode
• 0x4803fc SetBkColor
• 0x480400 SelectPalette
• 0x480404 SelectObject
• 0x480408 SaveDC
• 0x48040c RestoreDC
• 0x480410 Rectangle
• 0x480414 RectVisible
• 0x480418 RealizePalette
• 0x48041c Polyline
• 0x480420 PlayEnhMetaFile
• 0x480424 PatBlt
• 0x480428 MoveToEx
• 0x48042c MaskBlt
• 0x480430 LineTo
• 0x480434 LPtoDP
• 0x480438 IntersectClipRect
• 0x48043c GetWindowOrgEx
• 0x480440 GetWinMetaFileBits
• 0x480444 GetTextMetricsA
• 0x480450 GetStockObject
• 0x480454 GetPixel
• 0x480458 GetPaletteEntries
• 0x48045c GetObjectA
• 0x48046c GetEnhMetaFileBits
• 0x480470 GetDeviceCaps
• 0x480474 GetDIBits
• 0x480478 GetDIBColorTable
• 0x48047c GetDCOrgEx
• 0x480484 GetClipBox
• 0x480488 GetBrushOrgEx
• 0x48048c GetBitmapBits
• 0x480490 ExtTextOutA
• 0x480494 ExcludeClipRect
• 0x480498 DeleteObject
• 0x48049c DeleteEnhMetaFile
• 0x4804a0 DeleteDC
• 0x4804a4 CreateSolidBrush
• 0x4804a8 CreatePenIndirect
• 0x4804ac CreatePalette
• 0x4804b4 CreateFontIndirectA
• 0x4804b8 CreateEnhMetaFileA
• 0x4804bc CreateDIBitmap
• 0x4804c0 CreateDIBSection
• 0x4804c4 CreateCompatibleDC
• 0x4804cc CreateBrushIndirect
• 0x4804d0 CreateBitmap
• 0x4804d4 CopyEnhMetaFileA
• 0x4804d8 CloseEnhMetaFile
• 0x4804dc BitBlt
Library user32.dll:
• 0x4804e4 CreateWindowExA
• 0x4804e8 WindowFromPoint
• 0x4804ec WinHelpA
• 0x4804f0 WaitMessage
• 0x4804f4 UpdateWindow
• 0x4804f8 UnregisterClassA
• 0x4804fc UnhookWindowsHookEx
• 0x480500 TranslateMessage
• 0x480508 TrackPopupMenu
• 0x480510 ShowWindow
• 0x480514 ShowScrollBar
• 0x480518 ShowOwnedPopups
• 0x48051c ShowCursor
• 0x480520 SetWindowsHookExA
• 0x480524 SetWindowTextA
• 0x480528 SetWindowPos
• 0x48052c SetWindowPlacement
• 0x480530 SetWindowLongA
• 0x480534 SetTimer
• 0x480538 SetScrollRange
• 0x48053c SetScrollPos
• 0x480540 SetScrollInfo
• 0x480544 SetRect
• 0x480548 SetPropA
• 0x48054c SetParent
• 0x480550 SetMenuItemInfoA
• 0x480554 SetMenu
• 0x480558 SetForegroundWindow
• 0x48055c SetFocus
• 0x480560 SetCursor
• 0x480564 SetClassLongA
• 0x480568 SetCapture
• 0x48056c SetActiveWindow
• 0x480570 SendMessageA
• 0x480574 ScrollWindow
• 0x480578 ScreenToClient
• 0x48057c RemovePropA
• 0x480580 RemoveMenu
• 0x480584 ReleaseDC
• 0x480588 ReleaseCapture
• 0x480594 RegisterClassA
• 0x480598 RedrawWindow
• 0x48059c PtInRect
• 0x4805a0 PostQuitMessage
• 0x4805a4 PostMessageA
• 0x4805a8 PeekMessageA
• 0x4805ac OffsetRect
• 0x4805b0 OemToCharA
• 0x4805b4 MessageBoxA
• 0x4805b8 MessageBeep
• 0x4805bc MapWindowPoints
• 0x4805c0 MapVirtualKeyA
• 0x4805c4 LoadStringA
• 0x4805c8 LoadKeyboardLayoutA
• 0x4805cc LoadIconA
• 0x4805d0 LoadCursorA
• 0x4805d4 LoadBitmapA
• 0x4805d8 KillTimer
• 0x4805dc IsZoomed
• 0x4805e0 IsWindowVisible
• 0x4805e4 IsWindowEnabled
• 0x4805e8 IsWindow
• 0x4805ec IsRectEmpty
• 0x4805f0 IsIconic
• 0x4805f4 IsDialogMessageA
• 0x4805f8 IsChild
• 0x4805fc InvalidateRect
• 0x480600 IntersectRect
• 0x480604 InsertMenuItemA
• 0x480608 InsertMenuA
• 0x48060c InflateRect
• 0x480614 GetWindowTextA
• 0x480618 GetWindowRect
• 0x48061c GetWindowPlacement
• 0x480620 GetWindowLongA
• 0x480624 GetWindowDC
• 0x480628 GetTopWindow
• 0x48062c GetSystemMetrics
• 0x480630 GetSystemMenu
• 0x480634 GetSysColorBrush
• 0x480638 GetSysColor
• 0x48063c GetSubMenu
• 0x480640 GetScrollRange
• 0x480644 GetScrollPos
• 0x480648 GetScrollInfo
• 0x48064c GetPropA
• 0x480650 GetParent
• 0x480654 GetWindow
• 0x480658 GetMessageTime
• 0x48065c GetMenuStringA
• 0x480660 GetMenuState
• 0x480664 GetMenuItemInfoA
• 0x480668 GetMenuItemID
• 0x48066c GetMenuItemCount
• 0x480670 GetMenu
• 0x480674 GetLastActivePopup
• 0x480678 GetKeyboardState
• 0x480680 GetKeyboardLayout
• 0x480684 GetKeyState
• 0x480688 GetKeyNameTextA
• 0x48068c GetIconInfo
• 0x480690 GetForegroundWindow
• 0x480694 GetFocus
• 0x480698 GetDlgItem
• 0x48069c GetDesktopWindow
• 0x4806a0 GetDCEx
• 0x4806a4 GetDC
• 0x4806a8 GetCursorPos
• 0x4806ac GetCursor
• 0x4806b0 GetClipboardData
• 0x4806b4 GetClientRect
• 0x4806b8 GetClassNameA
• 0x4806bc GetClassInfoA
• 0x4806c0 GetCapture
• 0x4806c4 GetActiveWindow
• 0x4806c8 FrameRect
• 0x4806cc FindWindowA
• 0x4806d0 FillRect
• 0x4806d4 EqualRect
• 0x4806d8 EnumWindows
• 0x4806dc EnumThreadWindows
• 0x4806e0 EndPaint
• 0x4806e4 EnableWindow
• 0x4806e8 EnableScrollBar
• 0x4806ec EnableMenuItem
• 0x4806f0 DrawTextA
• 0x4806f4 DrawMenuBar
• 0x4806f8 DrawIconEx
• 0x4806fc DrawIcon
• 0x480700 DrawFrameControl
• 0x480704 DrawFocusRect
• 0x480708 DrawEdge
• 0x48070c DispatchMessageA
• 0x480710 DestroyWindow
• 0x480714 DestroyMenu
• 0x480718 DestroyIcon
• 0x48071c DestroyCursor
• 0x480720 DeleteMenu
• 0x480724 DefWindowProcA
• 0x480728 DefMDIChildProcA
• 0x48072c DefFrameProcA
• 0x480730 CreatePopupMenu
• 0x480734 CreateMenu
• 0x480738 CreateIcon
• 0x48073c ClientToScreen
• 0x480740 CheckMenuItem
• 0x480744 CallWindowProcA
• 0x480748 CallNextHookEx
• 0x48074c BeginPaint
• 0x480750 CharNextA
• 0x480754 CharLowerBuffA
• 0x480758 CharLowerA
• 0x48075c CharUpperBuffA
• 0x480760 CharToOemA
• 0x480764 AdjustWindowRectEx
Library kernel32.dll:
• 0x480770 Sleep
Library oleaut32.dll:
• 0x480778 SafeArrayPtrOfIndex
• 0x48077c SafeArrayGetUBound
• 0x480780 SafeArrayGetLBound
• 0x480784 SafeArrayCreate
• 0x480788 VariantChangeType
• 0x48078c VariantCopy
• 0x480790 VariantClear
• 0x480794 VariantInit
Library ole32.dll:
• 0x4807a0 IsAccelerator
• 0x4807a4 OleDraw
• 0x4807ac CoTaskMemFree
• 0x4807b0 ProgIDFromCLSID
• 0x4807b4 StringFromCLSID
• 0x4807b8 CoCreateInstance
• 0x4807bc CoGetClassObject
• 0x4807c0 CoUninitialize
• 0x4807c4 CoInitialize
• 0x4807c8 IsEqualGUID
Library oleaut32.dll:
• 0x4807d0 GetErrorInfo
• 0x4807d4 GetActiveObject
• 0x4807d8 SysFreeString
Library comctl32.dll:
• 0x4807e8 ImageList_Write
• 0x4807ec ImageList_Read
• 0x4807fc ImageList_DragMove
• 0x480800 ImageList_DragLeave
• 0x480804 ImageList_DragEnter
• 0x480808 ImageList_EndDrag
• 0x48080c ImageList_BeginDrag
• 0x480810 ImageList_Remove
• 0x480814 ImageList_DrawEx
• 0x480818 ImageList_Replace
• 0x48081c ImageList_Draw
• 0x48082c ImageList_Add
• 0x480834 ImageList_Destroy
• 0x480838 ImageList_Create
Library comdlg32.dll:
• 0x480840 GetSaveFileNameA
• 0x480844 GetOpenFileNameA
Library user32.dll:
• 0x48084c DdeCmpStringHandles
• 0x480850 DdeFreeStringHandle
• 0x480854 DdeQueryStringA
• 0x48085c DdeGetLastError
• 0x480860 DdeFreeDataHandle
• 0x480864 DdeUnaccessData
• 0x480868 DdeAccessData
• 0x48086c DdeCreateDataHandle
• 0x480874 DdeNameService
• 0x480878 DdePostAdvise
• 0x48087c DdeSetUserHandle
• 0x480880 DdeQueryConvInfo
• 0x480884 DdeDisconnect
• 0x480888 DdeConnect
• 0x48088c DdeUninitialize
• 0x480890 DdeInitializeA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.