6.2
高危
60 个模型检测该样本为恶意！
重新分析
更多

fc479e25d36a5a94c3656beb9128af5e7ddd2338e804e87d1b3ad5f748fbd953

f24aff7a97a695a32003447a9b7b12fd.exe

分析耗时

23s

最近分析

文件大小

706.5KB
静态报毒 动态报毒 0NA103FD20 100% AGEN AGENTTESLA AI SCORE=81 AIDETECTVM AUTO AVSARHER BTOMTW CLOUD COMET CONFIDENCE DELF DELPHILESS ELXR EMJE FAREIT FORMBOOK GENERICKD HIGH CONFIDENCE HLBIFR KRYPTIK MALICIOUS PE MALWARE2 OVLQ SCORE SGW@AEIBK8KI SUSGEN TSCOPE UNSAFE WACATAC X2066 ZELPHIF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/FormBook.f3f2b495 20190527 0.3.0.5
Avast Win32:Trojan-gen 20200811 18.4.3895.0
Tencent Win32.Trojan.Inject.Auto 20200811 1.0.0.1
Baidu 20190318 1.0.0.2
Kingsoft 20200811 2013.8.14.323
McAfee Fareit-FTB!F24AFF7A97A6 20200811 6.0.6.653
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1620004804.605249
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x752ad4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
f24aff7a97a695a32003447a9b7b12fd+0x543f8 @ 0x4543f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75174b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75175d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfdac14ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (28 个事件)
Time & API Arguments Status Return Repeated
1620004802.573876
NtAllocateVirtualMemory
process_identifier: 368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1620004802.745876
NtAllocateVirtualMemory
process_identifier: 368
region_size: 32768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01db0000
success 0 0
1620004802.760876
NtAllocateVirtualMemory
process_identifier: 368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01e10000
success 0 0
1620004804.089249
NtProtectVirtualMemory
process_identifier: 2404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1620004804.230249
NtAllocateVirtualMemory
process_identifier: 2404
region_size: 1572864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01e00000
success 0 0
1620004804.230249
NtAllocateVirtualMemory
process_identifier: 2404
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f40000
success 0 0
1620004804.230249
NtAllocateVirtualMemory
process_identifier: 2404
region_size: 311296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00510000
success 0 0
1620004804.230249
NtProtectVirtualMemory
process_identifier: 2404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 286720
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00512000
success 0 0
1620004804.574249
NtProtectVirtualMemory
process_identifier: 2404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1620004804.574249
NtProtectVirtualMemory
process_identifier: 2404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620004804.574249
NtProtectVirtualMemory
process_identifier: 2404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1620004804.574249
NtProtectVirtualMemory
process_identifier: 2404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1620004804.574249
NtProtectVirtualMemory
process_identifier: 2404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1620004804.574249
NtProtectVirtualMemory
process_identifier: 2404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1620004804.574249
NtProtectVirtualMemory
process_identifier: 2404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1620004804.574249
NtProtectVirtualMemory
process_identifier: 2404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620004804.574249
NtProtectVirtualMemory
process_identifier: 2404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1620004804.574249
NtProtectVirtualMemory
process_identifier: 2404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1620004804.574249
NtProtectVirtualMemory
process_identifier: 2404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1620004804.574249
NtProtectVirtualMemory
process_identifier: 2404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1620004804.574249
NtProtectVirtualMemory
process_identifier: 2404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1620004804.574249
NtProtectVirtualMemory
process_identifier: 2404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620004804.574249
NtProtectVirtualMemory
process_identifier: 2404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1620004804.574249
NtProtectVirtualMemory
process_identifier: 2404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1620004804.574249
NtProtectVirtualMemory
process_identifier: 2404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1620004804.574249
NtProtectVirtualMemory
process_identifier: 2404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1620004804.574249
NtProtectVirtualMemory
process_identifier: 2404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1620004804.574249
NtProtectVirtualMemory
process_identifier: 2404
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.504408399900199 section {'size_of_data': '0x00039c00', 'virtual_address': '0x0007d000', 'entropy': 7.504408399900199, 'name': '.rsrc', 'virtual_size': '0x00039ad0'} description A section with a high entropy has been found
entropy 0.32742735648476257 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 368 called NtSetContextThread to modify thread in remote process 2404
Time & API Arguments Status Return Repeated
1620004803.292876
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4866000
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2404
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 368 resumed a thread in remote process 2404
Time & API Arguments Status Return Repeated
1620004803.885876
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2404
success 0 0
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1620004803.198876
CreateProcessInternalW
thread_identifier: 2988
thread_handle: 0x000000fc
process_identifier: 2404
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\f24aff7a97a695a32003447a9b7b12fd.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1620004803.198876
NtUnmapViewOfSection
process_identifier: 2404
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1620004803.229876
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 2404
commit_size: 679936
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 679936
base_address: 0x00400000
success 0 0
1620004803.292876
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1620004803.292876
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4866000
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2404
success 0 0
1620004803.885876
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2404
success 0 0
File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
DrWeb BackDoor.Comet.3628
MicroWorld-eScan Trojan.GenericKD.34009873
FireEye Generic.mg.f24aff7a97a695a3
CAT-QuickHeal Trojan.Wacatac
ALYac Trojan.GenericKD.34009873
Cylance Unsafe
Zillya Trojan.Injector.Win32.742052
K7AntiVirus Trojan ( 005680341 )
Alibaba Trojan:Win32/FormBook.f3f2b495
K7GW Trojan ( 005680341 )
Cybereason malicious.7e1d2f
TrendMicro TROJ_FRS.0NA103FD20
BitDefenderTheta Gen:NN.ZelphiF.34152.SGW@aeibk8ki
F-Prot W32/Injector.JET
Symantec Trojan.Gen.2
ESET-NOD32 a variant of Win32/Injector.EMJE
APEX Malicious
Paloalto generic.ml
ClamAV Win.Malware.AgentTesla-8022099-1
GData Trojan.GenericKD.34009873
Kaspersky HEUR:Trojan.Win32.Kryptik.gen
BitDefender Trojan.GenericKD.34009873
NANO-Antivirus Trojan.Win32.Comet.hlbifr
Avast Win32:Trojan-gen
Tencent Win32.Trojan.Inject.Auto
Ad-Aware Trojan.GenericKD.34009873
F-Secure Heuristic.HEUR/AGEN.1137421
VIPRE Trojan.Win32.Generic!BT
Invincea heuristic
Trapmine suspicious.low.ml.score
Sophos Mal/Generic-S
SentinelOne DFI - Malicious PE
Cyren W32/Injector.OVLQ-4126
Jiangmin Trojan.Kryptik.bfs
Avira HEUR/AGEN.1137421
Antiy-AVL Trojan/Win32.Kryptik
Arcabit Trojan.Generic.D206F311
AegisLab Trojan.Win32.Kryptik.4!c
ZoneAlarm HEUR:Trojan.Win32.Kryptik.gen
Microsoft Trojan:Win32/FormBook.CR!MTB
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2066
Acronis suspicious
McAfee Fareit-FTB!F24AFF7A97A6
MAX malware (ai score=81)
VBA32 TScope.Trojan.Delf
Malwarebytes Trojan.MalPack.DLF
TrendMicro-HouseCall TROJ_FRS.0NA103FD20
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x47013c VirtualFree
• 0x470140 VirtualAlloc
• 0x470144 LocalFree
• 0x470148 LocalAlloc
• 0x47014c GetVersion
• 0x470150 GetCurrentThreadId
• 0x47015c VirtualQuery
• 0x470160 WideCharToMultiByte
• 0x470164 MultiByteToWideChar
• 0x470168 lstrlenA
• 0x47016c lstrcpynA
• 0x470170 LoadLibraryExA
• 0x470174 GetThreadLocale
• 0x470178 GetStartupInfoA
• 0x47017c GetProcAddress
• 0x470180 GetModuleHandleA
• 0x470184 GetModuleFileNameA
• 0x470188 GetLocaleInfoA
• 0x47018c GetCommandLineA
• 0x470190 FreeLibrary
• 0x470194 FindFirstFileA
• 0x470198 FindClose
• 0x47019c ExitProcess
• 0x4701a0 WriteFile
• 0x4701a8 RtlUnwind
• 0x4701ac RaiseException
• 0x4701b0 GetStdHandle
Library user32.dll:
• 0x4701b8 GetKeyboardType
• 0x4701bc LoadStringA
• 0x4701c0 MessageBoxA
• 0x4701c4 CharNextA
Library advapi32.dll:
• 0x4701cc RegQueryValueExA
• 0x4701d0 RegOpenKeyExA
• 0x4701d4 RegCloseKey
Library oleaut32.dll:
• 0x4701dc SysFreeString
• 0x4701e0 SysReAllocStringLen
• 0x4701e4 SysAllocStringLen
Library kernel32.dll:
• 0x4701ec TlsSetValue
• 0x4701f0 TlsGetValue
• 0x4701f4 LocalAlloc
• 0x4701f8 GetModuleHandleA
Library advapi32.dll:
• 0x470200 RegQueryValueExA
• 0x470204 RegOpenKeyExA
• 0x470208 RegCloseKey
Library kernel32.dll:
• 0x470210 lstrcpyA
• 0x470214 WriteFile
• 0x47021c WaitForSingleObject
• 0x470220 VirtualQuery
• 0x470224 VirtualAlloc
• 0x470228 Sleep
• 0x47022c SizeofResource
• 0x470230 SetThreadLocale
• 0x470234 SetFilePointer
• 0x470238 SetEvent
• 0x47023c SetErrorMode
• 0x470240 SetEndOfFile
• 0x470244 ResetEvent
• 0x470248 ReadFile
• 0x47024c MulDiv
• 0x470250 LockResource
• 0x470254 LoadResource
• 0x470258 LoadLibraryA
• 0x470264 GlobalUnlock
• 0x470268 GlobalReAlloc
• 0x47026c GlobalHandle
• 0x470270 GlobalLock
• 0x470274 GlobalFree
• 0x470278 GlobalFindAtomA
• 0x47027c GlobalDeleteAtom
• 0x470280 GlobalAlloc
• 0x470284 GlobalAddAtomA
• 0x470288 GetVersionExA
• 0x47028c GetVersion
• 0x470294 GetTickCount
• 0x470298 GetThreadLocale
• 0x47029c GetTempPathA
• 0x4702a4 GetSystemTime
• 0x4702a8 GetSystemInfo
• 0x4702ac GetStringTypeExA
• 0x4702b0 GetStdHandle
• 0x4702b4 GetProcAddress
• 0x4702b8 GetModuleHandleA
• 0x4702bc GetModuleFileNameA
• 0x4702c0 GetLocaleInfoA
• 0x4702c4 GetLocalTime
• 0x4702c8 GetLastError
• 0x4702cc GetFullPathNameA
• 0x4702d0 GetFileSize
• 0x4702d4 GetFileAttributesA
• 0x4702d8 GetDiskFreeSpaceA
• 0x4702dc GetDateFormatA
• 0x4702e0 GetCurrentThreadId
• 0x4702e4 GetCurrentProcessId
• 0x4702e8 GetCPInfo
• 0x4702ec GetACP
• 0x4702f0 FreeResource
• 0x4702f4 InterlockedExchange
• 0x4702f8 FreeLibrary
• 0x4702fc FormatMessageA
• 0x470300 FindResourceA
• 0x470304 FindFirstFileA
• 0x470308 FindClose
• 0x470314 ExitThread
• 0x470318 EnumCalendarInfoA
• 0x470324 CreateThread
• 0x470328 CreateFileA
• 0x47032c CreateEventA
• 0x470330 CompareStringA
• 0x470334 CloseHandle
Library version.dll:
• 0x47033c VerQueryValueA
• 0x470344 GetFileVersionInfoA
Library gdi32.dll:
• 0x47034c UnrealizeObject
• 0x470350 StretchBlt
• 0x470354 SetWindowOrgEx
• 0x470358 SetWinMetaFileBits
• 0x47035c SetViewportOrgEx
• 0x470360 SetTextColor
• 0x470364 SetStretchBltMode
• 0x470368 SetROP2
• 0x47036c SetPixel
• 0x470370 SetEnhMetaFileBits
• 0x470374 SetDIBColorTable
• 0x470378 SetBrushOrgEx
• 0x47037c SetBkMode
• 0x470380 SetBkColor
• 0x470384 SelectPalette
• 0x470388 SelectObject
• 0x47038c SaveDC
• 0x470390 RestoreDC
• 0x470394 Rectangle
• 0x470398 RectVisible
• 0x47039c RealizePalette
• 0x4703a0 Polyline
• 0x4703a4 PlayEnhMetaFile
• 0x4703a8 PatBlt
• 0x4703ac MoveToEx
• 0x4703b0 MaskBlt
• 0x4703b4 LineTo
• 0x4703b8 IntersectClipRect
• 0x4703bc GetWindowOrgEx
• 0x4703c0 GetWinMetaFileBits
• 0x4703c4 GetTextMetricsA
• 0x4703d0 GetStockObject
• 0x4703d4 GetPixel
• 0x4703d8 GetPaletteEntries
• 0x4703dc GetObjectA
• 0x4703e8 GetEnhMetaFileBits
• 0x4703ec GetDeviceCaps
• 0x4703f0 GetDIBits
• 0x4703f4 GetDIBColorTable
• 0x4703f8 GetDCOrgEx
• 0x470400 GetClipBox
• 0x470404 GetBrushOrgEx
• 0x470408 GetBitmapBits
• 0x47040c ExcludeClipRect
• 0x470410 DeleteObject
• 0x470414 DeleteEnhMetaFile
• 0x470418 DeleteDC
• 0x47041c CreateSolidBrush
• 0x470420 CreatePenIndirect
• 0x470424 CreatePalette
• 0x47042c CreateFontIndirectA
• 0x470430 CreateDIBitmap
• 0x470434 CreateDIBSection
• 0x470438 CreateCompatibleDC
• 0x470440 CreateBrushIndirect
• 0x470444 CreateBitmap
• 0x470448 CopyEnhMetaFileA
• 0x47044c BitBlt
Library user32.dll:
• 0x470454 CreateWindowExA
• 0x470458 WindowFromPoint
• 0x47045c WinHelpA
• 0x470460 WaitMessage
• 0x470464 UpdateWindow
• 0x470468 UnregisterClassA
• 0x47046c UnhookWindowsHookEx
• 0x470470 TranslateMessage
• 0x470478 TrackPopupMenu
• 0x470480 ShowWindow
• 0x470484 ShowScrollBar
• 0x470488 ShowOwnedPopups
• 0x47048c ShowCursor
• 0x470490 SetWindowsHookExA
• 0x470494 SetWindowPos
• 0x470498 SetWindowPlacement
• 0x47049c SetWindowLongA
• 0x4704a0 SetTimer
• 0x4704a4 SetScrollRange
• 0x4704a8 SetScrollPos
• 0x4704ac SetScrollInfo
• 0x4704b0 SetRect
• 0x4704b4 SetPropA
• 0x4704b8 SetParent
• 0x4704bc SetMenuItemInfoA
• 0x4704c0 SetMenu
• 0x4704c4 SetForegroundWindow
• 0x4704c8 SetFocus
• 0x4704cc SetCursor
• 0x4704d0 SetClassLongA
• 0x4704d4 SetCapture
• 0x4704d8 SetActiveWindow
• 0x4704dc SendMessageA
• 0x4704e0 ScrollWindow
• 0x4704e4 ScreenToClient
• 0x4704e8 RemovePropA
• 0x4704ec RemoveMenu
• 0x4704f0 ReleaseDC
• 0x4704f4 ReleaseCapture
• 0x470500 RegisterClassA
• 0x470504 RedrawWindow
• 0x470508 PtInRect
• 0x47050c PostQuitMessage
• 0x470510 PostMessageA
• 0x470514 PeekMessageA
• 0x470518 OffsetRect
• 0x47051c OemToCharA
• 0x470520 MessageBoxA
• 0x470524 MapWindowPoints
• 0x470528 MapVirtualKeyA
• 0x47052c LoadStringA
• 0x470530 LoadKeyboardLayoutA
• 0x470534 LoadIconA
• 0x470538 LoadCursorA
• 0x47053c LoadBitmapA
• 0x470540 KillTimer
• 0x470544 IsZoomed
• 0x470548 IsWindowVisible
• 0x47054c IsWindowEnabled
• 0x470550 IsWindow
• 0x470554 IsRectEmpty
• 0x470558 IsIconic
• 0x47055c IsDialogMessageA
• 0x470560 IsChild
• 0x470564 InvalidateRect
• 0x470568 IntersectRect
• 0x47056c InsertMenuItemA
• 0x470570 InsertMenuA
• 0x470574 InflateRect
• 0x47057c GetWindowTextA
• 0x470580 GetWindowRect
• 0x470584 GetWindowPlacement
• 0x470588 GetWindowLongA
• 0x47058c GetWindowDC
• 0x470590 GetTopWindow
• 0x470594 GetSystemMetrics
• 0x470598 GetSystemMenu
• 0x47059c GetSysColorBrush
• 0x4705a0 GetSysColor
• 0x4705a4 GetSubMenu
• 0x4705a8 GetScrollRange
• 0x4705ac GetScrollPos
• 0x4705b0 GetScrollInfo
• 0x4705b4 GetPropA
• 0x4705b8 GetParent
• 0x4705bc GetWindow
• 0x4705c0 GetMenuStringA
• 0x4705c4 GetMenuState
• 0x4705c8 GetMenuItemInfoA
• 0x4705cc GetMenuItemID
• 0x4705d0 GetMenuItemCount
• 0x4705d4 GetMenu
• 0x4705d8 GetLastActivePopup
• 0x4705dc GetKeyboardState
• 0x4705e4 GetKeyboardLayout
• 0x4705e8 GetKeyState
• 0x4705ec GetKeyNameTextA
• 0x4705f0 GetIconInfo
• 0x4705f4 GetForegroundWindow
• 0x4705f8 GetFocus
• 0x4705fc GetDlgItem
• 0x470600 GetDesktopWindow
• 0x470604 GetDCEx
• 0x470608 GetDC
• 0x47060c GetCursorPos
• 0x470610 GetCursor
• 0x470614 GetClipboardData
• 0x470618 GetClientRect
• 0x47061c GetClassNameA
• 0x470620 GetClassInfoA
• 0x470624 GetCapture
• 0x470628 GetActiveWindow
• 0x47062c FrameRect
• 0x470630 FindWindowA
• 0x470634 FillRect
• 0x470638 EqualRect
• 0x47063c EnumWindows
• 0x470640 EnumThreadWindows
• 0x470644 EndPaint
• 0x470648 EnableWindow
• 0x47064c EnableScrollBar
• 0x470650 EnableMenuItem
• 0x470654 DrawTextA
• 0x470658 DrawMenuBar
• 0x47065c DrawIconEx
• 0x470660 DrawIcon
• 0x470664 DrawFrameControl
• 0x470668 DrawEdge
• 0x47066c DispatchMessageA
• 0x470670 DestroyWindow
• 0x470674 DestroyMenu
• 0x470678 DestroyIcon
• 0x47067c DestroyCursor
• 0x470680 DeleteMenu
• 0x470684 DefWindowProcA
• 0x470688 DefMDIChildProcA
• 0x47068c DefFrameProcA
• 0x470690 CreatePopupMenu
• 0x470694 CreateMenu
• 0x470698 CreateIcon
• 0x47069c ClientToScreen
• 0x4706a0 CheckMenuItem
• 0x4706a4 CallWindowProcA
• 0x4706a8 CallNextHookEx
• 0x4706ac BeginPaint
• 0x4706b0 CharNextA
• 0x4706b4 CharLowerBuffA
• 0x4706b8 CharLowerA
• 0x4706bc CharToOemA
• 0x4706c0 AdjustWindowRectEx
Library kernel32.dll:
• 0x4706cc Sleep
Library oleaut32.dll:
• 0x4706d4 SafeArrayPtrOfIndex
• 0x4706d8 SafeArrayGetUBound
• 0x4706dc SafeArrayGetLBound
• 0x4706e0 SafeArrayCreate
• 0x4706e4 VariantChangeType
• 0x4706e8 VariantCopy
• 0x4706ec VariantClear
• 0x4706f0 VariantInit
Library comctl32.dll:
• 0x470700 ImageList_Write
• 0x470704 ImageList_Read
• 0x470714 ImageList_DragMove
• 0x470718 ImageList_DragLeave
• 0x47071c ImageList_DragEnter
• 0x470720 ImageList_EndDrag
• 0x470724 ImageList_BeginDrag
• 0x470728 ImageList_Remove
• 0x47072c ImageList_DrawEx
• 0x470730 ImageList_Replace
• 0x470734 ImageList_Draw
• 0x470744 ImageList_Add
• 0x47074c ImageList_Destroy
• 0x470750 ImageList_Create
• 0x470754 InitCommonControls
Library comdlg32.dll:
• 0x47075c GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 51809 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 60124 239.255.255.250 3702
192.168.56.101 62194 239.255.255.250 1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.