User API Log

Prev Next

The User API Logs are contained in various files.

  • The .log file contains the Windows user-level DLL API calls made directly by the analyzed file during dynamic analysis. To view this file in the Intelligent Sandbox web interface, select AnalysisAnalysis Reports. Then click GUID-B5B4CEAC-0E1F-4067-9ABA-8A273A2EFCFF-low.png and select User API Log. Alternatively, click GUID-B5B4CEAC-0E1F-4067-9ABA-8A273A2EFCFF-low.png, select Complete Results. Download the <sample_name>.zip file. This .zip file contains the same information in the <sample name>.log file in the AnalysisLog folder. The content of the .log file includes the following:

    • A record of all systems DLL API calling sequence.

    • An address which indicates the approximate calling address where the DLL API call was made.

    • Optional input and output parameters, and return code for key systems DLL API calls.

  • The following are the other files containing the dynamic execution logs. All these files are contained in the <sample name>.zip file.

    • <sample name>ntv.txt file. This file contains the Windows Zw version of native system services API calling sequence during the dynamic analysis. The API name typically starts with Zw as in ZwCreateFile.

    • log.zip

    • dump.zip

    • dropfiles.zip

    • networkdrive.zip