4.6
中危
该样本未表现出任何异常！
重新分析
更多

a46a4d49d8497c6cf8560c708fc6cf68c6901f2762938caa3be46b47a62d3ea6

093852c05607d0195e73a135b1c48df2.exe

分析耗时

25s

最近分析

文件大小

892.0KB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619134519.708065
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7501e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7501ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7501b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7501b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7501ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7501aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x75015511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7501559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75167f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75164de3
093852c05607d0195e73a135b1c48df2+0x90a4d @ 0x490a4d
093852c05607d0195e73a135b1c48df2+0x89254 @ 0x489254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff3914ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619134517.316605
NtAllocateVirtualMemory
process_identifier: 2272
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003f0000
success 0 0
1619134517.488605
NtProtectVirtualMemory
process_identifier: 2272
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 32768
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00469000
success 0 0
1619134517.488605
NtAllocateVirtualMemory
process_identifier: 2272
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01fa0000
success 0 0
1619134518.427065
NtProtectVirtualMemory
process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619134518.474065
NtAllocateVirtualMemory
process_identifier: 2996
region_size: 1703936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02070000
success 0 0
1619134518.474065
NtAllocateVirtualMemory
process_identifier: 2996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x021d0000
success 0 0
1619134518.474065
NtAllocateVirtualMemory
process_identifier: 2996
region_size: 557056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f30000
success 0 0
1619134518.474065
NtProtectVirtualMemory
process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 520192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f32000
success 0 0
1619134518.771065
NtAllocateVirtualMemory
process_identifier: 2996
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01fc0000
success 0 0
1619134518.771065
NtAllocateVirtualMemory
process_identifier: 2996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02020000
success 0 0
1619134519.661065
NtProtectVirtualMemory
process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e92000
success 0 0
1619134519.661065
NtProtectVirtualMemory
process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619134519.661065
NtProtectVirtualMemory
process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e92000
success 0 0
1619134519.661065
NtProtectVirtualMemory
process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619134519.661065
NtProtectVirtualMemory
process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e92000
success 0 0
1619134519.661065
NtProtectVirtualMemory
process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619134519.661065
NtProtectVirtualMemory
process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e92000
success 0 0
1619134519.661065
NtProtectVirtualMemory
process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619134519.661065
NtProtectVirtualMemory
process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e92000
success 0 0
1619134519.661065
NtProtectVirtualMemory
process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619134519.661065
NtProtectVirtualMemory
process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e92000
success 0 0
1619134519.661065
NtProtectVirtualMemory
process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619134519.661065
NtProtectVirtualMemory
process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e92000
success 0 0
1619134519.661065
NtProtectVirtualMemory
process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619134519.661065
NtProtectVirtualMemory
process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e92000
success 0 0
1619134519.661065
NtProtectVirtualMemory
process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619134519.661065
NtProtectVirtualMemory
process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e92000
success 0 0
1619134519.661065
NtProtectVirtualMemory
process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619134519.661065
NtProtectVirtualMemory
process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01e92000
success 0 0
1619134519.661065
NtProtectVirtualMemory
process_identifier: 2996
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.2627207039936605 section {'size_of_data': '0x00062c00', 'virtual_address': '0x00082000', 'entropy': 7.2627207039936605, 'name': '.rsrc', 'virtual_size': '0x00062a38'} description A section with a high entropy has been found
entropy 0.44332210998877664 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2272 called NtSetContextThread to modify thread in remote process 2996
Time & API Arguments Status Return Repeated
1619134517.675605
NtSetContextThread
thread_handle: 0x00000100
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5354720
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2996
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2272 resumed a thread in remote process 2996
Time & API Arguments Status Return Repeated
1619134518.378605
NtResumeThread
thread_handle: 0x00000100
suspend_count: 1
process_identifier: 2996
success 0 0
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619134517.613605
CreateProcessInternalW
thread_identifier: 364
thread_handle: 0x00000100
process_identifier: 2996
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\093852c05607d0195e73a135b1c48df2.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000104
inherit_handles: 0
success 1 0
1619134517.613605
NtUnmapViewOfSection
process_identifier: 2996
region_size: 4096
process_handle: 0x00000104
base_address: 0x00400000
success 0 0
1619134517.628605
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 2996
commit_size: 1167360
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000104
allocation_type: 0 ()
section_offset: 0
view_size: 1167360
base_address: 0x00400000
success 0 0
1619134517.675605
NtGetContextThread
thread_handle: 0x00000100
success 0 0
1619134517.675605
NtSetContextThread
thread_handle: 0x00000100
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5354720
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2996
success 0 0
1619134518.378605
NtResumeThread
thread_handle: 0x00000100
suspend_count: 1
process_identifier: 2996
success 0 0
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x47413c VirtualFree
• 0x474140 VirtualAlloc
• 0x474144 LocalFree
• 0x474148 LocalAlloc
• 0x47414c GetVersion
• 0x474150 GetCurrentThreadId
• 0x47415c VirtualQuery
• 0x474160 WideCharToMultiByte
• 0x474164 MultiByteToWideChar
• 0x474168 lstrlenA
• 0x47416c lstrcpynA
• 0x474170 LoadLibraryExA
• 0x474174 GetThreadLocale
• 0x474178 GetStartupInfoA
• 0x47417c GetProcAddress
• 0x474180 GetModuleHandleA
• 0x474184 GetModuleFileNameA
• 0x474188 GetLocaleInfoA
• 0x47418c GetCommandLineA
• 0x474190 FreeLibrary
• 0x474194 FindFirstFileA
• 0x474198 FindClose
• 0x47419c ExitProcess
• 0x4741a0 ExitThread
• 0x4741a4 CreateThread
• 0x4741a8 WriteFile
• 0x4741b0 RtlUnwind
• 0x4741b4 RaiseException
• 0x4741b8 GetStdHandle
Library user32.dll:
• 0x4741c0 GetKeyboardType
• 0x4741c4 LoadStringA
• 0x4741c8 MessageBoxA
• 0x4741cc CharNextA
Library advapi32.dll:
• 0x4741d4 RegQueryValueExA
• 0x4741d8 RegOpenKeyExA
• 0x4741dc RegCloseKey
Library oleaut32.dll:
• 0x4741e4 SysFreeString
• 0x4741e8 SysReAllocStringLen
• 0x4741ec SysAllocStringLen
Library kernel32.dll:
• 0x4741f4 TlsSetValue
• 0x4741f8 TlsGetValue
• 0x4741fc LocalAlloc
• 0x474200 GetModuleHandleA
Library advapi32.dll:
• 0x474208 RegQueryValueExA
• 0x47420c RegOpenKeyExA
• 0x474210 RegCloseKey
Library kernel32.dll:
• 0x474218 lstrcpyA
• 0x47421c WriteFile
• 0x474220 WaitForSingleObject
• 0x474224 VirtualQuery
• 0x474228 VirtualProtectEx
• 0x47422c VirtualAlloc
• 0x474230 SuspendThread
• 0x474234 Sleep
• 0x474238 SizeofResource
• 0x47423c SetThreadPriority
• 0x474240 SetThreadLocale
• 0x474244 SetFilePointer
• 0x474248 SetEvent
• 0x47424c SetErrorMode
• 0x474250 SetEndOfFile
• 0x474254 ResumeThread
• 0x474258 ResetEvent
• 0x47425c ReadFile
• 0x474260 MulDiv
• 0x474264 LockResource
• 0x474268 LoadResource
• 0x47426c LoadLibraryA
• 0x474278 GlobalUnlock
• 0x47427c GlobalReAlloc
• 0x474280 GlobalHandle
• 0x474284 GlobalLock
• 0x474288 GlobalFree
• 0x47428c GlobalFindAtomA
• 0x474290 GlobalDeleteAtom
• 0x474294 GlobalAlloc
• 0x474298 GlobalAddAtomA
• 0x47429c GetVersionExA
• 0x4742a0 GetVersion
• 0x4742a4 GetTickCount
• 0x4742a8 GetThreadLocale
• 0x4742ac GetTempPathA
• 0x4742b4 GetSystemTime
• 0x4742b8 GetSystemInfo
• 0x4742bc GetStringTypeExA
• 0x4742c0 GetStdHandle
• 0x4742c4 GetProcAddress
• 0x4742c8 GetModuleHandleA
• 0x4742cc GetModuleFileNameA
• 0x4742d0 GetLocaleInfoA
• 0x4742d4 GetLocalTime
• 0x4742d8 GetLastError
• 0x4742dc GetFullPathNameA
• 0x4742e0 GetFileSize
• 0x4742e4 GetExitCodeThread
• 0x4742e8 GetDiskFreeSpaceA
• 0x4742ec GetDateFormatA
• 0x4742f0 GetCurrentThreadId
• 0x4742f4 GetCurrentProcessId
• 0x4742f8 GetCurrentProcess
• 0x4742fc GetCPInfo
• 0x474300 GetACP
• 0x474304 FreeResource
• 0x47430c InterlockedExchange
• 0x474314 FreeLibrary
• 0x474318 FormatMessageA
• 0x47431c FindResourceA
• 0x474320 FindFirstFileA
• 0x474324 FindClose
• 0x474334 ExitThread
• 0x474338 EnumCalendarInfoA
• 0x474344 CreateThread
• 0x474348 CreateFileA
• 0x47434c CreateEventA
• 0x474350 CompareStringA
• 0x474354 CloseHandle
Library version.dll:
• 0x47435c VerQueryValueA
• 0x474364 GetFileVersionInfoA
Library gdi32.dll:
• 0x47436c UnrealizeObject
• 0x474370 StretchBlt
• 0x474374 SetWindowOrgEx
• 0x474378 SetWinMetaFileBits
• 0x47437c SetViewportOrgEx
• 0x474380 SetTextColor
• 0x474384 SetStretchBltMode
• 0x474388 SetROP2
• 0x47438c SetPixel
• 0x474390 SetEnhMetaFileBits
• 0x474394 SetDIBColorTable
• 0x474398 SetBrushOrgEx
• 0x47439c SetBkMode
• 0x4743a0 SetBkColor
• 0x4743a4 SelectPalette
• 0x4743a8 SelectObject
• 0x4743ac SaveDC
• 0x4743b0 RestoreDC
• 0x4743b4 Rectangle
• 0x4743b8 RectVisible
• 0x4743bc RealizePalette
• 0x4743c0 PlayEnhMetaFile
• 0x4743c4 PatBlt
• 0x4743c8 MoveToEx
• 0x4743cc MaskBlt
• 0x4743d0 LineTo
• 0x4743d4 IntersectClipRect
• 0x4743d8 GetWindowOrgEx
• 0x4743dc GetWinMetaFileBits
• 0x4743e0 GetTextMetricsA
• 0x4743ec GetStockObject
• 0x4743f0 GetPixel
• 0x4743f4 GetPaletteEntries
• 0x4743f8 GetObjectA
• 0x474404 GetEnhMetaFileBits
• 0x474408 GetDeviceCaps
• 0x47440c GetDIBits
• 0x474410 GetDIBColorTable
• 0x474414 GetDCOrgEx
• 0x47441c GetClipBox
• 0x474420 GetBrushOrgEx
• 0x474424 GetBitmapBits
• 0x474428 ExcludeClipRect
• 0x47442c DeleteObject
• 0x474430 DeleteEnhMetaFile
• 0x474434 DeleteDC
• 0x474438 CreateSolidBrush
• 0x47443c CreatePenIndirect
• 0x474440 CreatePen
• 0x474444 CreatePalette
• 0x47444c CreateFontIndirectA
• 0x474450 CreateDIBitmap
• 0x474454 CreateDIBSection
• 0x474458 CreateCompatibleDC
• 0x474460 CreateBrushIndirect
• 0x474464 CreateBitmap
• 0x474468 CopyEnhMetaFileA
• 0x47446c BitBlt
Library user32.dll:
• 0x474474 CreateWindowExA
• 0x474478 WindowFromPoint
• 0x47447c WinHelpA
• 0x474480 WaitMessage
• 0x474484 ValidateRect
• 0x474488 UpdateWindow
• 0x47448c UnregisterClassA
• 0x474490 UnhookWindowsHookEx
• 0x474494 TranslateMessage
• 0x47449c TrackPopupMenu
• 0x4744a4 ShowWindow
• 0x4744a8 ShowScrollBar
• 0x4744ac ShowOwnedPopups
• 0x4744b0 ShowCursor
• 0x4744b4 SetWindowsHookExA
• 0x4744b8 SetWindowPos
• 0x4744bc SetWindowPlacement
• 0x4744c0 SetWindowLongA
• 0x4744c4 SetTimer
• 0x4744c8 SetScrollRange
• 0x4744cc SetScrollPos
• 0x4744d0 SetScrollInfo
• 0x4744d4 SetRect
• 0x4744d8 SetPropA
• 0x4744dc SetParent
• 0x4744e0 SetMenuItemInfoA
• 0x4744e4 SetMenu
• 0x4744e8 SetForegroundWindow
• 0x4744ec SetFocus
• 0x4744f0 SetCursor
• 0x4744f4 SetClassLongA
• 0x4744f8 SetCapture
• 0x4744fc SetActiveWindow
• 0x474500 SendMessageA
• 0x474504 ScrollWindow
• 0x474508 ScreenToClient
• 0x47450c RemovePropA
• 0x474510 RemoveMenu
• 0x474514 ReleaseDC
• 0x474518 ReleaseCapture
• 0x474524 RegisterClassA
• 0x474528 RedrawWindow
• 0x47452c PtInRect
• 0x474530 PostQuitMessage
• 0x474534 PostMessageA
• 0x474538 PeekMessageA
• 0x47453c OffsetRect
• 0x474540 OemToCharA
• 0x474548 MessageBoxA
• 0x47454c MapWindowPoints
• 0x474550 MapVirtualKeyA
• 0x474554 LoadStringA
• 0x474558 LoadKeyboardLayoutA
• 0x47455c LoadIconA
• 0x474560 LoadCursorA
• 0x474564 LoadBitmapA
• 0x474568 KillTimer
• 0x47456c IsZoomed
• 0x474570 IsWindowVisible
• 0x474574 IsWindowEnabled
• 0x474578 IsWindow
• 0x47457c IsRectEmpty
• 0x474580 IsIconic
• 0x474584 IsDialogMessageA
• 0x474588 IsChild
• 0x47458c InvalidateRect
• 0x474590 IntersectRect
• 0x474594 InsertMenuItemA
• 0x474598 InsertMenuA
• 0x47459c InflateRect
• 0x4745a4 GetWindowTextA
• 0x4745a8 GetWindowRect
• 0x4745ac GetWindowPlacement
• 0x4745b0 GetWindowLongA
• 0x4745b4 GetWindowDC
• 0x4745b8 GetTopWindow
• 0x4745bc GetSystemMetrics
• 0x4745c0 GetSystemMenu
• 0x4745c4 GetSysColorBrush
• 0x4745c8 GetSysColor
• 0x4745cc GetSubMenu
• 0x4745d0 GetScrollRange
• 0x4745d4 GetScrollPos
• 0x4745d8 GetScrollInfo
• 0x4745dc GetPropA
• 0x4745e0 GetParent
• 0x4745e4 GetWindow
• 0x4745e8 GetMenuStringA
• 0x4745ec GetMenuState
• 0x4745f0 GetMenuItemInfoA
• 0x4745f4 GetMenuItemID
• 0x4745f8 GetMenuItemCount
• 0x4745fc GetMenu
• 0x474600 GetLastActivePopup
• 0x474604 GetKeyboardState
• 0x47460c GetKeyboardLayout
• 0x474610 GetKeyState
• 0x474614 GetKeyNameTextA
• 0x474618 GetIconInfo
• 0x47461c GetForegroundWindow
• 0x474620 GetFocus
• 0x474624 GetDlgItem
• 0x474628 GetDesktopWindow
• 0x47462c GetDCEx
• 0x474630 GetDC
• 0x474634 GetCursorPos
• 0x474638 GetCursor
• 0x47463c GetClipboardData
• 0x474640 GetClientRect
• 0x474644 GetClassNameA
• 0x474648 GetClassInfoA
• 0x47464c GetCapture
• 0x474650 GetActiveWindow
• 0x474654 FrameRect
• 0x474658 FindWindowA
• 0x47465c FillRect
• 0x474660 EqualRect
• 0x474664 EnumWindows
• 0x474668 EnumThreadWindows
• 0x47466c EndPaint
• 0x474670 EnableWindow
• 0x474674 EnableScrollBar
• 0x474678 EnableMenuItem
• 0x47467c DrawTextA
• 0x474680 DrawMenuBar
• 0x474684 DrawIconEx
• 0x474688 DrawIcon
• 0x47468c DrawFrameControl
• 0x474690 DrawEdge
• 0x474694 DispatchMessageA
• 0x474698 DestroyWindow
• 0x47469c DestroyMenu
• 0x4746a0 DestroyIcon
• 0x4746a4 DestroyCursor
• 0x4746a8 DeleteMenu
• 0x4746ac DefWindowProcA
• 0x4746b0 DefMDIChildProcA
• 0x4746b4 DefFrameProcA
• 0x4746b8 CreatePopupMenu
• 0x4746bc CreateMenu
• 0x4746c0 CreateIcon
• 0x4746c4 ClientToScreen
• 0x4746c8 CheckMenuItem
• 0x4746cc CallWindowProcA
• 0x4746d0 CallNextHookEx
• 0x4746d4 BeginPaint
• 0x4746d8 CharNextA
• 0x4746dc CharLowerBuffA
• 0x4746e0 CharLowerA
• 0x4746e4 CharToOemA
• 0x4746e8 AdjustWindowRectEx
Library kernel32.dll:
• 0x4746f4 Sleep
Library oleaut32.dll:
• 0x4746fc SafeArrayPtrOfIndex
• 0x474700 SafeArrayGetUBound
• 0x474704 SafeArrayGetLBound
• 0x474708 SafeArrayCreate
• 0x47470c VariantChangeType
• 0x474710 VariantCopy
• 0x474714 VariantClear
• 0x474718 VariantInit
Library comctl32.dll:
• 0x474728 ImageList_Write
• 0x47472c ImageList_Read
• 0x47473c ImageList_DragMove
• 0x474740 ImageList_DragLeave
• 0x474744 ImageList_DragEnter
• 0x474748 ImageList_EndDrag
• 0x47474c ImageList_BeginDrag
• 0x474750 ImageList_Remove
• 0x474754 ImageList_DrawEx
• 0x474758 ImageList_Draw
• 0x474768 ImageList_Add
• 0x474770 ImageList_Destroy
• 0x474774 ImageList_Create
• 0x474778 InitCommonControls
Library comdlg32.dll:
• 0x474780 GetOpenFileNameA

Hosts

No hosts contacted.

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 62194 239.255.255.250 1900
192.168.56.101 65005 239.255.255.250 3702
192.168.56.101 50534 8.8.8.8 53
192.168.56.101 60123 8.8.8.8 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.