5.6
高危
该样本未表现出任何异常！
重新分析
更多

4d48fc6432fbd06c737a526da3f6c074caf45514c2bb1f1c8a3f7d5a5d37436b

3d5e63cb273dd660823bba9a8ca69822.exe

分析耗时

56s

最近分析

文件大小

886.5KB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619408266.963374
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73aae97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73aaea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73aab25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73aab4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73aaac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73aaaed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73aa5511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73aa559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74167f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74164de3
3d5e63cb273dd660823bba9a8ca69822+0x58a4d @ 0x458a4d
3d5e63cb273dd660823bba9a8ca69822+0x51254 @ 0x451254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfcc114ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619408264.431249
NtAllocateVirtualMemory
process_identifier: 2860
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003d0000
success 0 0
1619408264.697249
NtProtectVirtualMemory
process_identifier: 2860
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 77824
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0047e000
success 0 0
1619408264.713249
NtAllocateVirtualMemory
process_identifier: 2860
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00520000
success 0 0
1619408265.619374
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619408265.650374
NtAllocateVirtualMemory
process_identifier: 368
region_size: 524288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00550000
success 0 0
1619408265.650374
NtAllocateVirtualMemory
process_identifier: 368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00590000
success 0 0
1619408265.650374
NtAllocateVirtualMemory
process_identifier: 368
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00710000
success 0 0
1619408265.650374
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 303104
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00712000
success 0 0
1619408266.244374
NtAllocateVirtualMemory
process_identifier: 368
region_size: 1507328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01fb0000
success 0 0
1619408266.244374
NtAllocateVirtualMemory
process_identifier: 368
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020e0000
success 0 0
1619408266.947374
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003f2000
success 0 0
1619408266.947374
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619408266.947374
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003f2000
success 0 0
1619408266.947374
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619408266.947374
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003f2000
success 0 0
1619408266.947374
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619408266.947374
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003f2000
success 0 0
1619408266.947374
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619408266.947374
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003f2000
success 0 0
1619408266.947374
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619408266.947374
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003f2000
success 0 0
1619408266.947374
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619408266.947374
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003f2000
success 0 0
1619408266.947374
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619408266.947374
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003f2000
success 0 0
1619408266.947374
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619408266.947374
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003f2000
success 0 0
1619408266.947374
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619408266.947374
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x003f2000
success 0 0
1619408266.947374
NtProtectVirtualMemory
process_identifier: 368
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.58733407260907 section {'size_of_data': '0x00040800', 'virtual_address': '0x000a3000', 'entropy': 7.58733407260907, 'name': '.rsrc', 'virtual_size': '0x000407b0'} description A section with a high entropy has been found
entropy 0.29136081309994355 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2860 called NtSetContextThread to modify thread in remote process 368
Time & API Arguments Status Return Repeated
1619408264.759249
NtSetContextThread
thread_handle: 0x000000f8
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4896944
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 368
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2860 resumed a thread in remote process 368
Time & API Arguments Status Return Repeated
1619408265.259249
NtResumeThread
thread_handle: 0x000000f8
suspend_count: 1
process_identifier: 368
success 0 0
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.160.110:443
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619408264.744249
CreateProcessInternalW
thread_identifier: 732
thread_handle: 0x000000f8
process_identifier: 368
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3d5e63cb273dd660823bba9a8ca69822.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000fc
inherit_handles: 0
success 1 0
1619408264.744249
NtUnmapViewOfSection
process_identifier: 368
region_size: 4096
process_handle: 0x000000fc
base_address: 0x00400000
success 0 0
1619408264.744249
NtMapViewOfSection
section_handle: 0x00000104
process_identifier: 368
commit_size: 708608
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000fc
allocation_type: 0 ()
section_offset: 0
view_size: 708608
base_address: 0x00400000
success 0 0
1619408264.759249
NtGetContextThread
thread_handle: 0x000000f8
success 0 0
1619408264.759249
NtSetContextThread
thread_handle: 0x000000f8
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4896944
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 368
success 0 0
1619408265.259249
NtResumeThread
thread_handle: 0x000000f8
suspend_count: 1
process_identifier: 368
success 0 0
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x494178 VirtualFree
• 0x49417c VirtualAlloc
• 0x494180 LocalFree
• 0x494184 LocalAlloc
• 0x494188 GetVersion
• 0x49418c GetCurrentThreadId
• 0x494198 VirtualQuery
• 0x49419c WideCharToMultiByte
• 0x4941a0 MultiByteToWideChar
• 0x4941a4 lstrlenA
• 0x4941a8 lstrcpynA
• 0x4941ac LoadLibraryExA
• 0x4941b0 GetThreadLocale
• 0x4941b4 GetStartupInfoA
• 0x4941b8 GetProcAddress
• 0x4941bc GetModuleHandleA
• 0x4941c0 GetModuleFileNameA
• 0x4941c4 GetLocaleInfoA
• 0x4941c8 GetCommandLineA
• 0x4941cc FreeLibrary
• 0x4941d0 FindFirstFileA
• 0x4941d4 FindClose
• 0x4941d8 ExitProcess
• 0x4941dc WriteFile
• 0x4941e4 RtlUnwind
• 0x4941e8 RaiseException
• 0x4941ec GetStdHandle
Library user32.dll:
• 0x4941f4 GetKeyboardType
• 0x4941f8 LoadStringA
• 0x4941fc MessageBoxA
• 0x494200 CharNextA
Library advapi32.dll:
• 0x494208 RegQueryValueExA
• 0x49420c RegOpenKeyExA
• 0x494210 RegCloseKey
Library oleaut32.dll:
• 0x494218 SysFreeString
• 0x49421c SysReAllocStringLen
• 0x494220 SysAllocStringLen
Library kernel32.dll:
• 0x494228 TlsSetValue
• 0x49422c TlsGetValue
• 0x494230 LocalAlloc
• 0x494234 GetModuleHandleA
Library advapi32.dll:
• 0x49423c RegQueryValueExA
• 0x494240 RegOpenKeyExA
• 0x494244 RegCloseKey
Library kernel32.dll:
• 0x49424c lstrcpyA
• 0x494250 lstrcmpA
• 0x494254 WriteFile
• 0x494258 WinExec
• 0x49425c WaitForSingleObject
• 0x494260 VirtualQuery
• 0x494264 VirtualProtect
• 0x494268 VirtualAlloc
• 0x49426c Sleep
• 0x494270 SizeofResource
• 0x494274 SetThreadLocale
• 0x494278 SetFilePointer
• 0x49427c SetEvent
• 0x494280 SetErrorMode
• 0x494284 SetEndOfFile
• 0x494288 ResetEvent
• 0x49428c ReadFile
• 0x494290 MultiByteToWideChar
• 0x494294 MulDiv
• 0x494298 LockResource
• 0x49429c LoadResource
• 0x4942a0 LoadLibraryA
• 0x4942ac GlobalUnlock
• 0x4942b0 GlobalSize
• 0x4942b4 GlobalReAlloc
• 0x4942b8 GlobalHandle
• 0x4942bc GlobalLock
• 0x4942c0 GlobalFree
• 0x4942c4 GlobalFindAtomA
• 0x4942c8 GlobalDeleteAtom
• 0x4942cc GlobalAlloc
• 0x4942d0 GlobalAddAtomA
• 0x4942d4 GetVersionExA
• 0x4942d8 GetVersion
• 0x4942dc GetUserDefaultLCID
• 0x4942e0 GetTickCount
• 0x4942e4 GetThreadLocale
• 0x4942ec GetSystemInfo
• 0x4942f0 GetStringTypeExA
• 0x4942f4 GetStdHandle
• 0x4942f8 GetProcAddress
• 0x4942fc GetModuleHandleA
• 0x494300 GetModuleFileNameA
• 0x494304 GetLocaleInfoA
• 0x494308 GetLocalTime
• 0x49430c GetLastError
• 0x494310 GetFullPathNameA
• 0x494314 GetDiskFreeSpaceA
• 0x494318 GetDateFormatA
• 0x49431c GetCurrentThreadId
• 0x494320 GetCurrentProcessId
• 0x494324 GetComputerNameA
• 0x494328 GetCPInfo
• 0x49432c GetACP
• 0x494330 FreeResource
• 0x494334 InterlockedExchange
• 0x494338 FreeLibrary
• 0x49433c FormatMessageA
• 0x494340 FindResourceA
• 0x494348 EnumCalendarInfoA
• 0x494354 CreateThread
• 0x494358 CreateFileA
• 0x49435c CreateEventA
• 0x494360 CompareStringA
• 0x494364 CloseHandle
Library version.dll:
• 0x49436c VerQueryValueA
• 0x494374 GetFileVersionInfoA
Library gdi32.dll:
• 0x49437c UnrealizeObject
• 0x494380 StretchBlt
• 0x494384 SetWindowOrgEx
• 0x494388 SetWinMetaFileBits
• 0x49438c SetViewportOrgEx
• 0x494390 SetTextColor
• 0x494394 SetStretchBltMode
• 0x494398 SetROP2
• 0x49439c SetPixel
• 0x4943a0 SetMapMode
• 0x4943a4 SetEnhMetaFileBits
• 0x4943a8 SetDIBColorTable
• 0x4943ac SetBrushOrgEx
• 0x4943b0 SetBkMode
• 0x4943b4 SetBkColor
• 0x4943b8 SelectPalette
• 0x4943bc SelectObject
• 0x4943c0 SelectClipRgn
• 0x4943c4 SaveDC
• 0x4943c8 RestoreDC
• 0x4943cc Rectangle
• 0x4943d0 RectVisible
• 0x4943d4 RealizePalette
• 0x4943d8 Polyline
• 0x4943dc PlayEnhMetaFile
• 0x4943e0 PatBlt
• 0x4943e4 MoveToEx
• 0x4943e8 MaskBlt
• 0x4943ec LineTo
• 0x4943f0 LPtoDP
• 0x4943f4 IntersectClipRect
• 0x4943f8 GetWindowOrgEx
• 0x4943fc GetWinMetaFileBits
• 0x494400 GetTextMetricsA
• 0x49440c GetStockObject
• 0x494410 GetPixel
• 0x494414 GetPaletteEntries
• 0x494418 GetObjectA
• 0x494428 GetEnhMetaFileBits
• 0x49442c GetDeviceCaps
• 0x494430 GetDIBits
• 0x494434 GetDIBColorTable
• 0x494438 GetDCOrgEx
• 0x494440 GetClipRgn
• 0x494444 GetClipBox
• 0x494448 GetBrushOrgEx
• 0x49444c GetBitmapBits
• 0x494450 GetArcDirection
• 0x494454 ExcludeClipRect
• 0x494458 DeleteObject
• 0x49445c DeleteEnhMetaFile
• 0x494460 DeleteDC
• 0x494464 CreateSolidBrush
• 0x494468 CreateRectRgn
• 0x49446c CreatePenIndirect
• 0x494470 CreatePen
• 0x494474 CreatePalette
• 0x49447c CreateFontIndirectA
• 0x494480 CreateEnhMetaFileA
• 0x494484 CreateDIBitmap
• 0x494488 CreateDIBSection
• 0x49448c CreateCompatibleDC
• 0x494494 CreateBrushIndirect
• 0x494498 CreateBitmap
• 0x49449c CopyEnhMetaFileA
• 0x4944a0 CloseEnhMetaFile
• 0x4944a4 BitBlt
Library user32.dll:
• 0x4944ac CreateWindowExA
• 0x4944b0 WindowFromPoint
• 0x4944b4 WinHelpA
• 0x4944b8 WaitMessage
• 0x4944bc ValidateRect
• 0x4944c0 UpdateWindow
• 0x4944c4 UnregisterClassA
• 0x4944c8 UnhookWindowsHookEx
• 0x4944cc TranslateMessage
• 0x4944d4 TrackPopupMenu
• 0x4944dc ShowWindow
• 0x4944e0 ShowScrollBar
• 0x4944e4 ShowOwnedPopups
• 0x4944e8 ShowCursor
• 0x4944ec SetWindowsHookExA
• 0x4944f0 SetWindowTextA
• 0x4944f4 SetWindowPos
• 0x4944f8 SetWindowPlacement
• 0x4944fc SetWindowLongA
• 0x494500 SetTimer
• 0x494504 SetScrollRange
• 0x494508 SetScrollPos
• 0x49450c SetScrollInfo
• 0x494510 SetRect
• 0x494514 SetPropA
• 0x494518 SetParent
• 0x49451c SetMenuItemInfoA
• 0x494520 SetMenu
• 0x494524 SetForegroundWindow
• 0x494528 SetFocus
• 0x49452c SetCursor
• 0x494530 SetClassLongA
• 0x494534 SetCapture
• 0x494538 SetActiveWindow
• 0x49453c SendMessageA
• 0x494540 ScrollWindow
• 0x494544 ScreenToClient
• 0x494548 RemovePropA
• 0x49454c RemoveMenu
• 0x494550 ReleaseDC
• 0x494554 ReleaseCapture
• 0x494560 RegisterClassA
• 0x494564 RedrawWindow
• 0x494568 PtInRect
• 0x49456c PostQuitMessage
• 0x494570 PostMessageA
• 0x494574 PeekMessageA
• 0x494578 OffsetRect
• 0x49457c OemToCharA
• 0x494580 MessageBoxA
• 0x494584 MapWindowPoints
• 0x494588 MapVirtualKeyA
• 0x49458c LoadStringA
• 0x494590 LoadKeyboardLayoutA
• 0x494594 LoadIconA
• 0x494598 LoadCursorA
• 0x49459c LoadBitmapA
• 0x4945a0 KillTimer
• 0x4945a4 IsZoomed
• 0x4945a8 IsWindowVisible
• 0x4945ac IsWindowEnabled
• 0x4945b0 IsWindow
• 0x4945b4 IsRectEmpty
• 0x4945b8 IsIconic
• 0x4945bc IsDialogMessageA
• 0x4945c0 IsChild
• 0x4945c4 InvalidateRect
• 0x4945c8 IntersectRect
• 0x4945cc InsertMenuItemA
• 0x4945d0 InsertMenuA
• 0x4945d4 InflateRect
• 0x4945dc GetWindowTextA
• 0x4945e0 GetWindowRect
• 0x4945e4 GetWindowPlacement
• 0x4945e8 GetWindowLongA
• 0x4945ec GetWindowDC
• 0x4945f0 GetTopWindow
• 0x4945f4 GetSystemMetrics
• 0x4945f8 GetSystemMenu
• 0x4945fc GetSysColorBrush
• 0x494600 GetSysColor
• 0x494604 GetSubMenu
• 0x494608 GetScrollRange
• 0x49460c GetScrollPos
• 0x494610 GetScrollInfo
• 0x494614 GetPropA
• 0x494618 GetParent
• 0x49461c GetWindow
• 0x494620 GetMessageTime
• 0x494624 GetMenuStringA
• 0x494628 GetMenuState
• 0x49462c GetMenuItemInfoA
• 0x494630 GetMenuItemID
• 0x494634 GetMenuItemCount
• 0x494638 GetMenu
• 0x49463c GetLastActivePopup
• 0x494640 GetKeyboardState
• 0x494648 GetKeyboardLayout
• 0x49464c GetKeyState
• 0x494650 GetKeyNameTextA
• 0x494654 GetIconInfo
• 0x494658 GetForegroundWindow
• 0x49465c GetFocus
• 0x494660 GetDlgItem
• 0x494664 GetDesktopWindow
• 0x494668 GetDCEx
• 0x49466c GetDC
• 0x494670 GetCursorPos
• 0x494674 GetCursor
• 0x494678 GetClipboardData
• 0x49467c GetClientRect
• 0x494680 GetClassNameA
• 0x494684 GetClassInfoA
• 0x494688 GetCapture
• 0x49468c GetActiveWindow
• 0x494690 FrameRect
• 0x494694 FindWindowA
• 0x494698 FillRect
• 0x49469c EqualRect
• 0x4946a0 EnumWindows
• 0x4946a4 EnumThreadWindows
• 0x4946a8 EndPaint
• 0x4946ac EnableWindow
• 0x4946b0 EnableScrollBar
• 0x4946b4 EnableMenuItem
• 0x4946b8 DrawTextA
• 0x4946bc DrawMenuBar
• 0x4946c0 DrawIconEx
• 0x4946c4 DrawIcon
• 0x4946c8 DrawFrameControl
• 0x4946cc DrawFocusRect
• 0x4946d0 DrawEdge
• 0x4946d4 DispatchMessageA
• 0x4946d8 DestroyWindow
• 0x4946dc DestroyMenu
• 0x4946e0 DestroyIcon
• 0x4946e4 DestroyCursor
• 0x4946e8 DeleteMenu
• 0x4946ec DefWindowProcA
• 0x4946f0 DefMDIChildProcA
• 0x4946f4 DefFrameProcA
• 0x4946f8 CreatePopupMenu
• 0x4946fc CreateMenu
• 0x494700 CreateIcon
• 0x494704 ClientToScreen
• 0x494708 CheckMenuItem
• 0x49470c CallWindowProcA
• 0x494710 CallNextHookEx
• 0x494714 BeginPaint
• 0x494718 CharNextA
• 0x49471c CharLowerBuffA
• 0x494720 CharLowerA
• 0x494724 CharUpperBuffA
• 0x494728 CharToOemA
• 0x49472c AdjustWindowRectEx
Library kernel32.dll:
• 0x494738 Sleep
Library oleaut32.dll:
• 0x494740 SafeArrayPtrOfIndex
• 0x494744 SafeArrayPutElement
• 0x494748 SafeArrayGetElement
• 0x494750 SafeArrayAccessData
• 0x494754 SafeArrayGetUBound
• 0x494758 SafeArrayGetLBound
• 0x49475c SafeArrayCreate
• 0x494760 VariantChangeType
• 0x494764 VariantCopyInd
• 0x494768 VariantCopy
• 0x49476c VariantClear
• 0x494770 VariantInit
Library ole32.dll:
• 0x49477c IsAccelerator
• 0x494780 OleDraw
• 0x494788 CoTaskMemFree
• 0x49478c ProgIDFromCLSID
• 0x494790 StringFromCLSID
• 0x494794 CoCreateInstance
• 0x494798 CoGetClassObject
• 0x49479c CoUninitialize
• 0x4947a0 CoInitialize
• 0x4947a4 IsEqualGUID
Library oleaut32.dll:
• 0x4947ac GetErrorInfo
• 0x4947b0 GetActiveObject
• 0x4947b4 SysFreeString
Library comctl32.dll:
• 0x4947c4 ImageList_Write
• 0x4947c8 ImageList_Read
• 0x4947d8 ImageList_DragMove
• 0x4947dc ImageList_DragLeave
• 0x4947e0 ImageList_DragEnter
• 0x4947e4 ImageList_EndDrag
• 0x4947e8 ImageList_BeginDrag
• 0x4947ec ImageList_Remove
• 0x4947f0 ImageList_DrawEx
• 0x4947f4 ImageList_Draw
• 0x494804 ImageList_Add
• 0x49480c ImageList_Destroy
• 0x494810 ImageList_Create
• 0x494814 InitCommonControls
Library comdlg32.dll:
• 0x49481c GetOpenFileNameA
Library user32.dll:
• 0x494824 DdeCmpStringHandles
• 0x494828 DdeFreeStringHandle
• 0x49482c DdeQueryStringA
• 0x494834 DdeGetLastError
• 0x494838 DdeFreeDataHandle
• 0x49483c DdeUnaccessData
• 0x494840 DdeAccessData
• 0x494844 DdeCreateDataHandle
• 0x49484c DdeNameService
• 0x494850 DdePostAdvise
• 0x494854 DdeSetUserHandle
• 0x494858 DdeQueryConvInfo
• 0x49485c DdeDisconnect
• 0x494860 DdeConnect
• 0x494864 DdeUninitialize
• 0x494868 DdeInitializeA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 49236 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.