7.0
高危
该样本未表现出任何异常！
重新分析
更多

1d9b668e956e75ca9edc68dd478757943d0a3f60bccb89a49b8aed84354638ae

bbf8117b6ed782f67e056e2d83934924.exe

分析耗时

82s

最近分析

文件大小

468.0KB
静态报毒 动态报毒 PUTTY
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1620930998.659
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Tries to locate where the browsers are installed (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1620930978.002
GlobalMemoryStatusEx
success 1 0
The file contains an unknown PE resource name possibly indicative of a packer (3 个事件)
resource name CLRC
resource name RCDATA
resource name RC_DATA
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (50 out of 163 个事件)
Time & API Arguments Status Return Repeated
1620930990.049
NtAllocateVirtualMemory
process_identifier: 284
region_size: 212992
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01fc0000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00401000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00402000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00403000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00404000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00405000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00406000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00407000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00408000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00409000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0040a000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0040b000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0040c000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0040d000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0040e000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0040f000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00410000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00411000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00412000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00413000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00414000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00415000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00416000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00417000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00418000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00419000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0041a000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0041b000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0041c000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0041d000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0041e000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0041f000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00420000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00421000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00422000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00423000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00424000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00425000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00426000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00427000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00428000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00429000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0042a000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0042b000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0042c000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0042d000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0042e000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x0042f000
success 0 0
1620930996.159
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00430000
success 0 0
Steals private information from local Internet browsers (19 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Web Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Web Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Web Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
file C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.364456686027418 section {'size_of_data': '0x00035200', 'virtual_address': '0x0003e000', 'entropy': 7.364456686027418, 'name': '.rsrc', 'virtual_size': '0x00035090'} description A section with a high entropy has been found
entropy 0.4550321199143469 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 172.217.24.14
host 198.23.200.241
Harvests credentials from local FTP client softwares (22 个事件)
file C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\FTPGetter\servers.xml
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\wcx_ftp.ini
file C:\Windows\wcx_ftp.ini
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\GHISLER\wcx_ftp.ini
file C:\Users\Administrator.Oskar-PC\wcx_ftp.ini
file C:\Windows\32BitFtp.ini
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\sitemanager.xml
file C:\Program Files (x86)\FileZilla\Filezilla.xml
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\filezilla.xml
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\recentservers.xml
registry HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry HKEY_CURRENT_USER\Software\Martin Prikryl
registry HKEY_LOCAL_MACHINE\Software\Martin Prikryl
Harvests information related to installed instant messenger clients (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\.purple\accounts.xml
Harvests credentials from local email clients (3 个事件)
registry HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
registry HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird
registry HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook
Putty Files, Registry Keys and/or Mutexes Detected
Generates some ICMP traffic
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 198.23.200.241:80
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-02-06 04:47:09

Imports

Library KERNEL32.dll:
• 0x4290e4 TerminateProcess
• 0x4290f0 IsDebuggerPresent
• 0x4290f4 HeapFree
• 0x4290f8 RtlUnwind
• 0x4290fc Sleep
• 0x429100 HeapReAlloc
• 0x429104 RaiseException
• 0x429108 HeapSize
• 0x42910c GetStdHandle
• 0x429110 GetModuleFileNameA
• 0x42911c GetCommandLineW
• 0x429120 SetHandleCount
• 0x429124 GetFileType
• 0x429128 GetStartupInfoA
• 0x42912c HeapCreate
• 0x429130 VirtualFree
• 0x429138 GetTickCount
• 0x429140 HeapAlloc
• 0x429148 GetCPInfo
• 0x42914c GetACP
• 0x429150 GetOEMCP
• 0x429154 IsValidCodePage
• 0x429158 GetLocaleInfoA
• 0x42915c GetConsoleCP
• 0x429160 GetConsoleMode
• 0x429164 GetStringTypeA
• 0x429168 GetStringTypeW
• 0x42916c LCMapStringA
• 0x429170 LCMapStringW
• 0x429174 SetStdHandle
• 0x429178 WriteConsoleA
• 0x42917c GetConsoleOutputCP
• 0x429180 WriteConsoleW
• 0x429184 CreateFileA
• 0x429188 ExitThread
• 0x42918c GetStartupInfoW
• 0x429190 SetErrorMode
• 0x429194 GetCurrentProcess
• 0x429198 FlushFileBuffers
• 0x4291a0 TlsFree
• 0x4291a4 LocalReAlloc
• 0x4291a8 TlsSetValue
• 0x4291ac TlsAlloc
• 0x4291b0 GlobalHandle
• 0x4291b4 GlobalReAlloc
• 0x4291b8 TlsGetValue
• 0x4291bc LocalAlloc
• 0x4291c4 GlobalFlags
• 0x4291d8 GlobalFindAtomW
• 0x4291dc GetVersionExW
• 0x4291e0 CompareStringW
• 0x4291e4 GetVersionExA
• 0x4291e8 FormatMessageW
• 0x4291ec LocalFree
• 0x4291f4 MulDiv
• 0x4291f8 lstrlenW
• 0x4291fc FreeResource
• 0x429200 GlobalAddAtomW
• 0x429204 GetCurrentProcessId
• 0x429208 SetLastError
• 0x42920c GlobalDeleteAtom
• 0x429210 GetCurrentThread
• 0x429214 GetCurrentThreadId
• 0x429220 GetModuleFileNameW
• 0x429224 lstrcmpA
• 0x429228 GetLocaleInfoW
• 0x42922c LoadLibraryW
• 0x429230 InterlockedExchange
• 0x429234 lstrcmpW
• 0x429238 FreeLibrary
• 0x42923c GetModuleHandleW
• 0x429244 OpenEventA
• 0x42924c LoadLibraryA
• 0x429250 GlobalFree
• 0x429258 GetProcAddress
• 0x429260 lstrcpynW
• 0x429264 GetConsoleWindow
• 0x429268 CreateEventA
• 0x42926c FindResourceExA
• 0x429274 WaitForSingleObject
• 0x429278 lstrlenA
• 0x42927c ExitProcess
• 0x429280 LockResource
• 0x429284 GlobalUnlock
• 0x429288 MultiByteToWideChar
• 0x42928c SizeofResource
• 0x429290 WideCharToMultiByte
• 0x429294 GlobalAlloc
• 0x429298 GlobalLock
• 0x42929c LoadResource
• 0x4292a0 FindResourceW
• 0x4292a8 GetTempPathA
• 0x4292b0 DeleteFileW
• 0x4292b4 CloseHandle
• 0x4292b8 GetModuleHandleA
• 0x4292bc DeviceIoControl
• 0x4292c0 GetLastError
• 0x4292c8 GetFileSizeEx
• 0x4292cc CreateFileW
• 0x4292d0 WriteFile
• 0x4292d8 SetEndOfFile
• 0x4292dc VirtualAlloc
• 0x4292e0 SetFilePointer
Library USER32.dll:
• 0x429340 SetForegroundWindow
• 0x429344 UpdateWindow
• 0x429348 CreateWindowExW
• 0x42934c GetClassInfoExW
• 0x429350 GetClassInfoW
• 0x429354 RegisterClassW
• 0x429358 AdjustWindowRectEx
• 0x42935c GetDlgCtrlID
• 0x429360 DefWindowProcW
• 0x429364 CallWindowProcW
• 0x429368 CopyRect
• 0x42936c PtInRect
• 0x429370 SetWindowLongW
• 0x429374 SetWindowPos
• 0x42937c GetWindowPlacement
• 0x429380 GetMenuItemID
• 0x429384 GetMenuItemCount
• 0x429388 UnhookWindowsHookEx
• 0x42938c GetSysColor
• 0x429390 ClientToScreen
• 0x429394 GrayStringW
• 0x429398 DrawTextExW
• 0x42939c DrawTextW
• 0x4293a0 TabbedTextOutW
• 0x4293a8 GetWindowTextW
• 0x4293ac GetWindow
• 0x4293b0 SetFocus
• 0x4293b4 GetDesktopWindow
• 0x4293b8 SetActiveWindow
• 0x4293bc IsWindow
• 0x4293c0 GetNextDlgTabItem
• 0x4293c4 EndDialog
• 0x4293c8 SetWindowsHookExW
• 0x4293cc CallNextHookEx
• 0x4293d0 GetMessageW
• 0x4293d4 TranslateMessage
• 0x4293d8 DispatchMessageW
• 0x4293dc GetKeyState
• 0x4293e0 PeekMessageW
• 0x4293e4 ValidateRect
• 0x4293ec GetWindowLongW
• 0x4293f0 GetLastActivePopup
• 0x4293f4 IsWindowEnabled
• 0x4293f8 MessageBoxW
• 0x4293fc SetCursor
• 0x429400 PostMessageW
• 0x429404 GetWindowRect
• 0x429408 GetSubMenu
• 0x42940c LoadBitmapW
• 0x429410 GetFocus
• 0x429414 GetParent
• 0x429418 ModifyMenuW
• 0x42941c GetMenuState
• 0x429420 EnableMenuItem
• 0x429424 CheckMenuItem
• 0x429428 EndPaint
• 0x42942c DestroyWindow
• 0x429430 SendInput
• 0x429434 PostQuitMessage
• 0x429438 DrawTextA
• 0x42943c SetMenuItemBitmaps
• 0x429440 LoadBitmapA
• 0x42944c BeginPaint
• 0x429450 GetDC
• 0x429454 DrawFocusRect
• 0x429458 GetMenu
• 0x42945c SetRect
• 0x429460 CheckMenuRadioItem
• 0x429464 MessageBoxA
• 0x42946c ReleaseDC
• 0x429474 SetClassLongA
• 0x429478 SetClipboardData
• 0x429480 GetDlgItem
• 0x429484 DefWindowProcA
• 0x429488 GetCursorPos
• 0x42948c GetMenuItemInfoA
• 0x429490 SetWindowTextA
• 0x429498 SetMenuItemInfoA
• 0x42949c GetDialogBaseUnits
• 0x4294a0 GetClassLongA
• 0x4294a4 CloseClipboard
• 0x4294a8 IsIconic
• 0x4294b0 DrawIcon
• 0x4294b4 GetClientRect
• 0x4294b8 LoadIconW
• 0x4294bc GetClipboardData
• 0x4294c0 EmptyClipboard
• 0x4294c4 UnregisterClassW
• 0x4294c8 GetActiveWindow
• 0x4294cc EnableWindow
• 0x4294d0 SendMessageW
• 0x4294d4 GetSystemMetrics
• 0x4294d8 OpenClipboard
• 0x4294dc DestroyMenu
• 0x4294e0 LoadCursorW
• 0x4294e4 GetSysColorBrush
• 0x4294e8 ShowWindow
• 0x4294ec SetWindowTextW
• 0x4294f0 IsDialogMessageW
• 0x4294f8 SendDlgItemMessageW
• 0x4294fc SendDlgItemMessageA
• 0x429500 WinHelpW
• 0x429504 GetCapture
• 0x429508 GetClassLongW
• 0x42950c GetClassNameW
• 0x429510 SetPropW
• 0x429514 GetPropW
• 0x429518 RemovePropW
• 0x42951c GetForegroundWindow
• 0x429520 GetTopWindow
• 0x429524 GetMessageTime
• 0x429528 GetMessagePos
• 0x42952c MapWindowPoints
• 0x429530 SetMenu
• 0x429534 IsWindowVisible
Library GDI32.dll:
• 0x429050 SetTextColor
• 0x429054 GetClipBox
• 0x429058 GetObjectW
• 0x42905c PtVisible
• 0x429060 RectVisible
• 0x429064 TextOutW
• 0x429068 ExtTextOutW
• 0x42906c SetViewportOrgEx
• 0x429070 OffsetViewportOrgEx
• 0x429074 SetViewportExtEx
• 0x429078 ScaleViewportExtEx
• 0x42907c ScaleWindowExtEx
• 0x429080 GetDeviceCaps
• 0x429084 SaveDC
• 0x429088 CreateBitmap
• 0x429090 LPtoDP
• 0x429094 DeleteDC
• 0x429098 StretchBlt
• 0x4290a0 CreateDCA
• 0x4290a4 DeleteObject
• 0x4290a8 SelectObject
• 0x4290ac CreateCompatibleDC
• 0x4290b0 SetMapMode
• 0x4290b8 StartDocA
• 0x4290bc Ellipse
• 0x4290c0 SetPixelV
• 0x4290c4 SetBkColor
• 0x4290cc Escape
• 0x4290d0 SetWindowExtEx
• 0x4290d4 RestoreDC
• 0x4290d8 GetStockObject
• 0x4290dc CreatePen
Library COMDLG32.dll:
• 0x429048 PrintDlgExA
Library WINSPOOL.DRV:
• 0x42954c DocumentPropertiesW
• 0x429550 ClosePrinter
• 0x429554 OpenPrinterW
Library ADVAPI32.dll:
• 0x429000 RegQueryValueW
• 0x429004 LookupAccountNameW
• 0x429008 RegCloseKey
• 0x42900c RegSetValueExW
• 0x429010 RegCreateKeyExW
• 0x429014 GetTokenInformation
• 0x429018 RegOpenKeyW
• 0x42901c RegEnumKeyW
• 0x429020 RegDeleteKeyW
• 0x429024 RegOpenKeyExW
• 0x429028 RegQueryValueExW
Library SHELL32.dll:
• 0x429310 SHBindToParent
• 0x429314 SHParseDisplayName
Library COMCTL32.dll:
Library SHLWAPI.dll:
• 0x42931c PathUnquoteSpacesA
• 0x429320 PathGetDriveNumberA
• 0x429324 StrRetToBufW
• 0x429328 PathFindExtensionW
• 0x42932c PathFindFileNameW
• 0x429330 PathIsContentTypeA
Library ole32.dll:
• 0x429590 CoTaskMemFree
Library OLEAUT32.dll:
• 0x4292fc VariantInit
• 0x429300 VariantChangeType
• 0x429304 VariantClear
Library urlmon.dll:
• 0x42959c GetClassFileOrMime
Library WS2_32.dll:
• 0x429568 WSAStartup
Library AVIFIL32.dll:
• 0x429030 AVIStreamStart
• 0x429038 AVIStreamLength
Library WINTRUST.dll:
• 0x429560 CryptCATPutAttrInfo
Library gdiplus.dll:
• 0x429578 GdipCloneImage
• 0x42957c GdipAlloc
• 0x429580 GdipFree
• 0x429588 GdipDisposeImage
Library OLEACC.dll:
• 0x4292f4 LresultFromObject
Library WTSAPI32.dll:
Library USP10.dll:
• 0x429540 ScriptFreeCache
• 0x429544 ScriptGetCMap
Library TAPI32.dll:
• 0x429338 lineSetTollListA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 49238 239.255.255.250 1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.