SmartHawk

9.4

极危

该样本未表现出任何异常！

重新分析

下载样本

85882eb547fe7cdfa1dc1ac5287ba40cd0580254d0df76b06f43d892dc701e95

fea90cb02dfefe7b0f20cb79db1a6a9d.exe

分析耗时

75s

最近分析

文件大小

594.0KB

静态报毒动态报毒 PUTTY

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Queries for the computername (3 个事件)

Time & API	Arguments	Status	Return
1620810358.051501 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620810358.911501 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620810359.098501 GetComputerNameW	computer_name: OSKAR-PC	success	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620810356.317501 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620809363.930307 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 49348416 registers.edi: 0 registers.eax: 0 registers.ebp: 49348488 registers.edx: 49 registers.ebx: 0 registers.esi: 0 registers.ecx: 879 exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 66 e9 41 f1 fa exception.symbol: fea90cb02dfefe7b0f20cb79db1a6a9d+0x5441e exception.instruction: div eax exception.module: fea90cb02dfefe7b0f20cb79db1a6a9d.exe exception.exception_code: 0xc0000094 exception.offset: 345118 exception.address: 0x45441e	success	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1620809363.758307 NtAllocateVirtualMemory	process_identifier: 1068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e0000	success
1620809363.930307 NtAllocateVirtualMemory	process_identifier: 1068 region_size: 61440 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00500000	success
1620809363.946307 NtAllocateVirtualMemory	process_identifier: 1068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01f60000	success

Steals private information from local Internet browsers (19 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (6 个事件)

Time & API	Arguments	Status	Return
1620809363.946307 Process32NextW	process_name: pythonw.exe snapshot_handle: 0x000000f8 process_identifier: 1432	success	1
1620809363.946307 Process32NextW	process_name: wsqmcons.exe snapshot_handle: 0x000000f8 process_identifier: 2476	success	1
1620809363.946307 Process32NextW	process_name: sdclt.exe snapshot_handle: 0x000000f8 process_identifier: 2620	success	1
1620809363.946307 Process32NextW	process_name: taskhost.exe snapshot_handle: 0x000000f8 process_identifier: 2344	success	1
1620809363.946307 Process32NextW	process_name: dllhost.exe snapshot_handle: 0x000000f8 process_identifier: 2760	success	1
1620809363.946307 Process32NextW	process_name: mobsync.exe snapshot_handle: 0x000000f8 process_identifier: 2824	success	1

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620810359.051501 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\fea90cb02dfefe7b0f20cb79db1a6a9d.exe newfilepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\6ED2B0\0019EA.exe newfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\6ED2B0\0019EA.exe flags: 1 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\fea90cb02dfefe7b0f20cb79db1a6a9d.exe	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (3 个事件)

entropy

7.677201593069892

section

{'size_of_data': '0x00010000', 'virtual_address': '0x00055000', 'entropy': 7.677201593069892, 'name': 'DATA', 'virtual_size': '0x0000ff40'}

description

A section with a high entropy has been found

entropy

7.095219814106221

section

{'size_of_data': '0x00028800', 'virtual_address': '0x00071000', 'entropy': 7.095219814106221, 'name': '.rsrc', 'virtual_size': '0x000286fc'}

description

A section with a high entropy has been found

entropy

0.3811129848229342

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620810358.832501 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Harvests credentials from local FTP client softwares (22 个事件)

file	C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FTPGetter\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\wcx_ftp.ini
file	C:\Windows\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\GHISLER\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\wcx_ftp.ini
file	C:\Windows\32BitFtp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Program Files (x86)\FileZilla\Filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\recentservers.xml
registry	HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry	HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry	HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry	HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry	HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_CURRENT_USER\Software\Martin Prikryl
registry	HKEY_LOCAL_MACHINE\Software\Martin Prikryl

Harvests information related to installed instant messenger clients (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\.purple\accounts.xml

Harvests credentials from local email clients (3 个事件)

registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1068 called NtSetContextThread to modify thread in remote process 2536
1620809364.993307 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2536	success	0	0

Putty Files, Registry Keys and/or Mutexes Detected

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1068 resumed a thread in remote process 2536
1620809365.383307 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 2536	success	0	0

Executed a process and injected code into it, probably while unpacking (7 个事件)

Time & API	Arguments	Status	Return
1620809364.774307 CreateProcessInternalW	thread_identifier: 196 thread_handle: 0x000000fc process_identifier: 2536 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\fea90cb02dfefe7b0f20cb79db1a6a9d.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000100 inherit_handles: 0	success	1
1620809364.774307 NtUnmapViewOfSection	process_identifier: 2536 region_size: 4096 process_handle: 0x00000100 base_address: 0x00400000	success	0
1620809364.774307 NtMapViewOfSection	section_handle: 0x00000108 process_identifier: 2536 commit_size: 663552 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000100 allocation_type: 0 () section_offset: 0 view_size: 663552 base_address: 0x00400000	success	0
1620809364.977307 NtGetContextThread	thread_handle: 0x000000fc	success	0
1620809364.993307 NtSetContextThread	thread_handle: 0x000000fc registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2536	success	0
1620809365.383307 NtResumeThread	thread_handle: 0x000000fc suspend_count: 1 process_identifier: 2536	success	0
1620810356.864501 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 2536	success	0

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x46612c DeleteCriticalSection

• 0x466130 LeaveCriticalSection

• 0x466134 EnterCriticalSection

• 0x466138 InitializeCriticalSection

• 0x46613c VirtualFree

• 0x466140 VirtualAlloc

• 0x466144 LocalFree

• 0x466148 LocalAlloc

• 0x46614c GetVersion

• 0x466150 GetCurrentThreadId

• 0x466154 InterlockedDecrement

• 0x466158 InterlockedIncrement

• 0x46615c VirtualQuery

• 0x466160 WideCharToMultiByte

• 0x466164 MultiByteToWideChar

• 0x466168 lstrlenA

• 0x46616c lstrcpynA

• 0x466170 LoadLibraryExA

• 0x466174 GetThreadLocale

• 0x466178 GetStartupInfoA

• 0x46617c GetProcAddress

• 0x466180 GetModuleHandleA

• 0x466184 GetModuleFileNameA

• 0x466188 GetLocaleInfoA

• 0x46618c GetCommandLineA

• 0x466190 FreeLibrary

• 0x466194 FindFirstFileA

• 0x466198 FindClose

• 0x46619c ExitProcess

• 0x4661a0 WriteFile

• 0x4661a4 UnhandledExceptionFilter

• 0x4661a8 RtlUnwind

• 0x4661ac RaiseException

• 0x4661b0 GetStdHandle

Library user32.dll:

• 0x4661b8 GetKeyboardType

• 0x4661bc LoadStringA

• 0x4661c0 MessageBoxA

• 0x4661c4 CharNextA

Library advapi32.dll:

• 0x4661cc RegQueryValueExA

• 0x4661d0 RegOpenKeyExA

• 0x4661d4 RegCloseKey

Library oleaut32.dll:

• 0x4661dc SysFreeString

• 0x4661e0 SysReAllocStringLen

• 0x4661e4 SysAllocStringLen

Library kernel32.dll:

• 0x4661ec TlsSetValue

• 0x4661f0 TlsGetValue

• 0x4661f4 LocalAlloc

• 0x4661f8 GetModuleHandleA

Library advapi32.dll:

• 0x466200 RegQueryValueExA

• 0x466204 RegOpenKeyExA

• 0x466208 RegCloseKey

Library kernel32.dll:

• 0x466210 lstrcpyA

• 0x466214 WriteFile

• 0x466218 WaitForSingleObjectEx

• 0x46621c WaitForSingleObject

• 0x466220 VirtualQuery

• 0x466224 VirtualAlloc

• 0x466228 Sleep

• 0x46622c SizeofResource

• 0x466230 SetThreadLocale

• 0x466234 SetFilePointer

• 0x466238 SetEvent

• 0x46623c SetErrorMode

• 0x466240 SetEndOfFile

• 0x466244 ResetEvent

• 0x466248 ReadFile

• 0x46624c MulDiv

• 0x466250 LockResource

• 0x466254 LoadResource

• 0x466258 LoadLibraryA

• 0x46625c LeaveCriticalSection

• 0x466260 InitializeCriticalSection

• 0x466264 GlobalUnlock

• 0x466268 GlobalReAlloc

• 0x46626c GlobalHandle

• 0x466270 GlobalLock

• 0x466274 GlobalFree

• 0x466278 GlobalFindAtomA

• 0x46627c GlobalDeleteAtom

• 0x466280 GlobalAlloc

• 0x466284 GlobalAddAtomA

• 0x466288 GetVersionExA

• 0x46628c GetVersion

• 0x466290 GetTickCount

• 0x466294 GetThreadLocale

• 0x466298 GetSystemTimeAsFileTime

• 0x46629c GetSystemTime

• 0x4662a0 GetSystemInfo

• 0x4662a4 GetStringTypeExA

• 0x4662a8 GetStdHandle

• 0x4662ac GetProcAddress

• 0x4662b0 GetModuleHandleA

• 0x4662b4 GetModuleFileNameA

• 0x4662b8 GetLocaleInfoA

• 0x4662bc GetLocalTime

• 0x4662c0 GetLastError

• 0x4662c4 GetFullPathNameA

• 0x4662c8 GetFileType

• 0x4662cc GetDiskFreeSpaceA

• 0x4662d0 GetDateFormatA

• 0x4662d4 GetCurrentThreadId

• 0x4662d8 GetCurrentProcessId

• 0x4662dc GetCPInfo

• 0x4662e0 GetACP

• 0x4662e4 FreeResource

• 0x4662e8 InterlockedExchange

• 0x4662ec FreeLibrary

• 0x4662f0 FormatMessageA

• 0x4662f4 FindResourceA

• 0x4662f8 FileTimeToSystemTime

• 0x4662fc ExitThread

• 0x466300 EnumCalendarInfoA

• 0x466304 EnterCriticalSection

• 0x466308 DeleteCriticalSection

• 0x46630c CreateThread

• 0x466310 CreateFileA

• 0x466314 CreateEventA

• 0x466318 CompareStringA

• 0x46631c CloseHandle

Library version.dll:

• 0x466324 VerQueryValueA

• 0x466328 GetFileVersionInfoSizeA

• 0x46632c GetFileVersionInfoA

Library gdi32.dll:

• 0x466334 UnrealizeObject

• 0x466338 StretchBlt

• 0x46633c SetWindowOrgEx

• 0x466340 SetViewportOrgEx

• 0x466344 SetTextColor

• 0x466348 SetStretchBltMode

• 0x46634c SetROP2

• 0x466350 SetPixel

• 0x466354 SetDIBColorTable

• 0x466358 SetBrushOrgEx

• 0x46635c SetBkMode

• 0x466360 SetBkColor

• 0x466364 SelectPalette

• 0x466368 SelectObject

• 0x46636c SaveDC

• 0x466370 RestoreDC

• 0x466374 RectVisible

• 0x466378 RealizePalette

• 0x46637c PatBlt

• 0x466380 MoveToEx

• 0x466384 MaskBlt

• 0x466388 LineTo

• 0x46638c IntersectClipRect

• 0x466390 GetWindowOrgEx

• 0x466394 GetTextMetricsA

• 0x466398 GetTextExtentPoint32A

• 0x46639c GetSystemPaletteEntries

• 0x4663a0 GetStockObject

• 0x4663a4 GetPixel

• 0x4663a8 GetPaletteEntries

• 0x4663ac GetObjectA

• 0x4663b0 GetDeviceCaps

• 0x4663b4 GetDIBits

• 0x4663b8 GetDIBColorTable

• 0x4663bc GetDCOrgEx

• 0x4663c0 GetCurrentPositionEx

• 0x4663c4 GetClipBox

• 0x4663c8 GetBrushOrgEx

• 0x4663cc GetBitmapBits

• 0x4663d0 ExcludeClipRect

• 0x4663d4 DeleteObject

• 0x4663d8 DeleteDC

• 0x4663dc CreateSolidBrush

• 0x4663e0 CreatePenIndirect

• 0x4663e4 CreatePalette

• 0x4663e8 CreateHalftonePalette

• 0x4663ec CreateFontIndirectA

• 0x4663f0 CreateDIBitmap

• 0x4663f4 CreateDIBSection

• 0x4663f8 CreateCompatibleDC

• 0x4663fc CreateCompatibleBitmap

• 0x466400 CreateBrushIndirect

• 0x466404 CreateBitmap

• 0x466408 BitBlt

Library user32.dll:

• 0x466410 CreateWindowExA

• 0x466414 WindowFromPoint

• 0x466418 WinHelpA

• 0x46641c WaitMessage

• 0x466420 UpdateWindow

• 0x466424 UnregisterClassA

• 0x466428 UnhookWindowsHookEx

• 0x46642c TranslateMessage

• 0x466430 TranslateMDISysAccel

• 0x466434 TrackPopupMenu

• 0x466438 SystemParametersInfoA

• 0x46643c ShowWindow

• 0x466440 ShowScrollBar

• 0x466444 ShowOwnedPopups

• 0x466448 ShowCursor

• 0x46644c SetWindowsHookExA

• 0x466450 SetWindowTextA

• 0x466454 SetWindowPos

• 0x466458 SetWindowPlacement

• 0x46645c SetWindowLongA

• 0x466460 SetTimer

• 0x466464 SetScrollRange

• 0x466468 SetScrollPos

• 0x46646c SetScrollInfo

• 0x466470 SetRect

• 0x466474 SetPropA

• 0x466478 SetParent

• 0x46647c SetMenuItemInfoA

• 0x466480 SetMenu

• 0x466484 SetForegroundWindow

• 0x466488 SetFocus

• 0x46648c SetCursor

• 0x466490 SetClassLongA

• 0x466494 SetCapture

• 0x466498 SetActiveWindow

• 0x46649c SendMessageA

• 0x4664a0 ScrollWindow

• 0x4664a4 ScreenToClient

• 0x4664a8 RemovePropA

• 0x4664ac RemoveMenu

• 0x4664b0 ReleaseDC

• 0x4664b4 ReleaseCapture

• 0x4664b8 RegisterWindowMessageA

• 0x4664bc RegisterClipboardFormatA

• 0x4664c0 RegisterClassA

• 0x4664c4 RedrawWindow

• 0x4664c8 PtInRect

• 0x4664cc PostQuitMessage

• 0x4664d0 PostMessageA

• 0x4664d4 PeekMessageA

• 0x4664d8 OffsetRect

• 0x4664dc OemToCharA

• 0x4664e0 MessageBoxA

• 0x4664e4 MessageBeep

• 0x4664e8 MapWindowPoints

• 0x4664ec MapVirtualKeyA

• 0x4664f0 LoadStringA

• 0x4664f4 LoadKeyboardLayoutA

• 0x4664f8 LoadIconA

• 0x4664fc LoadCursorA

• 0x466500 LoadBitmapA

• 0x466504 KillTimer

• 0x466508 IsZoomed

• 0x46650c IsWindowVisible

• 0x466510 IsWindowEnabled

• 0x466514 IsWindow

• 0x466518 IsRectEmpty

• 0x46651c IsIconic

• 0x466520 IsDialogMessageA

• 0x466524 IsChild

• 0x466528 InvalidateRect

• 0x46652c IntersectRect

• 0x466530 InsertMenuItemA

• 0x466534 InsertMenuA

• 0x466538 InflateRect

• 0x46653c GetWindowThreadProcessId

• 0x466540 GetWindowTextA

• 0x466544 GetWindowRect

• 0x466548 GetWindowPlacement

• 0x46654c GetWindowLongA

• 0x466550 GetWindowDC

• 0x466554 GetTopWindow

• 0x466558 GetSystemMetrics

• 0x46655c GetSystemMenu

• 0x466560 GetSysColorBrush

• 0x466564 GetSysColor

• 0x466568 GetSubMenu

• 0x46656c GetScrollRange

• 0x466570 GetScrollPos

• 0x466574 GetScrollInfo

• 0x466578 GetPropA

• 0x46657c GetParent

• 0x466580 GetWindow

• 0x466584 GetMenuStringA

• 0x466588 GetMenuState

• 0x46658c GetMenuItemInfoA

• 0x466590 GetMenuItemID

• 0x466594 GetMenuItemCount

• 0x466598 GetMenu

• 0x46659c GetLastActivePopup

• 0x4665a0 GetKeyboardState

• 0x4665a4 GetKeyboardLayoutList

• 0x4665a8 GetKeyboardLayout

• 0x4665ac GetKeyState

• 0x4665b0 GetKeyNameTextA

• 0x4665b4 GetIconInfo

• 0x4665b8 GetForegroundWindow

• 0x4665bc GetFocus

• 0x4665c0 GetDesktopWindow

• 0x4665c4 GetDCEx

• 0x4665c8 GetDC

• 0x4665cc GetCursorPos

• 0x4665d0 GetCursor

• 0x4665d4 GetClientRect

• 0x4665d8 GetClassNameA

• 0x4665dc GetClassInfoA

• 0x4665e0 GetCapture

• 0x4665e4 GetActiveWindow

• 0x4665e8 FrameRect

• 0x4665ec FindWindowA

• 0x4665f0 FillRect

• 0x4665f4 EqualRect

• 0x4665f8 EnumWindows

• 0x4665fc EnumThreadWindows

• 0x466600 EndPaint

• 0x466604 EnableWindow

• 0x466608 EnableScrollBar

• 0x46660c EnableMenuItem

• 0x466610 DrawTextA

• 0x466614 DrawMenuBar

• 0x466618 DrawIconEx

• 0x46661c DrawIcon

• 0x466620 DrawFrameControl

• 0x466624 DrawFocusRect

• 0x466628 DrawEdge

• 0x46662c DispatchMessageA

• 0x466630 DestroyWindow

• 0x466634 DestroyMenu

• 0x466638 DestroyIcon

• 0x46663c DestroyCursor

• 0x466640 DeleteMenu

• 0x466644 DefWindowProcA

• 0x466648 DefMDIChildProcA

• 0x46664c DefFrameProcA

• 0x466650 CreatePopupMenu

• 0x466654 CreateMenu

• 0x466658 CreateIcon

• 0x46665c ClientToScreen

• 0x466660 CheckMenuItem

• 0x466664 CallWindowProcA

• 0x466668 CallNextHookEx

• 0x46666c BringWindowToTop

• 0x466670 BeginPaint

• 0x466674 CharNextA

• 0x466678 CharLowerA

• 0x46667c CharToOemA

• 0x466680 AdjustWindowRectEx

• 0x466684 ActivateKeyboardLayout

Library kernel32.dll:

• 0x46668c Sleep

Library oleaut32.dll:

• 0x466694 SafeArrayPtrOfIndex

• 0x466698 SafeArrayGetUBound

• 0x46669c SafeArrayGetLBound

• 0x4666a0 SafeArrayCreate

• 0x4666a4 VariantChangeType

• 0x4666a8 VariantCopy

• 0x4666ac VariantClear

• 0x4666b0 VariantInit

Library comctl32.dll:

• 0x4666b8 ImageList_SetIconSize

• 0x4666bc ImageList_GetIconSize

• 0x4666c0 ImageList_Write

• 0x4666c4 ImageList_Read

• 0x4666c8 ImageList_GetDragImage

• 0x4666cc ImageList_DragShowNolock

• 0x4666d0 ImageList_SetDragCursorImage

• 0x4666d4 ImageList_DragMove

• 0x4666d8 ImageList_DragLeave

• 0x4666dc ImageList_DragEnter

• 0x4666e0 ImageList_EndDrag

• 0x4666e4 ImageList_BeginDrag

• 0x4666e8 ImageList_Remove

• 0x4666ec ImageList_DrawEx

• 0x4666f0 ImageList_Replace

• 0x4666f4 ImageList_Draw

• 0x4666f8 ImageList_GetBkColor

• 0x4666fc ImageList_SetBkColor

• 0x466700 ImageList_ReplaceIcon

• 0x466704 ImageList_Add

• 0x466708 ImageList_GetImageCount

• 0x46670c ImageList_Destroy

• 0x466710 ImageList_Create

Library comdlg32.dll:

• 0x466718 ReplaceTextA

• 0x46671c FindTextA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
taruntextlies.com
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49713	114.114.114.114	53
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	49714	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	1900
192.168.56.101	53658	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.