5.6
高危
该样本未表现出任何异常！
重新分析
更多

3c6f85f19f86f64fe7dba24594186dbd3365bd756bf97411f9270ac538896aaf

40b7c24bc80d6b43141fe82eeafb368d.exe

分析耗时

48s

最近分析

文件大小

719.0KB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619423412.656249
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 35323716
registers.edi: 0
registers.eax: 0
registers.ebp: 35323784
registers.edx: 2130553844
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 ae 61 00 00 e9
exception.symbol: 40b7c24bc80d6b43141fe82eeafb368d+0x60570
exception.instruction: div eax
exception.module: 40b7c24bc80d6b43141fe82eeafb368d.exe
exception.exception_code: 0xc0000094
exception.offset: 394608
exception.address: 0x460570
success 0 0
1619423424.406751
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73aae97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73aaea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73aab25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73aab4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73aaac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73aaaed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73aa5511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73aa559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74167f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74164de3
40b7c24bc80d6b43141fe82eeafb368d+0x5aa4d @ 0x45aa4d
40b7c24bc80d6b43141fe82eeafb368d+0x53254 @ 0x453254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe7414ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619423412.531249
NtAllocateVirtualMemory
process_identifier: 2504
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619423412.656249
NtProtectVirtualMemory
process_identifier: 2504
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 28672
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00460000
success 0 0
1619423412.687249
NtAllocateVirtualMemory
process_identifier: 2504
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01e80000
success 0 0
1619423413.624751
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619423413.671751
NtAllocateVirtualMemory
process_identifier: 2732
region_size: 2162688
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01f30000
success 0 0
1619423413.671751
NtAllocateVirtualMemory
process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02100000
success 0 0
1619423413.671751
NtAllocateVirtualMemory
process_identifier: 2732
region_size: 335872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00840000
success 0 0
1619423413.671751
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 307200
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00842000
success 0 0
1619423414.124751
NtAllocateVirtualMemory
process_identifier: 2732
region_size: 655360
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01f30000
success 0 0
1619423414.124751
NtAllocateVirtualMemory
process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01f90000
success 0 0
1619423424.390751
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f22000
success 0 0
1619423424.390751
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619423424.390751
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f22000
success 0 0
1619423424.390751
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619423424.390751
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f22000
success 0 0
1619423424.390751
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619423424.390751
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f22000
success 0 0
1619423424.390751
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619423424.390751
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f22000
success 0 0
1619423424.390751
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619423424.390751
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f22000
success 0 0
1619423424.390751
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619423424.390751
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f22000
success 0 0
1619423424.390751
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619423424.390751
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f22000
success 0 0
1619423424.390751
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619423424.390751
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f22000
success 0 0
1619423424.390751
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619423424.390751
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01f22000
success 0 0
1619423424.390751
NtProtectVirtualMemory
process_identifier: 2732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.408472356347568 section {'size_of_data': '0x00043200', 'virtual_address': '0x00077000', 'entropy': 7.408472356347568, 'name': '.rsrc', 'virtual_size': '0x00043198'} description A section with a high entropy has been found
entropy 0.37395543175487467 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2504 called NtSetContextThread to modify thread in remote process 2732
Time & API Arguments Status Return Repeated
1619423412.781249
NtSetContextThread
thread_handle: 0x000000f0
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907760
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2732
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2504 resumed a thread in remote process 2732
Time & API Arguments Status Return Repeated
1619423413.468249
NtResumeThread
thread_handle: 0x000000f0
suspend_count: 1
process_identifier: 2732
success 0 0
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.160.78:443
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619423412.765249
CreateProcessInternalW
thread_identifier: 1752
thread_handle: 0x000000f0
process_identifier: 2732
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\40b7c24bc80d6b43141fe82eeafb368d.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x000000f4
inherit_handles: 0
success 1 0
1619423412.765249
NtUnmapViewOfSection
process_identifier: 2732
region_size: 4096
process_handle: 0x000000f4
base_address: 0x00400000
success 0 0
1619423412.765249
NtMapViewOfSection
section_handle: 0x000000fc
process_identifier: 2732
commit_size: 720896
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x000000f4
allocation_type: 0 ()
section_offset: 0
view_size: 720896
base_address: 0x00400000
success 0 0
1619423412.781249
NtGetContextThread
thread_handle: 0x000000f0
success 0 0
1619423412.781249
NtSetContextThread
thread_handle: 0x000000f0
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907760
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2732
success 0 0
1619423413.468249
NtResumeThread
thread_handle: 0x000000f0
suspend_count: 1
process_identifier: 2732
success 0 0
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x46a13c VirtualFree
• 0x46a140 VirtualAlloc
• 0x46a144 LocalFree
• 0x46a148 LocalAlloc
• 0x46a14c GetVersion
• 0x46a150 GetCurrentThreadId
• 0x46a15c VirtualQuery
• 0x46a160 WideCharToMultiByte
• 0x46a168 MultiByteToWideChar
• 0x46a16c lstrlenA
• 0x46a170 lstrcpynA
• 0x46a174 LoadLibraryExA
• 0x46a178 GetThreadLocale
• 0x46a17c GetStartupInfoA
• 0x46a180 GetProcAddress
• 0x46a184 GetModuleHandleA
• 0x46a188 GetModuleFileNameA
• 0x46a18c GetLocaleInfoA
• 0x46a190 GetLastError
• 0x46a198 GetCommandLineA
• 0x46a19c FreeLibrary
• 0x46a1a0 FindFirstFileA
• 0x46a1a4 FindClose
• 0x46a1a8 ExitProcess
• 0x46a1ac WriteFile
• 0x46a1b4 RtlUnwind
• 0x46a1b8 RaiseException
• 0x46a1bc GetStdHandle
Library user32.dll:
• 0x46a1c4 GetKeyboardType
• 0x46a1c8 LoadStringA
• 0x46a1cc MessageBoxA
• 0x46a1d0 CharNextA
Library advapi32.dll:
• 0x46a1d8 RegQueryValueExA
• 0x46a1dc RegOpenKeyExA
• 0x46a1e0 RegCloseKey
Library oleaut32.dll:
• 0x46a1e8 SysFreeString
• 0x46a1ec SysReAllocStringLen
• 0x46a1f0 SysAllocStringLen
Library kernel32.dll:
• 0x46a1f8 TlsSetValue
• 0x46a1fc TlsGetValue
• 0x46a200 LocalAlloc
• 0x46a204 GetModuleHandleA
Library advapi32.dll:
• 0x46a20c RegQueryValueExA
• 0x46a210 RegOpenKeyExA
• 0x46a214 RegCloseKey
Library kernel32.dll:
• 0x46a21c lstrcpyA
• 0x46a220 lstrcmpA
• 0x46a224 WriteFile
• 0x46a228 WaitForSingleObject
• 0x46a22c VirtualQuery
• 0x46a230 VirtualProtect
• 0x46a234 VirtualAlloc
• 0x46a238 Sleep
• 0x46a23c SizeofResource
• 0x46a240 SetThreadLocale
• 0x46a244 SetFilePointer
• 0x46a248 SetEvent
• 0x46a24c SetErrorMode
• 0x46a250 SetEndOfFile
• 0x46a254 ResetEvent
• 0x46a258 ReadFile
• 0x46a25c MulDiv
• 0x46a260 LockResource
• 0x46a264 LoadResource
• 0x46a268 LoadLibraryA
• 0x46a274 GlobalUnlock
• 0x46a278 GlobalReAlloc
• 0x46a27c GlobalHandle
• 0x46a280 GlobalLock
• 0x46a284 GlobalFree
• 0x46a288 GlobalFindAtomA
• 0x46a28c GlobalDeleteAtom
• 0x46a290 GlobalAlloc
• 0x46a294 GlobalAddAtomA
• 0x46a298 GetVersionExA
• 0x46a29c GetVersion
• 0x46a2a0 GetTickCount
• 0x46a2a4 GetThreadLocale
• 0x46a2ac GetSystemTime
• 0x46a2b0 GetSystemInfo
• 0x46a2b4 GetStringTypeExA
• 0x46a2b8 GetStdHandle
• 0x46a2bc GetProcAddress
• 0x46a2c0 GetModuleHandleA
• 0x46a2c4 GetModuleFileNameA
• 0x46a2c8 GetLocaleInfoA
• 0x46a2cc GetLocalTime
• 0x46a2d0 GetLastError
• 0x46a2d4 GetFullPathNameA
• 0x46a2d8 GetFileAttributesA
• 0x46a2dc GetDiskFreeSpaceA
• 0x46a2e0 GetDateFormatA
• 0x46a2e4 GetCurrentThreadId
• 0x46a2e8 GetCurrentProcessId
• 0x46a2ec GetCPInfo
• 0x46a2f0 GetACP
• 0x46a2f4 FreeResource
• 0x46a2f8 InterlockedExchange
• 0x46a2fc FreeLibrary
• 0x46a300 FormatMessageA
• 0x46a304 FindResourceA
• 0x46a308 FindNextFileA
• 0x46a30c FindFirstFileA
• 0x46a310 FindClose
• 0x46a320 ExitThread
• 0x46a324 ExitProcess
• 0x46a328 EnumCalendarInfoA
• 0x46a334 CreateThread
• 0x46a338 CreateFileA
• 0x46a33c CreateEventA
• 0x46a340 CompareStringA
• 0x46a344 CloseHandle
Library version.dll:
• 0x46a34c VerQueryValueA
• 0x46a354 GetFileVersionInfoA
Library gdi32.dll:
• 0x46a35c UnrealizeObject
• 0x46a360 StretchBlt
• 0x46a364 SetWindowOrgEx
• 0x46a368 SetViewportOrgEx
• 0x46a36c SetTextColor
• 0x46a370 SetStretchBltMode
• 0x46a374 SetROP2
• 0x46a378 SetPixel
• 0x46a37c SetDIBColorTable
• 0x46a380 SetBrushOrgEx
• 0x46a384 SetBkMode
• 0x46a388 SetBkColor
• 0x46a38c SelectPalette
• 0x46a390 SelectObject
• 0x46a394 SaveDC
• 0x46a398 RestoreDC
• 0x46a39c Rectangle
• 0x46a3a0 RectVisible
• 0x46a3a4 RealizePalette
• 0x46a3a8 PatBlt
• 0x46a3ac MoveToEx
• 0x46a3b0 MaskBlt
• 0x46a3b4 LineTo
• 0x46a3b8 IntersectClipRect
• 0x46a3bc GetWindowOrgEx
• 0x46a3c0 GetTextMetricsA
• 0x46a3cc GetStockObject
• 0x46a3d0 GetPixel
• 0x46a3d4 GetPaletteEntries
• 0x46a3d8 GetObjectA
• 0x46a3dc GetDeviceCaps
• 0x46a3e0 GetDIBits
• 0x46a3e4 GetDIBColorTable
• 0x46a3e8 GetDCOrgEx
• 0x46a3f0 GetClipBox
• 0x46a3f4 GetBrushOrgEx
• 0x46a3f8 GetBitmapBits
• 0x46a3fc ExtTextOutA
• 0x46a400 ExcludeClipRect
• 0x46a404 DeleteObject
• 0x46a408 DeleteDC
• 0x46a40c CreateSolidBrush
• 0x46a410 CreatePenIndirect
• 0x46a414 CreatePalette
• 0x46a41c CreateFontIndirectA
• 0x46a420 CreateDIBitmap
• 0x46a424 CreateDIBSection
• 0x46a428 CreateCompatibleDC
• 0x46a430 CreateBrushIndirect
• 0x46a434 CreateBitmap
• 0x46a438 BitBlt
Library user32.dll:
• 0x46a440 CreateWindowExA
• 0x46a444 WindowFromPoint
• 0x46a448 WinHelpA
• 0x46a44c WaitMessage
• 0x46a450 UpdateWindow
• 0x46a454 UnregisterClassA
• 0x46a458 UnhookWindowsHookEx
• 0x46a45c TranslateMessage
• 0x46a464 TrackPopupMenu
• 0x46a46c ShowWindow
• 0x46a470 ShowScrollBar
• 0x46a474 ShowOwnedPopups
• 0x46a478 ShowCursor
• 0x46a47c SetWindowsHookExA
• 0x46a480 SetWindowTextA
• 0x46a484 SetWindowPos
• 0x46a488 SetWindowPlacement
• 0x46a48c SetWindowLongA
• 0x46a490 SetTimer
• 0x46a494 SetScrollRange
• 0x46a498 SetScrollPos
• 0x46a49c SetScrollInfo
• 0x46a4a0 SetRect
• 0x46a4a4 SetPropA
• 0x46a4a8 SetParent
• 0x46a4ac SetMenuItemInfoA
• 0x46a4b0 SetMenu
• 0x46a4b4 SetForegroundWindow
• 0x46a4b8 SetFocus
• 0x46a4bc SetCursor
• 0x46a4c0 SetClassLongA
• 0x46a4c4 SetCapture
• 0x46a4c8 SetActiveWindow
• 0x46a4cc SendMessageA
• 0x46a4d0 ScrollWindow
• 0x46a4d4 ScreenToClient
• 0x46a4d8 RemovePropA
• 0x46a4dc RemoveMenu
• 0x46a4e0 ReleaseDC
• 0x46a4e4 ReleaseCapture
• 0x46a4f0 RegisterClassA
• 0x46a4f4 RedrawWindow
• 0x46a4f8 PtInRect
• 0x46a4fc PostQuitMessage
• 0x46a500 PostMessageA
• 0x46a504 PeekMessageA
• 0x46a508 OffsetRect
• 0x46a50c OemToCharA
• 0x46a510 MessageBoxA
• 0x46a514 MessageBeep
• 0x46a518 MapWindowPoints
• 0x46a51c MapVirtualKeyA
• 0x46a520 LoadStringA
• 0x46a524 LoadKeyboardLayoutA
• 0x46a528 LoadIconA
• 0x46a52c LoadCursorA
• 0x46a530 LoadBitmapA
• 0x46a534 KillTimer
• 0x46a538 IsZoomed
• 0x46a53c IsWindowVisible
• 0x46a540 IsWindowEnabled
• 0x46a544 IsWindow
• 0x46a548 IsRectEmpty
• 0x46a54c IsIconic
• 0x46a550 IsDialogMessageA
• 0x46a554 IsChild
• 0x46a558 InvalidateRect
• 0x46a55c IntersectRect
• 0x46a560 InsertMenuItemA
• 0x46a564 InsertMenuA
• 0x46a568 InflateRect
• 0x46a570 GetWindowTextA
• 0x46a574 GetWindowRect
• 0x46a578 GetWindowPlacement
• 0x46a57c GetWindowLongA
• 0x46a580 GetWindowDC
• 0x46a584 GetTopWindow
• 0x46a588 GetSystemMetrics
• 0x46a58c GetSystemMenu
• 0x46a590 GetSysColorBrush
• 0x46a594 GetSysColor
• 0x46a598 GetSubMenu
• 0x46a59c GetScrollRange
• 0x46a5a0 GetScrollPos
• 0x46a5a4 GetScrollInfo
• 0x46a5a8 GetPropA
• 0x46a5ac GetParent
• 0x46a5b0 GetWindow
• 0x46a5b4 GetMenuStringA
• 0x46a5b8 GetMenuState
• 0x46a5bc GetMenuItemInfoA
• 0x46a5c0 GetMenuItemID
• 0x46a5c4 GetMenuItemCount
• 0x46a5c8 GetMenu
• 0x46a5cc GetLastActivePopup
• 0x46a5d0 GetKeyboardState
• 0x46a5d8 GetKeyboardLayout
• 0x46a5dc GetKeyState
• 0x46a5e0 GetKeyNameTextA
• 0x46a5e4 GetIconInfo
• 0x46a5e8 GetForegroundWindow
• 0x46a5ec GetFocus
• 0x46a5f0 GetDesktopWindow
• 0x46a5f4 GetDCEx
• 0x46a5f8 GetDC
• 0x46a5fc GetCursorPos
• 0x46a600 GetCursor
• 0x46a604 GetClientRect
• 0x46a608 GetClassNameA
• 0x46a60c GetClassInfoA
• 0x46a610 GetCapture
• 0x46a614 GetActiveWindow
• 0x46a618 FrameRect
• 0x46a61c FindWindowA
• 0x46a620 FillRect
• 0x46a624 EqualRect
• 0x46a628 EnumWindows
• 0x46a62c EnumThreadWindows
• 0x46a630 EndPaint
• 0x46a634 EnableWindow
• 0x46a638 EnableScrollBar
• 0x46a63c EnableMenuItem
• 0x46a640 DrawTextA
• 0x46a644 DrawMenuBar
• 0x46a648 DrawIconEx
• 0x46a64c DrawIcon
• 0x46a650 DrawFrameControl
• 0x46a654 DrawFocusRect
• 0x46a658 DrawEdge
• 0x46a65c DispatchMessageA
• 0x46a660 DestroyWindow
• 0x46a664 DestroyMenu
• 0x46a668 DestroyIcon
• 0x46a66c DestroyCursor
• 0x46a670 DeleteMenu
• 0x46a674 DefWindowProcA
• 0x46a678 DefMDIChildProcA
• 0x46a67c DefFrameProcA
• 0x46a680 CreatePopupMenu
• 0x46a684 CreateMenu
• 0x46a688 CreateIcon
• 0x46a68c ClientToScreen
• 0x46a690 CheckMenuItem
• 0x46a694 CallWindowProcA
• 0x46a698 CallNextHookEx
• 0x46a69c BeginPaint
• 0x46a6a0 CharNextA
• 0x46a6a4 CharLowerBuffA
• 0x46a6a8 CharLowerA
• 0x46a6ac CharToOemA
• 0x46a6b0 AdjustWindowRectEx
Library kernel32.dll:
• 0x46a6bc Sleep
Library oleaut32.dll:
• 0x46a6c4 SafeArrayPtrOfIndex
• 0x46a6c8 SafeArrayGetUBound
• 0x46a6cc SafeArrayGetLBound
• 0x46a6d0 SafeArrayCreate
• 0x46a6d4 VariantChangeType
• 0x46a6d8 VariantCopy
• 0x46a6dc VariantClear
• 0x46a6e0 VariantInit
Library ole32.dll:
• 0x46a6e8 CoTaskMemAlloc
• 0x46a6ec CoCreateInstance
• 0x46a6f0 CoUninitialize
• 0x46a6f4 CoInitialize
Library comctl32.dll:
• 0x46a704 ImageList_Write
• 0x46a708 ImageList_Read
• 0x46a718 ImageList_DragMove
• 0x46a71c ImageList_DragLeave
• 0x46a720 ImageList_DragEnter
• 0x46a724 ImageList_EndDrag
• 0x46a728 ImageList_BeginDrag
• 0x46a72c ImageList_Remove
• 0x46a730 ImageList_DrawEx
• 0x46a734 ImageList_Replace
• 0x46a738 ImageList_Draw
• 0x46a748 ImageList_Add
• 0x46a750 ImageList_Destroy
• 0x46a754 ImageList_Create
• 0x46a758 InitCommonControls

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 51378 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 50568 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 62912 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.