5.6
高危
该样本未表现出任何异常！
重新分析
更多

7c15dd07b223275e68dd8034583f12a73fc19f2d42abede56ed8d0dfdc92edc6

40bedcb0771e67eee9e2b7016d40defe.exe

分析耗时

38s

最近分析

文件大小

1.4MB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619384493.391
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49741364
registers.edi: 0
registers.eax: 0
registers.ebp: 49741704
registers.edx: 46
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 d5 74 00 00 e9
exception.symbol: 40bedcb0771e67eee9e2b7016d40defe+0x601cc
exception.instruction: div eax
exception.module: 40bedcb0771e67eee9e2b7016d40defe.exe
exception.exception_code: 0xc0000094
exception.offset: 393676
exception.address: 0x4601cc
success 0 0
1619395613.370875
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7478e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7478ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7478b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7478b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7478ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7478aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x74785511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7478559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741b7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741b4de3
40bedcb0771e67eee9e2b7016d40defe+0x52a4d @ 0x452a4d
40bedcb0771e67eee9e2b7016d40defe+0x4b254 @ 0x44b254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfcd614ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (32 个事件)
Time & API Arguments Status Return Repeated
1619384492.875
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619384493.391
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 32768
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00460000
success 0 0
1619384493.391
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02030000
success 0 0
1619395602.964875
NtAllocateVirtualMemory
process_identifier: 2008
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00350000
success 0 0
1619395611.417875
NtAllocateVirtualMemory
process_identifier: 2008
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00390000
success 0 0
1619395612.011875
NtProtectVirtualMemory
process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619395612.058875
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 786432
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x006f0000
success 0 0
1619395612.058875
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00770000
success 0 0
1619395612.058875
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 303104
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00550000
success 0 0
1619395612.058875
NtProtectVirtualMemory
process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 278528
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00552000
success 0 0
1619395612.824875
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 983040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01fa0000
success 0 0
1619395612.824875
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02050000
success 0 0
1619395613.339875
NtProtectVirtualMemory
process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00542000
success 0 0
1619395613.339875
NtProtectVirtualMemory
process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619395613.339875
NtProtectVirtualMemory
process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00542000
success 0 0
1619395613.339875
NtProtectVirtualMemory
process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619395613.339875
NtProtectVirtualMemory
process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00542000
success 0 0
1619395613.339875
NtProtectVirtualMemory
process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619395613.339875
NtProtectVirtualMemory
process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00542000
success 0 0
1619395613.339875
NtProtectVirtualMemory
process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619395613.339875
NtProtectVirtualMemory
process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00542000
success 0 0
1619395613.339875
NtProtectVirtualMemory
process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619395613.339875
NtProtectVirtualMemory
process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00542000
success 0 0
1619395613.339875
NtProtectVirtualMemory
process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619395613.339875
NtProtectVirtualMemory
process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00542000
success 0 0
1619395613.339875
NtProtectVirtualMemory
process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619395613.339875
NtProtectVirtualMemory
process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00542000
success 0 0
1619395613.339875
NtProtectVirtualMemory
process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619395613.339875
NtProtectVirtualMemory
process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00542000
success 0 0
1619395613.339875
NtProtectVirtualMemory
process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619395613.339875
NtProtectVirtualMemory
process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00542000
success 0 0
1619395613.339875
NtProtectVirtualMemory
process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.463297073971842 section {'size_of_data': '0x000ff400', 'virtual_address': '0x00078000', 'entropy': 7.463297073971842, 'name': '.rsrc', 'virtual_size': '0x000ff290'} description A section with a high entropy has been found
entropy 0.6922033898305084 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 个事件)
Process injection Process 3040 called NtSetContextThread to modify thread in remote process 2008
Process injection Process 2008 called NtSetContextThread to modify thread in remote process 2200
Time & API Arguments Status Return Repeated
1619384493.485
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4758212
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2008
success 0 0
1619395611.761875
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 2010382788
registers.esp: 1638384
registers.edi: 0
registers.eax: 4849120
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2200
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (4 个事件)
Process injection Process 3040 resumed a thread in remote process 2008
Process injection Process 2008 resumed a thread in remote process 2200
Time & API Arguments Status Return Repeated
1619384493.938
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2008
success 0 0
1619395611.824875
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 2200
success 0 0
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.24.14:443
Executed a process and injected code into it, probably while unpacking (13 个事件)
Time & API Arguments Status Return Repeated
1619384493.469
CreateProcessInternalW
thread_identifier: 2040
thread_handle: 0x000000fc
process_identifier: 2008
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\40bedcb0771e67eee9e2b7016d40defe.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619384493.469
NtUnmapViewOfSection
process_identifier: 2008
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619384493.469
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 2008
commit_size: 913408
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 913408
base_address: 0x00400000
success 0 0
1619384493.485
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1619384493.485
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4758212
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2008
success 0 0
1619384493.938
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 2008
success 0 0
1619395611.761875
CreateProcessInternalW
thread_identifier: 880
thread_handle: 0x00000104
process_identifier: 2200
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\40bedcb0771e67eee9e2b7016d40defe.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000108
inherit_handles: 0
success 1 0
1619395611.761875
NtGetContextThread
thread_handle: 0x00000104
success 0 0
1619395611.761875
NtUnmapViewOfSection
process_identifier: 2200
region_size: 4096
process_handle: 0x00000108
base_address: 0x00400000
success 0 0
1619395611.761875
NtMapViewOfSection
section_handle: 0x00000110
process_identifier: 2200
commit_size: 659456
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000108
allocation_type: 0 ()
section_offset: 0
view_size: 659456
base_address: 0x00400000
success 0 0
1619395611.761875
NtMapViewOfSection
section_handle: 0x0000010c
process_identifier: 2200
commit_size: 4096
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000108
allocation_type: 0 ()
section_offset: 0
view_size: 4096
base_address: 0x001e0000
success 0 0
1619395611.761875
NtSetContextThread
thread_handle: 0x00000104
registers.eip: 2010382788
registers.esp: 1638384
registers.edi: 0
registers.eax: 4849120
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2200
success 0 0
1619395611.824875
NtResumeThread
thread_handle: 0x00000104
suspend_count: 1
process_identifier: 2200
success 0 0
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x46b150 VirtualFree
• 0x46b154 VirtualAlloc
• 0x46b158 LocalFree
• 0x46b15c LocalAlloc
• 0x46b160 GetVersion
• 0x46b164 GetCurrentThreadId
• 0x46b170 VirtualQuery
• 0x46b174 WideCharToMultiByte
• 0x46b178 MultiByteToWideChar
• 0x46b17c lstrlenA
• 0x46b180 lstrcpynA
• 0x46b184 LoadLibraryExA
• 0x46b188 GetThreadLocale
• 0x46b18c GetStartupInfoA
• 0x46b190 GetProcAddress
• 0x46b194 GetModuleHandleA
• 0x46b198 GetModuleFileNameA
• 0x46b19c GetLocaleInfoA
• 0x46b1a0 GetCommandLineA
• 0x46b1a4 FreeLibrary
• 0x46b1a8 FindFirstFileA
• 0x46b1ac FindClose
• 0x46b1b0 ExitProcess
• 0x46b1b4 WriteFile
• 0x46b1bc RtlUnwind
• 0x46b1c0 RaiseException
• 0x46b1c4 GetStdHandle
Library user32.dll:
• 0x46b1cc GetKeyboardType
• 0x46b1d0 LoadStringA
• 0x46b1d4 MessageBoxA
• 0x46b1d8 CharNextA
Library advapi32.dll:
• 0x46b1e0 RegQueryValueExA
• 0x46b1e4 RegOpenKeyExA
• 0x46b1e8 RegCloseKey
Library oleaut32.dll:
• 0x46b1f0 SysFreeString
• 0x46b1f4 SysReAllocStringLen
• 0x46b1f8 SysAllocStringLen
Library kernel32.dll:
• 0x46b200 TlsSetValue
• 0x46b204 TlsGetValue
• 0x46b208 LocalAlloc
• 0x46b20c GetModuleHandleA
Library advapi32.dll:
• 0x46b214 RegQueryValueExA
• 0x46b218 RegOpenKeyExA
• 0x46b21c RegCloseKey
Library kernel32.dll:
• 0x46b224 lstrcpyA
• 0x46b228 lstrcmpA
• 0x46b22c WriteFile
• 0x46b234 WaitForSingleObject
• 0x46b238 VirtualQuery
• 0x46b23c VirtualAlloc
• 0x46b240 Sleep
• 0x46b244 SizeofResource
• 0x46b248 SetThreadLocale
• 0x46b24c SetFilePointer
• 0x46b250 SetEvent
• 0x46b254 SetErrorMode
• 0x46b258 SetEndOfFile
• 0x46b25c ResetEvent
• 0x46b260 ReadFile
• 0x46b264 MulDiv
• 0x46b268 LockResource
• 0x46b26c LoadResource
• 0x46b270 LoadLibraryA
• 0x46b27c GlobalUnlock
• 0x46b280 GlobalReAlloc
• 0x46b284 GlobalHandle
• 0x46b288 GlobalLock
• 0x46b28c GlobalFree
• 0x46b290 GlobalFindAtomA
• 0x46b294 GlobalDeleteAtom
• 0x46b298 GlobalAlloc
• 0x46b29c GlobalAddAtomA
• 0x46b2a0 GetVersionExA
• 0x46b2a4 GetVersion
• 0x46b2a8 GetTickCount
• 0x46b2ac GetThreadLocale
• 0x46b2b4 GetSystemTime
• 0x46b2b8 GetSystemInfo
• 0x46b2bc GetStringTypeExA
• 0x46b2c0 GetStdHandle
• 0x46b2c4 GetProcAddress
• 0x46b2c8 GetModuleHandleA
• 0x46b2cc GetModuleFileNameA
• 0x46b2d0 GetLocaleInfoA
• 0x46b2d4 GetLocalTime
• 0x46b2d8 GetLastError
• 0x46b2dc GetFullPathNameA
• 0x46b2e0 GetFileAttributesA
• 0x46b2e4 GetDiskFreeSpaceA
• 0x46b2e8 GetDateFormatA
• 0x46b2ec GetCurrentThreadId
• 0x46b2f0 GetCurrentProcessId
• 0x46b2f4 GetCPInfo
• 0x46b2f8 GetACP
• 0x46b2fc FreeResource
• 0x46b300 InterlockedExchange
• 0x46b304 FreeLibrary
• 0x46b308 FormatMessageA
• 0x46b30c FindResourceA
• 0x46b310 FindFirstFileA
• 0x46b314 FindClose
• 0x46b320 ExitThread
• 0x46b324 EnumCalendarInfoA
• 0x46b330 CreateThread
• 0x46b334 CreateFileA
• 0x46b338 CreateEventA
• 0x46b33c CompareStringA
• 0x46b340 CloseHandle
Library version.dll:
• 0x46b348 VerQueryValueA
• 0x46b350 GetFileVersionInfoA
Library gdi32.dll:
• 0x46b358 UnrealizeObject
• 0x46b35c StretchBlt
• 0x46b360 SetWindowOrgEx
• 0x46b364 SetWinMetaFileBits
• 0x46b368 SetViewportOrgEx
• 0x46b36c SetTextColor
• 0x46b370 SetStretchBltMode
• 0x46b374 SetROP2
• 0x46b378 SetPixel
• 0x46b37c SetEnhMetaFileBits
• 0x46b380 SetDIBColorTable
• 0x46b384 SetBrushOrgEx
• 0x46b388 SetBkMode
• 0x46b38c SetBkColor
• 0x46b390 SelectPalette
• 0x46b394 SelectObject
• 0x46b398 SelectClipPath
• 0x46b39c SaveDC
• 0x46b3a0 RestoreDC
• 0x46b3a4 Rectangle
• 0x46b3a8 RectVisible
• 0x46b3ac RealizePalette
• 0x46b3b0 Polyline
• 0x46b3b4 PlayEnhMetaFile
• 0x46b3b8 PatBlt
• 0x46b3bc MoveToEx
• 0x46b3c0 MaskBlt
• 0x46b3c4 LineTo
• 0x46b3c8 IntersectClipRect
• 0x46b3cc GetWindowOrgEx
• 0x46b3d0 GetWinMetaFileBits
• 0x46b3d4 GetTextMetricsA
• 0x46b3e0 GetStockObject
• 0x46b3e4 GetPixel
• 0x46b3e8 GetPaletteEntries
• 0x46b3ec GetObjectA
• 0x46b3f8 GetEnhMetaFileBits
• 0x46b3fc GetDeviceCaps
• 0x46b400 GetDIBits
• 0x46b404 GetDIBColorTable
• 0x46b408 GetDCOrgEx
• 0x46b410 GetClipBox
• 0x46b414 GetBrushOrgEx
• 0x46b418 GetBitmapBits
• 0x46b41c ExcludeClipRect
• 0x46b420 DeleteObject
• 0x46b424 DeleteEnhMetaFile
• 0x46b428 DeleteDC
• 0x46b42c CreateSolidBrush
• 0x46b430 CreatePenIndirect
• 0x46b434 CreatePalette
• 0x46b43c CreateFontIndirectA
• 0x46b440 CreateDIBitmap
• 0x46b444 CreateDIBSection
• 0x46b448 CreateCompatibleDC
• 0x46b450 CreateBrushIndirect
• 0x46b454 CreateBitmap
• 0x46b458 CopyEnhMetaFileA
• 0x46b45c BitBlt
Library user32.dll:
• 0x46b464 CreateWindowExA
• 0x46b468 WindowFromPoint
• 0x46b46c WinHelpA
• 0x46b470 WaitMessage
• 0x46b474 UpdateWindow
• 0x46b478 UnregisterClassA
• 0x46b47c UnhookWindowsHookEx
• 0x46b480 TranslateMessage
• 0x46b488 TrackPopupMenu
• 0x46b490 ShowWindow
• 0x46b494 ShowScrollBar
• 0x46b498 ShowOwnedPopups
• 0x46b49c ShowCursor
• 0x46b4a0 SetWindowsHookExA
• 0x46b4a4 SetWindowTextA
• 0x46b4a8 SetWindowPos
• 0x46b4ac SetWindowPlacement
• 0x46b4b0 SetWindowLongA
• 0x46b4b4 SetTimer
• 0x46b4b8 SetScrollRange
• 0x46b4bc SetScrollPos
• 0x46b4c0 SetScrollInfo
• 0x46b4c4 SetRect
• 0x46b4c8 SetPropA
• 0x46b4cc SetParent
• 0x46b4d0 SetMenuItemInfoA
• 0x46b4d4 SetMenu
• 0x46b4d8 SetForegroundWindow
• 0x46b4dc SetFocus
• 0x46b4e0 SetCursor
• 0x46b4e4 SetClassLongA
• 0x46b4e8 SetCapture
• 0x46b4ec SetActiveWindow
• 0x46b4f0 SendMessageA
• 0x46b4f4 ScrollWindow
• 0x46b4f8 ScreenToClient
• 0x46b4fc RemovePropA
• 0x46b500 RemoveMenu
• 0x46b504 ReleaseDC
• 0x46b508 ReleaseCapture
• 0x46b514 RegisterClassA
• 0x46b518 RedrawWindow
• 0x46b51c PtInRect
• 0x46b520 PostQuitMessage
• 0x46b524 PostMessageA
• 0x46b528 PeekMessageA
• 0x46b52c OffsetRect
• 0x46b530 OemToCharA
• 0x46b534 MessageBoxA
• 0x46b538 MapWindowPoints
• 0x46b53c MapVirtualKeyA
• 0x46b540 LoadStringA
• 0x46b544 LoadKeyboardLayoutA
• 0x46b548 LoadIconA
• 0x46b54c LoadCursorA
• 0x46b550 LoadBitmapA
• 0x46b554 KillTimer
• 0x46b558 IsZoomed
• 0x46b55c IsWindowVisible
• 0x46b560 IsWindowEnabled
• 0x46b564 IsWindow
• 0x46b568 IsRectEmpty
• 0x46b56c IsIconic
• 0x46b570 IsDialogMessageA
• 0x46b574 IsChild
• 0x46b578 InvalidateRect
• 0x46b57c IntersectRect
• 0x46b580 InsertMenuItemA
• 0x46b584 InsertMenuA
• 0x46b588 InflateRect
• 0x46b590 GetWindowTextA
• 0x46b594 GetWindowRect
• 0x46b598 GetWindowPlacement
• 0x46b59c GetWindowLongA
• 0x46b5a0 GetWindowDC
• 0x46b5a4 GetTopWindow
• 0x46b5a8 GetSystemMetrics
• 0x46b5ac GetSystemMenu
• 0x46b5b0 GetSysColorBrush
• 0x46b5b4 GetSysColor
• 0x46b5b8 GetSubMenu
• 0x46b5bc GetScrollRange
• 0x46b5c0 GetScrollPos
• 0x46b5c4 GetScrollInfo
• 0x46b5c8 GetPropA
• 0x46b5cc GetParent
• 0x46b5d0 GetWindow
• 0x46b5d4 GetMenuStringA
• 0x46b5d8 GetMenuState
• 0x46b5dc GetMenuItemInfoA
• 0x46b5e0 GetMenuItemID
• 0x46b5e4 GetMenuItemCount
• 0x46b5e8 GetMenu
• 0x46b5ec GetLastActivePopup
• 0x46b5f0 GetKeyboardState
• 0x46b5f8 GetKeyboardLayout
• 0x46b5fc GetKeyState
• 0x46b600 GetKeyNameTextA
• 0x46b604 GetIconInfo
• 0x46b608 GetForegroundWindow
• 0x46b60c GetFocus
• 0x46b610 GetDlgItem
• 0x46b614 GetDesktopWindow
• 0x46b618 GetDCEx
• 0x46b61c GetDC
• 0x46b620 GetCursorPos
• 0x46b624 GetCursor
• 0x46b628 GetClipboardData
• 0x46b62c GetClientRect
• 0x46b630 GetClassNameA
• 0x46b634 GetClassInfoA
• 0x46b638 GetCapture
• 0x46b63c GetActiveWindow
• 0x46b640 FrameRect
• 0x46b644 FindWindowA
• 0x46b648 FillRect
• 0x46b64c EqualRect
• 0x46b650 EnumWindows
• 0x46b654 EnumThreadWindows
• 0x46b658 EndPaint
• 0x46b65c EnableWindow
• 0x46b660 EnableScrollBar
• 0x46b664 EnableMenuItem
• 0x46b668 DrawTextA
• 0x46b66c DrawMenuBar
• 0x46b670 DrawIconEx
• 0x46b674 DrawIcon
• 0x46b678 DrawFrameControl
• 0x46b67c DrawEdge
• 0x46b680 DispatchMessageA
• 0x46b684 DestroyWindow
• 0x46b688 DestroyMenu
• 0x46b68c DestroyIcon
• 0x46b690 DestroyCursor
• 0x46b694 DeleteMenu
• 0x46b698 DefWindowProcA
• 0x46b69c DefMDIChildProcA
• 0x46b6a0 DefFrameProcA
• 0x46b6a4 CreatePopupMenu
• 0x46b6a8 CreateMenu
• 0x46b6ac CreateIcon
• 0x46b6b0 ClientToScreen
• 0x46b6b4 CheckMenuItem
• 0x46b6b8 CallWindowProcA
• 0x46b6bc CallNextHookEx
• 0x46b6c0 BeginPaint
• 0x46b6c4 CharNextA
• 0x46b6c8 CharLowerBuffA
• 0x46b6cc CharLowerA
• 0x46b6d0 CharToOemA
• 0x46b6d4 AdjustWindowRectEx
Library kernel32.dll:
• 0x46b6e0 Sleep
Library oleaut32.dll:
• 0x46b6e8 SafeArrayPtrOfIndex
• 0x46b6ec SafeArrayGetUBound
• 0x46b6f0 SafeArrayGetLBound
• 0x46b6f4 SafeArrayCreate
• 0x46b6f8 VariantChangeType
• 0x46b6fc VariantCopy
• 0x46b700 VariantClear
• 0x46b704 VariantInit
Library ole32.dll:
• 0x46b70c CoTaskMemAlloc
• 0x46b710 CoCreateInstance
• 0x46b714 CoUninitialize
• 0x46b718 CoInitialize
Library comctl32.dll:
• 0x46b728 ImageList_Write
• 0x46b72c ImageList_Read
• 0x46b73c ImageList_DragMove
• 0x46b740 ImageList_DragLeave
• 0x46b744 ImageList_DragEnter
• 0x46b748 ImageList_EndDrag
• 0x46b74c ImageList_BeginDrag
• 0x46b750 ImageList_Remove
• 0x46b754 ImageList_DrawEx
• 0x46b758 ImageList_Replace
• 0x46b75c ImageList_Draw
• 0x46b76c ImageList_Add
• 0x46b774 ImageList_Destroy
• 0x46b778 ImageList_Create
• 0x46b77c InitCommonControls
Library comdlg32.dll:
• 0x46b784 GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 60126 239.255.255.250 1900
192.168.56.101 60128 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.