5.6
高危
该样本未表现出任何异常！
重新分析
更多

c0e07d28db57e5956e32eb9ae9f4dac27841766c50c6b1feaf63f6507f8c17bc

42a259157e5123b70ee5b5d1a6de0a4f.exe

分析耗时

60s

最近分析

文件大小

841.0KB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619384495.4525
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7389e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7389ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7389b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7389b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7389ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7389aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73895511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7389559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x73f57f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x73f54de3
42a259157e5123b70ee5b5d1a6de0a4f+0x90a4d @ 0x490a4d
42a259157e5123b70ee5b5d1a6de0a4f+0x89254 @ 0x489254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfe4514ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619384493.593875
NtAllocateVirtualMemory
process_identifier: 2196
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00670000
success 0 0
1619384493.655875
NtProtectVirtualMemory
process_identifier: 2196
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 28672
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00463000
success 0 0
1619384493.655875
NtAllocateVirtualMemory
process_identifier: 2196
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02590000
success 0 0
1619384494.3275
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619384494.3435
NtAllocateVirtualMemory
process_identifier: 428
region_size: 1769472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01fc0000
success 0 0
1619384494.3435
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02130000
success 0 0
1619384494.3435
NtAllocateVirtualMemory
process_identifier: 428
region_size: 557056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x007c0000
success 0 0
1619384494.3435
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 520192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x007c2000
success 0 0
1619384494.8435
NtAllocateVirtualMemory
process_identifier: 428
region_size: 1835008
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x021a0000
success 0 0
1619384494.8435
NtAllocateVirtualMemory
process_identifier: 428
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02320000
success 0 0
1619384495.4525
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02192000
success 0 0
1619384495.4525
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619384495.4525
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02192000
success 0 0
1619384495.4525
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619384495.4525
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02192000
success 0 0
1619384495.4525
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619384495.4525
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02192000
success 0 0
1619384495.4525
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619384495.4525
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02192000
success 0 0
1619384495.4525
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619384495.4525
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02192000
success 0 0
1619384495.4525
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619384495.4525
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02192000
success 0 0
1619384495.4525
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619384495.4525
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02192000
success 0 0
1619384495.4525
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619384495.4525
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02192000
success 0 0
1619384495.4525
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619384495.4525
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02192000
success 0 0
1619384495.4525
NtProtectVirtualMemory
process_identifier: 428
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.2925876673798475 section {'size_of_data': '0x0005dc00', 'virtual_address': '0x0007b000', 'entropy': 7.2925876673798475, 'name': '.rsrc', 'virtual_size': '0x0005dad0'} description A section with a high entropy has been found
entropy 0.44642857142857145 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 203.208.41.98
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2196 called NtSetContextThread to modify thread in remote process 428
Time & API Arguments Status Return Repeated
1619384493.952875
NtSetContextThread
thread_handle: 0x00000114
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5354720
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 428
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2196 resumed a thread in remote process 428
Time & API Arguments Status Return Repeated
1619384494.124875
NtResumeThread
thread_handle: 0x00000114
suspend_count: 1
process_identifier: 428
success 0 0
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.24.14:443
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619384493.921875
CreateProcessInternalW
thread_identifier: 2120
thread_handle: 0x00000114
process_identifier: 428
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\42a259157e5123b70ee5b5d1a6de0a4f.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619384493.921875
NtUnmapViewOfSection
process_identifier: 428
region_size: 4096
process_handle: 0x00000118
base_address: 0x00400000
success 0 0
1619384493.921875
NtMapViewOfSection
section_handle: 0x00000120
process_identifier: 428
commit_size: 1167360
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000118
allocation_type: 0 ()
section_offset: 0
view_size: 1167360
base_address: 0x00400000
success 0 0
1619384493.952875
NtGetContextThread
thread_handle: 0x00000114
success 0 0
1619384493.952875
NtSetContextThread
thread_handle: 0x00000114
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 5354720
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 428
success 0 0
1619384494.124875
NtResumeThread
thread_handle: 0x00000114
suspend_count: 1
process_identifier: 428
success 0 0
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x46e164 VirtualFree
• 0x46e168 VirtualAlloc
• 0x46e16c LocalFree
• 0x46e170 LocalAlloc
• 0x46e174 GetVersion
• 0x46e178 GetCurrentThreadId
• 0x46e184 VirtualQuery
• 0x46e188 WideCharToMultiByte
• 0x46e18c MultiByteToWideChar
• 0x46e190 lstrlenA
• 0x46e194 lstrcpynA
• 0x46e198 LoadLibraryExA
• 0x46e19c GetThreadLocale
• 0x46e1a0 GetStartupInfoA
• 0x46e1a4 GetProcAddress
• 0x46e1a8 GetModuleHandleA
• 0x46e1ac GetModuleFileNameA
• 0x46e1b0 GetLocaleInfoA
• 0x46e1b4 GetCommandLineA
• 0x46e1b8 FreeLibrary
• 0x46e1bc FindFirstFileA
• 0x46e1c0 FindClose
• 0x46e1c4 ExitProcess
• 0x46e1c8 WriteFile
• 0x46e1d0 RtlUnwind
• 0x46e1d4 RaiseException
• 0x46e1d8 GetStdHandle
Library user32.dll:
• 0x46e1e0 GetKeyboardType
• 0x46e1e4 LoadStringA
• 0x46e1e8 MessageBoxA
• 0x46e1ec CharNextA
Library advapi32.dll:
• 0x46e1f4 RegQueryValueExA
• 0x46e1f8 RegOpenKeyExA
• 0x46e1fc RegCloseKey
Library oleaut32.dll:
• 0x46e204 SysFreeString
• 0x46e208 SysReAllocStringLen
• 0x46e20c SysAllocStringLen
Library kernel32.dll:
• 0x46e214 TlsSetValue
• 0x46e218 TlsGetValue
• 0x46e21c LocalAlloc
• 0x46e220 GetModuleHandleA
Library advapi32.dll:
• 0x46e228 RegQueryValueExA
• 0x46e22c RegOpenKeyExA
• 0x46e230 RegCloseKey
Library kernel32.dll:
• 0x46e238 lstrcpyA
• 0x46e23c lstrcmpA
• 0x46e240 WriteFile
• 0x46e248 WaitForSingleObject
• 0x46e24c VirtualQuery
• 0x46e250 VirtualAlloc
• 0x46e254 Sleep
• 0x46e258 SizeofResource
• 0x46e25c SetThreadLocale
• 0x46e260 SetFilePointer
• 0x46e264 SetEvent
• 0x46e268 SetErrorMode
• 0x46e26c SetEndOfFile
• 0x46e270 ResetEvent
• 0x46e274 ReadFile
• 0x46e278 MulDiv
• 0x46e27c LockResource
• 0x46e280 LoadResource
• 0x46e284 LoadLibraryA
• 0x46e290 GlobalUnlock
• 0x46e294 GlobalReAlloc
• 0x46e298 GlobalHandle
• 0x46e29c GlobalLock
• 0x46e2a0 GlobalFree
• 0x46e2a4 GlobalFindAtomA
• 0x46e2a8 GlobalDeleteAtom
• 0x46e2ac GlobalAlloc
• 0x46e2b0 GlobalAddAtomA
• 0x46e2b4 GetVersionExA
• 0x46e2b8 GetVersion
• 0x46e2bc GetTickCount
• 0x46e2c0 GetThreadLocale
• 0x46e2c8 GetSystemTime
• 0x46e2cc GetSystemInfo
• 0x46e2d0 GetStringTypeExA
• 0x46e2d4 GetStdHandle
• 0x46e2d8 GetProcAddress
• 0x46e2dc GetModuleHandleA
• 0x46e2e0 GetModuleFileNameA
• 0x46e2e4 GetLocaleInfoA
• 0x46e2e8 GetLocalTime
• 0x46e2ec GetLastError
• 0x46e2f0 GetFullPathNameA
• 0x46e2f4 GetFileAttributesA
• 0x46e2f8 GetDiskFreeSpaceA
• 0x46e2fc GetDateFormatA
• 0x46e300 GetCurrentThreadId
• 0x46e304 GetCurrentProcessId
• 0x46e308 GetCPInfo
• 0x46e30c GetACP
• 0x46e310 FreeResource
• 0x46e314 InterlockedExchange
• 0x46e318 FreeLibrary
• 0x46e31c FormatMessageA
• 0x46e320 FindResourceA
• 0x46e324 FindFirstFileA
• 0x46e328 FindClose
• 0x46e334 ExitThread
• 0x46e338 EnumCalendarInfoA
• 0x46e344 CreateThread
• 0x46e348 CreateFileA
• 0x46e34c CreateEventA
• 0x46e350 CompareStringA
• 0x46e354 CloseHandle
Library version.dll:
• 0x46e35c VerQueryValueA
• 0x46e364 GetFileVersionInfoA
Library gdi32.dll:
• 0x46e36c UnrealizeObject
• 0x46e370 StretchBlt
• 0x46e374 SetWindowOrgEx
• 0x46e378 SetWinMetaFileBits
• 0x46e37c SetViewportOrgEx
• 0x46e380 SetTextColor
• 0x46e384 SetStretchBltMode
• 0x46e388 SetROP2
• 0x46e38c SetPixel
• 0x46e390 SetEnhMetaFileBits
• 0x46e394 SetDIBColorTable
• 0x46e398 SetBrushOrgEx
• 0x46e39c SetBkMode
• 0x46e3a0 SetBkColor
• 0x46e3a4 SelectPalette
• 0x46e3a8 SelectObject
• 0x46e3ac SelectClipRgn
• 0x46e3b0 SaveDC
• 0x46e3b4 RestoreDC
• 0x46e3b8 Rectangle
• 0x46e3bc RectVisible
• 0x46e3c0 RealizePalette
• 0x46e3c4 Polyline
• 0x46e3c8 PlayEnhMetaFile
• 0x46e3cc PatBlt
• 0x46e3d0 MoveToEx
• 0x46e3d4 MaskBlt
• 0x46e3d8 LineTo
• 0x46e3dc IntersectClipRect
• 0x46e3e0 GetWindowOrgEx
• 0x46e3e4 GetWinMetaFileBits
• 0x46e3e8 GetTextMetricsA
• 0x46e3f4 GetStockObject
• 0x46e3f8 GetPixel
• 0x46e3fc GetPaletteEntries
• 0x46e400 GetObjectA
• 0x46e40c GetEnhMetaFileBits
• 0x46e410 GetDeviceCaps
• 0x46e414 GetDIBits
• 0x46e418 GetDIBColorTable
• 0x46e41c GetDCOrgEx
• 0x46e424 GetClipBox
• 0x46e428 GetBrushOrgEx
• 0x46e42c GetBitmapBits
• 0x46e430 ExtTextOutA
• 0x46e434 ExcludeClipRect
• 0x46e438 DeleteObject
• 0x46e43c DeleteEnhMetaFile
• 0x46e440 DeleteDC
• 0x46e444 CreateSolidBrush
• 0x46e448 CreateRectRgn
• 0x46e44c CreatePenIndirect
• 0x46e450 CreatePalette
• 0x46e458 CreateFontIndirectA
• 0x46e45c CreateDIBitmap
• 0x46e460 CreateDIBSection
• 0x46e464 CreateCompatibleDC
• 0x46e46c CreateBrushIndirect
• 0x46e470 CreateBitmap
• 0x46e474 CopyEnhMetaFileA
• 0x46e478 BitBlt
Library opengl32.dll:
• 0x46e480 wglCreateContext
Library user32.dll:
• 0x46e488 CreateWindowExA
• 0x46e48c WindowFromPoint
• 0x46e490 WinHelpA
• 0x46e494 WaitMessage
• 0x46e498 UpdateWindow
• 0x46e49c UnregisterClassA
• 0x46e4a0 UnhookWindowsHookEx
• 0x46e4a4 TranslateMessage
• 0x46e4ac TrackPopupMenu
• 0x46e4b4 ShowWindow
• 0x46e4b8 ShowScrollBar
• 0x46e4bc ShowOwnedPopups
• 0x46e4c0 ShowCursor
• 0x46e4c4 SetWindowsHookExA
• 0x46e4c8 SetWindowTextA
• 0x46e4cc SetWindowPos
• 0x46e4d0 SetWindowPlacement
• 0x46e4d4 SetWindowLongA
• 0x46e4d8 SetTimer
• 0x46e4dc SetScrollRange
• 0x46e4e0 SetScrollPos
• 0x46e4e4 SetScrollInfo
• 0x46e4e8 SetRect
• 0x46e4ec SetPropA
• 0x46e4f0 SetParent
• 0x46e4f4 SetMenuItemInfoA
• 0x46e4f8 SetMenu
• 0x46e4fc SetForegroundWindow
• 0x46e500 SetFocus
• 0x46e504 SetCursor
• 0x46e508 SetClassLongA
• 0x46e50c SetCapture
• 0x46e510 SetActiveWindow
• 0x46e514 SendMessageA
• 0x46e518 ScrollWindow
• 0x46e51c ScreenToClient
• 0x46e520 RemovePropA
• 0x46e524 RemoveMenu
• 0x46e528 ReleaseDC
• 0x46e52c ReleaseCapture
• 0x46e538 RegisterClassA
• 0x46e53c RedrawWindow
• 0x46e540 PtInRect
• 0x46e544 PostQuitMessage
• 0x46e548 PostMessageA
• 0x46e54c PeekMessageA
• 0x46e550 OffsetRect
• 0x46e554 OemToCharA
• 0x46e558 MessageBoxA
• 0x46e55c MapWindowPoints
• 0x46e560 MapVirtualKeyA
• 0x46e564 LoadStringA
• 0x46e568 LoadKeyboardLayoutA
• 0x46e56c LoadIconA
• 0x46e570 LoadCursorA
• 0x46e574 LoadBitmapA
• 0x46e578 KillTimer
• 0x46e57c IsZoomed
• 0x46e580 IsWindowVisible
• 0x46e584 IsWindowEnabled
• 0x46e588 IsWindow
• 0x46e58c IsRectEmpty
• 0x46e590 IsIconic
• 0x46e594 IsDialogMessageA
• 0x46e598 IsChild
• 0x46e59c InvalidateRect
• 0x46e5a0 IntersectRect
• 0x46e5a4 InsertMenuItemA
• 0x46e5a8 InsertMenuA
• 0x46e5ac InflateRect
• 0x46e5b4 GetWindowTextA
• 0x46e5b8 GetWindowRect
• 0x46e5bc GetWindowPlacement
• 0x46e5c0 GetWindowLongA
• 0x46e5c4 GetWindowDC
• 0x46e5c8 GetTopWindow
• 0x46e5cc GetSystemMetrics
• 0x46e5d0 GetSystemMenu
• 0x46e5d4 GetSysColorBrush
• 0x46e5d8 GetSysColor
• 0x46e5dc GetSubMenu
• 0x46e5e0 GetScrollRange
• 0x46e5e4 GetScrollPos
• 0x46e5e8 GetScrollInfo
• 0x46e5ec GetPropA
• 0x46e5f0 GetParent
• 0x46e5f4 GetWindow
• 0x46e5f8 GetMenuStringA
• 0x46e5fc GetMenuState
• 0x46e600 GetMenuItemInfoA
• 0x46e604 GetMenuItemID
• 0x46e608 GetMenuItemCount
• 0x46e60c GetMenu
• 0x46e610 GetLastActivePopup
• 0x46e614 GetKeyboardState
• 0x46e61c GetKeyboardLayout
• 0x46e620 GetKeyState
• 0x46e624 GetKeyNameTextA
• 0x46e628 GetIconInfo
• 0x46e62c GetForegroundWindow
• 0x46e630 GetFocus
• 0x46e634 GetDlgItem
• 0x46e638 GetDesktopWindow
• 0x46e63c GetDCEx
• 0x46e640 GetDC
• 0x46e644 GetCursorPos
• 0x46e648 GetCursor
• 0x46e64c GetClipboardData
• 0x46e650 GetClientRect
• 0x46e654 GetClassNameA
• 0x46e658 GetClassInfoA
• 0x46e65c GetCapture
• 0x46e660 GetActiveWindow
• 0x46e664 FrameRect
• 0x46e668 FindWindowA
• 0x46e66c FillRect
• 0x46e670 EqualRect
• 0x46e674 EnumWindows
• 0x46e678 EnumThreadWindows
• 0x46e67c EndPaint
• 0x46e680 EnableWindow
• 0x46e684 EnableScrollBar
• 0x46e688 EnableMenuItem
• 0x46e68c DrawTextA
• 0x46e690 DrawMenuBar
• 0x46e694 DrawIconEx
• 0x46e698 DrawIcon
• 0x46e69c DrawFrameControl
• 0x46e6a0 DrawFocusRect
• 0x46e6a4 DrawEdge
• 0x46e6a8 DispatchMessageA
• 0x46e6ac DestroyWindow
• 0x46e6b0 DestroyMenu
• 0x46e6b4 DestroyIcon
• 0x46e6b8 DestroyCursor
• 0x46e6bc DeleteMenu
• 0x46e6c0 DefWindowProcA
• 0x46e6c4 DefMDIChildProcA
• 0x46e6c8 DefFrameProcA
• 0x46e6cc CreatePopupMenu
• 0x46e6d0 CreateMenu
• 0x46e6d4 CreateIcon
• 0x46e6d8 ClientToScreen
• 0x46e6dc CheckMenuItem
• 0x46e6e0 CallWindowProcA
• 0x46e6e4 CallNextHookEx
• 0x46e6e8 BeginPaint
• 0x46e6ec CharNextA
• 0x46e6f0 CharLowerBuffA
• 0x46e6f4 CharLowerA
• 0x46e6f8 CharToOemA
• 0x46e6fc AdjustWindowRectEx
Library kernel32.dll:
• 0x46e708 Sleep
Library oleaut32.dll:
• 0x46e710 SafeArrayPtrOfIndex
• 0x46e714 SafeArrayGetUBound
• 0x46e718 SafeArrayGetLBound
• 0x46e71c SafeArrayCreate
• 0x46e720 VariantChangeType
• 0x46e724 VariantCopy
• 0x46e728 VariantClear
• 0x46e72c VariantInit
Library ole32.dll:
• 0x46e734 CoTaskMemAlloc
• 0x46e738 CoCreateInstance
• 0x46e73c CoUninitialize
• 0x46e740 CoInitialize
Library comctl32.dll:
• 0x46e750 ImageList_Write
• 0x46e754 ImageList_Read
• 0x46e764 ImageList_DragMove
• 0x46e768 ImageList_DragLeave
• 0x46e76c ImageList_DragEnter
• 0x46e770 ImageList_EndDrag
• 0x46e774 ImageList_BeginDrag
• 0x46e778 ImageList_Remove
• 0x46e77c ImageList_DrawEx
• 0x46e780 ImageList_Replace
• 0x46e784 ImageList_Draw
• 0x46e794 ImageList_Add
• 0x46e79c ImageList_Destroy
• 0x46e7a0 ImageList_Create
• 0x46e7a4 InitCommonControls
Library comdlg32.dll:
• 0x46e7ac GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 49236 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.