6.0
高危
该样本未表现出任何异常！
重新分析
更多

dc22c2145431a6ecc75ef2f7271120d8e102cef7faeac96d1d1d6ffb9b680ac4

66385e2a0e7bb2d7b31634e8e195ae64.exe

分析耗时

60s

最近分析

文件大小

736.5KB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619649160.762501
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 49217076
registers.edi: 0
registers.eax: 0
registers.ebp: 49217416
registers.edx: 32
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 e9 0b 89 00 00 e9
exception.symbol: 66385e2a0e7bb2d7b31634e8e195ae64+0x61406
exception.instruction: div eax
exception.module: 66385e2a0e7bb2d7b31634e8e195ae64.exe
exception.exception_code: 0xc0000094
exception.offset: 398342
exception.address: 0x461406
success 0 0
1619649164.606124
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x73aae97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x73aaea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x73aab25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x73aab4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x73aaac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x73aaaed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x73aa5511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x73aa559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74167f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74164de3
66385e2a0e7bb2d7b31634e8e195ae64+0x5aa4d @ 0x45aa4d
66385e2a0e7bb2d7b31634e8e195ae64+0x53254 @ 0x453254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfcde14ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619649156.980501
NtAllocateVirtualMemory
process_identifier: 1712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1619649160.762501
NtProtectVirtualMemory
process_identifier: 1712
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 36864
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00461000
success 0 0
1619649160.777501
NtAllocateVirtualMemory
process_identifier: 1712
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f70000
success 0 0
1619649161.122124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619649161.153124
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 1900544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01f50000
success 0 0
1619649161.153124
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x020e0000
success 0 0
1619649161.153124
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 335872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00560000
success 0 0
1619649161.153124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 307200
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00562000
success 0 0
1619649162.091124
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 851968
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01f50000
success 0 0
1619649162.091124
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01fe0000
success 0 0
1619649164.560124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005c2000
success 0 0
1619649164.560124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619649164.560124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005c2000
success 0 0
1619649164.560124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619649164.560124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005c2000
success 0 0
1619649164.560124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619649164.560124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005c2000
success 0 0
1619649164.560124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619649164.560124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005c2000
success 0 0
1619649164.560124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619649164.560124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005c2000
success 0 0
1619649164.560124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619649164.560124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005c2000
success 0 0
1619649164.560124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619649164.575124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005c2000
success 0 0
1619649164.575124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619649164.575124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005c2000
success 0 0
1619649164.575124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619649164.575124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x005c2000
success 0 0
1619649164.575124
NtProtectVirtualMemory
process_identifier: 3040
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.423258613782088 section {'size_of_data': '0x00044000', 'virtual_address': '0x0007b000', 'entropy': 7.423258613782088, 'name': '.rsrc', 'virtual_size': '0x00043ebc'} description A section with a high entropy has been found
entropy 0.3698164513936098 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 1712 called NtSetContextThread to modify thread in remote process 3040
Time & API Arguments Status Return Repeated
1619649160.840501
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907328
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3040
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 1712 resumed a thread in remote process 3040
Time & API Arguments Status Return Repeated
1619649160.949501
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 3040
success 0 0
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619649160.824501
CreateProcessInternalW
thread_identifier: 2772
thread_handle: 0x000000fc
process_identifier: 3040
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\66385e2a0e7bb2d7b31634e8e195ae64.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1619649160.824501
NtUnmapViewOfSection
process_identifier: 3040
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1619649160.824501
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 3040
commit_size: 720896
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 720896
base_address: 0x00400000
success 0 0
1619649160.840501
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1619649160.840501
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907328
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3040
success 0 0
1619649160.949501
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 3040
success 0 0
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 172.217.24.14:443
dead_host 216.58.200.238:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x46e13c VirtualFree
• 0x46e140 VirtualAlloc
• 0x46e144 LocalFree
• 0x46e148 LocalAlloc
• 0x46e14c GetVersion
• 0x46e150 GetCurrentThreadId
• 0x46e15c VirtualQuery
• 0x46e160 WideCharToMultiByte
• 0x46e168 MultiByteToWideChar
• 0x46e16c lstrlenA
• 0x46e170 lstrcpynA
• 0x46e174 LoadLibraryExA
• 0x46e178 GetThreadLocale
• 0x46e17c GetStartupInfoA
• 0x46e180 GetProcAddress
• 0x46e184 GetModuleHandleA
• 0x46e188 GetModuleFileNameA
• 0x46e18c GetLocaleInfoA
• 0x46e190 GetLastError
• 0x46e198 GetCommandLineA
• 0x46e19c FreeLibrary
• 0x46e1a0 FindFirstFileA
• 0x46e1a4 FindClose
• 0x46e1a8 ExitProcess
• 0x46e1ac WriteFile
• 0x46e1b4 RtlUnwind
• 0x46e1b8 RaiseException
• 0x46e1bc GetStdHandle
Library user32.dll:
• 0x46e1c4 GetKeyboardType
• 0x46e1c8 LoadStringA
• 0x46e1cc MessageBoxA
• 0x46e1d0 CharNextA
Library advapi32.dll:
• 0x46e1d8 RegQueryValueExA
• 0x46e1dc RegOpenKeyExA
• 0x46e1e0 RegCloseKey
Library oleaut32.dll:
• 0x46e1e8 SysFreeString
• 0x46e1ec SysReAllocStringLen
• 0x46e1f0 SysAllocStringLen
Library kernel32.dll:
• 0x46e1f8 TlsSetValue
• 0x46e1fc TlsGetValue
• 0x46e200 LocalAlloc
• 0x46e204 GetModuleHandleA
Library advapi32.dll:
• 0x46e20c RegQueryValueExA
• 0x46e210 RegOpenKeyExA
• 0x46e214 RegCloseKey
Library kernel32.dll:
• 0x46e21c lstrcpyA
• 0x46e220 WriteFile
• 0x46e228 WaitForSingleObject
• 0x46e22c VirtualQuery
• 0x46e230 VirtualAlloc
• 0x46e234 Sleep
• 0x46e238 SizeofResource
• 0x46e23c SetThreadLocale
• 0x46e240 SetFilePointer
• 0x46e244 SetEvent
• 0x46e248 SetErrorMode
• 0x46e24c SetEndOfFile
• 0x46e250 ResetEvent
• 0x46e254 ReadFile
• 0x46e258 MulDiv
• 0x46e25c LockResource
• 0x46e260 LoadResource
• 0x46e264 LoadLibraryA
• 0x46e270 GlobalUnlock
• 0x46e274 GlobalReAlloc
• 0x46e278 GlobalHandle
• 0x46e27c GlobalLock
• 0x46e280 GlobalFree
• 0x46e284 GlobalFindAtomA
• 0x46e288 GlobalDeleteAtom
• 0x46e28c GlobalAlloc
• 0x46e290 GlobalAddAtomA
• 0x46e294 GetVersionExA
• 0x46e298 GetVersion
• 0x46e29c GetTickCount
• 0x46e2a0 GetThreadLocale
• 0x46e2a8 GetSystemTime
• 0x46e2ac GetSystemInfo
• 0x46e2b0 GetStringTypeExA
• 0x46e2b4 GetStdHandle
• 0x46e2b8 GetProcAddress
• 0x46e2bc GetModuleHandleA
• 0x46e2c0 GetModuleFileNameA
• 0x46e2c4 GetLocaleInfoA
• 0x46e2c8 GetLocalTime
• 0x46e2cc GetLastError
• 0x46e2d0 GetFullPathNameA
• 0x46e2d4 GetFileAttributesA
• 0x46e2d8 GetDiskFreeSpaceA
• 0x46e2dc GetDateFormatA
• 0x46e2e0 GetCurrentThreadId
• 0x46e2e4 GetCurrentProcessId
• 0x46e2e8 GetCPInfo
• 0x46e2ec GetACP
• 0x46e2f0 FreeResource
• 0x46e2f4 InterlockedExchange
• 0x46e2f8 FreeLibrary
• 0x46e2fc FormatMessageA
• 0x46e300 FindResourceA
• 0x46e304 FindNextFileA
• 0x46e308 FindFirstFileA
• 0x46e30c FindClose
• 0x46e318 ExitThread
• 0x46e31c EnumCalendarInfoA
• 0x46e328 CreateThread
• 0x46e32c CreateFileA
• 0x46e330 CreateEventA
• 0x46e334 CompareStringA
• 0x46e338 CloseHandle
Library version.dll:
• 0x46e340 VerQueryValueA
• 0x46e348 GetFileVersionInfoA
Library gdi32.dll:
• 0x46e350 UnrealizeObject
• 0x46e354 StretchBlt
• 0x46e358 SetWindowOrgEx
• 0x46e35c SetWinMetaFileBits
• 0x46e360 SetViewportOrgEx
• 0x46e364 SetTextColor
• 0x46e368 SetStretchBltMode
• 0x46e36c SetROP2
• 0x46e370 SetPixel
• 0x46e374 SetEnhMetaFileBits
• 0x46e378 SetDIBColorTable
• 0x46e37c SetBrushOrgEx
• 0x46e380 SetBkMode
• 0x46e384 SetBkColor
• 0x46e388 SelectPalette
• 0x46e38c SelectObject
• 0x46e390 SaveDC
• 0x46e394 RestoreDC
• 0x46e398 Rectangle
• 0x46e39c RectVisible
• 0x46e3a0 RealizePalette
• 0x46e3a4 Polyline
• 0x46e3a8 PlayEnhMetaFile
• 0x46e3ac PatBlt
• 0x46e3b0 MoveToEx
• 0x46e3b4 MaskBlt
• 0x46e3b8 LineTo
• 0x46e3bc IntersectClipRect
• 0x46e3c0 GetWindowOrgEx
• 0x46e3c4 GetWinMetaFileBits
• 0x46e3c8 GetTextMetricsA
• 0x46e3d4 GetStockObject
• 0x46e3d8 GetPixel
• 0x46e3dc GetPaletteEntries
• 0x46e3e0 GetObjectA
• 0x46e3ec GetEnhMetaFileBits
• 0x46e3f0 GetDeviceCaps
• 0x46e3f4 GetDIBits
• 0x46e3f8 GetDIBColorTable
• 0x46e3fc GetDCOrgEx
• 0x46e404 GetClipBox
• 0x46e408 GetBrushOrgEx
• 0x46e40c GetBitmapBits
• 0x46e410 ExtTextOutA
• 0x46e414 ExcludeClipRect
• 0x46e418 DeleteObject
• 0x46e41c DeleteEnhMetaFile
• 0x46e420 DeleteDC
• 0x46e424 CreateSolidBrush
• 0x46e428 CreatePenIndirect
• 0x46e42c CreatePalette
• 0x46e434 CreateFontIndirectA
• 0x46e438 CreateDIBitmap
• 0x46e43c CreateDIBSection
• 0x46e440 CreateCompatibleDC
• 0x46e448 CreateBrushIndirect
• 0x46e44c CreateBitmap
• 0x46e450 CopyEnhMetaFileA
• 0x46e454 BitBlt
Library user32.dll:
• 0x46e45c CreateWindowExA
• 0x46e460 WindowFromPoint
• 0x46e464 WinHelpA
• 0x46e468 WaitMessage
• 0x46e46c UpdateWindow
• 0x46e470 UnregisterClassA
• 0x46e474 UnhookWindowsHookEx
• 0x46e478 TranslateMessage
• 0x46e480 TrackPopupMenu
• 0x46e488 ShowWindow
• 0x46e48c ShowScrollBar
• 0x46e490 ShowOwnedPopups
• 0x46e494 ShowCursor
• 0x46e498 SetWindowsHookExA
• 0x46e49c SetWindowTextA
• 0x46e4a0 SetWindowPos
• 0x46e4a4 SetWindowPlacement
• 0x46e4a8 SetWindowLongA
• 0x46e4ac SetTimer
• 0x46e4b0 SetScrollRange
• 0x46e4b4 SetScrollPos
• 0x46e4b8 SetScrollInfo
• 0x46e4bc SetRect
• 0x46e4c0 SetPropA
• 0x46e4c4 SetParent
• 0x46e4c8 SetMenuItemInfoA
• 0x46e4cc SetMenu
• 0x46e4d0 SetForegroundWindow
• 0x46e4d4 SetFocus
• 0x46e4d8 SetCursor
• 0x46e4dc SetClassLongA
• 0x46e4e0 SetCapture
• 0x46e4e4 SetActiveWindow
• 0x46e4e8 SendMessageA
• 0x46e4ec ScrollWindow
• 0x46e4f0 ScreenToClient
• 0x46e4f4 RemovePropA
• 0x46e4f8 RemoveMenu
• 0x46e4fc ReleaseDC
• 0x46e500 ReleaseCapture
• 0x46e50c RegisterClassA
• 0x46e510 RedrawWindow
• 0x46e514 PtInRect
• 0x46e518 PostQuitMessage
• 0x46e51c PostMessageA
• 0x46e520 PeekMessageA
• 0x46e524 OffsetRect
• 0x46e528 OemToCharA
• 0x46e52c MessageBoxA
• 0x46e530 MapWindowPoints
• 0x46e534 MapVirtualKeyA
• 0x46e538 LoadStringA
• 0x46e53c LoadKeyboardLayoutA
• 0x46e540 LoadIconA
• 0x46e544 LoadCursorA
• 0x46e548 LoadBitmapA
• 0x46e54c KillTimer
• 0x46e550 IsZoomed
• 0x46e554 IsWindowVisible
• 0x46e558 IsWindowEnabled
• 0x46e55c IsWindow
• 0x46e560 IsRectEmpty
• 0x46e564 IsIconic
• 0x46e568 IsDialogMessageA
• 0x46e56c IsChild
• 0x46e570 InvalidateRect
• 0x46e574 IntersectRect
• 0x46e578 InsertMenuItemA
• 0x46e57c InsertMenuA
• 0x46e580 InflateRect
• 0x46e588 GetWindowTextA
• 0x46e58c GetWindowRect
• 0x46e590 GetWindowPlacement
• 0x46e594 GetWindowLongA
• 0x46e598 GetWindowDC
• 0x46e59c GetTopWindow
• 0x46e5a0 GetSystemMetrics
• 0x46e5a4 GetSystemMenu
• 0x46e5a8 GetSysColorBrush
• 0x46e5ac GetSysColor
• 0x46e5b0 GetSubMenu
• 0x46e5b4 GetScrollRange
• 0x46e5b8 GetScrollPos
• 0x46e5bc GetScrollInfo
• 0x46e5c0 GetPropA
• 0x46e5c4 GetParent
• 0x46e5c8 GetWindow
• 0x46e5cc GetMenuStringA
• 0x46e5d0 GetMenuState
• 0x46e5d4 GetMenuItemInfoA
• 0x46e5d8 GetMenuItemID
• 0x46e5dc GetMenuItemCount
• 0x46e5e0 GetMenu
• 0x46e5e4 GetLastActivePopup
• 0x46e5e8 GetKeyboardState
• 0x46e5f0 GetKeyboardLayout
• 0x46e5f4 GetKeyState
• 0x46e5f8 GetKeyNameTextA
• 0x46e5fc GetInputState
• 0x46e600 GetIconInfo
• 0x46e604 GetForegroundWindow
• 0x46e608 GetFocus
• 0x46e60c GetDlgItem
• 0x46e610 GetDesktopWindow
• 0x46e614 GetDCEx
• 0x46e618 GetDC
• 0x46e61c GetCursorPos
• 0x46e620 GetCursor
• 0x46e624 GetClipboardData
• 0x46e628 GetClientRect
• 0x46e62c GetClassNameA
• 0x46e630 GetClassInfoA
• 0x46e634 GetCapture
• 0x46e638 GetActiveWindow
• 0x46e63c FrameRect
• 0x46e640 FindWindowA
• 0x46e644 FillRect
• 0x46e648 EqualRect
• 0x46e64c EnumWindows
• 0x46e650 EnumThreadWindows
• 0x46e654 EndPaint
• 0x46e658 EnableWindow
• 0x46e65c EnableScrollBar
• 0x46e660 EnableMenuItem
• 0x46e664 DrawTextA
• 0x46e668 DrawMenuBar
• 0x46e66c DrawIconEx
• 0x46e670 DrawIcon
• 0x46e674 DrawFrameControl
• 0x46e678 DrawFocusRect
• 0x46e67c DrawEdge
• 0x46e680 DispatchMessageA
• 0x46e684 DestroyWindow
• 0x46e688 DestroyMenu
• 0x46e68c DestroyIcon
• 0x46e690 DestroyCursor
• 0x46e694 DeleteMenu
• 0x46e698 DefWindowProcA
• 0x46e69c DefMDIChildProcA
• 0x46e6a0 DefFrameProcA
• 0x46e6a4 CreatePopupMenu
• 0x46e6a8 CreateMenu
• 0x46e6ac CreateIcon
• 0x46e6b0 ClientToScreen
• 0x46e6b4 CheckMenuItem
• 0x46e6b8 CallWindowProcA
• 0x46e6bc CallNextHookEx
• 0x46e6c0 BeginPaint
• 0x46e6c4 CharNextA
• 0x46e6c8 CharLowerBuffA
• 0x46e6cc CharLowerA
• 0x46e6d0 CharToOemA
• 0x46e6d4 AdjustWindowRectEx
Library kernel32.dll:
• 0x46e6e0 Sleep
Library oleaut32.dll:
• 0x46e6e8 SafeArrayPtrOfIndex
• 0x46e6ec SafeArrayGetUBound
• 0x46e6f0 SafeArrayGetLBound
• 0x46e6f4 SafeArrayCreate
• 0x46e6f8 VariantChangeType
• 0x46e6fc VariantCopy
• 0x46e700 VariantClear
• 0x46e704 VariantInit
Library comctl32.dll:
• 0x46e714 ImageList_Write
• 0x46e718 ImageList_Read
• 0x46e728 ImageList_DragMove
• 0x46e72c ImageList_DragLeave
• 0x46e730 ImageList_DragEnter
• 0x46e734 ImageList_EndDrag
• 0x46e738 ImageList_BeginDrag
• 0x46e73c ImageList_Remove
• 0x46e740 ImageList_DrawEx
• 0x46e744 ImageList_Replace
• 0x46e748 ImageList_Draw
• 0x46e758 ImageList_Add
• 0x46e760 ImageList_Destroy
• 0x46e764 ImageList_Create
Library comdlg32.dll:
• 0x46e76c GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 49236 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.