4.8
中危
该样本未表现出任何异常！
重新分析
更多

acbcb4df85d5f9b834b53599b13447cac78dcae89cbf9ae396ec7f932ea174cb

21c6ee752d826af0811cd0ec1ef184ab.exe

分析耗时

38s

最近分析

文件大小

810.0KB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619304043.411124
GlobalMemoryStatusEx
success 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (2 个事件)
Time & API Arguments Status Return Repeated
1619304043.192124
__exception__
stacktrace: 
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 51838784
registers.edi: 0
registers.eax: 0
registers.ebp: 51838856
registers.edx: 0
registers.ebx: 0
registers.esi: 0
registers.ecx: 1969237513
exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 5b e9 10 17 f9
exception.symbol: 21c6ee752d826af0811cd0ec1ef184ab+0x71ec3
exception.instruction: div eax
exception.module: 21c6ee752d826af0811cd0ec1ef184ab.exe
exception.exception_code: 0xc0000094
exception.offset: 466627
exception.address: 0x471ec3
success 0 0
1619304048.911249
__exception__
stacktrace: 
CreateFileMappingW+0xe5 OpenFileMappingW-0x29 kernelbase+0xdc73 @ 0x778edc73
GetFileVersion+0xa7 ND_RI2-0x2eb mscoreei+0xe97b @ 0x7474e97b
GetFileVersion+0x1bb ND_RI2-0x1d7 mscoreei+0xea8f @ 0x7474ea8f
RegisterShimImplCallback+0x48e5 CLRCreateInstance-0x13e6 mscoreei+0xb25a @ 0x7474b25a
RegisterShimImplCallback+0x4b52 CLRCreateInstance-0x1179 mscoreei+0xb4c7 @ 0x7474b4c7
RegisterShimImplCallback+0x4300 CLRCreateInstance-0x19cb mscoreei+0xac75 @ 0x7474ac75
RegisterShimImplCallback+0x4561 CLRCreateInstance-0x176a mscoreei+0xaed6 @ 0x7474aed6
CreateConfigStream+0xc89 _CorExeMain-0x62 mscoreei+0x5511 @ 0x74745511
_CorExeMain+0x2b _CorExeMain2-0x141 mscoreei+0x559e @ 0x7474559e
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x75027f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x75024de3
21c6ee752d826af0811cd0ec1ef184ab+0x5aa4d @ 0x45aa4d
21c6ee752d826af0811cd0ec1ef184ab+0x53254 @ 0x453254
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634372
registers.edi: 2
registers.eax: 1
registers.ebp: 1634412
registers.edx: 228
registers.ebx: 983045
registers.esi: 1634532
registers.ecx: 228
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xff4414ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (30 个事件)
Time & API Arguments Status Return Repeated
1619304042.739124
NtAllocateVirtualMemory
process_identifier: 2456
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x005a0000
success 0 0
1619304043.192124
NtAllocateVirtualMemory
process_identifier: 2456
region_size: 45056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01fb0000
success 0 0
1619304043.192124
NtAllocateVirtualMemory
process_identifier: 2456
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02000000
success 0 0
1619304045.505249
NtProtectVirtualMemory
process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619304045.614249
NtAllocateVirtualMemory
process_identifier: 2056
region_size: 262144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01db0000
success 0 0
1619304045.614249
NtAllocateVirtualMemory
process_identifier: 2056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01db0000
success 0 0
1619304045.630249
NtAllocateVirtualMemory
process_identifier: 2056
region_size: 335872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01df0000
success 0 0
1619304045.630249
NtProtectVirtualMemory
process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 307200
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01df2000
success 0 0
1619304046.567249
NtAllocateVirtualMemory
process_identifier: 2056
region_size: 1769472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02070000
success 0 0
1619304046.567249
NtAllocateVirtualMemory
process_identifier: 2056
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x021e0000
success 0 0
1619304048.864249
NtProtectVirtualMemory
process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ee2000
success 0 0
1619304048.864249
NtProtectVirtualMemory
process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619304048.864249
NtProtectVirtualMemory
process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ee2000
success 0 0
1619304048.864249
NtProtectVirtualMemory
process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619304048.864249
NtProtectVirtualMemory
process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ee2000
success 0 0
1619304048.864249
NtProtectVirtualMemory
process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619304048.864249
NtProtectVirtualMemory
process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ee2000
success 0 0
1619304048.864249
NtProtectVirtualMemory
process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619304048.864249
NtProtectVirtualMemory
process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ee2000
success 0 0
1619304048.864249
NtProtectVirtualMemory
process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619304048.864249
NtProtectVirtualMemory
process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ee2000
success 0 0
1619304048.864249
NtProtectVirtualMemory
process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619304048.864249
NtProtectVirtualMemory
process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ee2000
success 0 0
1619304048.864249
NtProtectVirtualMemory
process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619304048.864249
NtProtectVirtualMemory
process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ee2000
success 0 0
1619304048.864249
NtProtectVirtualMemory
process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619304048.864249
NtProtectVirtualMemory
process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ee2000
success 0 0
1619304048.864249
NtProtectVirtualMemory
process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619304048.864249
NtProtectVirtualMemory
process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ee2000
success 0 0
1619304048.864249
NtProtectVirtualMemory
process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (3 个事件)
entropy 7.502487179934397 section {'size_of_data': '0x0000ba00', 'virtual_address': '0x00073000', 'entropy': 7.502487179934397, 'name': 'DATA', 'virtual_size': '0x0000b9ec'} description A section with a high entropy has been found
entropy 7.367026027274055 section {'size_of_data': '0x00043000', 'virtual_address': '0x0008d000', 'entropy': 7.367026027274055, 'name': '.rsrc', 'virtual_size': '0x00042f7c'} description A section with a high entropy has been found
entropy 0.38875154511742893 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 2456 called NtSetContextThread to modify thread in remote process 2056
Time & API Arguments Status Return Repeated
1619304044.146124
NtSetContextThread
thread_handle: 0x00000118
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907712
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2056
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2456 resumed a thread in remote process 2056
Time & API Arguments Status Return Repeated
1619304045.208124
NtResumeThread
thread_handle: 0x00000118
suspend_count: 1
process_identifier: 2056
success 0 0
Executed a process and injected code into it, probably while unpacking (6 个事件)
Time & API Arguments Status Return Repeated
1619304043.974124
CreateProcessInternalW
thread_identifier: 2264
thread_handle: 0x00000118
process_identifier: 2056
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\21c6ee752d826af0811cd0ec1ef184ab.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x0000011c
inherit_handles: 0
success 1 0
1619304043.974124
NtUnmapViewOfSection
process_identifier: 2056
region_size: 4096
process_handle: 0x0000011c
base_address: 0x00400000
success 0 0
1619304043.989124
NtMapViewOfSection
section_handle: 0x000001b8
process_identifier: 2056
commit_size: 720896
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x0000011c
allocation_type: 0 ()
section_offset: 0
view_size: 720896
base_address: 0x00400000
success 0 0
1619304044.146124
NtGetContextThread
thread_handle: 0x00000118
success 0 0
1619304044.146124
NtSetContextThread
thread_handle: 0x00000118
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4907712
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2056
success 0 0
1619304045.208124
NtResumeThread
thread_handle: 0x00000118
suspend_count: 1
process_identifier: 2056
success 0 0
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x480178 VirtualFree
• 0x48017c VirtualAlloc
• 0x480180 LocalFree
• 0x480184 LocalAlloc
• 0x480188 GetVersion
• 0x48018c GetCurrentThreadId
• 0x480198 VirtualQuery
• 0x48019c WideCharToMultiByte
• 0x4801a0 MultiByteToWideChar
• 0x4801a4 lstrlenA
• 0x4801a8 lstrcpynA
• 0x4801ac LoadLibraryExA
• 0x4801b0 GetThreadLocale
• 0x4801b4 GetStartupInfoA
• 0x4801b8 GetProcAddress
• 0x4801bc GetModuleHandleA
• 0x4801c0 GetModuleFileNameA
• 0x4801c4 GetLocaleInfoA
• 0x4801c8 GetCommandLineA
• 0x4801cc FreeLibrary
• 0x4801d0 FindFirstFileA
• 0x4801d4 FindClose
• 0x4801d8 ExitProcess
• 0x4801dc ExitThread
• 0x4801e0 CreateThread
• 0x4801e4 WriteFile
• 0x4801ec RtlUnwind
• 0x4801f0 RaiseException
• 0x4801f4 GetStdHandle
Library user32.dll:
• 0x4801fc GetKeyboardType
• 0x480200 LoadStringA
• 0x480204 MessageBoxA
• 0x480208 CharNextA
Library advapi32.dll:
• 0x480210 RegQueryValueExA
• 0x480214 RegOpenKeyExA
• 0x480218 RegCloseKey
Library oleaut32.dll:
• 0x480220 SysFreeString
• 0x480224 SysReAllocStringLen
• 0x480228 SysAllocStringLen
Library kernel32.dll:
• 0x480230 TlsSetValue
• 0x480234 TlsGetValue
• 0x480238 LocalAlloc
• 0x48023c GetModuleHandleA
Library advapi32.dll:
• 0x480244 RegQueryValueExA
• 0x480248 RegOpenKeyExA
• 0x48024c RegCloseKey
Library kernel32.dll:
• 0x480254 lstrlenA
• 0x480258 lstrcpyA
• 0x48025c lstrcmpA
• 0x480260 WriteFile
• 0x480264 WaitForSingleObject
• 0x48026c VirtualQuery
• 0x480270 VirtualAlloc
• 0x480274 Sleep
• 0x480278 SizeofResource
• 0x48027c SetThreadLocale
• 0x480280 SetFilePointer
• 0x480284 SetEvent
• 0x480288 SetErrorMode
• 0x48028c SetEndOfFile
• 0x480294 ResumeThread
• 0x480298 ResetEvent
• 0x48029c ReleaseMutex
• 0x4802a0 ReadFile
• 0x4802a4 MultiByteToWideChar
• 0x4802a8 MulDiv
• 0x4802ac LockResource
• 0x4802b0 LoadResource
• 0x4802b4 LoadLibraryA
• 0x4802c0 GlobalUnlock
• 0x4802c4 GlobalReAlloc
• 0x4802c8 GlobalHandle
• 0x4802cc GlobalLock
• 0x4802d0 GlobalFree
• 0x4802d4 GlobalFindAtomA
• 0x4802d8 GlobalDeleteAtom
• 0x4802dc GlobalAlloc
• 0x4802e0 GlobalAddAtomA
• 0x4802e4 GetVersionExA
• 0x4802e8 GetVersion
• 0x4802ec GetTickCount
• 0x4802f0 GetThreadLocale
• 0x4802f8 GetSystemTime
• 0x4802fc GetSystemInfo
• 0x480300 GetStringTypeExA
• 0x480304 GetStdHandle
• 0x480308 GetProcAddress
• 0x48030c GetModuleHandleA
• 0x480310 GetModuleFileNameA
• 0x480314 GetLocaleInfoA
• 0x480318 GetLocalTime
• 0x48031c GetLastError
• 0x480320 GetFullPathNameA
• 0x480324 GetExitCodeThread
• 0x480328 GetDiskFreeSpaceA
• 0x48032c GetDateFormatA
• 0x480330 GetCurrentThreadId
• 0x480334 GetCurrentProcessId
• 0x48033c GetCPInfo
• 0x480340 GetACP
• 0x480344 FreeResource
• 0x48034c InterlockedExchange
• 0x480354 FreeLibrary
• 0x480358 FormatMessageA
• 0x48035c FindResourceA
• 0x480364 FindFirstFileA
• 0x480370 FindClose
• 0x480380 ExitThread
• 0x480384 EnumCalendarInfoA
• 0x480390 CreateThread
• 0x480394 CreateMutexA
• 0x480398 CreateFileA
• 0x48039c CreateEventA
• 0x4803a0 CompareStringA
• 0x4803a4 CloseHandle
Library version.dll:
• 0x4803ac VerQueryValueA
• 0x4803b4 GetFileVersionInfoA
Library gdi32.dll:
• 0x4803bc UnrealizeObject
• 0x4803c0 StretchBlt
• 0x4803c4 SetWindowOrgEx
• 0x4803c8 SetViewportOrgEx
• 0x4803cc SetTextColor
• 0x4803d0 SetStretchBltMode
• 0x4803d4 SetROP2
• 0x4803d8 SetPixel
• 0x4803dc SetDIBColorTable
• 0x4803e0 SetBrushOrgEx
• 0x4803e4 SetBkMode
• 0x4803e8 SetBkColor
• 0x4803ec SelectPalette
• 0x4803f0 SelectObject
• 0x4803f4 SelectClipRgn
• 0x4803f8 SaveDC
• 0x4803fc RestoreDC
• 0x480400 Rectangle
• 0x480404 RectVisible
• 0x480408 RealizePalette
• 0x48040c Polyline
• 0x480410 PatBlt
• 0x480414 MoveToEx
• 0x480418 MaskBlt
• 0x48041c LineTo
• 0x480420 IntersectClipRect
• 0x480424 GetWindowOrgEx
• 0x480428 GetTextMetricsA
• 0x480434 GetStockObject
• 0x480438 GetPixel
• 0x48043c GetPaletteEntries
• 0x480440 GetObjectA
• 0x480444 GetDeviceCaps
• 0x480448 GetDIBits
• 0x48044c GetDIBColorTable
• 0x480450 GetDCOrgEx
• 0x480458 GetClipBox
• 0x48045c GetBrushOrgEx
• 0x480460 GetBitmapBits
• 0x480464 GetArcDirection
• 0x480468 ExtTextOutA
• 0x48046c ExcludeClipRect
• 0x480470 DeleteObject
• 0x480474 DeleteDC
• 0x480478 CreateSolidBrush
• 0x48047c CreatePenIndirect
• 0x480480 CreatePalette
• 0x480488 CreateFontIndirectA
• 0x48048c CreateDIBitmap
• 0x480490 CreateDIBSection
• 0x480494 CreateCompatibleDC
• 0x48049c CreateBrushIndirect
• 0x4804a0 CreateBitmap
• 0x4804a4 BitBlt
Library user32.dll:
• 0x4804ac CreateWindowExA
• 0x4804b0 WindowFromPoint
• 0x4804b4 WinHelpA
• 0x4804b8 WaitMessage
• 0x4804bc UpdateWindow
• 0x4804c0 UnregisterClassA
• 0x4804c4 UnhookWindowsHookEx
• 0x4804c8 TranslateMessage
• 0x4804d0 TrackPopupMenu
• 0x4804d8 ShowWindow
• 0x4804dc ShowScrollBar
• 0x4804e0 ShowOwnedPopups
• 0x4804e4 ShowCursor
• 0x4804e8 SetWindowsHookExA
• 0x4804ec SetWindowTextA
• 0x4804f0 SetWindowPos
• 0x4804f4 SetWindowPlacement
• 0x4804f8 SetWindowLongA
• 0x4804fc SetTimer
• 0x480500 SetScrollRange
• 0x480504 SetScrollPos
• 0x480508 SetScrollInfo
• 0x48050c SetRect
• 0x480510 SetPropA
• 0x480514 SetParent
• 0x480518 SetMenuItemInfoA
• 0x48051c SetMenu
• 0x480520 SetForegroundWindow
• 0x480524 SetFocus
• 0x480528 SetCursor
• 0x48052c SetClassLongA
• 0x480530 SetCapture
• 0x480534 SetActiveWindow
• 0x480538 SendMessageA
• 0x48053c ScrollWindow
• 0x480540 ScreenToClient
• 0x480544 RemovePropA
• 0x480548 RemoveMenu
• 0x48054c ReleaseDC
• 0x480550 ReleaseCapture
• 0x48055c RegisterClassA
• 0x480560 RedrawWindow
• 0x480564 PtInRect
• 0x480568 PostQuitMessage
• 0x48056c PostMessageA
• 0x480570 PeekMessageA
• 0x480574 OffsetRect
• 0x480578 OemToCharA
• 0x480580 MessageBoxA
• 0x480584 MapWindowPoints
• 0x480588 MapVirtualKeyA
• 0x48058c LoadStringA
• 0x480590 LoadKeyboardLayoutA
• 0x480594 LoadIconA
• 0x480598 LoadCursorA
• 0x48059c LoadBitmapA
• 0x4805a0 KillTimer
• 0x4805a4 IsZoomed
• 0x4805a8 IsWindowVisible
• 0x4805ac IsWindowEnabled
• 0x4805b0 IsWindow
• 0x4805b4 IsRectEmpty
• 0x4805b8 IsIconic
• 0x4805bc IsDialogMessageA
• 0x4805c0 IsChild
• 0x4805c4 InvalidateRect
• 0x4805c8 IntersectRect
• 0x4805cc InsertMenuItemA
• 0x4805d0 InsertMenuA
• 0x4805d4 InflateRect
• 0x4805dc GetWindowTextA
• 0x4805e0 GetWindowRect
• 0x4805e4 GetWindowPlacement
• 0x4805e8 GetWindowLongA
• 0x4805ec GetWindowDC
• 0x4805f0 GetTopWindow
• 0x4805f4 GetSystemMetrics
• 0x4805f8 GetSystemMenu
• 0x4805fc GetSysColorBrush
• 0x480600 GetSysColor
• 0x480604 GetSubMenu
• 0x480608 GetScrollRange
• 0x48060c GetScrollPos
• 0x480610 GetScrollInfo
• 0x480614 GetPropA
• 0x480618 GetParent
• 0x48061c GetWindow
• 0x480620 GetMessagePos
• 0x480624 GetMenuStringA
• 0x480628 GetMenuState
• 0x48062c GetMenuItemInfoA
• 0x480630 GetMenuItemID
• 0x480634 GetMenuItemCount
• 0x480638 GetMenu
• 0x48063c GetLastActivePopup
• 0x480640 GetKeyboardState
• 0x480648 GetKeyboardLayout
• 0x48064c GetKeyState
• 0x480650 GetKeyNameTextA
• 0x480654 GetIconInfo
• 0x480658 GetForegroundWindow
• 0x48065c GetFocus
• 0x480660 GetDesktopWindow
• 0x480664 GetDCEx
• 0x480668 GetDC
• 0x48066c GetCursorPos
• 0x480670 GetCursor
• 0x480674 GetClientRect
• 0x480678 GetClassNameA
• 0x48067c GetClassInfoA
• 0x480680 GetCapture
• 0x480684 GetActiveWindow
• 0x480688 FrameRect
• 0x48068c FindWindowA
• 0x480690 FillRect
• 0x480694 EqualRect
• 0x480698 EnumWindows
• 0x48069c EnumThreadWindows
• 0x4806a0 EndPaint
• 0x4806a4 EndDeferWindowPos
• 0x4806a8 EnableWindow
• 0x4806ac EnableScrollBar
• 0x4806b0 EnableMenuItem
• 0x4806b4 DrawTextA
• 0x4806b8 DrawMenuBar
• 0x4806bc DrawIconEx
• 0x4806c0 DrawIcon
• 0x4806c4 DrawFrameControl
• 0x4806c8 DrawEdge
• 0x4806cc DispatchMessageA
• 0x4806d0 DestroyWindow
• 0x4806d4 DestroyMenu
• 0x4806d8 DestroyIcon
• 0x4806dc DestroyCursor
• 0x4806e0 DeleteMenu
• 0x4806e4 DeferWindowPos
• 0x4806e8 DefWindowProcA
• 0x4806ec DefMDIChildProcA
• 0x4806f0 DefFrameProcA
• 0x4806f4 CreatePopupMenu
• 0x4806f8 CreateMenu
• 0x4806fc CreateIcon
• 0x480700 ClientToScreen
• 0x480708 CheckMenuItem
• 0x48070c CallWindowProcA
• 0x480710 CallNextHookEx
• 0x480714 BeginPaint
• 0x480718 BeginDeferWindowPos
• 0x48071c CharNextA
• 0x480720 CharLowerA
• 0x480724 CharUpperBuffA
• 0x480728 CharToOemA
• 0x48072c AdjustWindowRectEx
Library kernel32.dll:
• 0x480738 Sleep
Library oleaut32.dll:
• 0x480740 SafeArrayPtrOfIndex
• 0x480744 SafeArrayGetUBound
• 0x480748 SafeArrayGetLBound
• 0x48074c SafeArrayCreate
• 0x480750 VariantChangeType
• 0x480754 VariantCopy
• 0x480758 VariantClear
• 0x48075c VariantInit
Library ole32.dll:
• 0x480764 OleUninitialize
• 0x480768 OleInitialize
• 0x48076c CoTaskMemAlloc
• 0x480770 CoCreateInstance
• 0x480774 CoUninitialize
• 0x480778 CoInitialize
Library oleaut32.dll:
• 0x480780 GetErrorInfo
• 0x480784 SysFreeString
Library comctl32.dll:
• 0x480794 ImageList_Write
• 0x480798 ImageList_Read
• 0x4807a8 ImageList_DragMove
• 0x4807ac ImageList_DragLeave
• 0x4807b0 ImageList_DragEnter
• 0x4807b4 ImageList_EndDrag
• 0x4807b8 ImageList_BeginDrag
• 0x4807bc ImageList_Remove
• 0x4807c0 ImageList_DrawEx
• 0x4807c4 ImageList_Draw
• 0x4807d4 ImageList_Add
• 0x4807dc ImageList_Destroy
• 0x4807e0 ImageList_Create
• 0x4807e4 InitCommonControls
Library shell32.dll:
• 0x4807ec ShellExecuteExA
• 0x4807f0 ShellExecuteA
• 0x4807f4 SHGetFileInfoA
Library shell32.dll:
• 0x480800 SHGetMalloc
• 0x480804 SHGetDesktopFolder

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 49238 239.255.255.250 1900
192.168.56.101 50003 239.255.255.250 3702
192.168.56.101 50005 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.