SmartHawk

8.6

极危

59 个模型检测该样本为恶意！

重新分析

下载样本

061683dae15dd995c0a0669b0fd23f0e60973901f98ab58f11d0cd783b700b4b

510ac74d2a3f6ff820a5712e677cfa60.exe

分析耗时

28s

最近分析

文件大小

686.0KB

静态报毒动态报毒 100% AI SCORE=84 ALI2000015 AUTO BT8UQV CLASSIC CONFIDENCE DAQC DELF DELFINJECT DELPHILESS EMOY EMSE FAREIT HIGH CONFIDENCE HOENYX HPLOKI IGENT KCLOUD KRYPTIK MALWARE@#TD91DL4APYZ5 QGW@ACGN3VGI QHJBK QVM05 REMCOS SCORE SMBD STATIC AI SUSGEN SUSPICIOUS PE TCCZ TSCOPE TSPY UNSAFE X2094 ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20201228	21.1.5827.0
Alibaba	Trojan:Win32/DelfInject.ali2000015	20190527	0.3.0.5
Tencent	Win32.Backdoor.Remcos.Auto	20201228	1.0.0.1
Kingsoft	Win32.Troj.Undef.(kcloud)	20201228	2017.9.26.565
McAfee	Fareit-FVZ!510AC74D2A3F	20201228	6.0.6.653
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Command line console output was observed (22 个事件)

Time & API	Arguments	Status	Return
1619428170.529249 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1619428170.529249 WriteConsoleW	buffer: PING console_handle: 0x00000007	success	1
1619428170.544249 WriteConsoleW	buffer: 127.0.0.1 -n 2 console_handle: 0x00000007	success	1
1619428172.982249 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1619428172.998249 WriteConsoleW	buffer: start console_handle: 0x00000007	success	1
1619428172.998249 WriteConsoleW	buffer: "" "C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe" console_handle: 0x00000007	success	1
1619428175.919249 WriteConsoleW	buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp> console_handle: 0x00000007	success	1
1619428175.919249 WriteConsoleW	buffer: del console_handle: 0x00000007	success	1
1619428175.998249 WriteConsoleW	buffer: "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\install.bat" console_handle: 0x00000007	success	1
1619428176.232249 WriteConsoleW	buffer: 找不到批处理文件。 console_handle: 0x0000000b	success	1
1619428171.184999 WriteConsoleA	buffer: ÕýÔÚ Ping 127.0.0.1 console_handle: 0x00000007	success	1
1619428171.200999 WriteConsoleA	buffer: ¾ßÓÐ 32 ×Ö½ÚµÄÊý¾Ý: console_handle: 0x00000007	success	1
1619428171.231999 WriteConsoleA	buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´: console_handle: 0x00000007	success	1
1619428171.231999 WriteConsoleA	buffer: ×Ö½Ú=32 console_handle: 0x00000007	success	1
1619428171.247999 WriteConsoleA	buffer: Ê±¼ä<1ms console_handle: 0x00000007	success	1
1619428171.247999 WriteConsoleA	buffer: TTL=128 console_handle: 0x00000007	success	1
1619428172.247999 WriteConsoleA	buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´: console_handle: 0x00000007	success	1
1619428172.262999 WriteConsoleA	buffer: ×Ö½Ú=32 console_handle: 0x00000007	success	1
1619428172.262999 WriteConsoleA	buffer: Ê±¼ä<1ms console_handle: 0x00000007	success	1
1619428172.262999 WriteConsoleA	buffer: TTL=128 console_handle: 0x00000007	success	1
1619428172.262999 WriteConsoleA	buffer: 127.0.0.1 µÄ Ping Í³¼ÆÐÅÏ¢: Êý¾Ý°ü: ÒÑ·¢ËÍ = 2£¬ÒÑ½ÓÊÕ = 2£¬¶ªÊ§ = 0 (0% ¶ªÊ§)£¬ console_handle: 0x00000007	success	1
1619428172.278999 WriteConsoleA	buffer: Íù·µÐÐ³ÌµÄ¹À¼ÆÊ±¼ä(ÒÔºÁÃëÎªµ¥Î»): ×î¶Ì = 0ms£¬×î³¤ = 0ms£¬Æ½¾ù = 0ms console_handle: 0x00000007	success	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619428171.137999 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (6 个事件)

Time & API	Arguments	Status
1619426979.271429 NtAllocateVirtualMemory	process_identifier: 2104 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00390000	success
1619426979.349429 NtProtectVirtualMemory	process_identifier: 2104 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 40960 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00471000	success
1619426979.365429 NtAllocateVirtualMemory	process_identifier: 2104 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00890000	success
1619428173.513499 NtAllocateVirtualMemory	process_identifier: 3068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f0000	success
1619428173.576499 NtProtectVirtualMemory	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 40960 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00471000	success
1619428173.576499 NtAllocateVirtualMemory	process_identifier: 3068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x02360000	success

Creates executable files on the filesystem (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\install.bat

Drops a binary and executes it (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\install.bat

A process created a hidden window (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619428169.998124 ShellExecuteExW	parameters: filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\install.bat filepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\install.bat show_type: 0	success	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (9 个事件)

Time & API	Arguments	Status	Return
1619426979.381429 Process32NextW	process_name: wsqmcons.exe snapshot_handle: 0x00000110 process_identifier: 3064	success	1
1619426979.381429 Process32NextW	process_name: sdclt.exe snapshot_handle: 0x00000110 process_identifier: 2868	success	1
1619426979.381429 Process32NextW	process_name: dllhost.exe snapshot_handle: 0x00000110 process_identifier: 2200	success	1
1619426979.381429 Process32NextW	process_name: mobsync.exe snapshot_handle: 0x00000110 process_identifier: 2852	success	1
1619426979.381429 Process32NextW	process_name: 510ac74d2a3f6ff820a5712e677cfa60.exe snapshot_handle: 0x00000110 process_identifier: 2104	success	1
1619428173.623499 Process32NextW	process_name: 510ac74d2a3f6ff820a5712e677cfa60.exe snapshot_handle: 0x00000110 process_identifier: 2976	success	1
1619428173.623499 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000110 process_identifier: 2144	success	1
1619428173.623499 Process32NextW	process_name: inject-x86.exe snapshot_handle: 0x00000110 process_identifier: 2136	success	1
1619428173.623499 Process32NextW	process_name: remcos.exe snapshot_handle: 0x00000110 process_identifier: 3068	success	1

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

6.979787316230421

section

{'size_of_data': '0x00025400', 'virtual_address': '0x0008c000', 'entropy': 6.979787316230421, 'name': '.rsrc', 'virtual_size': '0x00025290'}

description

A section with a high entropy has been found

entropy

0.21751824817518248

description

Overall entropy of this PE file is high

Uses Windows utilities for basic Windows functionality (1 个事件)

cmdline

PING 127.0.0.1 -n 2

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Installs itself for autorun at Windows startup (1 个事件)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\remcos

reg_value

"C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe"

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2104 called NtSetContextThread to modify thread in remote process 2976
Process injection	Process 3068 called NtSetContextThread to modify thread in remote process 2440
1619426979.631429 NtSetContextThread	thread_handle: 0x00000114 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4259208 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2976	success	0	0
1619428173.857499 NtSetContextThread	thread_handle: 0x00000114 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4259208 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2440	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (6 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2104 resumed a thread in remote process 2976
Process injection	Process 3064 resumed a thread in remote process 3068
Process injection	Process 3068 resumed a thread in remote process 2440
1619426980.084429 NtResumeThread	thread_handle: 0x00000114 suspend_count: 1 process_identifier: 2976	success	0	0
1619428175.810249 NtResumeThread	thread_handle: 0x00000080 suspend_count: 0 process_identifier: 3068	success	0	0
1619428174.216499 NtResumeThread	thread_handle: 0x00000114 suspend_count: 1 process_identifier: 2440	success	0	0

Executed a process and injected code into it, probably while unpacking (17 个事件)

Time & API	Arguments	Status	Return
1619426979.631429 CreateProcessInternalW	thread_identifier: 912 thread_handle: 0x00000114 process_identifier: 2976 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\510ac74d2a3f6ff820a5712e677cfa60.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000118 inherit_handles: 0	success	1
1619426979.631429 NtUnmapViewOfSection	process_identifier: 2976 region_size: 4096 process_handle: 0x00000118 base_address: 0x00400000	success	0
1619426979.631429 NtMapViewOfSection	section_handle: 0x00000120 process_identifier: 2976 commit_size: 94208 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000118 allocation_type: 0 () section_offset: 0 view_size: 94208 base_address: 0x00400000	success	0
1619426979.631429 NtGetContextThread	thread_handle: 0x00000114	success	0
1619426979.631429 NtSetContextThread	thread_handle: 0x00000114 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4259208 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2976	success	0
1619426980.084429 NtResumeThread	thread_handle: 0x00000114 suspend_count: 1 process_identifier: 2976	success	0
1619428169.998124 CreateProcessInternalW	thread_identifier: 2316 thread_handle: 0x000001f8 process_identifier: 3064 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: track: 1 command_line: "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\install.bat" filepath_r: stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x00000214 inherit_handles: 0	success	1
1619428170.857249 CreateProcessInternalW	thread_identifier: 944 thread_handle: 0x00000084 process_identifier: 2772 current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp filepath: C:\Windows\System32\PING.EXE track: 1 command_line: PING 127.0.0.1 -n 2 filepath_r: C:\Windows\system32\PING.EXE stack_pivoted: 0 creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x00000080 inherit_handles: 1	success	1
1619428173.201249 CreateProcessInternalW	thread_identifier: 2632 thread_handle: 0x00000080 process_identifier: 3068 current_directory: filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe" filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe stack_pivoted: 0 creation_flags: 525328 (CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) process_handle: 0x00000084 inherit_handles: 1	success	1
1619428175.810249 NtResumeThread	thread_handle: 0x00000080 suspend_count: 0 process_identifier: 3068	success	0
1619428171.137999 NtResumeThread	thread_handle: 0x000000d8 suspend_count: 1 process_identifier: 2772	success	0
1619428173.857499 CreateProcessInternalW	thread_identifier: 420 thread_handle: 0x00000114 process_identifier: 2440 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000118 inherit_handles: 0	success	1
1619428173.857499 NtUnmapViewOfSection	process_identifier: 2440 region_size: 4096 process_handle: 0x00000118 base_address: 0x00400000	success	0
1619428173.857499 NtMapViewOfSection	section_handle: 0x00000120 process_identifier: 2440 commit_size: 94208 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000118 allocation_type: 0 () section_offset: 0 view_size: 94208 base_address: 0x00400000	success	0
1619428173.857499 NtGetContextThread	thread_handle: 0x00000114	success	0
1619428173.857499 NtSetContextThread	thread_handle: 0x00000114 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4259208 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2440	success	0
1619428174.216499 NtResumeThread	thread_handle: 0x00000114 suspend_count: 1 process_identifier: 2440	success	0

File has been identified by 59 AntiVirus engines on VirusTotal as malicious (50 out of 59 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Delf.FareIt.Gen.7
FireEye	Generic.mg.510ac74d2a3f6ff8
CAT-QuickHeal	Trojan.Kryptik
Qihoo-360	Generic/HEUR/QVM05.1.BC22.Malware.Gen
ALYac	Trojan.Delf.FareIt.Gen.7
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Win32.Kryptik.4!c
Sangfor	Malware
K7AntiVirus	Trojan ( 0056aeff1 )
BitDefender	Trojan.Delf.FareIt.Gen.7
K7GW	Trojan ( 0056aeff1 )
Cybereason	malicious.d2a3f6
BitDefenderTheta	Gen:NN.ZelphiF.34700.QGW@aCgn3vgi
Cyren	W32/Injector.TCCZ-7150
Symantec	Trojan.Gen.2
APEX	Malicious
Avast	Win32:Trojan-gen
ClamAV	Win.Malware.Daqc-6598201-0
Kaspersky	HEUR:Trojan.Win32.Kryptik.gen
Alibaba	Trojan:Win32/DelfInject.ali2000015
NANO-Antivirus	Trojan.Win32.Delf.hoenyx
Tencent	Win32.Backdoor.Remcos.Auto
Ad-Aware	Trojan.Delf.FareIt.Gen.7
Sophos	Mal/Generic-S
Comodo	Malware@#td91dl4apyz5
F-Secure	Trojan.TR/Injector.qhjbk
DrWeb	Trojan.PWS.Stealer.28962
TrendMicro	TSPY_HPLOKI.SMBD
McAfee-GW-Edition	BehavesLike.Win32.Fareit.jh
Emsisoft	Trojan.Delf.FareIt.Gen.7 (B)
Ikarus	Trojan.Inject
Avira	TR/Injector.qhjbk
MAX	malware (ai score=84)
Antiy-AVL	Trojan/Win32.Kryptik
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	PWS:Win32/Fareit.AQ!MTB
Arcabit	Trojan.Delf.FareIt.Gen.7
ZoneAlarm	HEUR:Trojan.Win32.Kryptik.gen
GData	Trojan.Delf.FareIt.Gen.7
Cynet	Malicious (score: 100)
AhnLab-V3	Suspicious/Win.Delphiless.X2094
Acronis	suspicious
McAfee	Fareit-FVZ!510AC74D2A3F
VBA32	TScope.Trojan.Delf
Malwarebytes	Trojan.MalPack.DLF
Panda	Trj/CI.A
Zoner	Trojan.Win32.91567
ESET-NOD32	a variant of Win32/Injector.EMSE

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x47e168 DeleteCriticalSection

• 0x47e16c LeaveCriticalSection

• 0x47e170 EnterCriticalSection

• 0x47e174 InitializeCriticalSection

• 0x47e178 VirtualFree

• 0x47e17c VirtualAlloc

• 0x47e180 LocalFree

• 0x47e184 LocalAlloc

• 0x47e188 GetVersion

• 0x47e18c GetCurrentThreadId

• 0x47e190 InterlockedDecrement

• 0x47e194 InterlockedIncrement

• 0x47e198 VirtualQuery

• 0x47e19c WideCharToMultiByte

• 0x47e1a0 MultiByteToWideChar

• 0x47e1a4 lstrlenA

• 0x47e1a8 lstrcpynA

• 0x47e1ac LoadLibraryExA

• 0x47e1b0 GetThreadLocale

• 0x47e1b4 GetStartupInfoA

• 0x47e1b8 GetProcAddress

• 0x47e1bc GetModuleHandleA

• 0x47e1c0 GetModuleFileNameA

• 0x47e1c4 GetLocaleInfoA

• 0x47e1c8 GetCommandLineA

• 0x47e1cc FreeLibrary

• 0x47e1d0 FindFirstFileA

• 0x47e1d4 FindClose

• 0x47e1d8 ExitProcess

• 0x47e1dc WriteFile

• 0x47e1e0 UnhandledExceptionFilter

• 0x47e1e4 RtlUnwind

• 0x47e1e8 RaiseException

• 0x47e1ec GetStdHandle

Library user32.dll:

• 0x47e1f4 GetKeyboardType

• 0x47e1f8 LoadStringA

• 0x47e1fc MessageBoxA

• 0x47e200 CharNextA

Library advapi32.dll:

• 0x47e208 RegQueryValueExA

• 0x47e20c RegOpenKeyExA

• 0x47e210 RegCloseKey

Library oleaut32.dll:

• 0x47e218 SysFreeString

• 0x47e21c SysReAllocStringLen

• 0x47e220 SysAllocStringLen

Library kernel32.dll:

• 0x47e228 TlsSetValue

• 0x47e22c TlsGetValue

• 0x47e230 LocalAlloc

• 0x47e234 GetModuleHandleA

Library advapi32.dll:

• 0x47e23c RegQueryValueExA

• 0x47e240 RegOpenKeyExA

• 0x47e244 RegCloseKey

Library kernel32.dll:

• 0x47e24c lstrcpyA

• 0x47e250 WriteFile

• 0x47e254 WaitForSingleObject

• 0x47e258 VirtualQuery

• 0x47e25c VirtualProtect

• 0x47e260 VirtualAlloc

• 0x47e264 Sleep

• 0x47e268 SizeofResource

• 0x47e26c SetThreadLocale

• 0x47e270 SetFilePointer

• 0x47e274 SetEvent

• 0x47e278 SetErrorMode

• 0x47e27c SetEndOfFile

• 0x47e280 ResetEvent

• 0x47e284 ReadFile

• 0x47e288 MultiByteToWideChar

• 0x47e28c MulDiv

• 0x47e290 LockResource

• 0x47e294 LoadResource

• 0x47e298 LoadLibraryA

• 0x47e29c LeaveCriticalSection

• 0x47e2a0 InitializeCriticalSection

• 0x47e2a4 GlobalUnlock

• 0x47e2a8 GlobalSize

• 0x47e2ac GlobalReAlloc

• 0x47e2b0 GlobalHandle

• 0x47e2b4 GlobalLock

• 0x47e2b8 GlobalFree

• 0x47e2bc GlobalFindAtomA

• 0x47e2c0 GlobalDeleteAtom

• 0x47e2c4 GlobalAlloc

• 0x47e2c8 GlobalAddAtomA

• 0x47e2cc GetVersionExA

• 0x47e2d0 GetVersion

• 0x47e2d4 GetUserDefaultLCID

• 0x47e2d8 GetTickCount

• 0x47e2dc GetThreadLocale

• 0x47e2e0 GetSystemInfo

• 0x47e2e4 GetStringTypeExA

• 0x47e2e8 GetStdHandle

• 0x47e2ec GetProcAddress

• 0x47e2f0 GetModuleHandleA

• 0x47e2f4 GetModuleFileNameA

• 0x47e2f8 GetLocaleInfoA

• 0x47e2fc GetLocalTime

• 0x47e300 GetLastError

• 0x47e304 GetFullPathNameA

• 0x47e308 GetFileAttributesA

• 0x47e30c GetDiskFreeSpaceA

• 0x47e310 GetDateFormatA

• 0x47e314 GetCurrentThreadId

• 0x47e318 GetCurrentProcessId

• 0x47e31c GetComputerNameA

• 0x47e320 GetCPInfo

• 0x47e324 GetACP

• 0x47e328 FreeResource

• 0x47e32c InterlockedExchange

• 0x47e330 FreeLibrary

• 0x47e334 FormatMessageA

• 0x47e338 FindResourceA

• 0x47e33c FindFirstFileA

• 0x47e340 FindClose

• 0x47e344 FileTimeToLocalFileTime

• 0x47e348 FileTimeToDosDateTime

• 0x47e34c EnumCalendarInfoA

• 0x47e350 EnterCriticalSection

• 0x47e354 DeleteCriticalSection

• 0x47e358 CreateThread

• 0x47e35c CreateFileA

• 0x47e360 CreateEventA

• 0x47e364 CompareStringA

• 0x47e368 CloseHandle

Library version.dll:

• 0x47e370 VerQueryValueA

• 0x47e374 GetFileVersionInfoSizeA

• 0x47e378 GetFileVersionInfoA

Library gdi32.dll:

• 0x47e380 UnrealizeObject

• 0x47e384 StretchBlt

• 0x47e388 SetWindowOrgEx

• 0x47e38c SetWinMetaFileBits

• 0x47e390 SetViewportOrgEx

• 0x47e394 SetTextColor

• 0x47e398 SetStretchBltMode

• 0x47e39c SetROP2

• 0x47e3a0 SetPixel

• 0x47e3a4 SetMapMode

• 0x47e3a8 SetEnhMetaFileBits

• 0x47e3ac SetDIBColorTable

• 0x47e3b0 SetBrushOrgEx

• 0x47e3b4 SetBkMode

• 0x47e3b8 SetBkColor

• 0x47e3bc SelectPalette

• 0x47e3c0 SelectObject

• 0x47e3c4 SelectClipRgn

• 0x47e3c8 SaveDC

• 0x47e3cc RestoreDC

• 0x47e3d0 Rectangle

• 0x47e3d4 RectVisible

• 0x47e3d8 RealizePalette

• 0x47e3dc Polyline

• 0x47e3e0 PlayEnhMetaFile

• 0x47e3e4 PatBlt

• 0x47e3e8 MoveToEx

• 0x47e3ec MaskBlt

• 0x47e3f0 LineTo

• 0x47e3f4 LPtoDP

• 0x47e3f8 IntersectClipRect

• 0x47e3fc GetWindowOrgEx

• 0x47e400 GetWinMetaFileBits

• 0x47e404 GetTextMetricsA

• 0x47e408 GetTextExtentPoint32A

• 0x47e40c GetSystemPaletteEntries

• 0x47e410 GetStockObject

• 0x47e414 GetPixel

• 0x47e418 GetPaletteEntries

• 0x47e41c GetObjectA

• 0x47e420 GetEnhMetaFilePaletteEntries

• 0x47e424 GetEnhMetaFileHeader

• 0x47e428 GetEnhMetaFileDescriptionA

• 0x47e42c GetEnhMetaFileBits

• 0x47e430 GetDeviceCaps

• 0x47e434 GetDIBits

• 0x47e438 GetDIBColorTable

• 0x47e43c GetDCOrgEx

• 0x47e440 GetCurrentPositionEx

• 0x47e444 GetClipBox

• 0x47e448 GetBrushOrgEx

• 0x47e44c GetBitmapBits

• 0x47e450 ExcludeClipRect

• 0x47e454 DeleteObject

• 0x47e458 DeleteEnhMetaFile

• 0x47e45c DeleteDC

• 0x47e460 CreateSolidBrush

• 0x47e464 CreatePenIndirect

• 0x47e468 CreatePen

• 0x47e46c CreatePalette

• 0x47e470 CreateHalftonePalette

• 0x47e474 CreateFontIndirectA

• 0x47e478 CreateEnhMetaFileA

• 0x47e47c CreateDIBitmap

• 0x47e480 CreateDIBSection

• 0x47e484 CreateCompatibleDC

• 0x47e488 CreateCompatibleBitmap

• 0x47e48c CreateBrushIndirect

• 0x47e490 CreateBitmap

• 0x47e494 CopyEnhMetaFileA

• 0x47e498 CloseEnhMetaFile

• 0x47e49c BitBlt

Library opengl32.dll:

• 0x47e4a4 wglDeleteContext

Library user32.dll:

• 0x47e4ac CreateWindowExA

• 0x47e4b0 WindowFromPoint

• 0x47e4b4 WinHelpA

• 0x47e4b8 WaitMessage

• 0x47e4bc ValidateRect

• 0x47e4c0 UpdateWindow

• 0x47e4c4 UnregisterClassA

• 0x47e4c8 UnhookWindowsHookEx

• 0x47e4cc TranslateMessage

• 0x47e4d0 TranslateMDISysAccel

• 0x47e4d4 TrackPopupMenu

• 0x47e4d8 SystemParametersInfoA

• 0x47e4dc ShowWindow

• 0x47e4e0 ShowScrollBar

• 0x47e4e4 ShowOwnedPopups

• 0x47e4e8 ShowCursor

• 0x47e4ec SetWindowsHookExA

• 0x47e4f0 SetWindowTextA

• 0x47e4f4 SetWindowPos

• 0x47e4f8 SetWindowPlacement

• 0x47e4fc SetWindowLongA

• 0x47e500 SetTimer

• 0x47e504 SetScrollRange

• 0x47e508 SetScrollPos

• 0x47e50c SetScrollInfo

• 0x47e510 SetRect

• 0x47e514 SetPropA

• 0x47e518 SetParent

• 0x47e51c SetMenuItemInfoA

• 0x47e520 SetMenu

• 0x47e524 SetForegroundWindow

• 0x47e528 SetFocus

• 0x47e52c SetCursor

• 0x47e530 SetClassLongA

• 0x47e534 SetCapture

• 0x47e538 SetActiveWindow

• 0x47e53c SendMessageA

• 0x47e540 ScrollWindow

• 0x47e544 ScreenToClient

• 0x47e548 RemovePropA

• 0x47e54c RemoveMenu

• 0x47e550 ReleaseDC

• 0x47e554 ReleaseCapture

• 0x47e558 RegisterWindowMessageA

• 0x47e55c RegisterClipboardFormatA

• 0x47e560 RegisterClassA

• 0x47e564 RedrawWindow

• 0x47e568 PtInRect

• 0x47e56c PostQuitMessage

• 0x47e570 PostMessageA

• 0x47e574 PeekMessageA

• 0x47e578 OffsetRect

• 0x47e57c OemToCharA

• 0x47e580 MessageBoxA

• 0x47e584 MapWindowPoints

• 0x47e588 MapVirtualKeyA

• 0x47e58c LoadStringA

• 0x47e590 LoadKeyboardLayoutA

• 0x47e594 LoadIconA

• 0x47e598 LoadCursorA

• 0x47e59c LoadBitmapA

• 0x47e5a0 KillTimer

• 0x47e5a4 IsZoomed

• 0x47e5a8 IsWindowVisible

• 0x47e5ac IsWindowEnabled

• 0x47e5b0 IsWindow

• 0x47e5b4 IsRectEmpty

• 0x47e5b8 IsIconic

• 0x47e5bc IsDialogMessageA

• 0x47e5c0 IsChild

• 0x47e5c4 InvalidateRect

• 0x47e5c8 IntersectRect

• 0x47e5cc InsertMenuItemA

• 0x47e5d0 InsertMenuA

• 0x47e5d4 InflateRect

• 0x47e5d8 GetWindowThreadProcessId

• 0x47e5dc GetWindowTextA

• 0x47e5e0 GetWindowRect

• 0x47e5e4 GetWindowPlacement

• 0x47e5e8 GetWindowLongA

• 0x47e5ec GetWindowDC

• 0x47e5f0 GetTopWindow

• 0x47e5f4 GetSystemMetrics

• 0x47e5f8 GetSystemMenu

• 0x47e5fc GetSysColorBrush

• 0x47e600 GetSysColor

• 0x47e604 GetSubMenu

• 0x47e608 GetScrollRange

• 0x47e60c GetScrollPos

• 0x47e610 GetScrollInfo

• 0x47e614 GetPropA

• 0x47e618 GetParent

• 0x47e61c GetWindow

• 0x47e620 GetMessageTime

• 0x47e624 GetMenuStringA

• 0x47e628 GetMenuState

• 0x47e62c GetMenuItemInfoA

• 0x47e630 GetMenuItemID

• 0x47e634 GetMenuItemCount

• 0x47e638 GetMenu

• 0x47e63c GetLastActivePopup

• 0x47e640 GetKeyboardState

• 0x47e644 GetKeyboardLayoutList

• 0x47e648 GetKeyboardLayout

• 0x47e64c GetKeyState

• 0x47e650 GetKeyNameTextA

• 0x47e654 GetIconInfo

• 0x47e658 GetForegroundWindow

• 0x47e65c GetFocus

• 0x47e660 GetDlgItem

• 0x47e664 GetDesktopWindow

• 0x47e668 GetDCEx

• 0x47e66c GetDC

• 0x47e670 GetCursorPos

• 0x47e674 GetCursor

• 0x47e678 GetClipboardData

• 0x47e67c GetClientRect

• 0x47e680 GetClassNameA

• 0x47e684 GetClassInfoA

• 0x47e688 GetCapture

• 0x47e68c GetActiveWindow

• 0x47e690 FrameRect

• 0x47e694 FindWindowA

• 0x47e698 FillRect

• 0x47e69c EqualRect

• 0x47e6a0 EnumWindows

• 0x47e6a4 EnumThreadWindows

• 0x47e6a8 EndPaint

• 0x47e6ac EnableWindow

• 0x47e6b0 EnableScrollBar

• 0x47e6b4 EnableMenuItem

• 0x47e6b8 DrawTextA

• 0x47e6bc DrawMenuBar

• 0x47e6c0 DrawIconEx

• 0x47e6c4 DrawIcon

• 0x47e6c8 DrawFrameControl

• 0x47e6cc DrawEdge

• 0x47e6d0 DispatchMessageA

• 0x47e6d4 DestroyWindow

• 0x47e6d8 DestroyMenu

• 0x47e6dc DestroyIcon

• 0x47e6e0 DestroyCursor

• 0x47e6e4 DeleteMenu

• 0x47e6e8 DefWindowProcA

• 0x47e6ec DefMDIChildProcA

• 0x47e6f0 DefFrameProcA

• 0x47e6f4 CreatePopupMenu

• 0x47e6f8 CreateMenu

• 0x47e6fc CreateIcon

• 0x47e700 ClientToScreen

• 0x47e704 CheckMenuItem

• 0x47e708 CallWindowProcA

• 0x47e70c CallNextHookEx

• 0x47e710 BeginPaint

• 0x47e714 CharNextA

• 0x47e718 CharLowerBuffA

• 0x47e71c CharLowerA

• 0x47e720 CharUpperBuffA

• 0x47e724 CharToOemA

• 0x47e728 AdjustWindowRectEx

• 0x47e72c ActivateKeyboardLayout

Library kernel32.dll:

• 0x47e734 Sleep

Library oleaut32.dll:

• 0x47e73c SafeArrayPtrOfIndex

• 0x47e740 SafeArrayPutElement

• 0x47e744 SafeArrayGetElement

• 0x47e748 SafeArrayUnaccessData

• 0x47e74c SafeArrayAccessData

• 0x47e750 SafeArrayGetUBound

• 0x47e754 SafeArrayGetLBound

• 0x47e758 SafeArrayCreate

• 0x47e75c VariantChangeType

• 0x47e760 VariantCopyInd

• 0x47e764 VariantCopy

• 0x47e768 VariantClear

• 0x47e76c VariantInit

Library ole32.dll:

• 0x47e774 CreateStreamOnHGlobal

• 0x47e778 IsAccelerator

• 0x47e77c OleDraw

• 0x47e780 OleSetMenuDescriptor

• 0x47e784 CoTaskMemFree

• 0x47e788 ProgIDFromCLSID

• 0x47e78c StringFromCLSID

• 0x47e790 CoCreateInstance

• 0x47e794 CoGetClassObject

• 0x47e798 CoUninitialize

• 0x47e79c CoInitialize

• 0x47e7a0 IsEqualGUID

Library oleaut32.dll:

• 0x47e7a8 GetErrorInfo

• 0x47e7ac GetActiveObject

• 0x47e7b0 SysFreeString

Library comctl32.dll:

• 0x47e7b8 ImageList_SetIconSize

• 0x47e7bc ImageList_GetIconSize

• 0x47e7c0 ImageList_Write

• 0x47e7c4 ImageList_Read

• 0x47e7c8 ImageList_GetDragImage

• 0x47e7cc ImageList_DragShowNolock

• 0x47e7d0 ImageList_SetDragCursorImage

• 0x47e7d4 ImageList_DragMove

• 0x47e7d8 ImageList_DragLeave

• 0x47e7dc ImageList_DragEnter

• 0x47e7e0 ImageList_EndDrag

• 0x47e7e4 ImageList_BeginDrag

• 0x47e7e8 ImageList_Remove

• 0x47e7ec ImageList_DrawEx

• 0x47e7f0 ImageList_Replace

• 0x47e7f4 ImageList_Draw

• 0x47e7f8 ImageList_GetBkColor

• 0x47e7fc ImageList_SetBkColor

• 0x47e800 ImageList_ReplaceIcon

• 0x47e804 ImageList_Add

• 0x47e808 ImageList_GetImageCount

• 0x47e80c ImageList_Destroy

• 0x47e810 ImageList_Create

• 0x47e814 InitCommonControls

Library comdlg32.dll:

• 0x47e81c GetOpenFileNameA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58370	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.