4.6
中危
50 个模型检测该样本为恶意！
重新分析
更多

040a69fe6d68904cbb33cffa3930c2a9d2d4a16377c730e8db78386034e1bfd3

7fe1be366dcec24af3d895a5cf6444a6.exe

分析耗时

89s

最近分析

文件大小

772.5KB
静态报毒 动态报毒 AI SCORE=85 BTSZQO CLOUD DELF DOWNLOADER33 EHPAD FAMVT FAREIT GDSDA GENERICKD HKZUIK IGENT LAMER MALICIOUS OQJKETCH R002C0WFA20 R339814 REMCOS SXQU UNSAFE WACATAC 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FVP!7FE1BE366DCE 20200804 6.0.6.653
Alibaba TrojanDownloader:Win32/Remcos.f5bf28bd 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20200804 18.4.3895.0
Kingsoft 20200804 2013.8.14.323
Tencent 20200804 1.0.0.1
CrowdStrike 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)
section .itext
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (3 个事件)
Time & API Arguments Status Return Repeated
1619694286.238
__exception__
stacktrace: 
7fe1be366dcec24af3d895a5cf6444a6+0x490f7 @ 0x4490f7
7fe1be366dcec24af3d895a5cf6444a6+0x4b4c6 @ 0x44b4c6
7fe1be366dcec24af3d895a5cf6444a6+0x4f1e1 @ 0x44f1e1
7fe1be366dcec24af3d895a5cf6444a6+0x5f106 @ 0x45f106
7fe1be366dcec24af3d895a5cf6444a6+0x4e997 @ 0x44e997
7fe1be366dcec24af3d895a5cf6444a6+0x1f8be @ 0x41f8be
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x775a62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x775a6d3a
LoadStringW+0x210 SystemParametersInfoW-0xa user32+0x190c9 @ 0x775a90c9
WCSToMBEx+0xd2 MBToWCSEx-0xd5 user32+0x1cfef @ 0x775acfef
CloseThemeData-0x143d uxtheme+0x10b64 @ 0x75380b64
CloseThemeData+0x322 GetThemeColor-0x4fd uxtheme+0x122c3 @ 0x753822c3
WCSToMBEx+0x17e MBToWCSEx-0x29 user32+0x1d09b @ 0x775ad09b
CallWindowProcA+0x24 GetClassNameA-0x8c user32+0x27953 @ 0x775b7953
LoadBitmapA+0x2ed DefFrameProcA-0xc user32+0x27faf @ 0x775b7faf
DefFrameProcA+0x1b DefMDIChildProcA-0x136 user32+0x27fd6 @ 0x775b7fd6
7fe1be366dcec24af3d895a5cf6444a6+0x60ed8 @ 0x460ed8
7fe1be366dcec24af3d895a5cf6444a6+0x4f1e1 @ 0x44f1e1
7fe1be366dcec24af3d895a5cf6444a6+0x5f106 @ 0x45f106
7fe1be366dcec24af3d895a5cf6444a6+0x4e997 @ 0x44e997
7fe1be366dcec24af3d895a5cf6444a6+0x1f8be @ 0x41f8be
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x775a62fa
GetDC+0x52 ReleaseDC-0x130 user32+0x17316 @ 0x775a7316
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x775a6de8
LoadStringW+0xee SystemParametersInfoW-0x12c user32+0x18fa7 @ 0x775a8fa7
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x77d4011a
7fe1be366dcec24af3d895a5cf6444a6+0x4b4c6 @ 0x44b4c6
7fe1be366dcec24af3d895a5cf6444a6+0x4f1e1 @ 0x44f1e1
7fe1be366dcec24af3d895a5cf6444a6+0x5f106 @ 0x45f106
7fe1be366dcec24af3d895a5cf6444a6+0x4b153 @ 0x44b153
7fe1be366dcec24af3d895a5cf6444a6+0x4e80e @ 0x44e80e
7fe1be366dcec24af3d895a5cf6444a6+0x4e881 @ 0x44e881
7fe1be366dcec24af3d895a5cf6444a6+0x4f1e1 @ 0x44f1e1
7fe1be366dcec24af3d895a5cf6444a6+0x5f106 @ 0x45f106
7fe1be366dcec24af3d895a5cf6444a6+0x4b153 @ 0x44b153
7fe1be366dcec24af3d895a5cf6444a6+0x49dbf @ 0x449dbf
7fe1be366dcec24af3d895a5cf6444a6+0x5dcff @ 0x45dcff
7fe1be366dcec24af3d895a5cf6444a6+0x5dcd5 @ 0x45dcd5
7fe1be366dcec24af3d895a5cf6444a6+0x6688c @ 0x46688c
7fe1be366dcec24af3d895a5cf6444a6+0x9a85d @ 0x49a85d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634580
registers.edi: 0
registers.eax: 0
registers.ebp: 1634652
registers.edx: 0
registers.ebx: 4896364
registers.esi: 4896360
registers.ecx: 1634656
exception.instruction_r: f6 40 1c 10 74 31 83 78 30 00 74 2b 8b 48 18 81
exception.symbol: 7fe1be366dcec24af3d895a5cf6444a6+0x6371c
exception.instruction: test byte ptr [eax + 0x1c], 0x10
exception.module: 7fe1be366dcec24af3d895a5cf6444a6.exe
exception.exception_code: 0xc0000005
exception.offset: 407324
exception.address: 0x46371c
success 0 0
1619694286.254
__exception__
stacktrace: 
7fe1be366dcec24af3d895a5cf6444a6+0x490f7 @ 0x4490f7
7fe1be366dcec24af3d895a5cf6444a6+0x4b4c6 @ 0x44b4c6
7fe1be366dcec24af3d895a5cf6444a6+0x4f1e1 @ 0x44f1e1
7fe1be366dcec24af3d895a5cf6444a6+0x5f106 @ 0x45f106
7fe1be366dcec24af3d895a5cf6444a6+0x4e997 @ 0x44e997
7fe1be366dcec24af3d895a5cf6444a6+0x1f8be @ 0x41f8be
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x775a62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x775a6d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x775a6de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x775a6e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x77d4011a
7fe1be366dcec24af3d895a5cf6444a6+0x4b4c6 @ 0x44b4c6
7fe1be366dcec24af3d895a5cf6444a6+0x4f1e1 @ 0x44f1e1
7fe1be366dcec24af3d895a5cf6444a6+0x5f106 @ 0x45f106
7fe1be366dcec24af3d895a5cf6444a6+0x4b153 @ 0x44b153
7fe1be366dcec24af3d895a5cf6444a6+0x4e80e @ 0x44e80e
7fe1be366dcec24af3d895a5cf6444a6+0x4e881 @ 0x44e881
7fe1be366dcec24af3d895a5cf6444a6+0x4f1e1 @ 0x44f1e1
7fe1be366dcec24af3d895a5cf6444a6+0x5f106 @ 0x45f106
7fe1be366dcec24af3d895a5cf6444a6+0x4b153 @ 0x44b153
7fe1be366dcec24af3d895a5cf6444a6+0x49dbf @ 0x449dbf
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1636264
registers.edi: 0
registers.eax: 0
registers.ebp: 1636336
registers.edx: 0
registers.ebx: 4896364
registers.esi: 4896360
registers.ecx: 1636340
exception.instruction_r: f6 40 1c 10 74 31 83 78 30 00 74 2b 8b 48 18 81
exception.symbol: 7fe1be366dcec24af3d895a5cf6444a6+0x6371c
exception.instruction: test byte ptr [eax + 0x1c], 0x10
exception.module: 7fe1be366dcec24af3d895a5cf6444a6.exe
exception.exception_code: 0xc0000005
exception.offset: 407324
exception.address: 0x46371c
success 0 0
1619694337.176
__exception__
stacktrace: 
0x36d41aa
0x3a5fe6c

registers.esp: 61209628
registers.edi: 0
registers.eax: 0
registers.ebp: 61209656
registers.edx: 0
registers.ebx: 0
registers.esi: 61209672
registers.ecx: 4294967294
exception.instruction_r: 8b 40 3c 99 03 04 24 13 54 24 04 83 c4 08 89 44
exception.instruction: mov eax, dword ptr [eax + 0x3c]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x36d8e16
success 0 0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (1 个事件)
Time & API Arguments Status Return Repeated
1619694285.941
NtAllocateVirtualMemory
process_identifier: 2996
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00630000
success 0 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619694313.473
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
网络通信
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)
Time & API Arguments Status Return Repeated
1619694316.035
RegSetValueExA
key_handle: 0x000003cc
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619694316.035
RegSetValueExA
key_handle: 0x000003cc
value: @d|Ù<×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619694316.035
RegSetValueExA
key_handle: 0x000003cc
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619694316.035
RegSetValueExW
key_handle: 0x000003cc
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619694316.035
RegSetValueExA
key_handle: 0x000003e4
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619694316.035
RegSetValueExA
key_handle: 0x000003e4
value: @d|Ù<×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619694316.035
RegSetValueExA
key_handle: 0x000003e4
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1619694316.066
RegSetValueExW
key_handle: 0x000003c8
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
File has been identified by 50 AntiVirus engines on VirusTotal as malicious (50 个事件)
Bkav W32.FamVT.OqjketCH.Trojan
MicroWorld-eScan Trojan.GenericKD.33996090
FireEye Trojan.GenericKD.33996090
CAT-QuickHeal Backdoor.Remcos
McAfee Fareit-FVP!7FE1BE366DCE
Cylance Unsafe
Zillya Backdoor.Remcos.Win32.2838
Sangfor Malware
K7AntiVirus Trojan-Downloader ( 00565ed51 )
Alibaba TrojanDownloader:Win32/Remcos.f5bf28bd
K7GW Trojan-Downloader ( 00565ed51 )
Arcabit Trojan.Generic.D206BD3A
Cyren W32/Trojan.SXQU-6457
Symantec Trojan.Gen.MBT
APEX Malicious
Avast Win32:Trojan-gen
Kaspersky HEUR:Backdoor.Win32.Remcos.gen
BitDefender Trojan.GenericKD.33996090
NANO-Antivirus Trojan.Win32.Delf.hkzuik
Paloalto generic.ml
Rising Backdoor.Remcos!8.B89E (CLOUD)
Ad-Aware Trojan.GenericKD.33996090
Emsisoft Trojan.GenericKD.33996090 (B)
F-Secure Trojan.TR/Dldr.Delf.ehpad
DrWeb Trojan.DownLoader33.52076
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R002C0WFA20
Sophos Mal/Generic-S
Ikarus Trojan-Downloader.Win32.Delf
Jiangmin Backdoor.Remcos.bqm
Webroot W32.Trojan.Gen
Avira TR/Dldr.Delf.ehpad
MAX malware (ai score=85)
Antiy-AVL Trojan[Backdoor]/Win32.Remcos
Microsoft PWS:Win32/Fareit.ART!MTB
AegisLab Trojan.Win32.Remcos.m!c
ZoneAlarm HEUR:Backdoor.Win32.Remcos.gen
GData Trojan.GenericKD.33996090
AhnLab-V3 Trojan/Win32.Delf.R339814
ALYac Trojan.GenericKD.33996090
VBA32 Trojan.Wacatac
Malwarebytes Backdoor.Remcos
ESET-NOD32 Win32/TrojanDownloader.Delf.CXM
TrendMicro-HouseCall TROJ_GEN.R002C0WFA20
Yandex Trojan.Igent.bTSzQo.2
Fortinet W32/Delf.BZL!tr
MaxSecure Virus.W32.Lamer.I
AVG Win32:Trojan-gen
Panda Trj/GdSda.A
Qihoo-360 Win32/Backdoor.a07
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 172.217.24.14:443
dead_host 157.240.20.8:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library oleaut32.dll:
• 0x4ac838 SysFreeString
• 0x4ac83c SysReAllocStringLen
• 0x4ac840 SysAllocStringLen
Library advapi32.dll:
• 0x4ac848 RegQueryValueExA
• 0x4ac84c RegOpenKeyExA
• 0x4ac850 RegCloseKey
Library user32.dll:
• 0x4ac858 GetKeyboardType
• 0x4ac85c DestroyWindow
• 0x4ac860 LoadStringA
• 0x4ac864 MessageBoxA
• 0x4ac868 CharNextA
Library kernel32.dll:
• 0x4ac870 GetACP
• 0x4ac874 Sleep
• 0x4ac878 VirtualFree
• 0x4ac87c VirtualAlloc
• 0x4ac880 GetCurrentThreadId
• 0x4ac88c VirtualQuery
• 0x4ac890 WideCharToMultiByte
• 0x4ac894 MultiByteToWideChar
• 0x4ac898 lstrlenA
• 0x4ac89c lstrcpynA
• 0x4ac8a0 LoadLibraryExA
• 0x4ac8a4 GetThreadLocale
• 0x4ac8a8 GetStartupInfoA
• 0x4ac8ac GetProcAddress
• 0x4ac8b0 GetModuleHandleA
• 0x4ac8b4 GetModuleFileNameA
• 0x4ac8b8 GetLocaleInfoA
• 0x4ac8bc GetCommandLineA
• 0x4ac8c0 FreeLibrary
• 0x4ac8c4 FindFirstFileA
• 0x4ac8c8 FindClose
• 0x4ac8cc ExitProcess
• 0x4ac8d0 CompareStringA
• 0x4ac8d4 WriteFile
• 0x4ac8dc RtlUnwind
• 0x4ac8e0 RaiseException
• 0x4ac8e4 GetStdHandle
Library kernel32.dll:
• 0x4ac8ec TlsSetValue
• 0x4ac8f0 TlsGetValue
• 0x4ac8f4 LocalAlloc
• 0x4ac8f8 GetModuleHandleA
Library user32.dll:
• 0x4ac900 CreateWindowExA
• 0x4ac904 WindowFromPoint
• 0x4ac908 WaitMessage
• 0x4ac90c UpdateWindow
• 0x4ac910 UnregisterClassA
• 0x4ac914 UnhookWindowsHookEx
• 0x4ac918 TranslateMessage
• 0x4ac920 TrackPopupMenu
• 0x4ac928 ShowWindow
• 0x4ac92c ShowScrollBar
• 0x4ac930 ShowOwnedPopups
• 0x4ac934 SetWindowsHookExA
• 0x4ac938 SetWindowTextA
• 0x4ac93c SetWindowPos
• 0x4ac940 SetWindowPlacement
• 0x4ac944 SetWindowLongW
• 0x4ac948 SetWindowLongA
• 0x4ac94c SetTimer
• 0x4ac950 SetScrollRange
• 0x4ac954 SetScrollPos
• 0x4ac958 SetScrollInfo
• 0x4ac95c SetRect
• 0x4ac960 SetPropA
• 0x4ac964 SetParent
• 0x4ac968 SetMenuItemInfoA
• 0x4ac96c SetMenu
• 0x4ac970 SetForegroundWindow
• 0x4ac974 SetFocus
• 0x4ac978 SetCursor
• 0x4ac97c SetClipboardData
• 0x4ac980 SetClassLongA
• 0x4ac984 SetCapture
• 0x4ac988 SetActiveWindow
• 0x4ac98c SendMessageW
• 0x4ac990 SendMessageA
• 0x4ac994 ScrollWindow
• 0x4ac998 ScreenToClient
• 0x4ac99c RemovePropA
• 0x4ac9a0 RemoveMenu
• 0x4ac9a4 ReleaseDC
• 0x4ac9a8 ReleaseCapture
• 0x4ac9b4 RegisterClassA
• 0x4ac9b8 RedrawWindow
• 0x4ac9bc PtInRect
• 0x4ac9c0 PostQuitMessage
• 0x4ac9c4 PostMessageA
• 0x4ac9c8 PeekMessageW
• 0x4ac9cc PeekMessageA
• 0x4ac9d0 OpenClipboard
• 0x4ac9d4 OffsetRect
• 0x4ac9d8 OemToCharA
• 0x4ac9dc MessageBoxA
• 0x4ac9e0 MessageBeep
• 0x4ac9e4 MapWindowPoints
• 0x4ac9e8 MapVirtualKeyA
• 0x4ac9ec LoadStringA
• 0x4ac9f0 LoadKeyboardLayoutA
• 0x4ac9f4 LoadIconA
• 0x4ac9f8 LoadCursorA
• 0x4ac9fc LoadBitmapA
• 0x4aca00 KillTimer
• 0x4aca04 IsZoomed
• 0x4aca08 IsWindowVisible
• 0x4aca0c IsWindowUnicode
• 0x4aca10 IsWindowEnabled
• 0x4aca14 IsWindow
• 0x4aca18 IsRectEmpty
• 0x4aca1c IsIconic
• 0x4aca20 IsDialogMessageW
• 0x4aca24 IsDialogMessageA
• 0x4aca28 IsChild
• 0x4aca2c InvalidateRect
• 0x4aca30 IntersectRect
• 0x4aca34 InsertMenuItemA
• 0x4aca38 InsertMenuA
• 0x4aca3c InflateRect
• 0x4aca44 GetWindowTextA
• 0x4aca48 GetWindowRect
• 0x4aca4c GetWindowPlacement
• 0x4aca50 GetWindowLongW
• 0x4aca54 GetWindowLongA
• 0x4aca58 GetWindowDC
• 0x4aca5c GetTopWindow
• 0x4aca60 GetSystemMetrics
• 0x4aca64 GetSystemMenu
• 0x4aca68 GetSysColorBrush
• 0x4aca6c GetSysColor
• 0x4aca70 GetSubMenu
• 0x4aca74 GetScrollRange
• 0x4aca78 GetScrollPos
• 0x4aca7c GetScrollInfo
• 0x4aca80 GetPropA
• 0x4aca84 GetParent
• 0x4aca88 GetWindow
• 0x4aca8c GetMessageTime
• 0x4aca90 GetMessagePos
• 0x4aca94 GetMenuStringA
• 0x4aca98 GetMenuState
• 0x4aca9c GetMenuItemInfoA
• 0x4acaa0 GetMenuItemID
• 0x4acaa4 GetMenuItemCount
• 0x4acaa8 GetMenu
• 0x4acaac GetLastActivePopup
• 0x4acab0 GetKeyboardState
• 0x4acabc GetKeyboardLayout
• 0x4acac0 GetKeyState
• 0x4acac4 GetKeyNameTextA
• 0x4acac8 GetIconInfo
• 0x4acacc GetForegroundWindow
• 0x4acad0 GetFocus
• 0x4acad4 GetDlgItem
• 0x4acad8 GetDesktopWindow
• 0x4acadc GetDCEx
• 0x4acae0 GetDC
• 0x4acae4 GetCursorPos
• 0x4acae8 GetCursor
• 0x4acaec GetClipboardData
• 0x4acaf0 GetClientRect
• 0x4acaf4 GetClassLongA
• 0x4acaf8 GetClassInfoA
• 0x4acafc GetCapture
• 0x4acb00 GetActiveWindow
• 0x4acb04 FrameRect
• 0x4acb08 FindWindowA
• 0x4acb0c FillRect
• 0x4acb10 EqualRect
• 0x4acb14 EnumWindows
• 0x4acb18 EnumThreadWindows
• 0x4acb20 EnumChildWindows
• 0x4acb24 EndPaint
• 0x4acb28 EnableWindow
• 0x4acb2c EnableScrollBar
• 0x4acb30 EnableMenuItem
• 0x4acb34 EmptyClipboard
• 0x4acb38 DrawTextA
• 0x4acb3c DrawMenuBar
• 0x4acb40 DrawIconEx
• 0x4acb44 DrawIcon
• 0x4acb48 DrawFrameControl
• 0x4acb4c DrawFocusRect
• 0x4acb50 DrawEdge
• 0x4acb54 DispatchMessageW
• 0x4acb58 DispatchMessageA
• 0x4acb5c DestroyWindow
• 0x4acb60 DestroyMenu
• 0x4acb64 DestroyIcon
• 0x4acb68 DestroyCursor
• 0x4acb6c DeleteMenu
• 0x4acb70 DefWindowProcA
• 0x4acb74 DefMDIChildProcA
• 0x4acb78 DefFrameProcA
• 0x4acb7c CreatePopupMenu
• 0x4acb80 CreateMenu
• 0x4acb84 CreateIcon
• 0x4acb88 CloseClipboard
• 0x4acb8c ClientToScreen
• 0x4acb90 CheckMenuItem
• 0x4acb94 CallWindowProcA
• 0x4acb98 CallNextHookEx
• 0x4acb9c BeginPaint
• 0x4acba0 CharNextA
• 0x4acba4 CharLowerBuffA
• 0x4acba8 CharLowerA
• 0x4acbac CharUpperBuffA
• 0x4acbb0 CharToOemA
• 0x4acbb4 AdjustWindowRectEx
Library gdi32.dll:
• 0x4acbc0 UnrealizeObject
• 0x4acbc4 StretchBlt
• 0x4acbc8 SetWindowOrgEx
• 0x4acbcc SetWinMetaFileBits
• 0x4acbd0 SetViewportOrgEx
• 0x4acbd4 SetTextColor
• 0x4acbd8 SetStretchBltMode
• 0x4acbdc SetROP2
• 0x4acbe0 SetPixel
• 0x4acbe4 SetMapMode
• 0x4acbe8 SetEnhMetaFileBits
• 0x4acbec SetDIBColorTable
• 0x4acbf0 SetBrushOrgEx
• 0x4acbf4 SetBkMode
• 0x4acbf8 SetBkColor
• 0x4acbfc SelectPalette
• 0x4acc00 SelectObject
• 0x4acc04 SaveDC
• 0x4acc08 RestoreDC
• 0x4acc0c Rectangle
• 0x4acc10 RectVisible
• 0x4acc14 RealizePalette
• 0x4acc18 Polyline
• 0x4acc1c PlayEnhMetaFile
• 0x4acc20 PatBlt
• 0x4acc24 MoveToEx
• 0x4acc28 MaskBlt
• 0x4acc2c LineTo
• 0x4acc30 LPtoDP
• 0x4acc34 IntersectClipRect
• 0x4acc38 GetWindowOrgEx
• 0x4acc3c GetWinMetaFileBits
• 0x4acc40 GetTextMetricsA
• 0x4acc44 GetTextExtentPointA
• 0x4acc50 GetStockObject
• 0x4acc54 GetRgnBox
• 0x4acc58 GetPixel
• 0x4acc5c GetPaletteEntries
• 0x4acc60 GetObjectA
• 0x4acc70 GetEnhMetaFileBits
• 0x4acc74 GetDeviceCaps
• 0x4acc78 GetDIBits
• 0x4acc7c GetDIBColorTable
• 0x4acc80 GetDCOrgEx
• 0x4acc88 GetClipBox
• 0x4acc8c GetBrushOrgEx
• 0x4acc90 GetBitmapBits
• 0x4acc94 ExtTextOutA
• 0x4acc98 ExcludeClipRect
• 0x4acc9c DeleteObject
• 0x4acca0 DeleteEnhMetaFile
• 0x4acca4 DeleteDC
• 0x4acca8 CreateSolidBrush
• 0x4accac CreatePenIndirect
• 0x4accb0 CreatePalette
• 0x4accb8 CreateFontIndirectA
• 0x4accbc CreateEnhMetaFileA
• 0x4accc0 CreateDIBitmap
• 0x4accc4 CreateDIBSection
• 0x4accc8 CreateCompatibleDC
• 0x4accd0 CreateBrushIndirect
• 0x4accd4 CreateBitmap
• 0x4accd8 CopyEnhMetaFileA
• 0x4accdc CloseEnhMetaFile
• 0x4acce0 BitBlt
Library version.dll:
• 0x4acce8 VerQueryValueA
• 0x4accf0 GetFileVersionInfoA
Library kernel32.dll:
• 0x4accf8 lstrcpyA
• 0x4accfc lstrcmpA
• 0x4acd00 WriteFile
• 0x4acd04 WaitForSingleObject
• 0x4acd08 VirtualQuery
• 0x4acd0c VirtualProtect
• 0x4acd10 VirtualAlloc
• 0x4acd14 SizeofResource
• 0x4acd18 SetThreadLocale
• 0x4acd1c SetFilePointer
• 0x4acd20 SetEvent
• 0x4acd24 SetErrorMode
• 0x4acd28 SetEndOfFile
• 0x4acd2c ResetEvent
• 0x4acd30 ReadFile
• 0x4acd34 MultiByteToWideChar
• 0x4acd38 MulDiv
• 0x4acd3c LockResource
• 0x4acd40 LoadResource
• 0x4acd44 LoadLibraryA
• 0x4acd50 GlobalUnlock
• 0x4acd54 GlobalSize
• 0x4acd58 GlobalLock
• 0x4acd5c GlobalFree
• 0x4acd60 GlobalFindAtomA
• 0x4acd64 GlobalDeleteAtom
• 0x4acd68 GlobalAlloc
• 0x4acd6c GlobalAddAtomA
• 0x4acd70 GetVersionExA
• 0x4acd74 GetVersion
• 0x4acd78 GetUserDefaultLCID
• 0x4acd7c GetTickCount
• 0x4acd80 GetThreadLocale
• 0x4acd84 GetStdHandle
• 0x4acd88 GetProcAddress
• 0x4acd8c GetModuleHandleA
• 0x4acd90 GetModuleFileNameA
• 0x4acd94 GetLocaleInfoA
• 0x4acd98 GetLocalTime
• 0x4acd9c GetLastError
• 0x4acda0 GetFullPathNameA
• 0x4acda4 GetDiskFreeSpaceA
• 0x4acda8 GetDateFormatA
• 0x4acdac GetCurrentThreadId
• 0x4acdb0 GetCurrentProcessId
• 0x4acdb4 GetComputerNameA
• 0x4acdb8 GetCPInfo
• 0x4acdbc FreeResource
• 0x4acdc0 InterlockedExchange
• 0x4acdc4 FreeLibrary
• 0x4acdc8 FormatMessageA
• 0x4acdcc FindResourceA
• 0x4acdd0 EnumCalendarInfoA
• 0x4acddc CreateThread
• 0x4acde0 CreateFileA
• 0x4acde4 CreateEventA
• 0x4acde8 CompareStringA
• 0x4acdec CloseHandle
Library advapi32.dll:
• 0x4acdf4 RegQueryValueExA
• 0x4acdf8 RegOpenKeyExA
• 0x4acdfc RegFlushKey
• 0x4ace00 RegCloseKey
Library oleaut32.dll:
• 0x4ace08 GetErrorInfo
• 0x4ace0c GetActiveObject
• 0x4ace10 SysFreeString
Library ole32.dll:
• 0x4ace1c IsAccelerator
• 0x4ace20 OleDraw
• 0x4ace28 CoTaskMemFree
• 0x4ace2c ProgIDFromCLSID
• 0x4ace30 StringFromCLSID
• 0x4ace34 CoCreateInstance
• 0x4ace38 CoGetClassObject
• 0x4ace3c CoUninitialize
• 0x4ace40 CoInitialize
• 0x4ace44 IsEqualGUID
Library kernel32.dll:
• 0x4ace4c Sleep
Library oleaut32.dll:
• 0x4ace54 SafeArrayPtrOfIndex
• 0x4ace58 SafeArrayGetUBound
• 0x4ace5c SafeArrayGetLBound
• 0x4ace60 SafeArrayCreate
• 0x4ace64 VariantChangeType
• 0x4ace68 VariantCopy
• 0x4ace6c VariantClear
• 0x4ace70 VariantInit
Library comctl32.dll:
• 0x4ace78 _TrackMouseEvent
• 0x4ace84 ImageList_Write
• 0x4ace88 ImageList_Read
• 0x4ace90 ImageList_DragMove
• 0x4ace94 ImageList_DragLeave
• 0x4ace98 ImageList_DragEnter
• 0x4ace9c ImageList_EndDrag
• 0x4acea0 ImageList_BeginDrag
• 0x4acea4 ImageList_Remove
• 0x4acea8 ImageList_DrawEx
• 0x4aceac ImageList_Draw
• 0x4aceb8 ImageList_Add
• 0x4acec0 ImageList_Destroy
• 0x4acec4 ImageList_Create
Library comdlg32.dll:
• 0x4acecc GetSaveFileNameA
• 0x4aced0 GetOpenFileNameA
Library advapi32.dll:
• 0x4aced8 QueryServiceStatus
• 0x4acedc OpenServiceA
• 0x4acee0 OpenSCManagerA
• 0x4acee4 CloseServiceHandle
Library URL.DLL:
• 0x4aceec InetIsOffline

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 61680 114.114.114.114 53
192.168.56.101 62912 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 50568 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 53210 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 60221 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.