8.6
极危
59 个模型检测该样本为恶意！
重新分析
更多

57294ac308436e17b7e99da25f3d0fa1eb0a466572bed8ee736e078d0dc8042f

fe59b9e260519d6227ff7e239c9d0a04.exe

分析耗时

36s

最近分析

文件大小

659.5KB
静态报毒 动态报毒 0IHOLXFNYTE 100% AI SCORE=80 AIDETECTVM ALI2000015 ANDROM AWNG CLASSIC CONFIDENCE DELF DELFINJECT DELPHI DELPHILESS EFKR ELDORADO ELZG EMJE FAREIT HIGH CONFIDENCE HLISRD IGENERIC LOKIBOT MALWARE2 MALWARE@#1DML4AZNBO7KB PGW@A02AKGAI R066C0DL220 REMCOS S + TROJ SCORE SIGGEN2 STATIC AI SUSGEN SUSPICIOUS PE TRJGEN TSCOPE UMWGU UNSAFE WACATAC X2066 ZELPHIF ZUSY 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FTB!FE59B9E26051 20201211 6.0.6.653
Avast Win32:Trojan-gen 20201210 21.1.5827.0
Alibaba Trojan:Win32/DelfInject.ali2000015 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Kingsoft 20201211 2017.9.26.565
Tencent Win32.Backdoor.Androm.Efkr 20201211 1.0.0.1
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
Command line console output was observed (22 个事件)
Time & API Arguments Status Return Repeated
1620823977.56475
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
1620823977.56475
WriteConsoleW
buffer: PING
console_handle: 0x00000007
success 1 0
1620823977.56475
WriteConsoleW
buffer: 127.0.0.1 -n 2
console_handle: 0x00000007
success 1 0
1620823980.42475
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
1620823980.42475
WriteConsoleW
buffer: start
console_handle: 0x00000007
success 1 0
1620823980.43975
WriteConsoleW
buffer: "" "C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe"
console_handle: 0x00000007
success 1 0
1620823985.39375
WriteConsoleW
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp>
console_handle: 0x00000007
success 1 0
1620823985.39375
WriteConsoleW
buffer: del
console_handle: 0x00000007
success 1 0
1620823985.39375
WriteConsoleW
buffer: "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\install.bat"
console_handle: 0x00000007
success 1 0
1620823985.51875
WriteConsoleW
buffer: 找不到批处理文件。
console_handle: 0x0000000b
success 1 0
1620823978.17525
WriteConsoleA
buffer: ÕýÔÚ Ping 127.0.0.1
console_handle: 0x00000007
success 1 0
1620823978.19025
WriteConsoleA
buffer: ¾ßÓÐ 32 ×Ö½ÚµÄÊý¾Ý:
console_handle: 0x00000007
success 1 0
1620823978.22225
WriteConsoleA
buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´:
console_handle: 0x00000007
success 1 0
1620823978.22225
WriteConsoleA
buffer: ×Ö½Ú=32
console_handle: 0x00000007
success 1 0
1620823978.22225
WriteConsoleA
buffer: ʱ¼ä<1ms
console_handle: 0x00000007
success 1 0
1620823978.22225
WriteConsoleA
buffer: TTL=128
console_handle: 0x00000007
success 1 0
1620823979.22225
WriteConsoleA
buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´:
console_handle: 0x00000007
success 1 0
1620823979.22225
WriteConsoleA
buffer: ×Ö½Ú=32
console_handle: 0x00000007
success 1 0
1620823979.22225
WriteConsoleA
buffer: ʱ¼ä<1ms
console_handle: 0x00000007
success 1 0
1620823979.22225
WriteConsoleA
buffer: TTL=128
console_handle: 0x00000007
success 1 0
1620823979.25325
WriteConsoleA
buffer: 127.0.0.1 µÄ Ping ͳ¼ÆÐÅÏ¢: Êý¾Ý°ü: ÒÑ·¢ËÍ = 2£¬ÒѽÓÊÕ = 2£¬¶ªÊ§ = 0 (0% ¶ªÊ§)£¬
console_handle: 0x00000007
success 1 0
1620823979.26925
WriteConsoleA
buffer: Íù·µÐг̵ĹÀ¼Æʱ¼ä(ÒÔºÁÃëΪµ¥Î»): ×î¶Ì = 0ms£¬× = 0ms£¬Æ½¾ù = 0ms
console_handle: 0x00000007
success 1 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1620823978.09725
GlobalMemoryStatusEx
success 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (6 个事件)
Time & API Arguments Status Return Repeated
1620809368.1503
NtAllocateVirtualMemory
process_identifier: 2240
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x01cb0000
success 0 0
1620809368.3073
NtAllocateVirtualMemory
process_identifier: 2240
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f10000
success 0 0
1620809368.3223
NtAllocateVirtualMemory
process_identifier: 2240
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01fb0000
success 0 0
1620823982.08075
NtAllocateVirtualMemory
process_identifier: 3220
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003e0000
success 0 0
1620823982.43975
NtAllocateVirtualMemory
process_identifier: 3220
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f40000
success 0 0
1620823982.45575
NtAllocateVirtualMemory
process_identifier: 3220
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x020b0000
success 0 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\install.bat
Drops a binary and executes it (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\install.bat
A process created a hidden window (1 个事件)
Time & API Arguments Status Return Repeated
1620823976.878125
ShellExecuteExW
parameters:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\install.bat
filepath_r: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\install.bat
show_type: 0
success 1 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (3 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.177978267218462 section {'size_of_data': '0x00022c00', 'virtual_address': '0x00087000', 'entropy': 7.177978267218462, 'name': '.rsrc', 'virtual_size': '0x00022a70'} description A section with a high entropy has been found
entropy 0.21108580106302202 description Overall entropy of this PE file is high
Uses Windows utilities for basic Windows functionality (1 个事件)
cmdline PING 127.0.0.1 -n 2
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Installs itself for autorun at Windows startup (1 个事件)
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\remcos reg_value "C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe"
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (4 个事件)
Process injection Process 2240 called NtSetContextThread to modify thread in remote process 912
Process injection Process 3220 called NtSetContextThread to modify thread in remote process 3292
Time & API Arguments Status Return Repeated
1620809369.0883
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4259208
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 912
success 0 0
1620823983.79975
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4259208
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3292
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (6 个事件)
Process injection Process 2240 resumed a thread in remote process 912
Process injection Process 2440 resumed a thread in remote process 3220
Process injection Process 3220 resumed a thread in remote process 3292
Time & API Arguments Status Return Repeated
1620809369.5413
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 912
success 0 0
1620823985.36175
NtResumeThread
thread_handle: 0x00000080
suspend_count: 0
process_identifier: 3220
success 0 0
1620823984.86175
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 3292
success 0 0
Executed a process and injected code into it, probably while unpacking (17 个事件)
Time & API Arguments Status Return Repeated
1620809369.0723
CreateProcessInternalW
thread_identifier: 3048
thread_handle: 0x000000fc
process_identifier: 912
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\fe59b9e260519d6227ff7e239c9d0a04.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1620809369.0723
NtUnmapViewOfSection
process_identifier: 912
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1620809369.0883
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 912
commit_size: 94208
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 94208
base_address: 0x00400000
success 0 0
1620809369.0883
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1620809369.0883
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4259208
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 912
success 0 0
1620809369.5413
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 912
success 0 0
1620823976.862125
CreateProcessInternalW
thread_identifier: 1176
thread_handle: 0x00000160
process_identifier: 2440
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath:
track: 1
command_line: "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\install.bat"
filepath_r:
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x00000174
inherit_handles: 0
success 1 0
1620823977.86175
CreateProcessInternalW
thread_identifier: 3068
thread_handle: 0x00000084
process_identifier: 2296
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath: C:\Windows\System32\PING.EXE
track: 1
command_line: PING 127.0.0.1 -n 2
filepath_r: C:\Windows\system32\PING.EXE
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x00000080
inherit_handles: 1
success 1 0
1620823981.17475
CreateProcessInternalW
thread_identifier: 3224
thread_handle: 0x00000080
process_identifier: 3220
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe"
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe
stack_pivoted: 0
creation_flags: 525328 (CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x00000084
inherit_handles: 1
success 1 0
1620823985.36175
NtResumeThread
thread_handle: 0x00000080
suspend_count: 0
process_identifier: 3220
success 0 0
1620823978.14425
NtResumeThread
thread_handle: 0x000000d8
suspend_count: 1
process_identifier: 2296
success 0 0
1620823983.65875
CreateProcessInternalW
thread_identifier: 3296
thread_handle: 0x000000fc
process_identifier: 3292
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Roaming\remcos\remcos.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000100
inherit_handles: 0
success 1 0
1620823983.65875
NtUnmapViewOfSection
process_identifier: 3292
region_size: 4096
process_handle: 0x00000100
base_address: 0x00400000
success 0 0
1620823983.76875
NtMapViewOfSection
section_handle: 0x00000108
process_identifier: 3292
commit_size: 94208
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000100
allocation_type: 0 ()
section_offset: 0
view_size: 94208
base_address: 0x00400000
success 0 0
1620823983.79975
NtGetContextThread
thread_handle: 0x000000fc
success 0 0
1620823983.79975
NtSetContextThread
thread_handle: 0x000000fc
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4259208
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3292
success 0 0
1620823984.86175
NtResumeThread
thread_handle: 0x000000fc
suspend_count: 1
process_identifier: 3292
success 0 0
File has been identified by 59 AntiVirus engines on VirusTotal as malicious (50 out of 59 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
DrWeb Trojan.PWS.Siggen2.51314
MicroWorld-eScan Gen:Variant.Zusy.307621
FireEye Generic.mg.fe59b9e260519d62
CAT-QuickHeal Trojan.IGENERIC
Qihoo-360 Win32/Backdoor.650
McAfee Fareit-FTB!FE59B9E26051
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Malware
K7AntiVirus Trojan ( 005680341 )
BitDefender Gen:Variant.Zusy.307621
K7GW Trojan ( 005680341 )
Cybereason malicious.d5fd67
BitDefenderTheta Gen:NN.ZelphiF.34670.PGW@a02AkGai
Cyren W32/Injector.ABY.gen!Eldorado
Symantec Trojan Horse
APEX Malicious
Avast Win32:Trojan-gen
ClamAV Win.Dropper.Remcos-8328482-0
Kaspersky HEUR:Backdoor.Win32.Androm.gen
Alibaba Trojan:Win32/DelfInject.ali2000015
NANO-Antivirus Trojan.Win32.TrjGen.hlisrd
Rising Trojan.Injector!1.CB27 (CLASSIC)
Ad-Aware Gen:Variant.Zusy.307621
Sophos Mal/Generic-S + Troj/Remcos-SE
Comodo Malware@#1dml4aznbo7kb
F-Secure Dropper.DR/Delphi.umwgu
TrendMicro TROJ_GEN.R066C0DL220
McAfee-GW-Edition BehavesLike.Win32.Fareit.jh
Emsisoft Gen:Variant.Zusy.307621 (B)
SentinelOne Static AI - Suspicious PE
Jiangmin Backdoor.Androm.awng
Webroot W32.Trojan.Gen
Avira DR/Delphi.umwgu
Antiy-AVL Trojan/Win32.Wacatac
Microsoft Trojan:Win32/Lokibot.VD!MTB
Gridinsoft Trojan.Win32.Injector.dd!i
Arcabit Trojan.Zusy.D4B1A5
ZoneAlarm HEUR:Backdoor.Win32.Androm.gen
GData Gen:Variant.Zusy.307621
Cynet Malicious (score: 100)
AhnLab-V3 Suspicious/Win.Delphiless.X2066
Acronis suspicious
VBA32 TScope.Trojan.Delf
MAX malware (ai score=80)
Malwarebytes Trojan.MalPack.DLF
Panda Trj/CI.A
ESET-NOD32 a variant of Win32/Injector.EMJE
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x47a164 VirtualFree
• 0x47a168 VirtualAlloc
• 0x47a16c LocalFree
• 0x47a170 LocalAlloc
• 0x47a174 GetVersion
• 0x47a178 GetCurrentThreadId
• 0x47a184 VirtualQuery
• 0x47a188 WideCharToMultiByte
• 0x47a18c MultiByteToWideChar
• 0x47a190 lstrlenA
• 0x47a194 lstrcpynA
• 0x47a198 LoadLibraryExA
• 0x47a19c GetThreadLocale
• 0x47a1a0 GetStartupInfoA
• 0x47a1a4 GetProcAddress
• 0x47a1a8 GetModuleHandleA
• 0x47a1ac GetModuleFileNameA
• 0x47a1b0 GetLocaleInfoA
• 0x47a1b4 GetCommandLineA
• 0x47a1b8 FreeLibrary
• 0x47a1bc FindFirstFileA
• 0x47a1c0 FindClose
• 0x47a1c4 ExitProcess
• 0x47a1c8 WriteFile
• 0x47a1d0 RtlUnwind
• 0x47a1d4 RaiseException
• 0x47a1d8 GetStdHandle
Library user32.dll:
• 0x47a1e0 GetKeyboardType
• 0x47a1e4 LoadStringA
• 0x47a1e8 MessageBoxA
• 0x47a1ec CharNextA
Library advapi32.dll:
• 0x47a1f4 RegQueryValueExA
• 0x47a1f8 RegOpenKeyExA
• 0x47a1fc RegCloseKey
Library oleaut32.dll:
• 0x47a204 SysFreeString
• 0x47a208 SysReAllocStringLen
• 0x47a20c SysAllocStringLen
Library kernel32.dll:
• 0x47a214 TlsSetValue
• 0x47a218 TlsGetValue
• 0x47a21c LocalAlloc
• 0x47a220 GetModuleHandleA
Library advapi32.dll:
• 0x47a228 RegQueryValueExA
• 0x47a22c RegOpenKeyExA
• 0x47a230 RegCloseKey
Library kernel32.dll:
• 0x47a238 lstrcpyA
• 0x47a23c WriteFile
• 0x47a244 WaitForSingleObject
• 0x47a248 VirtualQuery
• 0x47a24c VirtualAlloc
• 0x47a250 Sleep
• 0x47a254 SizeofResource
• 0x47a258 SetThreadLocale
• 0x47a25c SetFilePointer
• 0x47a260 SetEvent
• 0x47a264 SetErrorMode
• 0x47a268 SetEndOfFile
• 0x47a26c ResetEvent
• 0x47a270 ReadFile
• 0x47a274 MultiByteToWideChar
• 0x47a278 MulDiv
• 0x47a27c LockResource
• 0x47a280 LoadResource
• 0x47a284 LoadLibraryA
• 0x47a290 GlobalUnlock
• 0x47a294 GlobalReAlloc
• 0x47a298 GlobalHandle
• 0x47a29c GlobalLock
• 0x47a2a0 GlobalFree
• 0x47a2a4 GlobalFindAtomA
• 0x47a2a8 GlobalDeleteAtom
• 0x47a2ac GlobalAlloc
• 0x47a2b0 GlobalAddAtomA
• 0x47a2b4 GetVersionExA
• 0x47a2b8 GetVersion
• 0x47a2bc GetTickCount
• 0x47a2c0 GetThreadLocale
• 0x47a2c8 GetSystemTime
• 0x47a2cc GetSystemInfo
• 0x47a2d0 GetStringTypeExA
• 0x47a2d4 GetStdHandle
• 0x47a2d8 GetProcAddress
• 0x47a2dc GetModuleHandleA
• 0x47a2e0 GetModuleFileNameA
• 0x47a2e4 GetLocaleInfoA
• 0x47a2e8 GetLocalTime
• 0x47a2ec GetLastError
• 0x47a2f0 GetFullPathNameA
• 0x47a2f4 GetDiskFreeSpaceA
• 0x47a2f8 GetDateFormatA
• 0x47a2fc GetCurrentThreadId
• 0x47a300 GetCurrentProcessId
• 0x47a304 GetCPInfo
• 0x47a308 GetACP
• 0x47a30c FreeResource
• 0x47a314 InterlockedExchange
• 0x47a31c FreeLibrary
• 0x47a320 FormatMessageA
• 0x47a324 FindResourceA
• 0x47a328 ExitThread
• 0x47a32c EnumCalendarInfoA
• 0x47a338 CreateThread
• 0x47a33c CreateFileA
• 0x47a340 CreateEventA
• 0x47a344 CompareStringA
• 0x47a348 CloseHandle
Library version.dll:
• 0x47a350 VerQueryValueA
• 0x47a358 GetFileVersionInfoA
Library gdi32.dll:
• 0x47a360 UnrealizeObject
• 0x47a364 StretchBlt
• 0x47a368 SetWindowOrgEx
• 0x47a36c SetViewportOrgEx
• 0x47a370 SetTextColor
• 0x47a374 SetStretchBltMode
• 0x47a378 SetROP2
• 0x47a37c SetPixel
• 0x47a380 SetDIBColorTable
• 0x47a384 SetBrushOrgEx
• 0x47a388 SetBkMode
• 0x47a38c SetBkColor
• 0x47a390 SelectPalette
• 0x47a394 SelectObject
• 0x47a398 SaveDC
• 0x47a39c RestoreDC
• 0x47a3a0 Rectangle
• 0x47a3a4 RectVisible
• 0x47a3a8 RealizePalette
• 0x47a3ac PatBlt
• 0x47a3b0 MoveToEx
• 0x47a3b4 MaskBlt
• 0x47a3b8 LineTo
• 0x47a3bc IntersectClipRect
• 0x47a3c0 GetWindowOrgEx
• 0x47a3c4 GetTextMetricsA
• 0x47a3d0 GetStockObject
• 0x47a3d4 GetPixel
• 0x47a3d8 GetPaletteEntries
• 0x47a3dc GetObjectA
• 0x47a3e0 GetDeviceCaps
• 0x47a3e4 GetDIBits
• 0x47a3e8 GetDIBColorTable
• 0x47a3ec GetDCOrgEx
• 0x47a3f4 GetClipBox
• 0x47a3f8 GetBrushOrgEx
• 0x47a3fc GetBitmapBits
• 0x47a400 ExcludeClipRect
• 0x47a404 DeleteObject
• 0x47a408 DeleteDC
• 0x47a40c CreateSolidBrush
• 0x47a410 CreatePenIndirect
• 0x47a414 CreatePen
• 0x47a418 CreatePalette
• 0x47a420 CreateFontIndirectA
• 0x47a424 CreateDIBitmap
• 0x47a428 CreateDIBSection
• 0x47a42c CreateCompatibleDC
• 0x47a434 CreateBrushIndirect
• 0x47a438 CreateBitmap
• 0x47a43c BitBlt
Library user32.dll:
• 0x47a444 CreateWindowExA
• 0x47a448 WindowFromPoint
• 0x47a44c WinHelpA
• 0x47a450 WaitMessage
• 0x47a454 ValidateRect
• 0x47a458 UpdateWindow
• 0x47a45c UnregisterClassA
• 0x47a460 UnhookWindowsHookEx
• 0x47a464 TranslateMessage
• 0x47a46c TrackPopupMenu
• 0x47a474 ShowWindow
• 0x47a478 ShowScrollBar
• 0x47a47c ShowOwnedPopups
• 0x47a480 ShowCursor
• 0x47a484 SetWindowsHookExA
• 0x47a488 SetWindowTextA
• 0x47a48c SetWindowPos
• 0x47a490 SetWindowPlacement
• 0x47a494 SetWindowLongA
• 0x47a498 SetTimer
• 0x47a49c SetScrollRange
• 0x47a4a0 SetScrollPos
• 0x47a4a4 SetScrollInfo
• 0x47a4a8 SetRect
• 0x47a4ac SetPropA
• 0x47a4b0 SetParent
• 0x47a4b4 SetMenuItemInfoA
• 0x47a4b8 SetMenu
• 0x47a4bc SetForegroundWindow
• 0x47a4c0 SetFocus
• 0x47a4c4 SetCursor
• 0x47a4c8 SetClassLongA
• 0x47a4cc SetCapture
• 0x47a4d0 SetActiveWindow
• 0x47a4d4 SendMessageA
• 0x47a4d8 ScrollWindow
• 0x47a4dc ScreenToClient
• 0x47a4e0 RemovePropA
• 0x47a4e4 RemoveMenu
• 0x47a4e8 ReleaseDC
• 0x47a4ec ReleaseCapture
• 0x47a4f8 RegisterClassA
• 0x47a4fc RedrawWindow
• 0x47a500 PtInRect
• 0x47a504 PostQuitMessage
• 0x47a508 PostMessageA
• 0x47a50c PeekMessageA
• 0x47a510 OffsetRect
• 0x47a514 OemToCharA
• 0x47a518 MessageBoxA
• 0x47a51c MapWindowPoints
• 0x47a520 MapVirtualKeyA
• 0x47a524 LockWindowUpdate
• 0x47a528 LoadStringA
• 0x47a52c LoadKeyboardLayoutA
• 0x47a530 LoadIconA
• 0x47a534 LoadCursorA
• 0x47a538 LoadBitmapA
• 0x47a53c KillTimer
• 0x47a540 IsZoomed
• 0x47a544 IsWindowVisible
• 0x47a548 IsWindowEnabled
• 0x47a54c IsWindow
• 0x47a550 IsRectEmpty
• 0x47a554 IsIconic
• 0x47a558 IsDialogMessageA
• 0x47a55c IsChild
• 0x47a560 InvalidateRect
• 0x47a564 IntersectRect
• 0x47a568 InsertMenuItemA
• 0x47a56c InsertMenuA
• 0x47a570 InflateRect
• 0x47a578 GetWindowTextA
• 0x47a57c GetWindowRect
• 0x47a580 GetWindowPlacement
• 0x47a584 GetWindowLongA
• 0x47a588 GetWindowDC
• 0x47a58c GetTopWindow
• 0x47a590 GetSystemMetrics
• 0x47a594 GetSystemMenu
• 0x47a598 GetSysColorBrush
• 0x47a59c GetSysColor
• 0x47a5a0 GetSubMenu
• 0x47a5a4 GetScrollRange
• 0x47a5a8 GetScrollPos
• 0x47a5ac GetScrollInfo
• 0x47a5b0 GetPropA
• 0x47a5b4 GetParent
• 0x47a5b8 GetWindow
• 0x47a5bc GetMessagePos
• 0x47a5c0 GetMenuStringA
• 0x47a5c4 GetMenuState
• 0x47a5c8 GetMenuItemInfoA
• 0x47a5cc GetMenuItemID
• 0x47a5d0 GetMenuItemCount
• 0x47a5d4 GetMenu
• 0x47a5d8 GetLastActivePopup
• 0x47a5dc GetKeyboardState
• 0x47a5e4 GetKeyboardLayout
• 0x47a5e8 GetKeyState
• 0x47a5ec GetKeyNameTextA
• 0x47a5f0 GetIconInfo
• 0x47a5f4 GetForegroundWindow
• 0x47a5f8 GetFocus
• 0x47a5fc GetDlgItem
• 0x47a600 GetDesktopWindow
• 0x47a604 GetDCEx
• 0x47a608 GetDC
• 0x47a60c GetCursorPos
• 0x47a610 GetCursor
• 0x47a614 GetClientRect
• 0x47a618 GetClassNameA
• 0x47a61c GetClassInfoA
• 0x47a620 GetCapture
• 0x47a624 GetActiveWindow
• 0x47a628 FrameRect
• 0x47a62c FindWindowA
• 0x47a630 FillRect
• 0x47a634 EqualRect
• 0x47a638 EnumWindows
• 0x47a63c EnumThreadWindows
• 0x47a640 EndPaint
• 0x47a644 EnableWindow
• 0x47a648 EnableScrollBar
• 0x47a64c EnableMenuItem
• 0x47a650 DrawTextA
• 0x47a654 DrawMenuBar
• 0x47a658 DrawIconEx
• 0x47a65c DrawIcon
• 0x47a660 DrawFrameControl
• 0x47a664 DrawEdge
• 0x47a668 DispatchMessageA
• 0x47a66c DestroyWindow
• 0x47a670 DestroyMenu
• 0x47a674 DestroyIcon
• 0x47a678 DestroyCursor
• 0x47a67c DeleteMenu
• 0x47a680 DefWindowProcA
• 0x47a684 DefMDIChildProcA
• 0x47a688 DefFrameProcA
• 0x47a68c CreatePopupMenu
• 0x47a690 CreateMenu
• 0x47a694 CreateIcon
• 0x47a698 ClientToScreen
• 0x47a69c CheckMenuItem
• 0x47a6a0 CallWindowProcA
• 0x47a6a4 CallNextHookEx
• 0x47a6a8 BeginPaint
• 0x47a6ac CharNextA
• 0x47a6b0 CharLowerA
• 0x47a6b4 CharToOemA
• 0x47a6b8 AdjustWindowRectEx
Library kernel32.dll:
• 0x47a6c4 Sleep
Library oleaut32.dll:
• 0x47a6cc SafeArrayPtrOfIndex
• 0x47a6d0 SafeArrayGetUBound
• 0x47a6d4 SafeArrayGetLBound
• 0x47a6d8 SafeArrayCreate
• 0x47a6dc VariantChangeType
• 0x47a6e0 VariantCopy
• 0x47a6e4 VariantClear
• 0x47a6e8 VariantInit
Library ole32.dll:
• 0x47a6f0 CoCreateInstance
• 0x47a6f4 CoUninitialize
• 0x47a6f8 CoInitialize
Library oleaut32.dll:
• 0x47a700 CreateErrorInfo
• 0x47a704 GetErrorInfo
• 0x47a708 SetErrorInfo
• 0x47a70c SysFreeString
Library comctl32.dll:
• 0x47a71c ImageList_Write
• 0x47a720 ImageList_Read
• 0x47a730 ImageList_DragMove
• 0x47a734 ImageList_DragLeave
• 0x47a738 ImageList_DragEnter
• 0x47a73c ImageList_EndDrag
• 0x47a740 ImageList_BeginDrag
• 0x47a744 ImageList_Remove
• 0x47a748 ImageList_DrawEx
• 0x47a74c ImageList_Draw
• 0x47a75c ImageList_Add
• 0x47a764 ImageList_Destroy
• 0x47a768 ImageList_Create
• 0x47a76c InitCommonControls
Library comdlg32.dll:
• 0x47a774 GetSaveFileNameA
• 0x47a778 GetOpenFileNameA

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49713 114.114.114.114 53
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 50568 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62912 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 49238 239.255.255.250 1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.