SmartHawk

7.0

高危

55 个模型检测该样本为恶意！

重新分析

下载样本

ef827d770af90d63a92c5eb936729d9a4523c555eec1d49ef3ee72f3d518985c

05ebf344864ad1538637f6b95ba778f4.exe

分析耗时

83s

最近分析

文件大小

801.3KB

静态报毒动态报毒 100% AI SCORE=88 AVSARHER BUTLL5 CLOUD COINS CONFIDENCE DELF DOUH ELDORADO EWFF FAREIT GDSDA HGIASOUA HIGH CONFIDENCE HUJQLQ INVALIDSIG LOKIBOT MALICIOUS PE MALWARE@#3M4QW4NO6CEMY MCFKI R351003 REMCOS REMCOSCRYPT SCORE STATIC AI TROJANPSW UNSAFE WINDOWBANK YG2@A4FFPBKO ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FZO!05EBF344864A	20210301	6.0.6.653
Avast	Win32:Trojan-gen	20210301	21.1.5827.0
Alibaba	TrojanPSW:Win32/Remcos.f3b22c71	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Kingsoft		20210301	2017.9.26.565
CrowdStrike	win/malicious_confidence_100% (W)	20210203	1.0

This executable is signed

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620137590.396001 __exception__	stacktrace: 0x2040573 0x20406d8 DriverCallback+0x4e waveOutOpen-0xa2e winmm+0x3af0 @ 0x75463af0 timeEndPeriod+0x54a timeKillEvent-0x57 winmm+0xa535 @ 0x7546a535 timeEndPeriod+0x449 timeKillEvent-0x158 winmm+0xa434 @ 0x7546a434 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 54656496 registers.edi: 33818212 registers.eax: 0 registers.ebp: 54656576 registers.edx: 0 registers.ebx: 4294967294 registers.esi: 16 registers.ecx: 87 exception.instruction_r: 8b 40 3c 99 03 04 24 13 54 24 04 83 c4 08 89 45 exception.instruction: mov eax, dword ptr [eax + 0x3c] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x202d320	success	0	0

Time & API

Arguments

Status

Return

Repeated

1620137590.396001
__exception__

stacktrace:

0x2040573
0x20406d8
DriverCallback+0x4e waveOutOpen-0xa2e winmm+0x3af0 @ 0x75463af0
timeEndPeriod+0x54a timeKillEvent-0x57 winmm+0xa535 @ 0x7546a535
timeEndPeriod+0x449 timeKillEvent-0x158 winmm+0xa434 @ 0x7546a434
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 54656496
registers.edi: 33818212
registers.eax: 0
registers.ebp: 54656576
registers.edx: 0
registers.ebx: 4294967294
registers.esi: 16
registers.ecx: 87
exception.instruction_r: 8b 40 3c 99 03 04 24 13 54 24 04 83 c4 08 89 45
exception.instruction: mov eax, dword ptr [eax + 0x3c]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x202d320

success

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620137530.521001 NtAllocateVirtualMemory	process_identifier: 2264 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003d0000	success	0	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620137548.084001 NtProtectVirtualMemory	process_identifier: 2264 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 131072 protection: 32 (PAGE_EXECUTE_READ) process_handle: 0xffffffff base_address: 0x02021000	success	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620137558.990001 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Disables proxy possibly for traffic interception (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620137558.553001 RegSetValueExA	key_handle: 0x000002bc value: 0 regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	success	0	0

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1620137561.553001 RegSetValueExA	key_handle: 0x000003ac value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1620137561.553001 RegSetValueExA	key_handle: 0x000003ac value: ;´¸ú@× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1620137561.553001 RegSetValueExA	key_handle: 0x000003ac value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1620137561.553001 RegSetValueExW	key_handle: 0x000003ac value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1620137561.553001 RegSetValueExA	key_handle: 0x000003c8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1620137561.553001 RegSetValueExA	key_handle: 0x000003c8 value: ;´¸ú@× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1620137561.553001 RegSetValueExA	key_handle: 0x000003c8 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1620137561.584001 RegSetValueExW	key_handle: 0x000003a8 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Network activity contains more than one unique useragent (2 个事件)

process	05ebf344864ad1538637f6b95ba778f4.exe				useragent	Internal
process	05ebf344864ad1538637f6b95ba778f4.exe				useragent	05ebf344864ad1538637f6b95ba778f4.exe

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)

Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Stealer.29274
MicroWorld-eScan	Trojan.Agent.EWFF
McAfee	Fareit-FZO!05EBF344864A
Malwarebytes	Trojan.MalPack
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Win32.Coins.i!c
Sangfor	Trojan.Win32.RemcosCrypt.ACH
K7AntiVirus	Trojan-Downloader ( 0056e1f41 )
BitDefender	Trojan.Agent.EWFF
K7GW	Trojan-Downloader ( 0056e1f41 )
Cybereason	malicious.4864ad
BitDefenderTheta	Gen:NN.ZelphiF.34590.YG2@a4fFpBko
Cyren	W32/Injector.ADI.gen!Eldorado
Symantec	Trojan Horse
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	HEUR:Trojan-PSW.Win32.Coins.gen
Alibaba	TrojanPSW:Win32/Remcos.f3b22c71
NANO-Antivirus	Trojan.Win32.Stealer.hujqlq
ViRobot	Trojan.Win32.S.Agent.820577
Ad-Aware	Trojan.Agent.EWFF
Emsisoft	Trojan.Agent.EWFF (B)
Comodo	Malware@#3m4qw4no6cemy
F-Secure	Trojan.TR/AD.WindowBank.mcfki
Zillya	Downloader.Delf.Win32.59903
McAfee-GW-Edition	Fareit-FZO!05EBF344864A
Sophos	Mal/Generic-S
Ikarus	Trojan.Inject
Jiangmin	Trojan.PSW.Coins.iam
Webroot	W32.Trojan.Gen
Avira	TR/AD.WindowBank.mcfki
Antiy-AVL	Trojan[PSW]/Win32.Coins
Microsoft	Trojan:Win32/Remcos.ZEE!MTB
Gridinsoft	Trojan.Win32.Agent.oa
Arcabit	Trojan.Agent.EWFF
ZoneAlarm	HEUR:Trojan-PSW.Win32.Coins.gen
GData	Trojan.Agent.EWFF
Cynet	Malicious (score: 100)
AhnLab-V3	Backdoor/Win32.Remcos.R351003
ALYac	Spyware.LokiBot
MAX	malware (ai score=88)
Cylance	Unsafe
Panda	Trj/GdSda.A
Zoner	Trojan.Win32.93727
ESET-NOD32	Win32/TrojanDownloader.Delf.DAF
Rising	Trojan.Injector!1.CB77 (CLOUD)
Yandex	Trojan.AvsArher.bUtll5
SentinelOne	Static AI - Malicious PE
eGambit	PE.Heur.InvalidSig

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	69.171.245.84:443
dead_host	192.168.56.101:49176

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x4ac168 DeleteCriticalSection

• 0x4ac16c LeaveCriticalSection

• 0x4ac170 EnterCriticalSection

• 0x4ac174 InitializeCriticalSection

• 0x4ac178 VirtualFree

• 0x4ac17c VirtualAlloc

• 0x4ac180 LocalFree

• 0x4ac184 LocalAlloc

• 0x4ac188 GetTickCount

• 0x4ac18c QueryPerformanceCounter

• 0x4ac190 GetVersion

• 0x4ac194 GetCurrentThreadId

• 0x4ac198 InterlockedDecrement

• 0x4ac19c InterlockedIncrement

• 0x4ac1a0 VirtualQuery

• 0x4ac1a4 WideCharToMultiByte

• 0x4ac1a8 MultiByteToWideChar

• 0x4ac1ac lstrlenA

• 0x4ac1b0 lstrcpynA

• 0x4ac1b4 LoadLibraryExA

• 0x4ac1b8 GetThreadLocale

• 0x4ac1bc GetStartupInfoA

• 0x4ac1c0 GetProcAddress

• 0x4ac1c4 GetModuleHandleA

• 0x4ac1c8 GetModuleFileNameA

• 0x4ac1cc GetLocaleInfoA

• 0x4ac1d0 GetCommandLineA

• 0x4ac1d4 FreeLibrary

• 0x4ac1d8 FindFirstFileA

• 0x4ac1dc FindClose

• 0x4ac1e0 ExitProcess

• 0x4ac1e4 WriteFile

• 0x4ac1e8 UnhandledExceptionFilter

• 0x4ac1ec RtlUnwind

• 0x4ac1f0 RaiseException

• 0x4ac1f4 GetStdHandle

Library user32.dll:

• 0x4ac1fc GetKeyboardType

• 0x4ac200 LoadStringA

• 0x4ac204 MessageBoxA

• 0x4ac208 CharNextA

Library advapi32.dll:

• 0x4ac210 RegQueryValueExA

• 0x4ac214 RegOpenKeyExA

• 0x4ac218 RegCloseKey

Library oleaut32.dll:

• 0x4ac220 SysFreeString

• 0x4ac224 SysReAllocStringLen

• 0x4ac228 SysAllocStringLen

Library kernel32.dll:

• 0x4ac230 TlsSetValue

• 0x4ac234 TlsGetValue

• 0x4ac238 LocalAlloc

• 0x4ac23c GetModuleHandleA

Library advapi32.dll:

• 0x4ac244 RegQueryValueExA

• 0x4ac248 RegOpenKeyExA

• 0x4ac24c RegCloseKey

Library kernel32.dll:

• 0x4ac254 lstrcpyA

• 0x4ac258 lstrcmpiA

• 0x4ac25c WriteFile

• 0x4ac260 WaitForSingleObject

• 0x4ac264 VirtualQuery

• 0x4ac268 VirtualProtect

• 0x4ac26c VirtualAlloc

• 0x4ac270 Sleep

• 0x4ac274 SizeofResource

• 0x4ac278 SetThreadLocale

• 0x4ac27c SetFilePointer

• 0x4ac280 SetEvent

• 0x4ac284 SetErrorMode

• 0x4ac288 SetEndOfFile

• 0x4ac28c ResetEvent

• 0x4ac290 ReadFile

• 0x4ac294 MultiByteToWideChar

• 0x4ac298 MulDiv

• 0x4ac29c LockResource

• 0x4ac2a0 LoadResource

• 0x4ac2a4 LoadLibraryA

• 0x4ac2a8 LeaveCriticalSection

• 0x4ac2ac InitializeCriticalSection

• 0x4ac2b0 GlobalUnlock

• 0x4ac2b4 GlobalReAlloc

• 0x4ac2b8 GlobalHandle

• 0x4ac2bc GlobalLock

• 0x4ac2c0 GlobalFree

• 0x4ac2c4 GlobalFindAtomA

• 0x4ac2c8 GlobalDeleteAtom

• 0x4ac2cc GlobalAlloc

• 0x4ac2d0 GlobalAddAtomA

• 0x4ac2d4 GetVersionExA

• 0x4ac2d8 GetVersion

• 0x4ac2dc GetTickCount

• 0x4ac2e0 GetThreadLocale

• 0x4ac2e4 GetSystemInfo

• 0x4ac2e8 GetStringTypeExA

• 0x4ac2ec GetStdHandle

• 0x4ac2f0 GetProcAddress

• 0x4ac2f4 GetModuleHandleA

• 0x4ac2f8 GetModuleFileNameA

• 0x4ac2fc GetLocaleInfoA

• 0x4ac300 GetLocalTime

• 0x4ac304 GetLastError

• 0x4ac308 GetFullPathNameA

• 0x4ac30c GetDiskFreeSpaceA

• 0x4ac310 GetDateFormatA

• 0x4ac314 GetCurrentThreadId

• 0x4ac318 GetCurrentProcessId

• 0x4ac31c GetComputerNameA

• 0x4ac320 GetCPInfo

• 0x4ac324 GetACP

• 0x4ac328 FreeResource

• 0x4ac32c InterlockedExchange

• 0x4ac330 FreeLibrary

• 0x4ac334 FormatMessageA

• 0x4ac338 FindResourceA

• 0x4ac33c FindFirstFileA

• 0x4ac340 FindClose

• 0x4ac344 FileTimeToLocalFileTime

• 0x4ac348 FileTimeToDosDateTime

• 0x4ac34c EnumCalendarInfoA

• 0x4ac350 EnterCriticalSection

• 0x4ac354 DeleteFileA

• 0x4ac358 DeleteCriticalSection

• 0x4ac35c CreateThread

• 0x4ac360 CreateFileA

• 0x4ac364 CreateEventA

• 0x4ac368 CompareStringA

• 0x4ac36c CloseHandle

Library version.dll:

• 0x4ac374 VerQueryValueA

• 0x4ac378 GetFileVersionInfoSizeA

• 0x4ac37c GetFileVersionInfoA

Library gdi32.dll:

• 0x4ac384 UnrealizeObject

• 0x4ac388 StretchBlt

• 0x4ac38c SetWindowOrgEx

• 0x4ac390 SetWinMetaFileBits

• 0x4ac394 SetViewportOrgEx

• 0x4ac398 SetTextColor

• 0x4ac39c SetStretchBltMode

• 0x4ac3a0 SetROP2

• 0x4ac3a4 SetPixel

• 0x4ac3a8 SetEnhMetaFileBits

• 0x4ac3ac SetDIBColorTable

• 0x4ac3b0 SetBrushOrgEx

• 0x4ac3b4 SetBkMode

• 0x4ac3b8 SetBkColor

• 0x4ac3bc SelectPalette

• 0x4ac3c0 SelectObject

• 0x4ac3c4 SelectClipRgn

• 0x4ac3c8 SaveDC

• 0x4ac3cc RestoreDC

• 0x4ac3d0 Rectangle

• 0x4ac3d4 RectVisible

• 0x4ac3d8 RealizePalette

• 0x4ac3dc Polyline

• 0x4ac3e0 Polygon

• 0x4ac3e4 PlayEnhMetaFile

• 0x4ac3e8 PatBlt

• 0x4ac3ec MoveToEx

• 0x4ac3f0 MaskBlt

• 0x4ac3f4 LineTo

• 0x4ac3f8 IntersectClipRect

• 0x4ac3fc GetWindowOrgEx

• 0x4ac400 GetWinMetaFileBits

• 0x4ac404 GetTextMetricsA

• 0x4ac408 GetTextExtentPointA

• 0x4ac40c GetTextExtentPoint32A

• 0x4ac410 GetTextAlign

• 0x4ac414 GetSystemPaletteEntries

• 0x4ac418 GetStockObject

• 0x4ac41c GetROP2

• 0x4ac420 GetPixel

• 0x4ac424 GetPaletteEntries

• 0x4ac428 GetObjectA

• 0x4ac42c GetEnhMetaFilePaletteEntries

• 0x4ac430 GetEnhMetaFileHeader

• 0x4ac434 GetEnhMetaFileBits

• 0x4ac438 GetDeviceCaps

• 0x4ac43c GetDIBits

• 0x4ac440 GetDIBColorTable

• 0x4ac444 GetDCOrgEx

• 0x4ac448 GetCurrentPositionEx

• 0x4ac44c GetClipBox

• 0x4ac450 GetBrushOrgEx

• 0x4ac454 GetBitmapBits

• 0x4ac458 GdiFlush

• 0x4ac45c ExcludeClipRect

• 0x4ac460 DeleteObject

• 0x4ac464 DeleteEnhMetaFile

• 0x4ac468 DeleteDC

• 0x4ac46c CreateSolidBrush

• 0x4ac470 CreatePenIndirect

• 0x4ac474 CreatePalette

• 0x4ac478 CreateHalftonePalette

• 0x4ac47c CreateFontIndirectA

• 0x4ac480 CreateDIBitmap

• 0x4ac484 CreateDIBSection

• 0x4ac488 CreateCompatibleDC

• 0x4ac48c CreateCompatibleBitmap

• 0x4ac490 CreateBrushIndirect

• 0x4ac494 CreateBitmap

• 0x4ac498 CopyEnhMetaFileA

• 0x4ac49c BitBlt

Library user32.dll:

• 0x4ac4a4 CreateWindowExA

• 0x4ac4a8 WindowFromPoint

• 0x4ac4ac WinHelpA

• 0x4ac4b0 WaitMessage

• 0x4ac4b4 UpdateWindow

• 0x4ac4b8 UnregisterClassA

• 0x4ac4bc UnhookWindowsHookEx

• 0x4ac4c0 TranslateMessage

• 0x4ac4c4 TranslateMDISysAccel

• 0x4ac4c8 TrackPopupMenu

• 0x4ac4cc SystemParametersInfoA

• 0x4ac4d0 ShowWindow

• 0x4ac4d4 ShowScrollBar

• 0x4ac4d8 ShowOwnedPopups

• 0x4ac4dc ShowCursor

• 0x4ac4e0 ShowCaret

• 0x4ac4e4 SetWindowsHookExA

• 0x4ac4e8 SetWindowTextA

• 0x4ac4ec SetWindowPos

• 0x4ac4f0 SetWindowPlacement

• 0x4ac4f4 SetWindowLongA

• 0x4ac4f8 SetTimer

• 0x4ac4fc SetScrollRange

• 0x4ac500 SetScrollPos

• 0x4ac504 SetScrollInfo

• 0x4ac508 SetRect

• 0x4ac50c SetPropA

• 0x4ac510 SetParent

• 0x4ac514 SetMenuItemInfoA

• 0x4ac518 SetMenu

• 0x4ac51c SetForegroundWindow

• 0x4ac520 SetFocus

• 0x4ac524 SetCursor

• 0x4ac528 SetClipboardData

• 0x4ac52c SetClassLongA

• 0x4ac530 SetCapture

• 0x4ac534 SetActiveWindow

• 0x4ac538 SendMessageA

• 0x4ac53c ScrollWindow

• 0x4ac540 ScreenToClient

• 0x4ac544 RemovePropA

• 0x4ac548 RemoveMenu

• 0x4ac54c ReleaseDC

• 0x4ac550 ReleaseCapture

• 0x4ac554 RegisterWindowMessageA

• 0x4ac558 RegisterClipboardFormatA

• 0x4ac55c RegisterClassA

• 0x4ac560 RedrawWindow

• 0x4ac564 PtInRect

• 0x4ac568 PostQuitMessage

• 0x4ac56c PostMessageA

• 0x4ac570 PeekMessageA

• 0x4ac574 OpenClipboard

• 0x4ac578 OffsetRect

• 0x4ac57c OemToCharA

• 0x4ac580 MessageBoxA

• 0x4ac584 MessageBeep

• 0x4ac588 MapWindowPoints

• 0x4ac58c MapVirtualKeyA

• 0x4ac590 LoadStringA

• 0x4ac594 LoadKeyboardLayoutA

• 0x4ac598 LoadIconA

• 0x4ac59c LoadCursorA

• 0x4ac5a0 LoadBitmapA

• 0x4ac5a4 KillTimer

• 0x4ac5a8 IsZoomed

• 0x4ac5ac IsWindowVisible

• 0x4ac5b0 IsWindowEnabled

• 0x4ac5b4 IsWindow

• 0x4ac5b8 IsRectEmpty

• 0x4ac5bc IsIconic

• 0x4ac5c0 IsDialogMessageA

• 0x4ac5c4 IsChild

• 0x4ac5c8 InvalidateRect

• 0x4ac5cc IntersectRect

• 0x4ac5d0 InsertMenuItemA

• 0x4ac5d4 InsertMenuA

• 0x4ac5d8 InflateRect

• 0x4ac5dc HideCaret

• 0x4ac5e0 GetWindowThreadProcessId

• 0x4ac5e4 GetWindowTextA

• 0x4ac5e8 GetWindowRect

• 0x4ac5ec GetWindowPlacement

• 0x4ac5f0 GetWindowLongA

• 0x4ac5f4 GetWindowDC

• 0x4ac5f8 GetTopWindow

• 0x4ac5fc GetSystemMetrics

• 0x4ac600 GetSystemMenu

• 0x4ac604 GetSysColorBrush

• 0x4ac608 GetSysColor

• 0x4ac60c GetSubMenu

• 0x4ac610 GetScrollRange

• 0x4ac614 GetScrollPos

• 0x4ac618 GetScrollInfo

• 0x4ac61c GetPropA

• 0x4ac620 GetParent

• 0x4ac624 GetWindow

• 0x4ac628 GetMenuStringA

• 0x4ac62c GetMenuState

• 0x4ac630 GetMenuItemInfoA

• 0x4ac634 GetMenuItemID

• 0x4ac638 GetMenuItemCount

• 0x4ac63c GetMenu

• 0x4ac640 GetLastActivePopup

• 0x4ac644 GetKeyboardState

• 0x4ac648 GetKeyboardLayoutList

• 0x4ac64c GetKeyboardLayout

• 0x4ac650 GetKeyState

• 0x4ac654 GetKeyNameTextA

• 0x4ac658 GetIconInfo

• 0x4ac65c GetForegroundWindow

• 0x4ac660 GetFocus

• 0x4ac664 GetDesktopWindow

• 0x4ac668 GetDCEx

• 0x4ac66c GetDC

• 0x4ac670 GetCursorPos

• 0x4ac674 GetCursor

• 0x4ac678 GetClipboardData

• 0x4ac67c GetClientRect

• 0x4ac680 GetClassNameA

• 0x4ac684 GetClassInfoA

• 0x4ac688 GetCapture

• 0x4ac68c GetActiveWindow

• 0x4ac690 FrameRect

• 0x4ac694 FindWindowA

• 0x4ac698 FillRect

• 0x4ac69c EqualRect

• 0x4ac6a0 EnumWindows

• 0x4ac6a4 EnumThreadWindows

• 0x4ac6a8 EndPaint

• 0x4ac6ac EnableWindow

• 0x4ac6b0 EnableScrollBar

• 0x4ac6b4 EnableMenuItem

• 0x4ac6b8 EmptyClipboard

• 0x4ac6bc DrawTextA

• 0x4ac6c0 DrawStateA

• 0x4ac6c4 DrawMenuBar

• 0x4ac6c8 DrawIconEx

• 0x4ac6cc DrawIcon

• 0x4ac6d0 DrawFrameControl

• 0x4ac6d4 DrawFocusRect

• 0x4ac6d8 DrawEdge

• 0x4ac6dc DispatchMessageA

• 0x4ac6e0 DestroyWindow

• 0x4ac6e4 DestroyMenu

• 0x4ac6e8 DestroyIcon

• 0x4ac6ec DestroyCursor

• 0x4ac6f0 DeleteMenu

• 0x4ac6f4 DefWindowProcA

• 0x4ac6f8 DefMDIChildProcA

• 0x4ac6fc DefFrameProcA

• 0x4ac700 CreatePopupMenu

• 0x4ac704 CreateMenu

• 0x4ac708 CreateIcon

• 0x4ac70c CloseClipboard

• 0x4ac710 ClientToScreen

• 0x4ac714 CheckMenuItem

• 0x4ac718 CallWindowProcA

• 0x4ac71c CallNextHookEx

• 0x4ac720 BeginPaint

• 0x4ac724 CharNextA

• 0x4ac728 CharLowerBuffA

• 0x4ac72c CharLowerA

• 0x4ac730 CharUpperBuffA

• 0x4ac734 CharToOemA

• 0x4ac738 AdjustWindowRectEx

• 0x4ac73c ActivateKeyboardLayout

Library kernel32.dll:

• 0x4ac744 Sleep

Library oleaut32.dll:

• 0x4ac74c SafeArrayPtrOfIndex

• 0x4ac750 SafeArrayPutElement

• 0x4ac754 SafeArrayGetElement

• 0x4ac758 SafeArrayUnaccessData

• 0x4ac75c SafeArrayAccessData

• 0x4ac760 SafeArrayGetUBound

• 0x4ac764 SafeArrayGetLBound

• 0x4ac768 SafeArrayCreate

• 0x4ac76c VariantChangeType

• 0x4ac770 VariantCopyInd

• 0x4ac774 VariantCopy

• 0x4ac778 VariantClear

• 0x4ac77c VariantInit

Library ole32.dll:

• 0x4ac784 CoTaskMemFree

• 0x4ac788 ProgIDFromCLSID

• 0x4ac78c StringFromCLSID

• 0x4ac790 CoCreateInstance

• 0x4ac794 CoUninitialize

• 0x4ac798 CoInitialize

• 0x4ac79c IsEqualGUID

Library oleaut32.dll:

• 0x4ac7a4 GetErrorInfo

• 0x4ac7a8 GetActiveObject

• 0x4ac7ac SysFreeString

Library comctl32.dll:

• 0x4ac7b4 ImageList_SetIconSize

• 0x4ac7b8 ImageList_GetIconSize

• 0x4ac7bc ImageList_Write

• 0x4ac7c0 ImageList_Read

• 0x4ac7c4 ImageList_GetDragImage

• 0x4ac7c8 ImageList_DragShowNolock

• 0x4ac7cc ImageList_SetDragCursorImage

• 0x4ac7d0 ImageList_DragMove

• 0x4ac7d4 ImageList_DragLeave

• 0x4ac7d8 ImageList_DragEnter

• 0x4ac7dc ImageList_EndDrag

• 0x4ac7e0 ImageList_BeginDrag

• 0x4ac7e4 ImageList_Remove

• 0x4ac7e8 ImageList_DrawEx

• 0x4ac7ec ImageList_Replace

• 0x4ac7f0 ImageList_Draw

• 0x4ac7f4 ImageList_GetBkColor

• 0x4ac7f8 ImageList_SetBkColor

• 0x4ac7fc ImageList_ReplaceIcon

• 0x4ac800 ImageList_Add

• 0x4ac804 ImageList_SetImageCount

• 0x4ac808 ImageList_GetImageCount

• 0x4ac80c ImageList_Destroy

• 0x4ac810 ImageList_Create

Library advapi32.dll:

• 0x4ac818 QueryServiceStatus

• 0x4ac81c OpenServiceA

• 0x4ac820 OpenSCManagerA

• 0x4ac824 CloseServiceHandle

Library winmm.dll:

• 0x4ac82c sndPlaySoundA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
www.microsoft.com	CNAME www.microsoft.com-c-3.edgekey.net CNAME www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net CNAME e13678.ca2.s.tl88.net A 183.61.93.182	183.61.93.182
cdn.discordapp.com	A 69.171.245.84	103.223.122.178
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.