SmartHawk

5.6

高危

48 个模型检测该样本为恶意！

重新分析

下载样本

580c82350dc9fd24b024706c0ca028ccc4721399dc23e65a09b44fda2a5700eb

2927a0554937c4961d33e73fb239212c.exe

分析耗时

92s

最近分析

文件大小

1.0MB

静态报毒动态报毒 100% AI SCORE=83 AIDETECTVM AVEMARIA CHY@AMOPHXPI CLASSIC CONFIDENCE DELF DOWNLOADER34 DPIE FALSESIGN FAREIT FKMFGBQHLEW GDSDA GENERICKD GENKRYPTIK HIGH CONFIDENCE HQBV HRHQJO INJECTS INVALIDSIG KRYPTIK MALICIOUS PE MALWARE2 MALWARE@#3R3CL36C7ARTQ REDCAP SCORE SHDEP TBPP UNSAFE YMACCO ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0
Alibaba	TrojanDownloader:Win32/Ymacco.de8dd352	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Malware-gen	20201023	18.4.3895.0
Kingsoft		20201023	2013.8.14.323
McAfee	Fareit-FUL!2927A0554937	20201023	6.0.6.653
Tencent	Win32.Trojan.Falsesign.Hqbv	20201023	1.0.0.1

This executable is signed

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619361043.02075 __exception__	stacktrace: 0x339b4f6 0x339b529 0x339b446 0x334f7e8 0x339beee 0x339c387 0x335ee5a gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x775a62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x775a6d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x775a77c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x775a7bca 0x33948a4 0x339c697 2927a0554937c4961d33e73fb239212c+0x77191 @ 0x477191 registers.esp: 1633828 registers.edi: 0 registers.eax: 1633828 registers.ebp: 1633908 registers.edx: 0 registers.ebx: 1635584 registers.esi: 57220004 registers.ecx: 7 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x778eb727	success	0	0

Allocates read-write-execute memory (usually to unpack itself) (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619360987.47375 NtAllocateVirtualMemory	process_identifier: 1380 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00510000	success	0	0
1619361005.33275 NtAllocateVirtualMemory	process_identifier: 1380 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x021f0000	success	0	0

Downloads a file or document from Google Drive (1 个事件)

domain

drive.google.com

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Disables proxy possibly for traffic interception (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619361021.83275 RegSetValueExA	key_handle: 0x000002d0 value: 0 regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	success	0	0

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
FireEye	Trojan.GenericKD.43627090
ALYac	Trojan.PSW.AveMaria
Cylance	Unsafe
Zillya	Trojan.Injects.Win32.5210
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	TrojanDownloader:Win32/Ymacco.de8dd352
K7GW	Trojan-Downloader ( 0056c2b81 )
K7AntiVirus	Trojan-Downloader ( 0056c2b81 )
Cyren	W32/Trojan.TBPP-1375
Symantec	Trojan.Gen.2
APEX	Malicious
Avast	Win32:Malware-gen
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Injects.gen
BitDefender	Trojan.GenericKD.43627090
NANO-Antivirus	Trojan.Win32.Injects.hrhqjo
AegisLab	Trojan.Win32.Injects.4!c
MicroWorld-eScan	Trojan.GenericKD.43627090
Rising	Trojan.Kryptik!1.C56D (CLASSIC)
Ad-Aware	Trojan.GenericKD.43627090
Emsisoft	Trojan.GenericKD.43627090 (B)
Comodo	Malware@#3r3cl36c7artq
DrWeb	Trojan.DownLoader34.20126
VIPRE	Trojan.Win32.Generic!BT
Invincea	Mal/Generic-S
McAfee-GW-Edition	Fareit-FUL!2927A0554937
Sophos	Mal/Generic-S
Paloalto	generic.ml
Avira	TR/Redcap.shdep
eGambit	PE.Heur.InvalidSig
MAX	malware (ai score=83)
Antiy-AVL	Trojan/Win32.Injects
Microsoft	Trojan:Win32/Ymacco.AA58
ZoneAlarm	HEUR:Trojan.Win32.Injects.gen
GData	Trojan.GenericKD.43627090
McAfee	Fareit-FUL!2927A0554937
Malwarebytes	Trojan.MalPack.SMY
ESET-NOD32	Win32/TrojanDownloader.Delf.CZH
Tencent	Win32.Trojan.Falsesign.Hqbv
Yandex	Trojan.DL.Delf!fkmFgBqhLEw
SentinelOne	DFI - Malicious PE
Fortinet	W32/GenKryptik.DPIE!tr
BitDefenderTheta	Gen:NN.ZelphiF.34570.cHY@amoPHxpi
AVG	Win32:Malware-gen
Panda	Trj/GdSda.A
Qihoo-360	Win32/Trojan.f4d

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443
dead_host	104.244.46.9:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x4eb168 DeleteCriticalSection

• 0x4eb16c LeaveCriticalSection

• 0x4eb170 EnterCriticalSection

• 0x4eb174 InitializeCriticalSection

• 0x4eb178 VirtualFree

• 0x4eb17c VirtualAlloc

• 0x4eb180 LocalFree

• 0x4eb184 LocalAlloc

• 0x4eb188 GetTickCount

• 0x4eb18c QueryPerformanceCounter

• 0x4eb190 GetVersion

• 0x4eb194 GetCurrentThreadId

• 0x4eb198 InterlockedDecrement

• 0x4eb19c InterlockedIncrement

• 0x4eb1a0 VirtualQuery

• 0x4eb1a4 WideCharToMultiByte

• 0x4eb1a8 MultiByteToWideChar

• 0x4eb1ac lstrlenA

• 0x4eb1b0 lstrcpynA

• 0x4eb1b4 LoadLibraryExA

• 0x4eb1b8 GetThreadLocale

• 0x4eb1bc GetStartupInfoA

• 0x4eb1c0 GetProcAddress

• 0x4eb1c4 GetModuleHandleA

• 0x4eb1c8 GetModuleFileNameA

• 0x4eb1cc GetLocaleInfoA

• 0x4eb1d0 GetLastError

• 0x4eb1d4 GetCommandLineA

• 0x4eb1d8 FreeLibrary

• 0x4eb1dc FindFirstFileA

• 0x4eb1e0 FindClose

• 0x4eb1e4 ExitProcess

• 0x4eb1e8 WriteFile

• 0x4eb1ec UnhandledExceptionFilter

• 0x4eb1f0 SetFilePointer

• 0x4eb1f4 SetEndOfFile

• 0x4eb1f8 RtlUnwind

• 0x4eb1fc ReadFile

• 0x4eb200 RaiseException

• 0x4eb204 GetStdHandle

• 0x4eb208 GetFileSize

• 0x4eb20c GetFileType

• 0x4eb210 CreateFileA

• 0x4eb214 CloseHandle

Library user32.dll:

• 0x4eb21c GetKeyboardType

• 0x4eb220 LoadStringA

• 0x4eb224 MessageBoxA

• 0x4eb228 CharNextA

Library advapi32.dll:

• 0x4eb230 RegQueryValueExA

• 0x4eb234 RegOpenKeyExA

• 0x4eb238 RegCloseKey

Library oleaut32.dll:

• 0x4eb240 SysFreeString

• 0x4eb244 SysReAllocStringLen

• 0x4eb248 SysAllocStringLen

Library kernel32.dll:

• 0x4eb250 TlsSetValue

• 0x4eb254 TlsGetValue

• 0x4eb258 LocalAlloc

• 0x4eb25c GetModuleHandleA

Library advapi32.dll:

• 0x4eb264 RegQueryValueExA

• 0x4eb268 RegOpenKeyExA

• 0x4eb26c RegCloseKey

Library kernel32.dll:

• 0x4eb274 lstrcpyA

• 0x4eb278 lstrcmpA

• 0x4eb27c WriteFile

• 0x4eb280 WaitForSingleObject

• 0x4eb284 VirtualQuery

• 0x4eb288 VirtualProtect

• 0x4eb28c VirtualAlloc

• 0x4eb290 Sleep

• 0x4eb294 SizeofResource

• 0x4eb298 SetThreadLocale

• 0x4eb29c SetFilePointer

• 0x4eb2a0 SetEvent

• 0x4eb2a4 SetErrorMode

• 0x4eb2a8 SetEndOfFile

• 0x4eb2ac ResetEvent

• 0x4eb2b0 ReadFile

• 0x4eb2b4 MulDiv

• 0x4eb2b8 LockResource

• 0x4eb2bc LoadResource

• 0x4eb2c0 LoadLibraryA

• 0x4eb2c4 LeaveCriticalSection

• 0x4eb2c8 InitializeCriticalSection

• 0x4eb2cc GlobalUnlock

• 0x4eb2d0 GlobalReAlloc

• 0x4eb2d4 GlobalHandle

• 0x4eb2d8 GlobalLock

• 0x4eb2dc GlobalFree

• 0x4eb2e0 GlobalFindAtomA

• 0x4eb2e4 GlobalDeleteAtom

• 0x4eb2e8 GlobalAlloc

• 0x4eb2ec GlobalAddAtomA

• 0x4eb2f0 GetVersionExA

• 0x4eb2f4 GetVersion

• 0x4eb2f8 GetTickCount

• 0x4eb2fc GetThreadLocale

• 0x4eb300 GetSystemInfo

• 0x4eb304 GetStringTypeExA

• 0x4eb308 GetStdHandle

• 0x4eb30c GetProcAddress

• 0x4eb310 GetModuleHandleA

• 0x4eb314 GetModuleFileNameA

• 0x4eb318 GetLocaleInfoA

• 0x4eb31c GetLocalTime

• 0x4eb320 GetLastError

• 0x4eb324 GetFullPathNameA

• 0x4eb328 GetDiskFreeSpaceA

• 0x4eb32c GetDateFormatA

• 0x4eb330 GetCurrentThreadId

• 0x4eb334 GetCurrentProcessId

• 0x4eb338 GetCPInfo

• 0x4eb33c GetACP

• 0x4eb340 FreeResource

• 0x4eb344 InterlockedExchange

• 0x4eb348 FreeLibrary

• 0x4eb34c FormatMessageA

• 0x4eb350 FindResourceA

• 0x4eb354 EnumCalendarInfoA

• 0x4eb358 EnterCriticalSection

• 0x4eb35c DeleteCriticalSection

• 0x4eb360 CreateThread

• 0x4eb364 CreateFileA

• 0x4eb368 CreateEventA

• 0x4eb36c CompareStringA

• 0x4eb370 CloseHandle

Library version.dll:

• 0x4eb378 VerQueryValueA

• 0x4eb37c GetFileVersionInfoSizeA

• 0x4eb380 GetFileVersionInfoA

Library gdi32.dll:

• 0x4eb388 UnrealizeObject

• 0x4eb38c StretchBlt

• 0x4eb390 SetWindowOrgEx

• 0x4eb394 SetWinMetaFileBits

• 0x4eb398 SetViewportOrgEx

• 0x4eb39c SetTextColor

• 0x4eb3a0 SetStretchBltMode

• 0x4eb3a4 SetROP2

• 0x4eb3a8 SetPixel

• 0x4eb3ac SetEnhMetaFileBits

• 0x4eb3b0 SetDIBColorTable

• 0x4eb3b4 SetBrushOrgEx

• 0x4eb3b8 SetBkMode

• 0x4eb3bc SetBkColor

• 0x4eb3c0 SelectPalette

• 0x4eb3c4 SelectObject

• 0x4eb3c8 SaveDC

• 0x4eb3cc RestoreDC

• 0x4eb3d0 Rectangle

• 0x4eb3d4 RectVisible

• 0x4eb3d8 RealizePalette

• 0x4eb3dc PlayEnhMetaFile

• 0x4eb3e0 PatBlt

• 0x4eb3e4 MoveToEx

• 0x4eb3e8 MaskBlt

• 0x4eb3ec LineTo

• 0x4eb3f0 IntersectClipRect

• 0x4eb3f4 GetWindowOrgEx

• 0x4eb3f8 GetWinMetaFileBits

• 0x4eb3fc GetTextMetricsA

• 0x4eb400 GetTextExtentPoint32A

• 0x4eb404 GetSystemPaletteEntries

• 0x4eb408 GetStockObject

• 0x4eb40c GetRgnBox

• 0x4eb410 GetPolyFillMode

• 0x4eb414 GetPixel

• 0x4eb418 GetPaletteEntries

• 0x4eb41c GetObjectA

• 0x4eb420 GetMapMode

• 0x4eb424 GetEnhMetaFilePaletteEntries

• 0x4eb428 GetEnhMetaFileHeader

• 0x4eb42c GetEnhMetaFileBits

• 0x4eb430 GetDeviceCaps

• 0x4eb434 GetDIBits

• 0x4eb438 GetDIBColorTable

• 0x4eb43c GetDCOrgEx

• 0x4eb440 GetDCBrushColor

• 0x4eb444 GetCurrentPositionEx

• 0x4eb448 GetClipBox

• 0x4eb44c GetBrushOrgEx

• 0x4eb450 GetBkMode

• 0x4eb454 GetBitmapBits

• 0x4eb458 ExtTextOutA

• 0x4eb45c ExcludeClipRect

• 0x4eb460 DeleteObject

• 0x4eb464 DeleteEnhMetaFile

• 0x4eb468 DeleteDC

• 0x4eb46c CreateSolidBrush

• 0x4eb470 CreateRectRgn

• 0x4eb474 CreatePenIndirect

• 0x4eb478 CreatePalette

• 0x4eb47c CreateHalftonePalette

• 0x4eb480 CreateFontIndirectA

• 0x4eb484 CreateDIBitmap

• 0x4eb488 CreateDIBSection

• 0x4eb48c CreateCompatibleDC

• 0x4eb490 CreateCompatibleBitmap

• 0x4eb494 CreateBrushIndirect

• 0x4eb498 CreateBitmap

• 0x4eb49c CopyEnhMetaFileA

• 0x4eb4a0 CombineRgn

• 0x4eb4a4 BitBlt

Library user32.dll:

• 0x4eb4ac CreateWindowExA

• 0x4eb4b0 WindowFromPoint

• 0x4eb4b4 WinHelpA

• 0x4eb4b8 WaitMessage

• 0x4eb4bc UpdateWindow

• 0x4eb4c0 UnregisterClassA

• 0x4eb4c4 UnhookWindowsHookEx

• 0x4eb4c8 TranslateMessage

• 0x4eb4cc TranslateMDISysAccel

• 0x4eb4d0 TrackPopupMenu

• 0x4eb4d4 SystemParametersInfoA

• 0x4eb4d8 ShowWindow

• 0x4eb4dc ShowScrollBar

• 0x4eb4e0 ShowOwnedPopups

• 0x4eb4e4 ShowCursor

• 0x4eb4e8 SetWindowsHookExA

• 0x4eb4ec SetWindowTextA

• 0x4eb4f0 SetWindowPos

• 0x4eb4f4 SetWindowPlacement

• 0x4eb4f8 SetWindowLongA

• 0x4eb4fc SetTimer

• 0x4eb500 SetScrollRange

• 0x4eb504 SetScrollPos

• 0x4eb508 SetScrollInfo

• 0x4eb50c SetRect

• 0x4eb510 SetPropA

• 0x4eb514 SetParent

• 0x4eb518 SetMenuItemInfoA

• 0x4eb51c SetMenu

• 0x4eb520 SetForegroundWindow

• 0x4eb524 SetFocus

• 0x4eb528 SetCursor

• 0x4eb52c SetClassLongA

• 0x4eb530 SetCapture

• 0x4eb534 SetActiveWindow

• 0x4eb538 SendMessageA

• 0x4eb53c ScrollWindow

• 0x4eb540 ScreenToClient

• 0x4eb544 RemovePropA

• 0x4eb548 RemoveMenu

• 0x4eb54c ReleaseDC

• 0x4eb550 ReleaseCapture

• 0x4eb554 RegisterWindowMessageA

• 0x4eb558 RegisterClipboardFormatA

• 0x4eb55c RegisterClassA

• 0x4eb560 RedrawWindow

• 0x4eb564 PtInRect

• 0x4eb568 PostQuitMessage

• 0x4eb56c PostMessageA

• 0x4eb570 PeekMessageA

• 0x4eb574 OffsetRect

• 0x4eb578 OemToCharA

• 0x4eb57c MessageBoxA

• 0x4eb580 MapWindowPoints

• 0x4eb584 MapVirtualKeyA

• 0x4eb588 LockWindowUpdate

• 0x4eb58c LoadStringA

• 0x4eb590 LoadKeyboardLayoutA

• 0x4eb594 LoadIconA

• 0x4eb598 LoadCursorA

• 0x4eb59c LoadBitmapA

• 0x4eb5a0 KillTimer

• 0x4eb5a4 IsZoomed

• 0x4eb5a8 IsWindowVisible

• 0x4eb5ac IsWindowEnabled

• 0x4eb5b0 IsWindow

• 0x4eb5b4 IsRectEmpty

• 0x4eb5b8 IsIconic

• 0x4eb5bc IsDialogMessageA

• 0x4eb5c0 IsChild

• 0x4eb5c4 InvalidateRect

• 0x4eb5c8 IntersectRect

• 0x4eb5cc InsertMenuItemA

• 0x4eb5d0 InsertMenuA

• 0x4eb5d4 InflateRect

• 0x4eb5d8 GetWindowThreadProcessId

• 0x4eb5dc GetWindowTextA

• 0x4eb5e0 GetWindowRect

• 0x4eb5e4 GetWindowPlacement

• 0x4eb5e8 GetWindowLongA

• 0x4eb5ec GetWindowDC

• 0x4eb5f0 GetTopWindow

• 0x4eb5f4 GetSystemMetrics

• 0x4eb5f8 GetSystemMenu

• 0x4eb5fc GetSysColorBrush

• 0x4eb600 GetSysColor

• 0x4eb604 GetSubMenu

• 0x4eb608 GetScrollRange

• 0x4eb60c GetScrollPos

• 0x4eb610 GetScrollInfo

• 0x4eb614 GetPropA

• 0x4eb618 GetParent

• 0x4eb61c GetWindow

• 0x4eb620 GetMessagePos

• 0x4eb624 GetMenuStringA

• 0x4eb628 GetMenuState

• 0x4eb62c GetMenuItemInfoA

• 0x4eb630 GetMenuItemID

• 0x4eb634 GetMenuItemCount

• 0x4eb638 GetMenu

• 0x4eb63c GetLastActivePopup

• 0x4eb640 GetKeyboardState

• 0x4eb644 GetKeyboardLayoutList

• 0x4eb648 GetKeyboardLayout

• 0x4eb64c GetKeyState

• 0x4eb650 GetKeyNameTextA

• 0x4eb654 GetIconInfo

• 0x4eb658 GetForegroundWindow

• 0x4eb65c GetFocus

• 0x4eb660 GetDlgItem

• 0x4eb664 GetDesktopWindow

• 0x4eb668 GetDCEx

• 0x4eb66c GetDC

• 0x4eb670 GetCursorPos

• 0x4eb674 GetCursor

• 0x4eb678 GetClipboardData

• 0x4eb67c GetClientRect

• 0x4eb680 GetClassNameA

• 0x4eb684 GetClassInfoA

• 0x4eb688 GetCapture

• 0x4eb68c GetActiveWindow

• 0x4eb690 FrameRect

• 0x4eb694 FindWindowA

• 0x4eb698 FillRect

• 0x4eb69c EqualRect

• 0x4eb6a0 EnumWindows

• 0x4eb6a4 EnumThreadWindows

• 0x4eb6a8 EndPaint

• 0x4eb6ac EnableWindow

• 0x4eb6b0 EnableScrollBar

• 0x4eb6b4 EnableMenuItem

• 0x4eb6b8 DrawTextA

• 0x4eb6bc DrawMenuBar

• 0x4eb6c0 DrawIconEx

• 0x4eb6c4 DrawIcon

• 0x4eb6c8 DrawFrameControl

• 0x4eb6cc DrawEdge

• 0x4eb6d0 DispatchMessageA

• 0x4eb6d4 DestroyWindow

• 0x4eb6d8 DestroyMenu

• 0x4eb6dc DestroyIcon

• 0x4eb6e0 DestroyCursor

• 0x4eb6e4 DeleteMenu

• 0x4eb6e8 DefWindowProcA

• 0x4eb6ec DefMDIChildProcA

• 0x4eb6f0 DefFrameProcA

• 0x4eb6f4 CreatePopupMenu

• 0x4eb6f8 CreateMenu

• 0x4eb6fc CreateIcon

• 0x4eb700 ClientToScreen

• 0x4eb704 ChildWindowFromPoint

• 0x4eb708 CheckMenuItem

• 0x4eb70c CallWindowProcA

• 0x4eb710 CallNextHookEx

• 0x4eb714 BeginPaint

• 0x4eb718 CharNextA

• 0x4eb71c CharLowerBuffA

• 0x4eb720 CharLowerA

• 0x4eb724 CharToOemA

• 0x4eb728 AdjustWindowRectEx

• 0x4eb72c ActivateKeyboardLayout

Library kernel32.dll:

• 0x4eb734 Sleep

Library oleaut32.dll:

• 0x4eb73c SafeArrayPtrOfIndex

• 0x4eb740 SafeArrayGetUBound

• 0x4eb744 SafeArrayGetLBound

• 0x4eb748 SafeArrayCreate

• 0x4eb74c VariantChangeType

• 0x4eb750 VariantCopy

• 0x4eb754 VariantClear

• 0x4eb758 VariantInit

Library ole32.dll:

• 0x4eb760 CoTaskMemAlloc

• 0x4eb764 CoCreateInstance

• 0x4eb768 CoUninitialize

• 0x4eb76c CoInitialize

Library comctl32.dll:

• 0x4eb774 ImageList_SetIconSize

• 0x4eb778 ImageList_GetIconSize

• 0x4eb77c ImageList_Write

• 0x4eb780 ImageList_Read

• 0x4eb784 ImageList_GetDragImage

• 0x4eb788 ImageList_DragShowNolock

• 0x4eb78c ImageList_SetDragCursorImage

• 0x4eb790 ImageList_DragMove

• 0x4eb794 ImageList_DragLeave

• 0x4eb798 ImageList_DragEnter

• 0x4eb79c ImageList_EndDrag

• 0x4eb7a0 ImageList_BeginDrag

• 0x4eb7a4 ImageList_Remove

• 0x4eb7a8 ImageList_DrawEx

• 0x4eb7ac ImageList_Draw

• 0x4eb7b0 ImageList_GetBkColor

• 0x4eb7b4 ImageList_SetBkColor

• 0x4eb7b8 ImageList_ReplaceIcon

• 0x4eb7bc ImageList_Add

• 0x4eb7c0 ImageList_SetImageCount

• 0x4eb7c4 ImageList_GetImageCount

• 0x4eb7c8 ImageList_Destroy

• 0x4eb7cc ImageList_Create

• 0x4eb7d0 InitCommonControls

Library shell32.dll:

• 0x4eb7d8 ShellExecuteA

Library comdlg32.dll:

• 0x4eb7e0 GetOpenFileNameA

Library UrL:

• 0x4eb7e8 InetIsOffline

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
www.microsoft.com	CNAME www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net CNAME e13678.ca2.s.tl88.net CNAME www.microsoft.com-c-3.edgekey.net A 27.148.139.88	27.148.139.88
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.24.14
drive.google.com	A 104.244.46.9	103.200.31.172
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53210	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	61680	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	63497	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60215	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.