SmartHawk

6.4

高危

56 个模型检测该样本为恶意！

重新分析

下载样本

8e99ebae5c7d8b8620f20ff54a24db4d15c817f24e2a3017525063a34308bf60

339a9743ed8f6ff2a4d19762e2adf277.exe

分析耗时

97s

最近分析

文件大小

550.6KB

静态报毒动态报毒 100% AI SCORE=87 AIDETECTVM BLOCKER BSCOPE CONFIDENCE CRYPTINJECT DELF DJ8WEN EKLE EMUJJL1DPYF FAREIT GDSDA GENCIRC GENERICKD GENKRYPTIK HIGH CONFIDENCE HWCMLS IGX@AWYGB2JO JNSH MALICIOUS PE MALWARE2 MALWARE@#3K37VM6Y0GX7Y OJCW R + MAL R002C0DIA20 R350766 REMCOS SCORE SUSGEN UNSAFE WANNACRY WINDOWBANK XMYMF ZELPHICO 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FZO!339A9743ED8F	20201028	6.0.6.653
Alibaba	Trojan:Win32/Injector.191	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0
Avast	Win32:Trojan-gen	20201028	18.4.3895.0
Baidu		20190318	1.0.0.2
Kingsoft		20201028	2013.8.14.323
Tencent	Malware.Win32.Gencirc.11ae64d0	20201028	1.0.0.1

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620752215.539625 __exception__	stacktrace: 0x245047f 0x24505e4 DriverCallback+0x4e waveOutOpen-0xa2e winmm+0x3af0 @ 0x75043af0 timeEndPeriod+0x54a timeKillEvent-0x57 winmm+0xa535 @ 0x7504a535 timeEndPeriod+0x449 timeKillEvent-0x158 winmm+0xa434 @ 0x7504a434 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 55639536 registers.edi: 38077808 registers.eax: 0 registers.ebp: 55639616 registers.edx: 0 registers.ebx: 0 registers.esi: 16 registers.ecx: 0 exception.instruction_r: 8b 40 3c 99 03 04 24 13 54 24 04 83 c4 08 89 45 exception.instruction: mov eax, dword ptr [eax + 0x3c] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x243d308	success	0	0

Time & API

Arguments

Status

Return

Repeated

1620752215.539625
__exception__

stacktrace:

0x245047f
0x24505e4
DriverCallback+0x4e waveOutOpen-0xa2e winmm+0x3af0 @ 0x75043af0
timeEndPeriod+0x54a timeKillEvent-0x57 winmm+0xa535 @ 0x7504a535
timeEndPeriod+0x449 timeKillEvent-0x158 winmm+0xa434 @ 0x7504a434
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 55639536
registers.edi: 38077808
registers.eax: 0
registers.ebp: 55639616
registers.edx: 0
registers.ebx: 0
registers.esi: 16
registers.ecx: 0
exception.instruction_r: 8b 40 3c 99 03 04 24 13 54 24 04 83 c4 08 89 45
exception.instruction: mov eax, dword ptr [eax + 0x3c]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x243d308

success

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620752152.914625 NtAllocateVirtualMemory	process_identifier: 2424 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00490000	success	0	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620752171.492625 NtProtectVirtualMemory	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 131072 protection: 32 (PAGE_EXECUTE_READ) process_handle: 0xffffffff base_address: 0x02431000	success	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620752182.039625 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Disables proxy possibly for traffic interception (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620752181.789625 RegSetValueExA	key_handle: 0x000002cc value: 0 regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	success	0	0

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1620752184.789625 RegSetValueExA	key_handle: 0x000003dc value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1620752184.789625 RegSetValueExA	key_handle: 0x000003dc value: Ù'QFF× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1620752184.789625 RegSetValueExA	key_handle: 0x000003dc value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1620752184.789625 RegSetValueExW	key_handle: 0x000003dc value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1620752184.789625 RegSetValueExA	key_handle: 0x000003f8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1620752184.789625 RegSetValueExA	key_handle: 0x000003f8 value: Ù'QFF× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1620752184.804625 RegSetValueExA	key_handle: 0x000003f8 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1620752185.148625 RegSetValueExW	key_handle: 0x000003d8 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Network activity contains more than one unique useragent (2 个事件)

process	339a9743ed8f6ff2a4d19762e2adf277.exe				useragent	Internal
process	339a9743ed8f6ff2a4d19762e2adf277.exe				useragent	339a9743ed8f6ff2a4d19762e2adf277.exe

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

162.125.80.3:443

File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Stealer.29256
MicroWorld-eScan	Trojan.GenericKD.34489314
FireEye	Generic.mg.339a9743ed8f6ff2
Qihoo-360	Generic/Trojan.f71
McAfee	Fareit-FZO!339A9743ED8F
Cylance	Unsafe
K7AntiVirus	Trojan ( 0056df0b1 )
Alibaba	Trojan:Win32/Injector.191
K7GW	Trojan ( 0056df0b1 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Generic.D20E43E2
TrendMicro	Ransom_Blocker.R002C0DIA20
BitDefenderTheta	Gen:NN.ZelphiCO.34590.IGX@aWYGb2jO
Cyren	W32/Trojan.JNSH-7407
Symantec	Ransom.Wannacry
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	HEUR:Trojan-Ransom.Win32.Blocker.gen
BitDefender	Trojan.GenericKD.34489314
NANO-Antivirus	Trojan.Win32.Blocker.hwcmls
AegisLab	Trojan.Win32.Blocker.j!c
Rising	Ransom.Blocker!8.12A (TFE:5:EmuJJL1DPYF)
Ad-Aware	Trojan.GenericKD.34489314
Emsisoft	Trojan.Injector (A)
Comodo	Malware@#3k37vm6y0gx7y
F-Secure	Trojan.TR/AD.WindowBank.xmymf
VIPRE	Trojan.Win32.Generic!BT
Invincea	Mal/Generic-R + Mal/Agent-ATI
McAfee-GW-Edition	Fareit-FZO!339A9743ED8F
Sophos	Mal/Agent-ATI
Paloalto	generic.ml
Webroot	W32.Trojan.Gen
Avira	TR/AD.WindowBank.xmymf
MAX	malware (ai score=87)
Antiy-AVL	Trojan[Ransom]/Win32.Blocker
Microsoft	Trojan:Win32/CryptInject
ZoneAlarm	HEUR:Trojan-Ransom.Win32.Blocker.gen
GData	Win32.Trojan-Downloader.Delf.AC
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Injector.R350766
VBA32	BScope.Backdoor.Remcos
Malwarebytes	Trojan.MalPack.SMY
Zoner	Trojan.Win32.93459
ESET-NOD32	Win32/TrojanDownloader.Delf.DAF
TrendMicro-HouseCall	Ransom_Blocker.R002C0DIA20
Tencent	Malware.Win32.Gencirc.11ae64d0
Yandex	Trojan.Injector!DJ8WEn/oJCw
SentinelOne	DFI - Malicious PE

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x47a154 DeleteCriticalSection

• 0x47a158 LeaveCriticalSection

• 0x47a15c EnterCriticalSection

• 0x47a160 InitializeCriticalSection

• 0x47a164 VirtualFree

• 0x47a168 VirtualAlloc

• 0x47a16c LocalFree

• 0x47a170 LocalAlloc

• 0x47a174 GetTickCount

• 0x47a178 QueryPerformanceCounter

• 0x47a17c GetVersion

• 0x47a180 GetCurrentThreadId

• 0x47a184 InterlockedDecrement

• 0x47a188 InterlockedIncrement

• 0x47a18c VirtualQuery

• 0x47a190 WideCharToMultiByte

• 0x47a194 MultiByteToWideChar

• 0x47a198 lstrlenA

• 0x47a19c lstrcpynA

• 0x47a1a0 LoadLibraryExA

• 0x47a1a4 GetThreadLocale

• 0x47a1a8 GetStartupInfoA

• 0x47a1ac GetProcAddress

• 0x47a1b0 GetModuleHandleA

• 0x47a1b4 GetModuleFileNameA

• 0x47a1b8 GetLocaleInfoA

• 0x47a1bc GetCommandLineA

• 0x47a1c0 FreeLibrary

• 0x47a1c4 FindFirstFileA

• 0x47a1c8 FindClose

• 0x47a1cc ExitProcess

• 0x47a1d0 WriteFile

• 0x47a1d4 UnhandledExceptionFilter

• 0x47a1d8 RtlUnwind

• 0x47a1dc RaiseException

• 0x47a1e0 GetStdHandle

Library user32.dll:

• 0x47a1e8 GetKeyboardType

• 0x47a1ec LoadStringA

• 0x47a1f0 MessageBoxA

• 0x47a1f4 CharNextA

Library advapi32.dll:

• 0x47a1fc RegQueryValueExA

• 0x47a200 RegOpenKeyExA

• 0x47a204 RegCloseKey

Library oleaut32.dll:

• 0x47a20c SysFreeString

• 0x47a210 SysReAllocStringLen

• 0x47a214 SysAllocStringLen

Library kernel32.dll:

• 0x47a21c TlsSetValue

• 0x47a220 TlsGetValue

• 0x47a224 LocalAlloc

• 0x47a228 GetModuleHandleA

Library advapi32.dll:

• 0x47a230 RegQueryValueExA

• 0x47a234 RegOpenKeyExA

• 0x47a238 RegCloseKey

Library kernel32.dll:

• 0x47a240 lstrcpyA

• 0x47a244 lstrcmpiA

• 0x47a248 WriteFile

• 0x47a24c WaitForSingleObject

• 0x47a250 VirtualQuery

• 0x47a254 VirtualProtect

• 0x47a258 VirtualFree

• 0x47a25c VirtualAlloc

• 0x47a260 TlsSetValue

• 0x47a264 TlsGetValue

• 0x47a268 TlsFree

• 0x47a26c TlsAlloc

• 0x47a270 Sleep

• 0x47a274 SizeofResource

• 0x47a278 SetThreadLocale

• 0x47a27c SetFilePointer

• 0x47a280 SetEvent

• 0x47a284 SetErrorMode

• 0x47a288 SetEndOfFile

• 0x47a28c ResetEvent

• 0x47a290 ReadFile

• 0x47a294 MulDiv

• 0x47a298 LockResource

• 0x47a29c LoadResource

• 0x47a2a0 LoadLibraryA

• 0x47a2a4 LeaveCriticalSection

• 0x47a2a8 InitializeCriticalSection

• 0x47a2ac GlobalUnlock

• 0x47a2b0 GlobalReAlloc

• 0x47a2b4 GlobalHandle

• 0x47a2b8 GlobalLock

• 0x47a2bc GlobalFree

• 0x47a2c0 GlobalFindAtomA

• 0x47a2c4 GlobalDeleteAtom

• 0x47a2c8 GlobalAlloc

• 0x47a2cc GlobalAddAtomA

• 0x47a2d0 GetVersionExA

• 0x47a2d4 GetVersion

• 0x47a2d8 GetTickCount

• 0x47a2dc GetThreadLocale

• 0x47a2e0 GetSystemInfo

• 0x47a2e4 GetStringTypeExA

• 0x47a2e8 GetStdHandle

• 0x47a2ec GetProcAddress

• 0x47a2f0 GetModuleHandleA

• 0x47a2f4 GetModuleFileNameA

• 0x47a2f8 GetLocaleInfoA

• 0x47a2fc GetLocalTime

• 0x47a300 GetLastError

• 0x47a304 GetFullPathNameA

• 0x47a308 GetDiskFreeSpaceA

• 0x47a30c GetDateFormatA

• 0x47a310 GetCurrentThreadId

• 0x47a314 GetCurrentProcessId

• 0x47a318 GetCPInfo

• 0x47a31c GetACP

• 0x47a320 FreeResource

• 0x47a324 InterlockedExchange

• 0x47a328 FreeLibrary

• 0x47a32c FormatMessageA

• 0x47a330 FindResourceA

• 0x47a334 EnumCalendarInfoA

• 0x47a338 EnterCriticalSection

• 0x47a33c DeleteCriticalSection

• 0x47a340 CreateThread

• 0x47a344 CreateFileA

• 0x47a348 CreateEventA

• 0x47a34c CompareStringA

• 0x47a350 CloseHandle

Library version.dll:

• 0x47a358 VerQueryValueA

• 0x47a35c GetFileVersionInfoSizeA

• 0x47a360 GetFileVersionInfoA

Library gdi32.dll:

• 0x47a368 UnrealizeObject

• 0x47a36c SwapBuffers

• 0x47a370 StretchDIBits

• 0x47a374 StretchBlt

• 0x47a378 SetWindowOrgEx

• 0x47a37c SetWinMetaFileBits

• 0x47a380 SetViewportOrgEx

• 0x47a384 SetTextColor

• 0x47a388 SetStretchBltMode

• 0x47a38c SetROP2

• 0x47a390 SetPixelFormat

• 0x47a394 SetPixel

• 0x47a398 SetEnhMetaFileBits

• 0x47a39c SetDIBitsToDevice

• 0x47a3a0 SetDIBColorTable

• 0x47a3a4 SetBrushOrgEx

• 0x47a3a8 SetBkMode

• 0x47a3ac SetBkColor

• 0x47a3b0 SelectPalette

• 0x47a3b4 SelectObject

• 0x47a3b8 SaveDC

• 0x47a3bc RestoreDC

• 0x47a3c0 RectVisible

• 0x47a3c4 RealizePalette

• 0x47a3c8 PlayEnhMetaFile

• 0x47a3cc PatBlt

• 0x47a3d0 MoveToEx

• 0x47a3d4 MaskBlt

• 0x47a3d8 LineTo

• 0x47a3dc IntersectClipRect

• 0x47a3e0 GetWindowOrgEx

• 0x47a3e4 GetWinMetaFileBits

• 0x47a3e8 GetTextMetricsA

• 0x47a3ec GetTextExtentPoint32A

• 0x47a3f0 GetSystemPaletteEntries

• 0x47a3f4 GetStockObject

• 0x47a3f8 GetPixel

• 0x47a3fc GetPaletteEntries

• 0x47a400 GetObjectA

• 0x47a404 GetEnhMetaFilePaletteEntries

• 0x47a408 GetEnhMetaFileHeader

• 0x47a40c GetEnhMetaFileBits

• 0x47a410 GetDeviceCaps

• 0x47a414 GetDIBits

• 0x47a418 GetDIBColorTable

• 0x47a41c GetDCOrgEx

• 0x47a420 GetCurrentPositionEx

• 0x47a424 GetClipBox

• 0x47a428 GetBrushOrgEx

• 0x47a42c GetBitmapBits

• 0x47a430 GdiFlush

• 0x47a434 ExcludeClipRect

• 0x47a438 DescribePixelFormat

• 0x47a43c DeleteObject

• 0x47a440 DeleteEnhMetaFile

• 0x47a444 DeleteDC

• 0x47a448 CreateSolidBrush

• 0x47a44c CreatePenIndirect

• 0x47a450 CreatePalette

• 0x47a454 CreateHalftonePalette

• 0x47a458 CreateFontIndirectA

• 0x47a45c CreateDIBitmap

• 0x47a460 CreateDIBSection

• 0x47a464 CreateCompatibleDC

• 0x47a468 CreateCompatibleBitmap

• 0x47a46c CreateBrushIndirect

• 0x47a470 CreateBitmap

• 0x47a474 CopyEnhMetaFileA

• 0x47a478 ChoosePixelFormat

• 0x47a47c BitBlt

Library opengl32.dll:

• 0x47a484 wglShareLists

• 0x47a488 wglMakeCurrent

• 0x47a48c wglGetCurrentDC

• 0x47a490 wglDeleteContext

• 0x47a494 wglCreateContext

Library user32.dll:

• 0x47a49c CreateWindowExA

• 0x47a4a0 WindowFromPoint

• 0x47a4a4 WinHelpA

• 0x47a4a8 WaitMessage

• 0x47a4ac UpdateWindow

• 0x47a4b0 UnregisterClassA

• 0x47a4b4 UnhookWindowsHookEx

• 0x47a4b8 TranslateMessage

• 0x47a4bc TranslateMDISysAccel

• 0x47a4c0 TrackPopupMenu

• 0x47a4c4 SystemParametersInfoA

• 0x47a4c8 ShowWindow

• 0x47a4cc ShowScrollBar

• 0x47a4d0 ShowOwnedPopups

• 0x47a4d4 ShowCursor

• 0x47a4d8 SetWindowsHookExA

• 0x47a4dc SetWindowPos

• 0x47a4e0 SetWindowPlacement

• 0x47a4e4 SetWindowLongA

• 0x47a4e8 SetTimer

• 0x47a4ec SetScrollRange

• 0x47a4f0 SetScrollPos

• 0x47a4f4 SetScrollInfo

• 0x47a4f8 SetRect

• 0x47a4fc SetPropA

• 0x47a500 SetParent

• 0x47a504 SetMenuItemInfoA

• 0x47a508 SetMenu

• 0x47a50c SetForegroundWindow

• 0x47a510 SetFocus

• 0x47a514 SetCursor

• 0x47a518 SetClassLongA

• 0x47a51c SetCapture

• 0x47a520 SetActiveWindow

• 0x47a524 SendMessageA

• 0x47a528 ScrollWindow

• 0x47a52c ScreenToClient

• 0x47a530 RemovePropA

• 0x47a534 RemoveMenu

• 0x47a538 ReleaseDC

• 0x47a53c ReleaseCapture

• 0x47a540 RegisterWindowMessageA

• 0x47a544 RegisterClipboardFormatA

• 0x47a548 RegisterClassExA

• 0x47a54c RegisterClassA

• 0x47a550 RedrawWindow

• 0x47a554 PtInRect

• 0x47a558 PostQuitMessage

• 0x47a55c PostMessageA

• 0x47a560 PeekMessageA

• 0x47a564 OffsetRect

• 0x47a568 OemToCharA

• 0x47a56c MessageBoxA

• 0x47a570 MapWindowPoints

• 0x47a574 MapVirtualKeyA

• 0x47a578 LoadStringA

• 0x47a57c LoadKeyboardLayoutA

• 0x47a580 LoadIconA

• 0x47a584 LoadCursorA

• 0x47a588 LoadBitmapA

• 0x47a58c KillTimer

• 0x47a590 IsZoomed

• 0x47a594 IsWindowVisible

• 0x47a598 IsWindowEnabled

• 0x47a59c IsWindow

• 0x47a5a0 IsRectEmpty

• 0x47a5a4 IsIconic

• 0x47a5a8 IsDialogMessageA

• 0x47a5ac IsChild

• 0x47a5b0 InvalidateRect

• 0x47a5b4 IntersectRect

• 0x47a5b8 InsertMenuItemA

• 0x47a5bc InsertMenuA

• 0x47a5c0 InflateRect

• 0x47a5c4 GetWindowThreadProcessId

• 0x47a5c8 GetWindowTextA

• 0x47a5cc GetWindowRect

• 0x47a5d0 GetWindowPlacement

• 0x47a5d4 GetWindowLongA

• 0x47a5d8 GetWindowDC

• 0x47a5dc GetTopWindow

• 0x47a5e0 GetSystemMetrics

• 0x47a5e4 GetSystemMenu

• 0x47a5e8 GetSysColorBrush

• 0x47a5ec GetSysColor

• 0x47a5f0 GetSubMenu

• 0x47a5f4 GetScrollRange

• 0x47a5f8 GetScrollPos

• 0x47a5fc GetScrollInfo

• 0x47a600 GetPropA

• 0x47a604 GetParent

• 0x47a608 GetWindow

• 0x47a60c GetMenuStringA

• 0x47a610 GetMenuState

• 0x47a614 GetMenuItemInfoA

• 0x47a618 GetMenuItemID

• 0x47a61c GetMenuItemCount

• 0x47a620 GetMenu

• 0x47a624 GetLastActivePopup

• 0x47a628 GetKeyboardState

• 0x47a62c GetKeyboardLayoutList

• 0x47a630 GetKeyboardLayout

• 0x47a634 GetKeyState

• 0x47a638 GetKeyNameTextA

• 0x47a63c GetIconInfo

• 0x47a640 GetForegroundWindow

• 0x47a644 GetFocus

• 0x47a648 GetDesktopWindow

• 0x47a64c GetDCEx

• 0x47a650 GetDC

• 0x47a654 GetCursorPos

• 0x47a658 GetCursor

• 0x47a65c GetClipboardData

• 0x47a660 GetClientRect

• 0x47a664 GetClassNameA

• 0x47a668 GetClassInfoA

• 0x47a66c GetCapture

• 0x47a670 GetActiveWindow

• 0x47a674 FrameRect

• 0x47a678 FindWindowA

• 0x47a67c FillRect

• 0x47a680 EqualRect

• 0x47a684 EnumWindows

• 0x47a688 EnumThreadWindows

• 0x47a68c EndPaint

• 0x47a690 EnableWindow

• 0x47a694 EnableScrollBar

• 0x47a698 EnableMenuItem

• 0x47a69c DrawTextA

• 0x47a6a0 DrawMenuBar

• 0x47a6a4 DrawIconEx

• 0x47a6a8 DrawIcon

• 0x47a6ac DrawFrameControl

• 0x47a6b0 DrawEdge

• 0x47a6b4 DispatchMessageA

• 0x47a6b8 DestroyWindow

• 0x47a6bc DestroyMenu

• 0x47a6c0 DestroyIcon

• 0x47a6c4 DestroyCursor

• 0x47a6c8 DeleteMenu

• 0x47a6cc DefWindowProcA

• 0x47a6d0 DefMDIChildProcA

• 0x47a6d4 DefFrameProcA

• 0x47a6d8 CreatePopupMenu

• 0x47a6dc CreateMenu

• 0x47a6e0 CreateIcon

• 0x47a6e4 ClientToScreen

• 0x47a6e8 CheckMenuItem

• 0x47a6ec CallWindowProcA

• 0x47a6f0 CallNextHookEx

• 0x47a6f4 BeginPaint

• 0x47a6f8 CharNextA

• 0x47a6fc CharLowerBuffA

• 0x47a700 CharLowerA

• 0x47a704 CharToOemA

• 0x47a708 AdjustWindowRectEx

• 0x47a70c ActivateKeyboardLayout

Library kernel32.dll:

• 0x47a714 Sleep

Library oleaut32.dll:

• 0x47a71c SafeArrayPtrOfIndex

• 0x47a720 SafeArrayGetUBound

• 0x47a724 SafeArrayGetLBound

• 0x47a728 SafeArrayCreate

• 0x47a72c VariantChangeType

• 0x47a730 VariantCopy

• 0x47a734 VariantClear

• 0x47a738 VariantInit

Library comctl32.dll:

• 0x47a740 ImageList_SetIconSize

• 0x47a744 ImageList_GetIconSize

• 0x47a748 ImageList_Write

• 0x47a74c ImageList_Read

• 0x47a750 ImageList_GetDragImage

• 0x47a754 ImageList_DragShowNolock

• 0x47a758 ImageList_SetDragCursorImage

• 0x47a75c ImageList_DragMove

• 0x47a760 ImageList_DragLeave

• 0x47a764 ImageList_DragEnter

• 0x47a768 ImageList_EndDrag

• 0x47a76c ImageList_BeginDrag

• 0x47a770 ImageList_Remove

• 0x47a774 ImageList_DrawEx

• 0x47a778 ImageList_Draw

• 0x47a77c ImageList_GetBkColor

• 0x47a780 ImageList_SetBkColor

• 0x47a784 ImageList_ReplaceIcon

• 0x47a788 ImageList_Add

• 0x47a78c ImageList_SetImageCount

• 0x47a790 ImageList_GetImageCount

• 0x47a794 ImageList_Destroy

• 0x47a798 ImageList_Create

Library advapi32.dll:

• 0x47a7a0 QueryServiceStatus

• 0x47a7a4 OpenServiceA

• 0x47a7a8 OpenSCManagerA

• 0x47a7ac CloseServiceHandle

Library opengl32.dll:

• 0x47a7b4 wglGetProcAddress

• 0x47a7b8 glReadPixels

• 0x47a7bc glGetString

• 0x47a7c0 glGetError

• 0x47a7c4 glFlush

• 0x47a7c8 glFinish

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
www.microsoft.com	CNAME www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net CNAME e13678.ca2.s.tl88.net CNAME www.microsoft.com-c-3.edgekey.net A 27.148.139.88	27.148.139.88
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
cdn.discordapp.com	A 162.125.80.3	162.125.80.3
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49713	114.114.114.114	53
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	53210	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	61680	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50568	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.