SmartHawk

10.4

0-day

该样本未表现出任何异常！

重新分析

下载样本

9de4939cad422136f85fea944eaa792e1e44ef065809cf41ae2e3d956a489dc8

3cc7c0de68cb0fc5429f473980a595eb.exe

分析耗时

84s

最近分析

文件大小

650.0KB

静态报毒动态报毒 PUTTY

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Queries for the computername (3 个事件)

Time & API	Arguments	Status	Return
1619406378.307875 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619406387.745875 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619406392.354875 GetComputerNameW	computer_name: OSKAR-PC	success	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619406371.870875 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619406369.51125 __exception__	stacktrace: BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 34471744 registers.edi: 0 registers.eax: 0 registers.ebp: 34471816 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 0 exception.instruction_r: f7 f0 33 c0 5a 59 59 64 89 10 eb 61 e9 6e d8 f9 exception.symbol: 3cc7c0de68cb0fc5429f473980a595eb+0x65e2d exception.instruction: div eax exception.module: 3cc7c0de68cb0fc5429f473980a595eb.exe exception.exception_code: 0xc0000094 exception.offset: 417325 exception.address: 0x465e2d	success	0	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1619406369.41725 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01ea0000	success
1619406369.51125 NtAllocateVirtualMemory	process_identifier: 880 region_size: 57344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01f20000	success
1619406369.54225 NtAllocateVirtualMemory	process_identifier: 880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01f70000	success

Steals private information from local Internet browsers (19 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619406392.339875 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cc7c0de68cb0fc5429f473980a595eb.exe newfilepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\6ED2B0\0019EA.exe newfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\6ED2B0\0019EA.exe flags: 1 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cc7c0de68cb0fc5429f473980a595eb.exe	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (3 个事件)

entropy

7.657757195113507

section

{'size_of_data': '0x0000fa00', 'virtual_address': '0x00067000', 'entropy': 7.657757195113507, 'name': 'DATA', 'virtual_size': '0x0000f8e8'}

description

A section with a high entropy has been found

entropy

7.421146976598757

section

{'size_of_data': '0x00023800', 'virtual_address': '0x00085000', 'entropy': 7.421146976598757, 'name': '.rsrc', 'virtual_size': '0x000237ac'}

description

A section with a high entropy has been found

entropy

0.3151001540832049

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619406387.182875 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Harvests credentials from local FTP client softwares (22 个事件)

file	C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FTPGetter\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\wcx_ftp.ini
file	C:\Windows\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\GHISLER\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\wcx_ftp.ini
file	C:\Windows\32BitFtp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Program Files (x86)\FileZilla\Filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\recentservers.xml
registry	HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry	HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry	HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry	HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry	HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_CURRENT_USER\Software\Martin Prikryl
registry	HKEY_LOCAL_MACHINE\Software\Martin Prikryl

Harvests information related to installed instant messenger clients (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\.purple\accounts.xml

Harvests credentials from local email clients (3 个事件)

registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 880 called NtSetContextThread to modify thread in remote process 2040
1619406370.18225 NtSetContextThread	thread_handle: 0x000000f0 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2040	success	0	0

Putty Files, Registry Keys and/or Mutexes Detected

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 880 resumed a thread in remote process 2040
1619406371.22925 NtResumeThread	thread_handle: 0x000000f0 suspend_count: 1 process_identifier: 2040	success	0	0

Executed a process and injected code into it, probably while unpacking (7 个事件)

Time & API	Arguments	Status	Return
1619406370.02625 CreateProcessInternalW	thread_identifier: 1688 thread_handle: 0x000000f0 process_identifier: 2040 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3cc7c0de68cb0fc5429f473980a595eb.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x000000f4 inherit_handles: 0	success	1
1619406370.02625 NtUnmapViewOfSection	process_identifier: 2040 region_size: 4096 process_handle: 0x000000f4 base_address: 0x00400000	success	0
1619406370.04225 NtMapViewOfSection	section_handle: 0x000000fc process_identifier: 2040 commit_size: 663552 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x000000f4 allocation_type: 0 () section_offset: 0 view_size: 663552 base_address: 0x00400000	success	0
1619406370.18225 NtGetContextThread	thread_handle: 0x000000f0	success	0
1619406370.18225 NtSetContextThread	thread_handle: 0x000000f0 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2040	success	0
1619406371.22925 NtResumeThread	thread_handle: 0x000000f0 suspend_count: 1 process_identifier: 2040	success	0
1619406372.886875 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 2040	success	0

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x478140 DeleteCriticalSection

• 0x478144 LeaveCriticalSection

• 0x478148 EnterCriticalSection

• 0x47814c InitializeCriticalSection

• 0x478150 VirtualFree

• 0x478154 VirtualAlloc

• 0x478158 LocalFree

• 0x47815c LocalAlloc

• 0x478160 GetVersion

• 0x478164 GetCurrentThreadId

• 0x478168 InterlockedDecrement

• 0x47816c InterlockedIncrement

• 0x478170 VirtualQuery

• 0x478174 WideCharToMultiByte

• 0x478178 MultiByteToWideChar

• 0x47817c lstrlenA

• 0x478180 lstrcpynA

• 0x478184 LoadLibraryExA

• 0x478188 GetThreadLocale

• 0x47818c GetStartupInfoA

• 0x478190 GetProcAddress

• 0x478194 GetModuleHandleA

• 0x478198 GetModuleFileNameA

• 0x47819c GetLocaleInfoA

• 0x4781a0 GetCommandLineA

• 0x4781a4 FreeLibrary

• 0x4781a8 FindFirstFileA

• 0x4781ac FindClose

• 0x4781b0 ExitProcess

• 0x4781b4 ExitThread

• 0x4781b8 CreateThread

• 0x4781bc WriteFile

• 0x4781c0 UnhandledExceptionFilter

• 0x4781c4 RtlUnwind

• 0x4781c8 RaiseException

• 0x4781cc GetStdHandle

Library user32.dll:

• 0x4781d4 GetKeyboardType

• 0x4781d8 LoadStringA

• 0x4781dc MessageBoxA

• 0x4781e0 CharNextA

Library advapi32.dll:

• 0x4781e8 RegQueryValueExA

• 0x4781ec RegOpenKeyExA

• 0x4781f0 RegCloseKey

Library oleaut32.dll:

• 0x4781f8 SysFreeString

• 0x4781fc SysReAllocStringLen

• 0x478200 SysAllocStringLen

Library kernel32.dll:

• 0x478208 TlsSetValue

• 0x47820c TlsGetValue

• 0x478210 LocalAlloc

• 0x478214 GetModuleHandleA

Library advapi32.dll:

• 0x47821c RegQueryValueExA

• 0x478220 RegOpenKeyExA

• 0x478224 RegCloseKey

Library kernel32.dll:

• 0x47822c lstrcpyA

• 0x478230 WriteFile

• 0x478234 WaitForSingleObjectEx

• 0x478238 WaitForSingleObject

• 0x47823c VirtualQuery

• 0x478240 VirtualAlloc

• 0x478244 SuspendThread

• 0x478248 Sleep

• 0x47824c SizeofResource

• 0x478250 SetThreadPriority

• 0x478254 SetThreadLocale

• 0x478258 SetFilePointer

• 0x47825c SetEvent

• 0x478260 SetErrorMode

• 0x478264 SetEndOfFile

• 0x478268 ResumeThread

• 0x47826c ResetEvent

• 0x478270 ReadFile

• 0x478274 MultiByteToWideChar

• 0x478278 MulDiv

• 0x47827c LockResource

• 0x478280 LoadResource

• 0x478284 LoadLibraryA

• 0x478288 LeaveCriticalSection

• 0x47828c InitializeCriticalSection

• 0x478290 GlobalUnlock

• 0x478294 GlobalReAlloc

• 0x478298 GlobalHandle

• 0x47829c GlobalLock

• 0x4782a0 GlobalFree

• 0x4782a4 GlobalFindAtomA

• 0x4782a8 GlobalDeleteAtom

• 0x4782ac GlobalAlloc

• 0x4782b0 GlobalAddAtomA

• 0x4782b4 GetVersionExA

• 0x4782b8 GetVersion

• 0x4782bc GetTickCount

• 0x4782c0 GetThreadPriority

• 0x4782c4 GetThreadLocale

• 0x4782c8 GetTempPathA

• 0x4782cc GetSystemTimeAsFileTime

• 0x4782d0 GetSystemTime

• 0x4782d4 GetSystemInfo

• 0x4782d8 GetStringTypeExA

• 0x4782dc GetStdHandle

• 0x4782e0 GetProcAddress

• 0x4782e4 GetModuleHandleA

• 0x4782e8 GetModuleFileNameA

• 0x4782ec GetLocaleInfoA

• 0x4782f0 GetLocalTime

• 0x4782f4 GetLastError

• 0x4782f8 GetFullPathNameA

• 0x4782fc GetFileSize

• 0x478300 GetExitCodeThread

• 0x478304 GetDiskFreeSpaceA

• 0x478308 GetDateFormatA

• 0x47830c GetCurrentThreadId

• 0x478310 GetCurrentProcessId

• 0x478314 GetCPInfo

• 0x478318 GetACP

• 0x47831c FreeResource

• 0x478320 InterlockedIncrement

• 0x478324 InterlockedExchange

• 0x478328 InterlockedDecrement

• 0x47832c FreeLibrary

• 0x478330 FormatMessageA

• 0x478334 FindResourceA

• 0x478338 FileTimeToSystemTime

• 0x47833c ExitThread

• 0x478340 EnumCalendarInfoA

• 0x478344 EnterCriticalSection

• 0x478348 DeleteCriticalSection

• 0x47834c CreateThread

• 0x478350 CreateFileA

• 0x478354 CreateEventA

• 0x478358 CompareStringA

• 0x47835c CloseHandle

Library version.dll:

• 0x478364 VerQueryValueA

• 0x478368 GetFileVersionInfoSizeA

• 0x47836c GetFileVersionInfoA

Library gdi32.dll:

• 0x478374 UnrealizeObject

• 0x478378 StretchBlt

• 0x47837c SetWindowOrgEx

• 0x478380 SetViewportOrgEx

• 0x478384 SetTextColor

• 0x478388 SetStretchBltMode

• 0x47838c SetROP2

• 0x478390 SetPixel

• 0x478394 SetDIBColorTable

• 0x478398 SetBrushOrgEx

• 0x47839c SetBkMode

• 0x4783a0 SetBkColor

• 0x4783a4 SelectPalette

• 0x4783a8 SelectObject

• 0x4783ac SaveDC

• 0x4783b0 RestoreDC

• 0x4783b4 RectVisible

• 0x4783b8 RealizePalette

• 0x4783bc PatBlt

• 0x4783c0 MoveToEx

• 0x4783c4 MaskBlt

• 0x4783c8 LineTo

• 0x4783cc IntersectClipRect

• 0x4783d0 GetWindowOrgEx

• 0x4783d4 GetTextMetricsA

• 0x4783d8 GetTextExtentPoint32A

• 0x4783dc GetSystemPaletteEntries

• 0x4783e0 GetStockObject

• 0x4783e4 GetPixel

• 0x4783e8 GetPaletteEntries

• 0x4783ec GetObjectA

• 0x4783f0 GetDeviceCaps

• 0x4783f4 GetDIBits

• 0x4783f8 GetDIBColorTable

• 0x4783fc GetDCOrgEx

• 0x478400 GetCurrentPositionEx

• 0x478404 GetClipBox

• 0x478408 GetBrushOrgEx

• 0x47840c GetBitmapBits

• 0x478410 ExcludeClipRect

• 0x478414 DeleteObject

• 0x478418 DeleteDC

• 0x47841c CreateSolidBrush

• 0x478420 CreatePenIndirect

• 0x478424 CreatePalette

• 0x478428 CreateHalftonePalette

• 0x47842c CreateFontIndirectA

• 0x478430 CreateDIBitmap

• 0x478434 CreateDIBSection

• 0x478438 CreateCompatibleDC

• 0x47843c CreateCompatibleBitmap

• 0x478440 CreateBrushIndirect

• 0x478444 CreateBitmap

• 0x478448 BitBlt

Library user32.dll:

• 0x478450 CreateWindowExA

• 0x478454 WindowFromPoint

• 0x478458 WinHelpA

• 0x47845c WaitMessage

• 0x478460 UpdateWindow

• 0x478464 UnregisterClassA

• 0x478468 UnhookWindowsHookEx

• 0x47846c TranslateMessage

• 0x478470 TranslateMDISysAccel

• 0x478474 TrackPopupMenu

• 0x478478 SystemParametersInfoA

• 0x47847c ShowWindow

• 0x478480 ShowScrollBar

• 0x478484 ShowOwnedPopups

• 0x478488 ShowCursor

• 0x47848c SetWindowsHookExA

• 0x478490 SetWindowPos

• 0x478494 SetWindowPlacement

• 0x478498 SetWindowLongA

• 0x47849c SetTimer

• 0x4784a0 SetScrollRange

• 0x4784a4 SetScrollPos

• 0x4784a8 SetScrollInfo

• 0x4784ac SetRect

• 0x4784b0 SetPropA

• 0x4784b4 SetParent

• 0x4784b8 SetMenuItemInfoA

• 0x4784bc SetMenu

• 0x4784c0 SetForegroundWindow

• 0x4784c4 SetFocus

• 0x4784c8 SetCursor

• 0x4784cc SetClassLongA

• 0x4784d0 SetCapture

• 0x4784d4 SetActiveWindow

• 0x4784d8 SendMessageA

• 0x4784dc ScrollWindow

• 0x4784e0 ScreenToClient

• 0x4784e4 RemovePropA

• 0x4784e8 RemoveMenu

• 0x4784ec ReleaseDC

• 0x4784f0 ReleaseCapture

• 0x4784f4 RegisterWindowMessageA

• 0x4784f8 RegisterClipboardFormatA

• 0x4784fc RegisterClassA

• 0x478500 RedrawWindow

• 0x478504 PtInRect

• 0x478508 PostQuitMessage

• 0x47850c PostMessageA

• 0x478510 PeekMessageA

• 0x478514 OffsetRect

• 0x478518 OemToCharA

• 0x47851c MsgWaitForMultipleObjects

• 0x478520 MessageBoxA

• 0x478524 MapWindowPoints

• 0x478528 MapVirtualKeyA

• 0x47852c LoadStringA

• 0x478530 LoadKeyboardLayoutA

• 0x478534 LoadIconA

• 0x478538 LoadCursorA

• 0x47853c LoadBitmapA

• 0x478540 KillTimer

• 0x478544 IsZoomed

• 0x478548 IsWindowVisible

• 0x47854c IsWindowEnabled

• 0x478550 IsWindow

• 0x478554 IsRectEmpty

• 0x478558 IsIconic

• 0x47855c IsDialogMessageA

• 0x478560 IsChild

• 0x478564 InvalidateRect

• 0x478568 IntersectRect

• 0x47856c InsertMenuItemA

• 0x478570 InsertMenuA

• 0x478574 InflateRect

• 0x478578 GetWindowThreadProcessId

• 0x47857c GetWindowTextA

• 0x478580 GetWindowRect

• 0x478584 GetWindowPlacement

• 0x478588 GetWindowLongA

• 0x47858c GetWindowDC

• 0x478590 GetTopWindow

• 0x478594 GetSystemMetrics

• 0x478598 GetSystemMenu

• 0x47859c GetSysColorBrush

• 0x4785a0 GetSysColor

• 0x4785a4 GetSubMenu

• 0x4785a8 GetScrollRange

• 0x4785ac GetScrollPos

• 0x4785b0 GetScrollInfo

• 0x4785b4 GetPropA

• 0x4785b8 GetParent

• 0x4785bc GetWindow

• 0x4785c0 GetMenuStringA

• 0x4785c4 GetMenuState

• 0x4785c8 GetMenuItemInfoA

• 0x4785cc GetMenuItemID

• 0x4785d0 GetMenuItemCount

• 0x4785d4 GetMenuDefaultItem

• 0x4785d8 GetMenu

• 0x4785dc GetLastActivePopup

• 0x4785e0 GetKeyboardState

• 0x4785e4 GetKeyboardLayoutList

• 0x4785e8 GetKeyboardLayout

• 0x4785ec GetKeyState

• 0x4785f0 GetKeyNameTextA

• 0x4785f4 GetIconInfo

• 0x4785f8 GetForegroundWindow

• 0x4785fc GetFocus

• 0x478600 GetDesktopWindow

• 0x478604 GetDCEx

• 0x478608 GetDC

• 0x47860c GetCursorPos

• 0x478610 GetCursor

• 0x478614 GetClientRect

• 0x478618 GetClassNameA

• 0x47861c GetClassInfoA

• 0x478620 GetCapture

• 0x478624 GetActiveWindow

• 0x478628 FrameRect

• 0x47862c FindWindowA

• 0x478630 FillRect

• 0x478634 EqualRect

• 0x478638 EnumWindows

• 0x47863c EnumThreadWindows

• 0x478640 EndPaint

• 0x478644 EnableWindow

• 0x478648 EnableScrollBar

• 0x47864c EnableMenuItem

• 0x478650 DrawTextA

• 0x478654 DrawMenuBar

• 0x478658 DrawIconEx

• 0x47865c DrawIcon

• 0x478660 DrawFrameControl

• 0x478664 DrawEdge

• 0x478668 DispatchMessageA

• 0x47866c DestroyWindow

• 0x478670 DestroyMenu

• 0x478674 DestroyIcon

• 0x478678 DestroyCursor

• 0x47867c DeleteMenu

• 0x478680 DefWindowProcA

• 0x478684 DefMDIChildProcA

• 0x478688 DefFrameProcA

• 0x47868c CreatePopupMenu

• 0x478690 CreateMenu

• 0x478694 CreateIcon

• 0x478698 ClientToScreen

• 0x47869c CheckMenuItem

• 0x4786a0 CallWindowProcA

• 0x4786a4 CallNextHookEx

• 0x4786a8 BeginPaint

• 0x4786ac CharNextA

• 0x4786b0 CharLowerA

• 0x4786b4 CharUpperBuffA

• 0x4786b8 CharToOemA

• 0x4786bc AdjustWindowRectEx

• 0x4786c0 ActivateKeyboardLayout

Library kernel32.dll:

• 0x4786c8 Sleep

Library oleaut32.dll:

• 0x4786d0 SafeArrayPtrOfIndex

• 0x4786d4 SafeArrayPutElement

• 0x4786d8 SafeArrayGetElement

• 0x4786dc SafeArrayUnaccessData

• 0x4786e0 SafeArrayAccessData

• 0x4786e4 SafeArrayGetUBound

• 0x4786e8 SafeArrayGetLBound

• 0x4786ec SafeArrayCreate

• 0x4786f0 VariantChangeType

• 0x4786f4 VariantCopyInd

• 0x4786f8 VariantCopy

• 0x4786fc VariantClear

• 0x478700 VariantInit

Library ole32.dll:

• 0x478708 CoCreateInstance

• 0x47870c CoUninitialize

• 0x478710 CoInitialize

Library oleaut32.dll:

• 0x478718 CreateErrorInfo

• 0x47871c GetErrorInfo

• 0x478720 SetErrorInfo

• 0x478724 SysFreeString

Library comctl32.dll:

• 0x47872c ImageList_SetIconSize

• 0x478730 ImageList_GetIconSize

• 0x478734 ImageList_Write

• 0x478738 ImageList_Read

• 0x47873c ImageList_GetDragImage

• 0x478740 ImageList_DragShowNolock

• 0x478744 ImageList_SetDragCursorImage

• 0x478748 ImageList_DragMove

• 0x47874c ImageList_DragLeave

• 0x478750 ImageList_DragEnter

• 0x478754 ImageList_EndDrag

• 0x478758 ImageList_BeginDrag

• 0x47875c ImageList_Remove

• 0x478760 ImageList_DrawEx

• 0x478764 ImageList_Draw

• 0x478768 ImageList_GetBkColor

• 0x47876c ImageList_SetBkColor

• 0x478770 ImageList_ReplaceIcon

• 0x478774 ImageList_Add

• 0x478778 ImageList_GetImageCount

• 0x47877c ImageList_Destroy

• 0x478780 ImageList_Create

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
broken3.cf
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com A 172.217.160.110	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	57236	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53210	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.