SmartHawk

5.2

中危

58 个模型检测该样本为恶意！

重新分析

下载样本

ecabd11623ca39105438d03f355e7ba992bdd8b94430efab8d4f458e9853fc8a

4876b20e103d00b8cd9abf5b7b001625.exe

分析耗时

38s

最近分析

文件大小

2.1MB

静态报毒动态报毒 7HZPTSNQSA AGEN AI SCORE=83 AIDETECTVM BSCOPE CLASSIC CONFIDENCE DKW@AYJAZO ELDORADO ENCPK GENCIRC GENETIC HACKTOOL HBR@8QRQPO HCQT HIJXNI INJECT3 KRAP KRYPTIK LKMC MALICIOUS PE MALWARE1 MINT PINKSBOT QAKBOT QBOT QVM20 R + MAL R331912 RAZY REGOTET SCORE STATIC AI SUSGEN TROJANBANKER UNSAFE ZEXAF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20201229	21.1.5827.0
Alibaba	TrojanBanker:Win32/Qakbot.61ef98b0	20190527	0.3.0.5
Kingsoft		20201229	2017.9.26.565
McAfee	W32/PinkSbot-GN!4876B20E103D	20201229	6.0.6.653
Tencent	Malware.Win32.Gencirc.10b9c233	20201229	1.0.0.1
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

Queries for the computername (3 个事件)

Time & API	Arguments	Status	Return
1620737243.655249 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620737253.124249 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620737244.764249 GetComputerNameW	computer_name: OSKAR-PC	success	1

Command line console output was observed (28 个事件)

Time & API	Arguments	Status	Return
1620737255.107876 WriteConsoleA	buffer: ÕýÔÚ Ping 127.0.0.1 console_handle: 0x00000007	success	1
1620737255.123876 WriteConsoleA	buffer: ¾ßÓÐ 32 ×Ö½ÚµÄÊý¾Ý: console_handle: 0x00000007	success	1
1620737255.154876 WriteConsoleA	buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´: console_handle: 0x00000007	success	1
1620737255.154876 WriteConsoleA	buffer: ×Ö½Ú=32 console_handle: 0x00000007	success	1
1620737255.154876 WriteConsoleA	buffer: Ê±¼ä<1ms console_handle: 0x00000007	success	1
1620737255.154876 WriteConsoleA	buffer: TTL=128 console_handle: 0x00000007	success	1
1620737256.154876 WriteConsoleA	buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´: console_handle: 0x00000007	success	1
1620737256.154876 WriteConsoleA	buffer: ×Ö½Ú=32 console_handle: 0x00000007	success	1
1620737256.154876 WriteConsoleA	buffer: Ê±¼ä<1ms console_handle: 0x00000007	success	1
1620737256.170876 WriteConsoleA	buffer: TTL=128 console_handle: 0x00000007	success	1
1620737257.201876 WriteConsoleA	buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´: console_handle: 0x00000007	success	1
1620737257.216876 WriteConsoleA	buffer: ×Ö½Ú=32 console_handle: 0x00000007	success	1
1620737257.216876 WriteConsoleA	buffer: Ê±¼ä<1ms console_handle: 0x00000007	success	1
1620737257.232876 WriteConsoleA	buffer: TTL=128 console_handle: 0x00000007	success	1
1620737258.248876 WriteConsoleA	buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´: console_handle: 0x00000007	success	1
1620737258.263876 WriteConsoleA	buffer: ×Ö½Ú=32 console_handle: 0x00000007	success	1
1620737258.263876 WriteConsoleA	buffer: Ê±¼ä<1ms console_handle: 0x00000007	success	1
1620737258.263876 WriteConsoleA	buffer: TTL=128 console_handle: 0x00000007	success	1
1620737259.263876 WriteConsoleA	buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´: console_handle: 0x00000007	success	1
1620737259.263876 WriteConsoleA	buffer: ×Ö½Ú=32 console_handle: 0x00000007	success	1
1620737259.263876 WriteConsoleA	buffer: Ê±¼ä<1ms console_handle: 0x00000007	success	1
1620737259.263876 WriteConsoleA	buffer: TTL=128 console_handle: 0x00000007	success	1
1620737260.263876 WriteConsoleA	buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´: console_handle: 0x00000007	success	1
1620737260.263876 WriteConsoleA	buffer: ×Ö½Ú=32 console_handle: 0x00000007	success	1
1620737260.263876 WriteConsoleA	buffer: Ê±¼ä<1ms console_handle: 0x00000007	success	1
1620737260.263876 WriteConsoleA	buffer: TTL=128 console_handle: 0x00000007	success	1
1620737260.279876 WriteConsoleA	buffer: 127.0.0.1 µÄ Ping Í³¼ÆÐÅÏ¢: Êý¾Ý°ü: ÒÑ·¢ËÍ = 6£¬ÒÑ½ÓÊÕ = 6£¬¶ªÊ§ = 0 (0% ¶ªÊ§)£¬ console_handle: 0x00000007	success	1
1620737260.295876 WriteConsoleA	buffer: Íù·µÐÐ³ÌµÄ¹À¼ÆÊ±¼ä(ÒÔºÁÃëÎªµ¥Î»): ×î¶Ì = 0ms£¬×î³¤ = 0ms£¬Æ½¾ù = 0ms console_handle: 0x00000007	success	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620737255.029876 GlobalMemoryStatusEx		success	1	0

One or more processes crashed (4 个事件)

Time & API	Arguments	Status
1620737253.124249 __exception__	stacktrace: RtlConvertSidToUnicodeString+0x28 RtlFormatCurrentUserKeyPath-0x257 ntdll+0x3aeea @ 0x77d6aeea ConvertSidToStringSidW+0x24 CopySid-0xe6 advapi32+0x14368 @ 0x76554368 4876b20e103d00b8cd9abf5b7b001625+0xa5b6 @ 0x40a5b6 4876b20e103d00b8cd9abf5b7b001625+0x8853 @ 0x408853 4876b20e103d00b8cd9abf5b7b001625+0x8451 @ 0x408451 4876b20e103d00b8cd9abf5b7b001625+0x8ec9 @ 0x408ec9 4876b20e103d00b8cd9abf5b7b001625+0x17cc @ 0x4017cc 4876b20e103d00b8cd9abf5b7b001625+0x1c66 @ 0x401c66 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1632744 registers.edi: 0 registers.eax: 9460301 registers.ebp: 1632784 registers.edx: 7570196 registers.ebx: 1 registers.esi: 9460301 registers.ecx: 9460301 exception.instruction_r: 8a 08 80 e1 0f 80 f9 01 75 24 8a 48 01 80 f9 0f exception.symbol: RtlValidSid+0x17 RtlCopySid-0x3e ntdll+0x392a9 exception.instruction: mov cl, byte ptr [eax] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 234153 exception.address: 0x77d692a9	success
1620737253.280249 __exception__	stacktrace: EqualSid+0x19 EqualPrefixSid-0xc kernelbase+0x1bfe3 @ 0x778fbfe3 4876b20e103d00b8cd9abf5b7b001625+0x84c8 @ 0x4084c8 4876b20e103d00b8cd9abf5b7b001625+0xa27c @ 0x40a27c 4876b20e103d00b8cd9abf5b7b001625+0xa2b7 @ 0x40a2b7 4876b20e103d00b8cd9abf5b7b001625+0x8f66 @ 0x408f66 4876b20e103d00b8cd9abf5b7b001625+0x17cc @ 0x4017cc 4876b20e103d00b8cd9abf5b7b001625+0x1c66 @ 0x401c66 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634132 registers.edi: 9460301 registers.eax: 1281 registers.ebp: 1634140 registers.edx: 0 registers.ebx: 39581960 registers.esi: 39581960 registers.ecx: 2130563072 exception.instruction_r: 66 3b 07 0f 85 e1 ef ff ff 0f b6 4e 01 33 c0 8d exception.symbol: RtlEqualSid+0x10 RtlSetCriticalSectionSpinCount-0x26 ntdll+0x394c1 exception.instruction: cmp ax, word ptr [edi] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 234689 exception.address: 0x77d694c1	success
1620737245.436249 __exception__	stacktrace: 4876b20e103d00b8cd9abf5b7b001625+0x3daa @ 0x403daa 4876b20e103d00b8cd9abf5b7b001625+0x1b23 @ 0x401b23 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637624 registers.edi: 0 registers.eax: 1447909480 registers.ebp: 1637684 registers.edx: 22104 registers.ebx: 1 registers.esi: 8133568 registers.ecx: 10 exception.instruction_r: ed 89 5d e4 89 4d e0 5a 59 5b 58 83 4d fc ff eb exception.symbol: 4876b20e103d00b8cd9abf5b7b001625+0x33cc exception.instruction: in eax, dx exception.module: 4876b20e103d00b8cd9abf5b7b001625.exe exception.exception_code: 0xc0000096 exception.offset: 13260 exception.address: 0x4033cc	success
1620737245.436249 __exception__	stacktrace: 4876b20e103d00b8cd9abf5b7b001625+0x3db3 @ 0x403db3 4876b20e103d00b8cd9abf5b7b001625+0x1b23 @ 0x401b23 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637628 registers.edi: 0 registers.eax: 1447909480 registers.ebp: 1637684 registers.edx: 22104 registers.ebx: 1 registers.esi: 8133568 registers.ecx: 20 exception.instruction_r: ed 89 45 e4 5a 59 5b 58 83 4d fc ff eb 11 33 c0 exception.symbol: 4876b20e103d00b8cd9abf5b7b001625+0x3465 exception.instruction: in eax, dx exception.module: 4876b20e103d00b8cd9abf5b7b001625.exe exception.exception_code: 0xc0000096 exception.offset: 13413 exception.address: 0x403465	success

Allocates read-write-execute memory (usually to unpack itself) (6 个事件)

Time & API	Arguments	Status
1620737243.280249 NtAllocateVirtualMemory	process_identifier: 2976 region_size: 233472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00610000	success
1620737243.327249 NtAllocateVirtualMemory	process_identifier: 2976 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00650000	success
1620737243.327249 NtProtectVirtualMemory	process_identifier: 2976 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 245760 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1620737244.671249 NtAllocateVirtualMemory	process_identifier: 2296 region_size: 233472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01e50000	success
1620737244.686249 NtAllocateVirtualMemory	process_identifier: 2296 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01e90000	success
1620737244.686249 NtProtectVirtualMemory	process_identifier: 2296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 245760 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success

Creates executable files on the filesystem (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4876b20e103d00b8cd9abf5b7b001625.exe

Creates a suspicious process (2 个事件)

cmdline	"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4876b20e103d00b8cd9abf5b7b001625.exe"
cmdline	cmd.exe /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4876b20e103d00b8cd9abf5b7b001625.exe"

A process created a hidden window (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1620737244.530249 CreateProcessInternalW	thread_identifier: 2772 thread_handle: 0x0000013c process_identifier: 2296 current_directory: filepath: track: 1 command_line: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4876b20e103d00b8cd9abf5b7b001625.exe /C filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) process_handle: 0x00000140 inherit_handles: 0	success	1	0
1620737254.108249 ShellExecuteExW	parameters: /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4876b20e103d00b8cd9abf5b7b001625.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1	0

Uses Windows utilities for basic Windows functionality (3 个事件)

cmdline	"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4876b20e103d00b8cd9abf5b7b001625.exe"
cmdline	ping.exe -n 6 127.0.0.1
cmdline	cmd.exe /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4876b20e103d00b8cd9abf5b7b001625.exe"

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Detects VMWare through the in instruction feature (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620737245.436249 __exception__	stacktrace: 4876b20e103d00b8cd9abf5b7b001625+0x3daa @ 0x403daa 4876b20e103d00b8cd9abf5b7b001625+0x1b23 @ 0x401b23 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637624 registers.edi: 0 registers.eax: 1447909480 registers.ebp: 1637684 registers.edx: 22104 registers.ebx: 1 registers.esi: 8133568 registers.ecx: 10 exception.instruction_r: ed 89 5d e4 89 4d e0 5a 59 5b 58 83 4d fc ff eb exception.symbol: 4876b20e103d00b8cd9abf5b7b001625+0x33cc exception.instruction: in eax, dx exception.module: 4876b20e103d00b8cd9abf5b7b001625.exe exception.exception_code: 0xc0000096 exception.offset: 13260 exception.address: 0x4033cc	success	0	0

File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)

Bkav	W32.AIDetectVM.malware1
MicroWorld-eScan	Gen:Heur.Mint.Regotet.1
FireEye	Generic.mg.4876b20e103d00b8
ALYac	Gen:Heur.Mint.Regotet.1
Cylance	Unsafe
AegisLab	Hacktool.Win32.Krap.lKMc
Sangfor	Malware
K7AntiVirus	Trojan ( 0056422d1 )
BitDefender	Gen:Heur.Mint.Regotet.1
K7GW	Trojan ( 005652be1 )
Cybereason	malicious.e103d0
Cyren	W32/S-4cd6deb0!Eldorado
Symantec	Packed.Generic.459
ESET-NOD32	a variant of Win32/Kryptik.HCQT
APEX	Malicious
Avast	Win32:Trojan-gen
ClamAV	Win.Malware.Razy-7659589-0
Kaspersky	HEUR:Trojan-Banker.Win32.Qbot.vho
Alibaba	TrojanBanker:Win32/Qakbot.61ef98b0
NANO-Antivirus	Trojan.Win32.Inject3.hijxni
Rising	Trojan.Kryptik!1.C427 (CLASSIC)
Ad-Aware	Gen:Heur.Mint.Regotet.1
Emsisoft	Gen:Heur.Mint.Regotet.1 (B)
Comodo	TrojWare.Win32.Kryptik.HBR@8qrqpo
F-Secure	Heuristic.HEUR/AGEN.1133397
DrWeb	Trojan.Inject3.38145
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Backdoor.Win32.QAKBOT.SME
McAfee-GW-Edition	W32/PinkSbot-GN!4876B20E103D
MaxSecure	Trojan.Malware.74801313.susgen
Sophos	Mal/Generic-R + Mal/EncPk-APV
Ikarus	Trojan.Win32.Qbot
GData	Gen:Heur.Mint.Regotet.1
Jiangmin	Trojan.Banker.Qbot.mm
Avira	HEUR/AGEN.1133397
MAX	malware (ai score=83)
Antiy-AVL	Trojan/Win32.Kryptik
Gridinsoft	Trojan.Win32.Kryptik.ba!s2
Arcabit	Trojan.Mint.Regotet.1
AhnLab-V3	Trojan/Win32.Qbot.R331912
ZoneAlarm	HEUR:Trojan-Banker.Win32.Qbot.vho
Microsoft	Trojan:Win32/Qakbot.CK!MTB
Cynet	Malicious (score: 100)
Acronis	suspicious
McAfee	W32/PinkSbot-GN!4876B20E103D
VBA32	BScope.TrojanBanker.Qbot
Malwarebytes	Backdoor.Qbot
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	Backdoor.Win32.QAKBOT.SME
Tencent	Malware.Win32.Gencirc.10b9c233

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-04-08 21:07:51

Imports

Library KERNEL32.dll:

• 0x60e3ec VirtualAlloc

• 0x60e3f0 GetModuleHandleW

Library USER32.dll:

• 0x60e3f8 LoadIconA

• 0x60e3fc CharLowerA

• 0x60e400 InSendMessage

• 0x60e404 ReleaseCapture

• 0x60e408 GetFocus

• 0x60e40c GetQueueStatus

• 0x60e410 OpenIcon

• 0x60e414 AnyPopup

• 0x60e418 GetDoubleClickTime

• 0x60e41c CountClipboardFormats

• 0x60e420 DestroyCursor

• 0x60e424 GetClipboardOwner

• 0x60e428 CharNextA

• 0x60e42c GetKeyboardType

• 0x60e430 OemKeyScan

• 0x60e434 GetMenuItemID

• 0x60e438 GetSubMenu

• 0x60e43c GetMenu

• 0x60e440 RegisterClassA

• 0x60e444 GetClassInfoA

• 0x60e448 WinHelpA

• 0x60e44c GetCapture

• 0x60e450 GetTopWindow

• 0x60e454 CopyRect

• 0x60e458 GetClientRect

• 0x60e45c AdjustWindowRectEx

• 0x60e460 SetFocus

• 0x60e464 GetSysColor

• 0x60e468 MapWindowPoints

• 0x60e46c ShowWindow

• 0x60e470 LoadCursorA

• 0x60e474 GetSysColorBrush

• 0x60e478 DestroyMenu

• 0x60e47c DestroyWindow

• 0x60e480 CreateWindowExA

• 0x60e484 GetClassLongA

• 0x60e488 SetPropA

• 0x60e48c GetPropA

• 0x60e490 CallWindowProcA

• 0x60e494 RemovePropA

• 0x60e498 DefWindowProcA

• 0x60e49c GetMessageTime

• 0x60e4a0 GetForegroundWindow

• 0x60e4a4 SetForegroundWindow

• 0x60e4a8 SetWindowLongA

• 0x60e4ac SetWindowPos

• 0x60e4b0 RegisterWindowMessageA

• 0x60e4b4 SystemParametersInfoA

• 0x60e4b8 IsIconic

• 0x60e4bc GetWindowPlacement

• 0x60e4c0 GetSystemMetrics

• 0x60e4c4 LoadStringA

• 0x60e4c8 GrayStringA

• 0x60e4cc DrawTextA

• 0x60e4d0 TabbedTextOutA

• 0x60e4d4 ReleaseDC

• 0x60e4d8 GetDC

• 0x60e4dc GetMenuItemCount

• 0x60e4e0 wsprintfA

• 0x60e4e4 UnhookWindowsHookEx

• 0x60e4e8 GetLastActivePopup

• 0x60e4ec IsWindowEnabled

• 0x60e4f0 MessageBoxA

• 0x60e4f4 GetWindowTextA

• 0x60e4f8 SetWindowTextA

• 0x60e4fc ClientToScreen

• 0x60e500 GetWindow

• 0x60e504 GetDlgCtrlID

• 0x60e508 GetWindowRect

• 0x60e50c PtInRect

• 0x60e510 GetWindowLongA

• 0x60e514 GetClassNameA

• 0x60e518 GetMenuCheckMarkDimensions

• 0x60e51c LoadBitmapA

• 0x60e520 GetMenuState

• 0x60e524 ModifyMenuA

• 0x60e528 SetMenuItemBitmaps

• 0x60e52c CheckMenuItem

• 0x60e530 EnableMenuItem

• 0x60e534 GetParent

• 0x60e538 GetNextDlgTabItem

• 0x60e53c SetCursor

• 0x60e540 GetMessageA

• 0x60e544 TranslateMessage

• 0x60e548 DispatchMessageA

• 0x60e54c GetActiveWindow

• 0x60e550 SendMessageA

• 0x60e554 PostQuitMessage

• 0x60e558 PostMessageA

• 0x60e55c GetDlgItem

• 0x60e560 GetMessagePos

• 0x60e564 GetKeyState

• 0x60e568 CallNextHookEx

• 0x60e56c ValidateRect

• 0x60e570 IsWindowVisible

• 0x60e574 PeekMessageA

• 0x60e578 GetCursorPos

• 0x60e57c SetWindowsHookExA

• 0x60e580 EnableWindow

Library GDI32.dll:

• 0x60e588 GetStockObject

• 0x60e58c GetEnhMetaFileA

• 0x60e590 GetObjectType

• 0x60e594 GdiGetBatchLimit

• 0x60e598 CreateMetaFileW

• 0x60e59c GetPolyFillMode

• 0x60e5a0 CreateSolidBrush

• 0x60e5a4 CloseMetaFile

• 0x60e5a8 GetTextCharset

• 0x60e5ac GetSystemPaletteUse

• 0x60e5b0 EndPage

• 0x60e5b4 GetDCBrushColor

Library ADVAPI32.dll:

• 0x60e5bc RegOpenKeyA

• 0x60e5c0 RegQueryValueExA

• 0x60e5c4 RegSetValueExA

• 0x60e5c8 RegCloseKey

• 0x60e5cc RegOpenKeyExA

• 0x60e5d0 RegCreateKeyExA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 51.105.208.173 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50003	239.255.255.250	3702
192.168.56.101	51966	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.