SmartHawk

2.8

中危

53 个模型检测该样本为恶意！

重新分析

下载样本

95a2cba8517fc9a16cdaa4f63261d55ceacb4f299d0b6278f328fd16357ab979

6143ef33ee839111ac65de6bcdb948c5.exe

分析耗时

18s

最近分析

文件大小

580.3KB

静态报毒动态报毒 ADWAREDOMA AI SCORE=85 BAZARLOADER CLASSIC CONFIDENCE CRYPTERX ERED FSOT GENERICKDZ GENKRYPTIK H8OAATAC HIGH CONFIDENCE HTIEVG KCLOUD KRYPT KRYPTIK MALWARE@#3ET9XFUFH85HL MANSABO OHJE SCORE SUSGEN TRICKBOT UNSAFE UQMAN YHDGYGD8Q9W 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Trojan-FSOT!6143EF33EE83	20210223	6.0.6.653
Alibaba	Trojan:Win64/Trickbot.665468b5	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win64:CrypterX-gen [Trj]	20210223	21.1.5827.0
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)	20210223	2017.9.26.565
CrowdStrike	win/malicious_confidence_60% (W)	20210203	1.0

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513307.305465 __exception__	stacktrace: registers.r14: 32508241 registers.r9: 818 registers.rcx: 8791764828160 registers.rsi: 8 registers.r10: 3221225715 registers.rbx: 8791764828160 registers.rdi: 14 registers.r11: 0 registers.r8: 260 registers.rdx: 1238512 registers.rbp: 1238528 registers.r15: 35364736 registers.r12: 2008686432 registers.rsp: 1238264 registers.rax: 0 registers.r13: 0 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0	success	0	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 69 个事件)

Time & API	Arguments	Status
1619513306.399465 NtAllocateVirtualMemory	process_identifier: 784 region_size: 176128 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x0000000001f00000	success
1619513306.633465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feff1e6000	success
1619513306.633465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feff1e7000	success
1619513306.711465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feff183000	success
1619513306.711465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feff183000	success
1619513306.711465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feff165000	success
1619513306.711465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feff1cf000	success
1619513306.711465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feff173000	success
1619513306.742465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feff165000	success
1619513306.742465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feff183000	success
1619513306.742465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feff183000	success
1619513306.742465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feff1b0000	success
1619513306.742465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feff15c000	success
1619513306.742465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feff15f000	success
1619513306.742465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feff1aa000	success
1619513306.742465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feff15f000	success
1619513306.758465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feff169000	success
1619513306.758465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feff16b000	success
1619513306.758465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feff1b2000	success
1619513306.758465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feff181000	success
1619513306.758465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feff15e000	success
1619513306.758465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feff163000	success
1619513306.758465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feff15f000	success
1619513306.758465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feff182000	success
1619513306.758465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feff185000	success
1619513306.883465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feffb1b000	success
1619513306.883465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feffb03000	success
1619513306.899465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feffae8000	success
1619513306.899465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feffaed000	success
1619513306.899465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feffaed000	success
1619513306.899465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feffb1b000	success
1619513306.899465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feffb1b000	success
1619513306.899465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feffae8000	success
1619513306.914465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feffb2d000	success
1619513306.914465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feffb2d000	success
1619513306.945465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feffaed000	success
1619513306.945465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feffaf1000	success
1619513306.945465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feffafb000	success
1619513306.945465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feffafb000	success
1619513306.961465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feffae3000	success
1619513306.977465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feffb00000	success
1619513306.977465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feffaf1000	success
1619513306.977465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feffafb000	success
1619513306.992465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feffb06000	success
1619513306.992465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feffaf1000	success
1619513306.992465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feffaf1000	success
1619513306.992465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feffafc000	success
1619513306.992465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feffafb000	success
1619513306.992465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feffaed000	success
1619513306.992465 NtProtectVirtualMemory	process_identifier: 784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff base_address: 0x000007feffafc000	success

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.897056055879278

section

{'size_of_data': '0x0002ce00', 'virtual_address': '0x0005b000', 'entropy': 7.897056055879278, 'name': '.data', 'virtual_size': '0x00032ad0'}

description

A section with a high entropy has been found

entropy

0.31001727115716754

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.69748
FireEye	Generic.mg.6143ef33ee839111
McAfee	Trojan-FSOT!6143EF33EE83
Cylance	Unsafe
Zillya	Trojan.Mansabo.Win32.1883
AegisLab	Trojan.Win32.Mansabo.4!c
Sangfor	Trojan.Win64.Trickbot.VIS
K7AntiVirus	Trojan ( 0056d55a1 )
Alibaba	Trojan:Win64/Trickbot.665468b5
K7GW	Trojan ( 0056d55a1 )
Cybereason	malicious.3ee839
Arcabit	Trojan.Generic.D11074
Cyren	W64/Trojan.OHJE-0819
Symantec	Trojan.Gen.2
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Mansabo.vho
BitDefender	Trojan.GenericKDZ.69748
NANO-Antivirus	Trojan.Win64.Mansabo.htievg
Avast	Win64:CrypterX-gen [Trj]
Ad-Aware	Trojan.GenericKDZ.69748
Emsisoft	Trojan.GenericKDZ.69748 (B)
Comodo	Malware@#3et9xfufh85hl
F-Secure	Trojan.TR/Crypt.Agent.uqman
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win64.AdwareDoma.hh
Sophos	Mal/Generic-S
Jiangmin	Trojan.Mansabo.buk
eGambit	Generic.Malware
Avira	TR/Crypt.Agent.uqman
Antiy-AVL	Trojan/Win32.Mansabo
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Gridinsoft	Trojan.Win64.Gen.oa
Microsoft	Trojan:Win64/Trickbot.VIS!MSR
ZoneAlarm	HEUR:Trojan.Win32.Mansabo.vho
GData	Trojan.GenericKDZ.69748
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win64.Trickbot.C4187238
ALYac	Trojan.GenericKDZ.69748
MAX	malware (ai score=85)
VBA32	Trojan.Win64.Trickbot
Malwarebytes	Trojan.MalPack.TRE
ESET-NOD32	Win64/BazarLoader.E
Rising	Trojan.Kryptik!1.CB2B (CLASSIC)
Yandex	Trojan.Agent!YHdGYGd8q9w
Ikarus	Trojan.Win64.Krypt
MaxSecure	Trojan.Malware.1728101.susgen
Fortinet	W64/GenKryptik.ERED!tr
AVG	Win64:CrypterX-gen [Trj]

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-25 20:38:34

Imports

Library MSWSOCK.dll:

• 0x443570 TransmitFile

Library KERNEL32.dll:

• 0x443118 WritePrivateProfileStringA

• 0x443120 SetErrorMode

• 0x443128 FileTimeToLocalFileTime

• 0x443130 GetFileAttributesA

• 0x443138 GetFileTime

• 0x443140 RtlLookupFunctionEntry

• 0x443148 RtlUnwindEx

• 0x443150 GetSystemTimeAsFileTime

• 0x443158 HeapAlloc

• 0x443160 HeapFree

• 0x443168 HeapReAlloc

• 0x443170 GetCommandLineA

• 0x443178 GetProcessHeap

• 0x443180 GetStartupInfoA

• 0x443188 RaiseException

• 0x443190 RtlPcToFileHeader

• 0x443198 ExitThread

• 0x4431a0 CreateThread

• 0x4431a8 HeapSize

• 0x4431b0 TerminateProcess

• 0x4431b8 UnhandledExceptionFilter

• 0x4431c0 SetUnhandledExceptionFilter

• 0x4431c8 IsDebuggerPresent

• 0x4431d0 RtlCaptureContext

• 0x4431d8 FlsGetValue

• 0x4431e0 FlsSetValue

• 0x4431e8 FlsAlloc

• 0x4431f0 GetACP

• 0x4431f8 LCMapStringA

• 0x443200 LCMapStringW

• 0x443208 GetStdHandle

• 0x443210 HeapSetInformation

• 0x443218 HeapCreate

• 0x443220 RtlVirtualUnwind

• 0x443228 FreeEnvironmentStringsA

• 0x443230 GetEnvironmentStrings

• 0x443238 FreeEnvironmentStringsW

• 0x443240 GetEnvironmentStringsW

• 0x443248 SetHandleCount

• 0x443250 GetFileType

• 0x443258 QueryPerformanceCounter

• 0x443260 GetTickCount

• 0x443268 GetTimeZoneInformation

• 0x443270 GetConsoleCP

• 0x443278 GetConsoleMode

• 0x443280 GetStringTypeA

• 0x443288 GetStringTypeW

• 0x443290 SetStdHandle

• 0x443298 WriteConsoleA

• 0x4432a0 GetConsoleOutputCP

• 0x4432a8 WriteConsoleW

• 0x4432b0 SetEnvironmentVariableA

• 0x4432b8 FileTimeToSystemTime

• 0x4432c0 GetOEMCP

• 0x4432c8 GetCPInfo

• 0x4432d0 TlsFree

• 0x4432d8 LocalReAlloc

• 0x4432e0 TlsSetValue

• 0x4432e8 GlobalHandle

• 0x4432f0 GlobalReAlloc

• 0x4432f8 TlsAlloc

• 0x443300 TlsGetValue

• 0x443308 LocalAlloc

• 0x443310 GlobalFlags

• 0x443318 CreateFileA

• 0x443320 GetFullPathNameA

• 0x443328 GetVolumeInformationA

• 0x443330 FindFirstFileA

• 0x443338 FindClose

• 0x443340 GetCurrentProcess

• 0x443348 DuplicateHandle

• 0x443350 GetThreadLocale

• 0x443358 GetFileSize

• 0x443360 SetEndOfFile

• 0x443368 UnlockFile

• 0x443370 LockFile

• 0x443378 FlushFileBuffers

• 0x443380 SetFilePointer

• 0x443388 WriteFile

• 0x443390 ReadFile

• 0x443398 GetModuleFileNameW

• 0x4433a0 GetCurrentProcessId

• 0x4433a8 CreateEventA

• 0x4433b0 SetEvent

• 0x4433b8 SetThreadPriority

• 0x4433c0 ConvertDefaultLocale

• 0x4433c8 EnumResourceLanguagesA

• 0x4433d0 GetLocaleInfoA

• 0x4433d8 lstrcmpA

• 0x4433e0 WaitForSingleObject

• 0x4433e8 GlobalFree

• 0x4433f0 GlobalAlloc

• 0x4433f8 GlobalLock

• 0x443400 GlobalUnlock

• 0x443408 MulDiv

• 0x443410 FreeResource

• 0x443418 GlobalGetAtomNameA

• 0x443420 GlobalAddAtomA

• 0x443428 GlobalFindAtomA

• 0x443430 GlobalDeleteAtom

• 0x443438 FreeLibrary

• 0x443440 LoadLibraryA

• 0x443448 SetLastError

• 0x443450 lstrcmpW

• 0x443458 GetModuleHandleA

• 0x443460 GetProcAddress

• 0x443468 GetVersionExA

• 0x443470 lstrlenA

• 0x443478 CompareStringW

• 0x443480 CompareStringA

• 0x443488 GetVersion

• 0x443490 MultiByteToWideChar

• 0x443498 lstrcpyA

• 0x4434a0 GetModuleFileNameA

• 0x4434a8 GetLastError

• 0x4434b0 FormatMessageA

• 0x4434b8 LocalFree

• 0x4434c0 Sleep

• 0x4434c8 CloseHandle

• 0x4434d0 GetCurrentThreadId

• 0x4434d8 GetCurrentThread

• 0x4434e0 SuspendThread

• 0x4434e8 PostQueuedCompletionStatus

• 0x4434f0 GetExitCodeThread

• 0x4434f8 ResumeThread

• 0x443500 CancelIo

• 0x443508 CreateIoCompletionPort

• 0x443510 ExitProcess

• 0x443518 WideCharToMultiByte

• 0x443520 FindResourceA

• 0x443528 LoadResource

• 0x443530 LockResource

• 0x443538 SizeofResource

• 0x443540 InitializeCriticalSection

• 0x443548 LeaveCriticalSection

• 0x443550 EnterCriticalSection

• 0x443558 DeleteCriticalSection

• 0x443560 FlsFree

Library USER32.dll:

• 0x4435c8 UnregisterClassA

• 0x4435d0 BeginPaint

• 0x4435d8 ReleaseDC

• 0x4435e0 GetDC

• 0x4435e8 ClientToScreen

• 0x4435f0 GrayStringA

• 0x4435f8 DrawTextExA

• 0x443600 DrawTextA

• 0x443608 TabbedTextOutA

• 0x443610 GetDesktopWindow

• 0x443618 CreateDialogIndirectParamA

• 0x443620 GetNextDlgTabItem

• 0x443628 EndDialog

• 0x443630 GetWindowThreadProcessId

• 0x443638 SetCursor

• 0x443640 GetMessageA

• 0x443648 TranslateMessage

• 0x443650 GetActiveWindow

• 0x443658 GetCursorPos

• 0x443660 ValidateRect

• 0x443668 PostQuitMessage

• 0x443670 IsWindowEnabled

• 0x443678 ShowWindow

• 0x443680 SetWindowTextA

• 0x443688 IsDialogMessageA

• 0x443690 RegisterWindowMessageA

• 0x443698 SendDlgItemMessageA

• 0x4436a0 GetCapture

• 0x4436a8 SetWindowsHookExA

• 0x4436b0 CallNextHookEx

• 0x4436b8 GetClassLongA

• 0x4436c0 GetClassNameA

• 0x4436c8 GetClassLongPtrA

• 0x4436d0 SetPropA

• 0x4436d8 GetPropA

• 0x4436e0 RemovePropA

• 0x4436e8 IsWindow

• 0x4436f0 SetFocus

• 0x4436f8 GetWindowTextLengthA

• 0x443700 GetWindowTextA

• 0x443708 GetForegroundWindow

• 0x443710 GetLastActivePopup

• 0x443718 SetActiveWindow

• 0x443720 DispatchMessageA

• 0x443728 GetDlgItem

• 0x443730 DestroyWindow

• 0x443738 GetWindowLongPtrA

• 0x443740 SetWindowLongPtrA

• 0x443748 UnhookWindowsHookEx

• 0x443750 GetMessageTime

• 0x443758 GetMessagePos

• 0x443760 PeekMessageA

• 0x443768 MapWindowPoints

• 0x443770 GetKeyState

• 0x443778 SetForegroundWindow

• 0x443780 IsWindowVisible

• 0x443788 UpdateWindow

• 0x443790 GetMenu

• 0x443798 GetSubMenu

• 0x4437a0 GetMenuItemID

• 0x4437a8 GetMenuItemCount

• 0x4437b0 MessageBoxA

• 0x4437b8 CreateWindowExA

• 0x4437c0 GetClassInfoExA

• 0x4437c8 GetClassInfoA

• 0x4437d0 RegisterClassA

• 0x4437d8 GetSysColor

• 0x4437e0 AdjustWindowRectEx

• 0x4437e8 CopyRect

• 0x4437f0 PtInRect

• 0x4437f8 GetDlgCtrlID

• 0x443800 DefWindowProcA

• 0x443808 CallWindowProcA

• 0x443810 GetWindowLongA

• 0x443818 SetWindowLongA

• 0x443820 DestroyMenu

• 0x443828 LoadCursorA

• 0x443830 GetSysColorBrush

• 0x443838 WinHelpA

• 0x443840 EndPaint

• 0x443848 SetWindowPos

• 0x443850 SystemParametersInfoA

• 0x443858 GetWindowPlacement

• 0x443860 GetWindowRect

• 0x443868 GetWindow

• 0x443870 SetMenuItemBitmaps

• 0x443878 GetMenuCheckMarkDimensions

• 0x443880 LoadBitmapA

• 0x443888 GetFocus

• 0x443890 GetParent

• 0x443898 ModifyMenuA

• 0x4438a0 GetMenuState

• 0x4438a8 EnableMenuItem

• 0x4438b0 CheckMenuItem

• 0x4438b8 CharUpperA

• 0x4438c0 PostMessageA

• 0x4438c8 GetSystemMetrics

• 0x4438d0 LoadIconA

• 0x4438d8 KillTimer

• 0x4438e0 SetTimer

• 0x4438e8 InvalidateRect

• 0x4438f0 GetClientRect

• 0x4438f8 IsIconic

• 0x443900 DrawIcon

• 0x443908 SendMessageA

• 0x443910 EnableWindow

• 0x443918 GetTopWindow

Library GDI32.dll:

• 0x443050 SetWindowExtEx

• 0x443058 ScaleWindowExtEx

• 0x443060 DeleteDC

• 0x443068 GetStockObject

• 0x443070 ScaleViewportExtEx

• 0x443078 SetViewportExtEx

• 0x443080 OffsetViewportOrgEx

• 0x443088 SetViewportOrgEx

• 0x443090 SelectObject

• 0x443098 Escape

• 0x4430a0 ExtTextOutA

• 0x4430a8 TextOutA

• 0x4430b0 RectVisible

• 0x4430b8 CreateBitmap

• 0x4430c0 DeleteObject

• 0x4430c8 SetMapMode

• 0x4430d0 RestoreDC

• 0x4430d8 SaveDC

• 0x4430e0 GetDeviceCaps

• 0x4430e8 GetObjectA

• 0x4430f0 SetBkColor

• 0x4430f8 SetTextColor

• 0x443100 GetClipBox

• 0x443108 PtVisible

Library comdlg32.dll:

• 0x4439e0 GetFileTitleA

Library WINSPOOL.DRV:

• 0x443928 ClosePrinter

• 0x443930 OpenPrinterA

• 0x443938 DocumentPropertiesA

Library ADVAPI32.dll:

• 0x443000 RegCreateKeyExA

• 0x443008 RegQueryValueA

• 0x443010 RegEnumKeyA

• 0x443018 RegDeleteKeyA

• 0x443020 RegOpenKeyExA

• 0x443028 RegQueryValueExA

• 0x443030 RegOpenKeyA

• 0x443038 RegSetValueExA

• 0x443040 RegCloseKey

Library SHLWAPI.dll:

• 0x4435a0 PathFindFileNameA

• 0x4435a8 PathStripToRootA

• 0x4435b0 PathFindExtensionA

• 0x4435b8 PathIsUNCA

Library OLEAUT32.dll:

• 0x443580 VariantClear

• 0x443588 VariantChangeType

• 0x443590 VariantInit

Library WS2_32.dll:

• 0x443948 bind

• 0x443950 listen

• 0x443958 WSAWaitForMultipleEvents

• 0x443960 WSAEnumNetworkEvents

• 0x443968 WSACleanup

• 0x443970 WSAEventSelect

• 0x443978 WSACloseEvent

• 0x443980 gethostbyname

• 0x443988 socket

• 0x443990 WSAGetLastError

• 0x443998 WSACreateEvent

• 0x4439a0 WSASocketA

• 0x4439a8 htons

• 0x4439b0 inet_ntoa

• 0x4439b8 getpeername

• 0x4439c0 closesocket

• 0x4439c8 setsockopt

• 0x4439d0 WSAStartup

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	62192	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.