SmartHawk

5.0

中危

55 个模型检测该样本为恶意！

重新分析

下载样本

f01669ff0af4c1b8f4f15985fae94c302537ed8affc5b2fe01534594036218f2

622dca0ee8175c9a20456d8892d35a80.exe

分析耗时

90s

最近分析

文件大小

984.5KB

静态报毒动态报毒 9GX@AAUENPOI AGEN AI SCORE=81 AIDETECTVM CLOUD CONFIDENCE DELF EKLE FUERY GDSDA GEMC GENERICKD GENERICRXLL GENKRYPTIK HIGH CONFIDENCE HOIMSU KRYPTIK MALICIOUS PE MALREP MALWARE1 MALWARE@#TJ7412THZOIO NOON SCORE SIGGEN9 THGAHBO UNSAFE WLFP YMACCO ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	GenericRXLL-JO!622DCA0EE817	20200805	6.0.6.653
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0
Alibaba	TrojanDownloader:Win32/Generic.d7e153bb	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20200805	18.4.3895.0
Tencent	Win32.Trojan-spy.Noon.Wlfp	20200805	1.0.0.1
Kingsoft		20200805	2013.8.14.323

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619619559.571124 __exception__	stacktrace: 0x3379696 0x33796c9 0x33795e6 0x332f720 0x337a099 0x337afb6 0x333e3fa gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x775a62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x775a6d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x775a77c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x775a7bca 0x33767ec 0x337b27f 622dca0ee8175c9a20456d8892d35a80+0x68f4a @ 0x468f4a registers.esp: 1634012 registers.edi: 0 registers.eax: 1634012 registers.ebp: 1634092 registers.edx: 0 registers.ebx: 1635768 registers.esi: 57886172 registers.ecx: 7 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x778eb727	success	0	0

Allocates read-write-execute memory (usually to unpack itself) (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619619511.508124 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00550000	success	0	0
1619619528.102124 NtAllocateVirtualMemory	process_identifier: 1320 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x033a0000	success	0	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Disables proxy possibly for traffic interception (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619619538.337124 RegSetValueExA	key_handle: 0x000002c0 value: 0 regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	success	0	0

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)

Bkav	W32.AIDetectVM.malware1
MicroWorld-eScan	Trojan.GenericKD.43513766
FireEye	Generic.mg.622dca0ee8175c9a
CAT-QuickHeal	Trojanspy.Noon
McAfee	GenericRXLL-JO!622DCA0EE817
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
CrowdStrike	win/malicious_confidence_90% (W)
Alibaba	TrojanDownloader:Win32/Generic.d7e153bb
K7GW	Riskware ( 0040eff71 )
K7AntiVirus	Riskware ( 0040eff71 )
Arcabit	Trojan.Generic.D297F7A6
TrendMicro	Trojan.Win32.MALREP.THGAHBO
BitDefenderTheta	Gen:NN.ZelphiF.34152.9GX@aaUENPoi
Symantec	Trojan Horse
TrendMicro-HouseCall	Trojan.Win32.MALREP.THGAHBO
Avast	Win32:Trojan-gen
Kaspersky	HEUR:Trojan-Spy.Win32.Noon.gen
BitDefender	Trojan.GenericKD.43513766
NANO-Antivirus	Trojan.Win32.Noon.hoimsu
Paloalto	generic.ml
AegisLab	Trojan.Multi.Generic.4!c
Tencent	Win32.Trojan-spy.Noon.Wlfp
Endgame	malicious (high confidence)
Sophos	Mal/Generic-S
Comodo	Malware@#tj7412thzoio
F-Secure	Heuristic.HEUR/AGEN.1136974
DrWeb	Trojan.Siggen9.60184
Zillya	Downloader.Delf.Win32.59498
SentinelOne	DFI - Malicious PE
Emsisoft	Trojan.GenericKD.43513766 (B)
APEX	Malicious
Cyren	W32/Trojan.GEMC-0039
Avira	HEUR/AGEN.1136974
Antiy-AVL	Trojan[Spy]/Win32.Noon
Microsoft	Trojan:Win32/Ymacco.AAF0
ViRobot	Trojan.Win32.Z.Agent.1008130
ZoneAlarm	HEUR:Trojan-Spy.Win32.Noon.gen
GData	Trojan.GenericKD.43513766
Cynet	Malicious (score: 90)
AhnLab-V3	Malware/Win32.Generic.C4163244
VBA32	Trojan.Fuery
ALYac	Trojan.GenericKD.43513766
MAX	malware (ai score=81)
Ad-Aware	Trojan.GenericKD.43513766
Malwarebytes	Trojan.Crypt
ESET-NOD32	Win32/TrojanDownloader.Delf.CYK
Rising	Trojan.Kryptik!1.C56D (CLOUD)
Ikarus	Trojan.Inject

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443
dead_host	31.13.70.13:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x4d2168 DeleteCriticalSection

• 0x4d216c LeaveCriticalSection

• 0x4d2170 EnterCriticalSection

• 0x4d2174 InitializeCriticalSection

• 0x4d2178 VirtualFree

• 0x4d217c VirtualAlloc

• 0x4d2180 LocalFree

• 0x4d2184 LocalAlloc

• 0x4d2188 GetTickCount

• 0x4d218c QueryPerformanceCounter

• 0x4d2190 GetVersion

• 0x4d2194 GetCurrentThreadId

• 0x4d2198 InterlockedDecrement

• 0x4d219c InterlockedIncrement

• 0x4d21a0 VirtualQuery

• 0x4d21a4 WideCharToMultiByte

• 0x4d21a8 MultiByteToWideChar

• 0x4d21ac lstrlenA

• 0x4d21b0 lstrcpynA

• 0x4d21b4 LoadLibraryExA

• 0x4d21b8 GetThreadLocale

• 0x4d21bc GetStartupInfoA

• 0x4d21c0 GetProcAddress

• 0x4d21c4 GetModuleHandleA

• 0x4d21c8 GetModuleFileNameA

• 0x4d21cc GetLocaleInfoA

• 0x4d21d0 GetCommandLineA

• 0x4d21d4 FreeLibrary

• 0x4d21d8 FindFirstFileA

• 0x4d21dc FindClose

• 0x4d21e0 ExitProcess

• 0x4d21e4 WriteFile

• 0x4d21e8 UnhandledExceptionFilter

• 0x4d21ec RtlUnwind

• 0x4d21f0 RaiseException

• 0x4d21f4 GetStdHandle

Library user32.dll:

• 0x4d21fc GetKeyboardType

• 0x4d2200 LoadStringA

• 0x4d2204 MessageBoxA

• 0x4d2208 CharNextA

Library advapi32.dll:

• 0x4d2210 RegQueryValueExA

• 0x4d2214 RegOpenKeyExA

• 0x4d2218 RegCloseKey

Library oleaut32.dll:

• 0x4d2220 SysFreeString

• 0x4d2224 SysReAllocStringLen

• 0x4d2228 SysAllocStringLen

Library kernel32.dll:

• 0x4d2230 TlsSetValue

• 0x4d2234 TlsGetValue

• 0x4d2238 LocalAlloc

• 0x4d223c GetModuleHandleA

Library advapi32.dll:

• 0x4d2244 RegQueryValueExA

• 0x4d2248 RegOpenKeyExA

• 0x4d224c RegCloseKey

Library kernel32.dll:

• 0x4d2254 lstrcpyA

• 0x4d2258 WriteFile

• 0x4d225c WaitForSingleObject

• 0x4d2260 VirtualQuery

• 0x4d2264 VirtualProtect

• 0x4d2268 VirtualAlloc

• 0x4d226c Sleep

• 0x4d2270 SizeofResource

• 0x4d2274 SetThreadLocale

• 0x4d2278 SetFilePointer

• 0x4d227c SetEvent

• 0x4d2280 SetErrorMode

• 0x4d2284 SetEndOfFile

• 0x4d2288 ResetEvent

• 0x4d228c ReadFile

• 0x4d2290 MultiByteToWideChar

• 0x4d2294 MulDiv

• 0x4d2298 LockResource

• 0x4d229c LoadResource

• 0x4d22a0 LoadLibraryA

• 0x4d22a4 LeaveCriticalSection

• 0x4d22a8 InitializeCriticalSection

• 0x4d22ac GlobalUnlock

• 0x4d22b0 GlobalReAlloc

• 0x4d22b4 GlobalHandle

• 0x4d22b8 GlobalLock

• 0x4d22bc GlobalFree

• 0x4d22c0 GlobalFindAtomA

• 0x4d22c4 GlobalDeleteAtom

• 0x4d22c8 GlobalAlloc

• 0x4d22cc GlobalAddAtomA

• 0x4d22d0 GetVersionExA

• 0x4d22d4 GetVersion

• 0x4d22d8 GetTickCount

• 0x4d22dc GetThreadLocale

• 0x4d22e0 GetSystemInfo

• 0x4d22e4 GetStringTypeExA

• 0x4d22e8 GetStdHandle

• 0x4d22ec GetProcAddress

• 0x4d22f0 GetModuleHandleA

• 0x4d22f4 GetModuleFileNameA

• 0x4d22f8 GetLocaleInfoA

• 0x4d22fc GetLocalTime

• 0x4d2300 GetLastError

• 0x4d2304 GetFullPathNameA

• 0x4d2308 GetDiskFreeSpaceA

• 0x4d230c GetDateFormatA

• 0x4d2310 GetCurrentThreadId

• 0x4d2314 GetCurrentProcessId

• 0x4d2318 GetCPInfo

• 0x4d231c GetACP

• 0x4d2320 FreeResource

• 0x4d2324 InterlockedExchange

• 0x4d2328 FreeLibrary

• 0x4d232c FormatMessageA

• 0x4d2330 FindResourceA

• 0x4d2334 ExitProcess

• 0x4d2338 EnumCalendarInfoA

• 0x4d233c EnterCriticalSection

• 0x4d2340 DeleteCriticalSection

• 0x4d2344 CreateThread

• 0x4d2348 CreateFileA

• 0x4d234c CreateEventA

• 0x4d2350 CompareStringA

• 0x4d2354 CloseHandle

Library version.dll:

• 0x4d235c VerQueryValueA

• 0x4d2360 GetFileVersionInfoSizeA

• 0x4d2364 GetFileVersionInfoA

Library gdi32.dll:

• 0x4d236c UnrealizeObject

• 0x4d2370 StretchBlt

• 0x4d2374 SetWindowOrgEx

• 0x4d2378 SetViewportOrgEx

• 0x4d237c SetTextColor

• 0x4d2380 SetStretchBltMode

• 0x4d2384 SetROP2

• 0x4d2388 SetPixel

• 0x4d238c SetDIBColorTable

• 0x4d2390 SetBrushOrgEx

• 0x4d2394 SetBkMode

• 0x4d2398 SetBkColor

• 0x4d239c SelectPalette

• 0x4d23a0 SelectObject

• 0x4d23a4 SelectClipRgn

• 0x4d23a8 SaveDC

• 0x4d23ac RestoreDC

• 0x4d23b0 Rectangle

• 0x4d23b4 RectVisible

• 0x4d23b8 RealizePalette

• 0x4d23bc Polyline

• 0x4d23c0 PatBlt

• 0x4d23c4 MoveToEx

• 0x4d23c8 MaskBlt

• 0x4d23cc LineTo

• 0x4d23d0 IntersectClipRect

• 0x4d23d4 GetWindowOrgEx

• 0x4d23d8 GetTextMetricsA

• 0x4d23dc GetTextExtentPoint32A

• 0x4d23e0 GetSystemPaletteEntries

• 0x4d23e4 GetStockObject

• 0x4d23e8 GetRgnBox

• 0x4d23ec GetPixel

• 0x4d23f0 GetPaletteEntries

• 0x4d23f4 GetObjectA

• 0x4d23f8 GetGraphicsMode

• 0x4d23fc GetDeviceCaps

• 0x4d2400 GetDIBits

• 0x4d2404 GetDIBColorTable

• 0x4d2408 GetDCOrgEx

• 0x4d240c GetCurrentPositionEx

• 0x4d2410 GetClipBox

• 0x4d2414 GetBrushOrgEx

• 0x4d2418 GetBitmapBits

• 0x4d241c ExcludeClipRect

• 0x4d2420 DeleteObject

• 0x4d2424 DeleteDC

• 0x4d2428 CreateSolidBrush

• 0x4d242c CreateRectRgn

• 0x4d2430 CreatePenIndirect

• 0x4d2434 CreatePalette

• 0x4d2438 CreateHalftonePalette

• 0x4d243c CreateFontIndirectA

• 0x4d2440 CreateDIBitmap

• 0x4d2444 CreateDIBSection

• 0x4d2448 CreateCompatibleDC

• 0x4d244c CreateCompatibleBitmap

• 0x4d2450 CreateBrushIndirect

• 0x4d2454 CreateBitmap

• 0x4d2458 CombineRgn

• 0x4d245c BitBlt

Library user32.dll:

• 0x4d2464 CreateWindowExA

• 0x4d2468 WindowFromPoint

• 0x4d246c WinHelpA

• 0x4d2470 WaitMessage

• 0x4d2474 UpdateWindow

• 0x4d2478 UnregisterClassA

• 0x4d247c UnhookWindowsHookEx

• 0x4d2480 TranslateMessage

• 0x4d2484 TranslateMDISysAccel

• 0x4d2488 TrackPopupMenu

• 0x4d248c SystemParametersInfoA

• 0x4d2490 ShowWindow

• 0x4d2494 ShowScrollBar

• 0x4d2498 ShowOwnedPopups

• 0x4d249c ShowCursor

• 0x4d24a0 SetWindowsHookExA

• 0x4d24a4 SetWindowTextA

• 0x4d24a8 SetWindowPos

• 0x4d24ac SetWindowPlacement

• 0x4d24b0 SetWindowLongA

• 0x4d24b4 SetTimer

• 0x4d24b8 SetScrollRange

• 0x4d24bc SetScrollPos

• 0x4d24c0 SetScrollInfo

• 0x4d24c4 SetRect

• 0x4d24c8 SetPropA

• 0x4d24cc SetParent

• 0x4d24d0 SetMenuItemInfoA

• 0x4d24d4 SetMenu

• 0x4d24d8 SetForegroundWindow

• 0x4d24dc SetFocus

• 0x4d24e0 SetCursor

• 0x4d24e4 SetClassLongA

• 0x4d24e8 SetCapture

• 0x4d24ec SetActiveWindow

• 0x4d24f0 SendMessageA

• 0x4d24f4 ScrollWindow

• 0x4d24f8 ScreenToClient

• 0x4d24fc RemovePropA

• 0x4d2500 RemoveMenu

• 0x4d2504 ReleaseDC

• 0x4d2508 ReleaseCapture

• 0x4d250c RegisterWindowMessageA

• 0x4d2510 RegisterClipboardFormatA

• 0x4d2514 RegisterClassA

• 0x4d2518 RedrawWindow

• 0x4d251c PtInRect

• 0x4d2520 PostQuitMessage

• 0x4d2524 PostMessageA

• 0x4d2528 PeekMessageA

• 0x4d252c OffsetRect

• 0x4d2530 OemToCharA

• 0x4d2534 MessageBoxA

• 0x4d2538 MapWindowPoints

• 0x4d253c MapVirtualKeyA

• 0x4d2540 LoadStringA

• 0x4d2544 LoadKeyboardLayoutA

• 0x4d2548 LoadIconA

• 0x4d254c LoadCursorA

• 0x4d2550 LoadBitmapA

• 0x4d2554 KillTimer

• 0x4d2558 IsZoomed

• 0x4d255c IsWindowVisible

• 0x4d2560 IsWindowEnabled

• 0x4d2564 IsWindow

• 0x4d2568 IsRectEmpty

• 0x4d256c IsIconic

• 0x4d2570 IsDialogMessageA

• 0x4d2574 IsChild

• 0x4d2578 InvalidateRect

• 0x4d257c IntersectRect

• 0x4d2580 InsertMenuItemA

• 0x4d2584 InsertMenuA

• 0x4d2588 InflateRect

• 0x4d258c GetWindowThreadProcessId

• 0x4d2590 GetWindowTextA

• 0x4d2594 GetWindowRect

• 0x4d2598 GetWindowPlacement

• 0x4d259c GetWindowLongA

• 0x4d25a0 GetWindowDC

• 0x4d25a4 GetTopWindow

• 0x4d25a8 GetSystemMetrics

• 0x4d25ac GetSystemMenu

• 0x4d25b0 GetSysColorBrush

• 0x4d25b4 GetSysColor

• 0x4d25b8 GetSubMenu

• 0x4d25bc GetScrollRange

• 0x4d25c0 GetScrollPos

• 0x4d25c4 GetScrollInfo

• 0x4d25c8 GetPropA

• 0x4d25cc GetParent

• 0x4d25d0 GetWindow

• 0x4d25d4 GetMenuStringA

• 0x4d25d8 GetMenuState

• 0x4d25dc GetMenuItemInfoA

• 0x4d25e0 GetMenuItemID

• 0x4d25e4 GetMenuItemCount

• 0x4d25e8 GetMenu

• 0x4d25ec GetLastActivePopup

• 0x4d25f0 GetKeyboardState

• 0x4d25f4 GetKeyboardLayoutList

• 0x4d25f8 GetKeyboardLayout

• 0x4d25fc GetKeyState

• 0x4d2600 GetKeyNameTextA

• 0x4d2604 GetIconInfo

• 0x4d2608 GetForegroundWindow

• 0x4d260c GetFocus

• 0x4d2610 GetDesktopWindow

• 0x4d2614 GetDCEx

• 0x4d2618 GetDC

• 0x4d261c GetCursorPos

• 0x4d2620 GetCursor

• 0x4d2624 GetClientRect

• 0x4d2628 GetClassNameA

• 0x4d262c GetClassInfoA

• 0x4d2630 GetCapture

• 0x4d2634 GetActiveWindow

• 0x4d2638 FrameRect

• 0x4d263c FindWindowA

• 0x4d2640 FillRect

• 0x4d2644 EqualRect

• 0x4d2648 EnumWindows

• 0x4d264c EnumThreadWindows

• 0x4d2650 EndPaint

• 0x4d2654 EnableWindow

• 0x4d2658 EnableScrollBar

• 0x4d265c EnableMenuItem

• 0x4d2660 DrawTextA

• 0x4d2664 DrawMenuBar

• 0x4d2668 DrawIconEx

• 0x4d266c DrawIcon

• 0x4d2670 DrawFrameControl

• 0x4d2674 DrawEdge

• 0x4d2678 DispatchMessageA

• 0x4d267c DestroyWindow

• 0x4d2680 DestroyMenu

• 0x4d2684 DestroyIcon

• 0x4d2688 DestroyCursor

• 0x4d268c DeleteMenu

• 0x4d2690 DefWindowProcA

• 0x4d2694 DefMDIChildProcA

• 0x4d2698 DefFrameProcA

• 0x4d269c CreatePopupMenu

• 0x4d26a0 CreateMenu

• 0x4d26a4 CreateIcon

• 0x4d26a8 ClientToScreen

• 0x4d26ac CheckMenuItem

• 0x4d26b0 CallWindowProcA

• 0x4d26b4 CallNextHookEx

• 0x4d26b8 BeginPaint

• 0x4d26bc CharNextA

• 0x4d26c0 CharLowerA

• 0x4d26c4 CharUpperBuffA

• 0x4d26c8 CharToOemA

• 0x4d26cc AdjustWindowRectEx

• 0x4d26d0 ActivateKeyboardLayout

Library kernel32.dll:

• 0x4d26d8 Sleep

Library oleaut32.dll:

• 0x4d26e0 SafeArrayPtrOfIndex

• 0x4d26e4 SafeArrayPutElement

• 0x4d26e8 SafeArrayGetElement

• 0x4d26ec SafeArrayUnaccessData

• 0x4d26f0 SafeArrayAccessData

• 0x4d26f4 SafeArrayGetUBound

• 0x4d26f8 SafeArrayGetLBound

• 0x4d26fc SafeArrayCreate

• 0x4d2700 VariantChangeType

• 0x4d2704 VariantCopyInd

• 0x4d2708 VariantCopy

• 0x4d270c VariantClear

• 0x4d2710 VariantInit

Library ole32.dll:

• 0x4d2718 CoUninitialize

• 0x4d271c CoInitialize

Library oleaut32.dll:

• 0x4d2724 GetErrorInfo

• 0x4d2728 SysFreeString

Library comctl32.dll:

• 0x4d2730 ImageList_SetIconSize

• 0x4d2734 ImageList_GetIconSize

• 0x4d2738 ImageList_Write

• 0x4d273c ImageList_Read

• 0x4d2740 ImageList_GetDragImage

• 0x4d2744 ImageList_DragShowNolock

• 0x4d2748 ImageList_SetDragCursorImage

• 0x4d274c ImageList_DragMove

• 0x4d2750 ImageList_DragLeave

• 0x4d2754 ImageList_DragEnter

• 0x4d2758 ImageList_EndDrag

• 0x4d275c ImageList_BeginDrag

• 0x4d2760 ImageList_Remove

• 0x4d2764 ImageList_DrawEx

• 0x4d2768 ImageList_Draw

• 0x4d276c ImageList_GetBkColor

• 0x4d2770 ImageList_SetBkColor

• 0x4d2774 ImageList_ReplaceIcon

• 0x4d2778 ImageList_Add

• 0x4d277c ImageList_SetImageCount

• 0x4d2780 ImageList_GetImageCount

• 0x4d2784 ImageList_Destroy

• 0x4d2788 ImageList_Create

• 0x4d278c InitCommonControls

Library advapi32.dll:

• 0x4d2794 QueryServiceStatus

• 0x4d2798 OpenServiceA

• 0x4d279c OpenSCManagerA

• 0x4d27a0 CloseServiceHandle

Library url.dll:

• 0x4d27a8 InetIsOffline

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
www.microsoft.com	CNAME www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net CNAME e13678.ca2.s.tl88.net CNAME www.microsoft.com-c-3.edgekey.net A 27.148.139.88	27.148.139.88
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	CNAME clients.l.google.com A 216.58.200.238 A 172.217.160.110	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
cdn.discordapp.com	A 31.13.70.13	174.36.228.136
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53210	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	61680	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.