SmartHawk

5.2

中危

51 个模型检测该样本为恶意！

重新分析

下载样本

a95c6a61523704d369aa61231c2c1ae80c1ce87911f519b4108a40306b2152ac

69d0604790a25ff67938fa344b09d3b3.exe

分析耗时

92s

最近分析

文件大小

968.8KB

静态报毒动态报毒 100% 23IWAY+QOWE 8GY@A04U82KI AI SCORE=85 ATTRIBUTE BSCOPE CONFIDENCE CRYPTERX CXKJB DAPATO DELF DOWNLOADER34 EQHJ FALSESIGN GDSDA GENERIC PUA LA GENKRYPTIK HACKTOOL HDGA HIGH CONFIDENCE HIGHCONFIDENCE HRVAAQ INVALIDSIG KCLOUD MALICIOUS PE MALWARE@#8QOKR4IN2TX5 REMCOS RUNNER SAVE SCORE STATIC AI UNSAFE WLEA WSAI ZELPHIF ZUSY 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
CrowdStrike	win/malicious_confidence_100% (W)	20210203	1.0
Alibaba	Trojan:Win32/Injector.5cf987aa	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Kingsoft	Win32.HackTool.Undef.(kcloud)	20210309	2017.9.26.565
McAfee		20210310	6.0.6.653
Tencent	Win32.Trojan.Falsesign.Wsai	20210309	1.0.0.1
Avast	Win32:CrypterX-gen [Trj]	20210309	21.1.5827.0

This executable is signed

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619623915.341501 __exception__	stacktrace: 0x343b506 0x343b539 0x343b456 0x33ef7f8 0x343c0ea 0x343c5e1 0x33fee6a gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x775a62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x775a6d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x775a77c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x775a7bca 0x34348b4 0x343c8fd 69d0604790a25ff67938fa344b09d3b3+0x596bc @ 0x4596bc registers.esp: 1633832 registers.edi: 0 registers.eax: 1633832 registers.ebp: 1633912 registers.edx: 0 registers.ebx: 1635588 registers.esi: 54937852 registers.ecx: 7 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x778eb727	success	0	0

Allocates read-write-execute memory (usually to unpack itself) (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619623861.075501 NtAllocateVirtualMemory	process_identifier: 196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00600000	success	0	0
1619623877.013501 NtAllocateVirtualMemory	process_identifier: 196 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x020b0000	success	0	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Disables proxy possibly for traffic interception (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619623894.028501 RegSetValueExA	key_handle: 0x000002cc value: 0 regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	success	0	0

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 个事件)

Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader34.22502
MicroWorld-eScan	Gen:Variant.Zusy.336997
FireEye	Generic.mg.69d0604790a25ff6
ALYac	Backdoor.Remcos.A
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Win32.Delf.4!c
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan-Downloader ( 0056f5a71 )
BitDefender	Gen:Variant.Zusy.336997
K7GW	Trojan-Downloader ( 0056f5a71 )
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZelphiF.34608.8GY@a04U82ki
Cyren	W32/Trojan.HDGA-6978
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.Win32.Delf.gen
Alibaba	Trojan:Win32/Injector.5cf987aa
NANO-Antivirus	Trojan.Win32.Dwn.hrvaaq
Ad-Aware	Gen:Variant.Zusy.336997
Comodo	Malware@#8qokr4in2tx5
F-Secure	Trojan.TR/Injector.cxkjb
TrendMicro	Trojan.Win32.DELF.WLEA
Sophos	Generic PUA LA (PUA)
SentinelOne	Static AI - Malicious PE
GData	Gen:Variant.Zusy.336997
Avira	TR/Injector.cxkjb
Antiy-AVL	Trojan/Win32.Injector
Kingsoft	Win32.HackTool.Undef.(kcloud)
Gridinsoft	Trojan.Win32.Agent.oa
Arcabit	Trojan.Zusy.D52465
AhnLab-V3	Downloader/Win32.Agent.C4180520
ZoneAlarm	HEUR:Trojan.Win32.Delf.gen
Cynet	Malicious (score: 100)
ESET-NOD32	Win32/TrojanDownloader.Delf.CZJ
MAX	malware (ai score=85)
VBA32	BScope.TrojanDropper.Dapato
Malwarebytes	Trojan.Downloader.DLF
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Trojan.Win32.DELF.WLEA
Tencent	Win32.Trojan.Falsesign.Wsai
Yandex	Trojan.Injector!23IwAy+qowE
Ikarus	Trojan.VBS.Runner
eGambit	PE.Heur.InvalidSig
Fortinet	W32/GenKryptik.EQHJ!tr
AVG	Win32:CrypterX-gen [Trj]
Cybereason	malicious.790a25
Avast	Win32:CrypterX-gen [Trj]

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443
dead_host	104.244.46.208:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x4cf140 DeleteCriticalSection

• 0x4cf144 LeaveCriticalSection

• 0x4cf148 EnterCriticalSection

• 0x4cf14c InitializeCriticalSection

• 0x4cf150 VirtualFree

• 0x4cf154 VirtualAlloc

• 0x4cf158 LocalFree

• 0x4cf15c LocalAlloc

• 0x4cf160 GetTickCount

• 0x4cf164 QueryPerformanceCounter

• 0x4cf168 GetVersion

• 0x4cf16c GetCurrentThreadId

• 0x4cf170 InterlockedDecrement

• 0x4cf174 InterlockedIncrement

• 0x4cf178 VirtualQuery

• 0x4cf17c WideCharToMultiByte

• 0x4cf180 MultiByteToWideChar

• 0x4cf184 lstrlenA

• 0x4cf188 lstrcpynA

• 0x4cf18c LoadLibraryExA

• 0x4cf190 GetThreadLocale

• 0x4cf194 GetStartupInfoA

• 0x4cf198 GetProcAddress

• 0x4cf19c GetModuleHandleA

• 0x4cf1a0 GetModuleFileNameA

• 0x4cf1a4 GetLocaleInfoA

• 0x4cf1a8 GetCommandLineA

• 0x4cf1ac FreeLibrary

• 0x4cf1b0 FindFirstFileA

• 0x4cf1b4 FindClose

• 0x4cf1b8 ExitProcess

• 0x4cf1bc WriteFile

• 0x4cf1c0 UnhandledExceptionFilter

• 0x4cf1c4 RtlUnwind

• 0x4cf1c8 RaiseException

• 0x4cf1cc GetStdHandle

Library user32.dll:

• 0x4cf1d4 GetKeyboardType

• 0x4cf1d8 LoadStringA

• 0x4cf1dc MessageBoxA

• 0x4cf1e0 CharNextA

Library advapi32.dll:

• 0x4cf1e8 RegQueryValueExA

• 0x4cf1ec RegOpenKeyExA

• 0x4cf1f0 RegCloseKey

Library oleaut32.dll:

• 0x4cf1f8 SysFreeString

• 0x4cf1fc SysReAllocStringLen

• 0x4cf200 SysAllocStringLen

Library kernel32.dll:

• 0x4cf208 TlsSetValue

• 0x4cf20c TlsGetValue

• 0x4cf210 LocalAlloc

• 0x4cf214 GetModuleHandleA

Library advapi32.dll:

• 0x4cf21c RegQueryValueExA

• 0x4cf220 RegOpenKeyExA

• 0x4cf224 RegCloseKey

Library kernel32.dll:

• 0x4cf22c lstrcpyA

• 0x4cf230 WriteFile

• 0x4cf234 WaitForSingleObject

• 0x4cf238 VirtualQuery

• 0x4cf23c VirtualProtect

• 0x4cf240 VirtualAlloc

• 0x4cf244 Sleep

• 0x4cf248 SizeofResource

• 0x4cf24c SetThreadLocale

• 0x4cf250 SetFilePointer

• 0x4cf254 SetEvent

• 0x4cf258 SetErrorMode

• 0x4cf25c SetEndOfFile

• 0x4cf260 ResetEvent

• 0x4cf264 ReadFile

• 0x4cf268 MulDiv

• 0x4cf26c LockResource

• 0x4cf270 LoadResource

• 0x4cf274 LoadLibraryA

• 0x4cf278 LeaveCriticalSection

• 0x4cf27c InitializeCriticalSection

• 0x4cf280 GlobalUnlock

• 0x4cf284 GlobalReAlloc

• 0x4cf288 GlobalHandle

• 0x4cf28c GlobalLock

• 0x4cf290 GlobalFree

• 0x4cf294 GlobalFindAtomA

• 0x4cf298 GlobalDeleteAtom

• 0x4cf29c GlobalAlloc

• 0x4cf2a0 GlobalAddAtomA

• 0x4cf2a4 GetVersionExA

• 0x4cf2a8 GetVersion

• 0x4cf2ac GetTickCount

• 0x4cf2b0 GetThreadLocale

• 0x4cf2b4 GetSystemInfo

• 0x4cf2b8 GetStringTypeExA

• 0x4cf2bc GetStdHandle

• 0x4cf2c0 GetProcAddress

• 0x4cf2c4 GetModuleHandleA

• 0x4cf2c8 GetModuleFileNameA

• 0x4cf2cc GetLocaleInfoA

• 0x4cf2d0 GetLocalTime

• 0x4cf2d4 GetLastError

• 0x4cf2d8 GetFullPathNameA

• 0x4cf2dc GetDiskFreeSpaceA

• 0x4cf2e0 GetDateFormatA

• 0x4cf2e4 GetCurrentThreadId

• 0x4cf2e8 GetCurrentProcessId

• 0x4cf2ec GetCPInfo

• 0x4cf2f0 GetACP

• 0x4cf2f4 FreeResource

• 0x4cf2f8 InterlockedExchange

• 0x4cf2fc FreeLibrary

• 0x4cf300 FormatMessageA

• 0x4cf304 FindResourceA

• 0x4cf308 EnumCalendarInfoA

• 0x4cf30c EnterCriticalSection

• 0x4cf310 DeleteCriticalSection

• 0x4cf314 CreateThread

• 0x4cf318 CreateFileA

• 0x4cf31c CreateEventA

• 0x4cf320 CompareStringA

• 0x4cf324 CloseHandle

Library version.dll:

• 0x4cf32c VerQueryValueA

• 0x4cf330 GetFileVersionInfoSizeA

• 0x4cf334 GetFileVersionInfoA

Library gdi32.dll:

• 0x4cf33c UnrealizeObject

• 0x4cf340 StretchBlt

• 0x4cf344 SetWindowOrgEx

• 0x4cf348 SetWinMetaFileBits

• 0x4cf34c SetViewportOrgEx

• 0x4cf350 SetTextColor

• 0x4cf354 SetStretchBltMode

• 0x4cf358 SetROP2

• 0x4cf35c SetPixel

• 0x4cf360 SetEnhMetaFileBits

• 0x4cf364 SetDIBColorTable

• 0x4cf368 SetBrushOrgEx

• 0x4cf36c SetBkMode

• 0x4cf370 SetBkColor

• 0x4cf374 SelectPalette

• 0x4cf378 SelectObject

• 0x4cf37c SaveDC

• 0x4cf380 RestoreDC

• 0x4cf384 Rectangle

• 0x4cf388 RectVisible

• 0x4cf38c RealizePalette

• 0x4cf390 PlayEnhMetaFile

• 0x4cf394 PatBlt

• 0x4cf398 MoveToEx

• 0x4cf39c MaskBlt

• 0x4cf3a0 LineTo

• 0x4cf3a4 IntersectClipRect

• 0x4cf3a8 GetWindowOrgEx

• 0x4cf3ac GetWinMetaFileBits

• 0x4cf3b0 GetTextMetricsA

• 0x4cf3b4 GetTextExtentPointA

• 0x4cf3b8 GetTextExtentPoint32A

• 0x4cf3bc GetSystemPaletteEntries

• 0x4cf3c0 GetStockObject

• 0x4cf3c4 GetROP2

• 0x4cf3c8 GetPixelFormat

• 0x4cf3cc GetPixel

• 0x4cf3d0 GetPaletteEntries

• 0x4cf3d4 GetObjectA

• 0x4cf3d8 GetMapMode

• 0x4cf3dc GetGraphicsMode

• 0x4cf3e0 GetEnhMetaFilePaletteEntries

• 0x4cf3e4 GetEnhMetaFileHeader

• 0x4cf3e8 GetEnhMetaFileBits

• 0x4cf3ec GetDeviceCaps

• 0x4cf3f0 GetDIBits

• 0x4cf3f4 GetDIBColorTable

• 0x4cf3f8 GetDCOrgEx

• 0x4cf3fc GetDCPenColor

• 0x4cf400 GetDCBrushColor

• 0x4cf404 GetCurrentPositionEx

• 0x4cf408 GetClipBox

• 0x4cf40c GetBrushOrgEx

• 0x4cf410 GetBitmapBits

• 0x4cf414 ExcludeClipRect

• 0x4cf418 DeleteObject

• 0x4cf41c DeleteEnhMetaFile

• 0x4cf420 DeleteDC

• 0x4cf424 CreateSolidBrush

• 0x4cf428 CreatePenIndirect

• 0x4cf42c CreatePalette

• 0x4cf430 CreateHalftonePalette

• 0x4cf434 CreateFontIndirectA

• 0x4cf438 CreateDIBitmap

• 0x4cf43c CreateDIBSection

• 0x4cf440 CreateCompatibleDC

• 0x4cf444 CreateCompatibleBitmap

• 0x4cf448 CreateBrushIndirect

• 0x4cf44c CreateBitmap

• 0x4cf450 CopyEnhMetaFileA

• 0x4cf454 BitBlt

Library user32.dll:

• 0x4cf45c CreateWindowExA

• 0x4cf460 WindowFromPoint

• 0x4cf464 WinHelpA

• 0x4cf468 WaitMessage

• 0x4cf46c UpdateWindow

• 0x4cf470 UnregisterClassA

• 0x4cf474 UnhookWindowsHookEx

• 0x4cf478 TranslateMessage

• 0x4cf47c TranslateMDISysAccel

• 0x4cf480 TrackPopupMenu

• 0x4cf484 SystemParametersInfoA

• 0x4cf488 ShowWindow

• 0x4cf48c ShowScrollBar

• 0x4cf490 ShowOwnedPopups

• 0x4cf494 ShowCursor

• 0x4cf498 SetWindowsHookExA

• 0x4cf49c SetWindowTextA

• 0x4cf4a0 SetWindowPos

• 0x4cf4a4 SetWindowPlacement

• 0x4cf4a8 SetWindowLongA

• 0x4cf4ac SetTimer

• 0x4cf4b0 SetScrollRange

• 0x4cf4b4 SetScrollPos

• 0x4cf4b8 SetScrollInfo

• 0x4cf4bc SetRect

• 0x4cf4c0 SetPropA

• 0x4cf4c4 SetParent

• 0x4cf4c8 SetMenuItemInfoA

• 0x4cf4cc SetMenu

• 0x4cf4d0 SetForegroundWindow

• 0x4cf4d4 SetFocus

• 0x4cf4d8 SetCursor

• 0x4cf4dc SetClipboardData

• 0x4cf4e0 SetClassLongA

• 0x4cf4e4 SetCapture

• 0x4cf4e8 SetActiveWindow

• 0x4cf4ec SendMessageA

• 0x4cf4f0 ScrollWindow

• 0x4cf4f4 ScreenToClient

• 0x4cf4f8 RemovePropA

• 0x4cf4fc RemoveMenu

• 0x4cf500 ReleaseDC

• 0x4cf504 ReleaseCapture

• 0x4cf508 RegisterWindowMessageA

• 0x4cf50c RegisterClipboardFormatA

• 0x4cf510 RegisterClassA

• 0x4cf514 RedrawWindow

• 0x4cf518 PtInRect

• 0x4cf51c PostQuitMessage

• 0x4cf520 PostMessageA

• 0x4cf524 PeekMessageA

• 0x4cf528 OpenClipboard

• 0x4cf52c OffsetRect

• 0x4cf530 OemToCharA

• 0x4cf534 MessageBoxA

• 0x4cf538 MessageBeep

• 0x4cf53c MapWindowPoints

• 0x4cf540 MapVirtualKeyA

• 0x4cf544 LoadStringA

• 0x4cf548 LoadKeyboardLayoutA

• 0x4cf54c LoadIconA

• 0x4cf550 LoadCursorA

• 0x4cf554 LoadBitmapA

• 0x4cf558 KillTimer

• 0x4cf55c IsZoomed

• 0x4cf560 IsWindowVisible

• 0x4cf564 IsWindowEnabled

• 0x4cf568 IsWindow

• 0x4cf56c IsRectEmpty

• 0x4cf570 IsIconic

• 0x4cf574 IsDialogMessageA

• 0x4cf578 IsChild

• 0x4cf57c InvalidateRect

• 0x4cf580 IntersectRect

• 0x4cf584 InsertMenuItemA

• 0x4cf588 InsertMenuA

• 0x4cf58c InflateRect

• 0x4cf590 GetWindowThreadProcessId

• 0x4cf594 GetWindowTextA

• 0x4cf598 GetWindowRect

• 0x4cf59c GetWindowPlacement

• 0x4cf5a0 GetWindowLongA

• 0x4cf5a4 GetWindowDC

• 0x4cf5a8 GetTopWindow

• 0x4cf5ac GetSystemMetrics

• 0x4cf5b0 GetSystemMenu

• 0x4cf5b4 GetSysColorBrush

• 0x4cf5b8 GetSysColor

• 0x4cf5bc GetSubMenu

• 0x4cf5c0 GetScrollRange

• 0x4cf5c4 GetScrollPos

• 0x4cf5c8 GetScrollInfo

• 0x4cf5cc GetPropA

• 0x4cf5d0 GetParent

• 0x4cf5d4 GetWindow

• 0x4cf5d8 GetMenuStringA

• 0x4cf5dc GetMenuState

• 0x4cf5e0 GetMenuItemInfoA

• 0x4cf5e4 GetMenuItemID

• 0x4cf5e8 GetMenuItemCount

• 0x4cf5ec GetMenu

• 0x4cf5f0 GetLastActivePopup

• 0x4cf5f4 GetKeyboardState

• 0x4cf5f8 GetKeyboardLayoutList

• 0x4cf5fc GetKeyboardLayout

• 0x4cf600 GetKeyState

• 0x4cf604 GetKeyNameTextA

• 0x4cf608 GetIconInfo

• 0x4cf60c GetForegroundWindow

• 0x4cf610 GetFocus

• 0x4cf614 GetDlgItem

• 0x4cf618 GetDesktopWindow

• 0x4cf61c GetDCEx

• 0x4cf620 GetDC

• 0x4cf624 GetCursorPos

• 0x4cf628 GetCursor

• 0x4cf62c GetClipboardData

• 0x4cf630 GetClientRect

• 0x4cf634 GetClassNameA

• 0x4cf638 GetClassInfoA

• 0x4cf63c GetCapture

• 0x4cf640 GetActiveWindow

• 0x4cf644 FrameRect

• 0x4cf648 FindWindowA

• 0x4cf64c FillRect

• 0x4cf650 EqualRect

• 0x4cf654 EnumWindows

• 0x4cf658 EnumThreadWindows

• 0x4cf65c EndPaint

• 0x4cf660 EnableWindow

• 0x4cf664 EnableScrollBar

• 0x4cf668 EnableMenuItem

• 0x4cf66c EmptyClipboard

• 0x4cf670 DrawTextA

• 0x4cf674 DrawMenuBar

• 0x4cf678 DrawIconEx

• 0x4cf67c DrawIcon

• 0x4cf680 DrawFrameControl

• 0x4cf684 DrawFocusRect

• 0x4cf688 DrawEdge

• 0x4cf68c DispatchMessageA

• 0x4cf690 DestroyWindow

• 0x4cf694 DestroyMenu

• 0x4cf698 DestroyIcon

• 0x4cf69c DestroyCursor

• 0x4cf6a0 DeleteMenu

• 0x4cf6a4 DefWindowProcA

• 0x4cf6a8 DefMDIChildProcA

• 0x4cf6ac DefFrameProcA

• 0x4cf6b0 CreatePopupMenu

• 0x4cf6b4 CreateMenu

• 0x4cf6b8 CreateIcon

• 0x4cf6bc CloseClipboard

• 0x4cf6c0 ClientToScreen

• 0x4cf6c4 CheckMenuItem

• 0x4cf6c8 CallWindowProcA

• 0x4cf6cc CallNextHookEx

• 0x4cf6d0 BeginPaint

• 0x4cf6d4 CharNextA

• 0x4cf6d8 CharLowerBuffA

• 0x4cf6dc CharLowerA

• 0x4cf6e0 CharUpperBuffA

• 0x4cf6e4 CharToOemA

• 0x4cf6e8 AdjustWindowRectEx

• 0x4cf6ec ActivateKeyboardLayout

Library kernel32.dll:

• 0x4cf6f4 Sleep

Library oleaut32.dll:

• 0x4cf6fc SafeArrayPtrOfIndex

• 0x4cf700 SafeArrayGetUBound

• 0x4cf704 SafeArrayGetLBound

• 0x4cf708 SafeArrayCreate

• 0x4cf70c VariantChangeType

• 0x4cf710 VariantCopy

• 0x4cf714 VariantClear

• 0x4cf718 VariantInit

Library comctl32.dll:

• 0x4cf720 ImageList_SetIconSize

• 0x4cf724 ImageList_GetIconSize

• 0x4cf728 ImageList_Write

• 0x4cf72c ImageList_Read

• 0x4cf730 ImageList_GetDragImage

• 0x4cf734 ImageList_DragShowNolock

• 0x4cf738 ImageList_SetDragCursorImage

• 0x4cf73c ImageList_DragMove

• 0x4cf740 ImageList_DragLeave

• 0x4cf744 ImageList_DragEnter

• 0x4cf748 ImageList_EndDrag

• 0x4cf74c ImageList_BeginDrag

• 0x4cf750 ImageList_Remove

• 0x4cf754 ImageList_DrawEx

• 0x4cf758 ImageList_Replace

• 0x4cf75c ImageList_Draw

• 0x4cf760 ImageList_GetBkColor

• 0x4cf764 ImageList_SetBkColor

• 0x4cf768 ImageList_ReplaceIcon

• 0x4cf76c ImageList_Add

• 0x4cf770 ImageList_SetImageCount

• 0x4cf774 ImageList_GetImageCount

• 0x4cf778 ImageList_Destroy

• 0x4cf77c ImageList_Create

Library comdlg32.dll:

• 0x4cf784 GetOpenFileNameA

Library UrL:

• 0x4cf78c InetIsOffline

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.160.78
www.microsoft.com	CNAME www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net CNAME e13678.ca2.s.tl88.net CNAME www.microsoft.com-c-3.edgekey.net A 27.148.139.88	27.148.139.88
cdn.discordapp.com	A 104.244.46.208	69.171.235.64
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	53380	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	60221	114.114.114.114	53
192.168.56.101	62912	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57236	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.