SmartHawk

6.6

高危

49 个模型检测该样本为恶意！

重新分析

下载样本

e106b309426595cdb32f16831548afeb5f88b107aa3e51c7339aa18e0c53fd27

713aad804c3e16b155c5ec008cc1de0e.exe

分析耗时

76s

最近分析

文件大小

628.1KB

静态报毒动态报毒 AI SCORE=84 AIDETECTVM BFFX CLOUD CRIDEX CYLT EMOTET FRNBO GENCIRC GENERICKD GENERICKDZ GENETIC HOKNHE KRYPTIK MALICIOUS MALWARE1 QVM07 THGBCBO UNSAFE ZENPAK 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Emotet-FRI!713AAD804C3E	20200805	6.0.6.653
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20200805	18.4.3895.0
Alibaba	Trojan:Win32/Emotet.983bc2e9	20190527	0.3.0.5
Kingsoft		20200805	2013.8.14.323
Tencent	Malware.Win32.Gencirc.10cde1eb	20200805	1.0.0.1
CrowdStrike		20190702	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619596045.433495 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (3 个事件)

Time & API	Arguments	Status	Return
1619596034.121495 CryptGenKey	crypto_handle: 0x006681c8 algorithm_identifier: 0x0000660e () provider_handle: 0x005a0d10 flags: 1 key: fiZXeZ$æïSµR	success	1
1619596045.449495 CryptExportKey	crypto_handle: 0x006681c8 crypto_export_handle: 0x005a0de8 buffer: f¤x¼ød]K(áÑw±åªº¹d3RRýçîf¤ôp0zÝÌ?ÈI>;nÓV\|kuþÀÙCð¶«ópa2)«¾)I)<¤LÌH´âptôy#H>ñ/!b blob_type: 1 flags: 64	success	1
1619596080.355495 CryptExportKey	crypto_handle: 0x006681c8 crypto_export_handle: 0x005a0de8 buffer: f¤ÃöÒ'Ì/4ö¿3Hgm/Úâ¾svÕð:D2ù=°º4{qáp!IHQ×¤+ÿ8Ãé\ºLyã'ó2íÕ{õú¥@;Æï2Mý-ðon*á{u blob_type: 1 flags: 64	success	1

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

The file contains an unknown PE resource name possibly indicative of a packer (2 个事件)

resource name	RGN
resource name	None

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619596030.058495 NtAllocateVirtualMemory	process_identifier: 732 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x003f0000	success	0	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619596033.777495 Process32NextW	process_name: mobsync.exe snapshot_handle: 0x00000118 process_identifier: 340	success	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619596045.824495 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

713aad804c3e16b155c5ec008cc1de0e.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619596045.543495 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (3 个事件)

host	144.139.91.187
host	157.7.199.53
host	172.217.24.14

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619596048.371495 RegSetValueExA	key_handle: 0x00000374 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619596048.371495 RegSetValueExA	key_handle: 0x00000374 value: 7ª¨@<× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619596048.371495 RegSetValueExA	key_handle: 0x00000374 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619596048.371495 RegSetValueExW	key_handle: 0x00000374 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619596048.386495 RegSetValueExA	key_handle: 0x0000038c value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619596048.386495 RegSetValueExA	key_handle: 0x0000038c value: 7ª¨@<× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619596048.386495 RegSetValueExA	key_handle: 0x0000038c value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619596048.402495 RegSetValueExW	key_handle: 0x00000370 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

File has been identified by 49 AntiVirus engines on VirusTotal as malicious (49 个事件)

Bkav	W32.AIDetectVM.malware1
MicroWorld-eScan	Trojan.GenericKD.43531903
FireEye	Trojan.GenericKD.43531903
McAfee	Emotet-FRI!713AAD804C3E
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 0056af871 )
BitDefender	Trojan.GenericKD.43531903
K7GW	Trojan ( 0056af871 )
F-Prot	W32/Emotet.AOZ
Symantec	Trojan.Emotet
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	HEUR:Trojan.Win32.Zenpak.pef
Alibaba	Trojan:Win32/Emotet.983bc2e9
NANO-Antivirus	Trojan.Win32.Zenpak.hoknhe
ViRobot	Trojan.Win32.Emotet.643072.A
AegisLab	Trojan.Win32.Generic.4!c
Rising	Trojan.Kryptik!1.C89F (CLOUD)
Ad-Aware	Trojan.GenericKD.43531903
Sophos	Troj/Agent-BFFX
F-Secure	Trojan.TR/AD.Emotet.frnbo
DrWeb	Trojan.Emotet.991
TrendMicro	TrojanSpy.Win32.EMOTET.THGBCBO
Emsisoft	Trojan.Emotet (A)
Ikarus	Trojan.Win32.Cridex
Cyren	W32/Emotet.CYLT-6825
Jiangmin	Trojan.Zenpak.cqa
Webroot	W32.Trojan.Emotet
Avira	TR/AD.Emotet.frnbo
MAX	malware (ai score=84)
Antiy-AVL	Trojan[Banker]/Win32.Emotet
Microsoft	Trojan:Win32/Emotet.ARJ!MTB
Arcabit	Trojan.Generic.D2983E7F
ZoneAlarm	HEUR:Trojan-Banker.Win32.Emotet.gen
GData	Trojan.GenericKD.43531903
AhnLab-V3	Malware/Win32.Generic.C4165815
ALYac	Trojan.GenericKD.43531903
VBA32	Trojan.Downloader
Malwarebytes	Trojan.Emotet
Panda	Trj/Genetic.gen
ESET-NOD32	Win32/Emotet.CD
TrendMicro-HouseCall	TrojanSpy.Win32.EMOTET.THGBCBO
Tencent	Malware.Win32.Gencirc.10cde1eb
Fortinet	W32/GenericKDZ.6891!tr
AVG	Win32:Trojan-gen
Paloalto	generic.ml
Qihoo-360	Generic/HEUR/QVM07.1.BC9B.Malware.Gen

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	144.139.91.187:443
dead_host	157.7.199.53:8080

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-07-22 02:33:39

Imports

Library MFC42.DLL:

• 0x4442ec

• 0x4442f0

• 0x4442f4

• 0x4442f8

• 0x4442fc

• 0x444300

• 0x444304

• 0x444308

• 0x44430c

• 0x444310

• 0x444314

• 0x444318

• 0x44431c

• 0x444320

• 0x444324

• 0x444328

• 0x44432c

• 0x444330

• 0x444334

• 0x444338

• 0x44433c

• 0x444340

• 0x444344

• 0x444348

• 0x44434c

• 0x444350

• 0x444354

• 0x444358

• 0x44435c

• 0x444360

• 0x444364

• 0x444368

• 0x44436c

• 0x444370

• 0x444374

• 0x444378

• 0x44437c

• 0x444380

• 0x444384

• 0x444388

• 0x44438c

• 0x444390

• 0x444394

• 0x444398

• 0x44439c

• 0x4443a0

• 0x4443a4

• 0x4443a8

• 0x4443ac

• 0x4443b0

• 0x4443b4

• 0x4443b8

• 0x4443bc

• 0x4443c0

• 0x4443c4

• 0x4443c8

• 0x4443cc

• 0x4443d0

• 0x4443d4

• 0x4443d8

• 0x4443dc

• 0x4443e0

• 0x4443e4

• 0x4443e8

• 0x4443ec

• 0x4443f0

• 0x4443f4

• 0x4443f8

• 0x4443fc

• 0x444400

• 0x444404

• 0x444408

• 0x44440c

• 0x444410

• 0x444414

• 0x444418

• 0x44441c

• 0x444420

• 0x444424

• 0x444428

• 0x44442c

• 0x444430

• 0x444434

• 0x444438

• 0x44443c

• 0x444440

• 0x444444

• 0x444448

• 0x44444c

• 0x444450

• 0x444454

• 0x444458

• 0x44445c

• 0x444460

• 0x444464

• 0x444468

• 0x44446c

• 0x444470

• 0x444474

• 0x444478

• 0x44447c

• 0x444480

• 0x444484

• 0x444488

• 0x44448c

• 0x444490

• 0x444494

• 0x444498

• 0x44449c

• 0x4444a0

• 0x4444a4

• 0x4444a8

• 0x4444ac

• 0x4444b0

• 0x4444b4

• 0x4444b8

• 0x4444bc

• 0x4444c0

• 0x4444c4

• 0x4444c8

• 0x4444cc

• 0x4444d0

• 0x4444d4

• 0x4444d8

• 0x4444dc

• 0x4444e0

• 0x4444e4

• 0x4444e8

• 0x4444ec

• 0x4444f0

• 0x4444f4

• 0x4444f8

• 0x4444fc

• 0x444500

• 0x444504

• 0x444508

• 0x44450c

• 0x444510

• 0x444514

• 0x444518

• 0x44451c

• 0x444520

• 0x444524

• 0x444528

• 0x44452c

• 0x444530

• 0x444534

• 0x444538

• 0x44453c

• 0x444540

• 0x444544

• 0x444548

• 0x44454c

• 0x444550

• 0x444554

• 0x444558

• 0x44455c

• 0x444560

• 0x444564

• 0x444568

• 0x44456c

• 0x444570

• 0x444574

• 0x444578

• 0x44457c

• 0x444580

• 0x444584

• 0x444588

• 0x44458c

• 0x444590

• 0x444594

• 0x444598

• 0x44459c

• 0x4445a0

• 0x4445a4

• 0x4445a8

• 0x4445ac

• 0x4445b0

• 0x4445b4

• 0x4445b8

• 0x4445bc

• 0x4445c0

• 0x4445c4

• 0x4445c8

• 0x4445cc

• 0x4445d0

• 0x4445d4

• 0x4445d8

• 0x4445dc

• 0x4445e0

• 0x4445e4

• 0x4445e8

• 0x4445ec

• 0x4445f0

• 0x4445f4

• 0x4445f8

• 0x4445fc

• 0x444600

• 0x444604

• 0x444608

• 0x44460c

• 0x444610

• 0x444614

• 0x444618

• 0x44461c

• 0x444620

• 0x444624

• 0x444628

• 0x44462c

• 0x444630

• 0x444634

• 0x444638

• 0x44463c

• 0x444640

• 0x444644

• 0x444648

• 0x44464c

• 0x444650

• 0x444654

• 0x444658

• 0x44465c

• 0x444660

• 0x444664

• 0x444668

• 0x44466c

• 0x444670

• 0x444674

• 0x444678

• 0x44467c

• 0x444680

• 0x444684

• 0x444688

• 0x44468c

• 0x444690

• 0x444694

• 0x444698

• 0x44469c

• 0x4446a0

• 0x4446a4

• 0x4446a8

• 0x4446ac

• 0x4446b0

• 0x4446b4

• 0x4446b8

• 0x4446bc

• 0x4446c0

• 0x4446c4

• 0x4446c8

• 0x4446cc

• 0x4446d0

• 0x4446d4

• 0x4446d8

• 0x4446dc

• 0x4446e0

• 0x4446e4

• 0x4446e8

• 0x4446ec

• 0x4446f0

• 0x4446f4

• 0x4446f8

• 0x4446fc

• 0x444700

• 0x444704

• 0x444708

• 0x44470c

• 0x444710

• 0x444714

• 0x444718

• 0x44471c

• 0x444720

• 0x444724

• 0x444728

• 0x44472c

• 0x444730

• 0x444734

• 0x444738

• 0x44473c

• 0x444740

• 0x444744

• 0x444748

• 0x44474c

• 0x444750

• 0x444754

• 0x444758

• 0x44475c

• 0x444760

• 0x444764

• 0x444768

• 0x44476c

• 0x444770

• 0x444774

• 0x444778

• 0x44477c

• 0x444780

• 0x444784

• 0x444788

• 0x44478c

• 0x444790

• 0x444794

• 0x444798

• 0x44479c

• 0x4447a0

• 0x4447a4

• 0x4447a8

• 0x4447ac

• 0x4447b0

• 0x4447b4

• 0x4447b8

• 0x4447bc

• 0x4447c0

• 0x4447c4

• 0x4447c8

• 0x4447cc

• 0x4447d0

• 0x4447d4

• 0x4447d8

• 0x4447dc

• 0x4447e0

• 0x4447e4

• 0x4447e8

• 0x4447ec

• 0x4447f0

• 0x4447f4

• 0x4447f8

• 0x4447fc

• 0x444800

• 0x444804

• 0x444808

• 0x44480c

• 0x444810

• 0x444814

• 0x444818

• 0x44481c

• 0x444820

• 0x444824

• 0x444828

• 0x44482c

• 0x444830

• 0x444834

• 0x444838

• 0x44483c

• 0x444840

• 0x444844

• 0x444848

• 0x44484c

• 0x444850

• 0x444854

• 0x444858

• 0x44485c

• 0x444860

• 0x444864

• 0x444868

• 0x44486c

• 0x444870

• 0x444874

• 0x444878

• 0x44487c

• 0x444880

• 0x444884

• 0x444888

• 0x44488c

• 0x444890

• 0x444894

• 0x444898

• 0x44489c

• 0x4448a0

• 0x4448a4

• 0x4448a8

• 0x4448ac

• 0x4448b0

• 0x4448b4

• 0x4448b8

• 0x4448bc

• 0x4448c0

• 0x4448c4

• 0x4448c8

• 0x4448cc

• 0x4448d0

• 0x4448d4

• 0x4448d8

• 0x4448dc

• 0x4448e0

• 0x4448e4

• 0x4448e8

• 0x4448ec

• 0x4448f0

• 0x4448f4

• 0x4448f8

• 0x4448fc

• 0x444900

• 0x444904

• 0x444908

• 0x44490c

• 0x444910

• 0x444914

• 0x444918

• 0x44491c

• 0x444920

• 0x444924

• 0x444928

• 0x44492c

• 0x444930

• 0x444934

• 0x444938

• 0x44493c

• 0x444940

• 0x444944

• 0x444948

• 0x44494c

• 0x444950

• 0x444954

• 0x444958

• 0x44495c

• 0x444960

• 0x444964

• 0x444968

• 0x44496c

• 0x444970

• 0x444974

• 0x444978

• 0x44497c

• 0x444980

• 0x444984

• 0x444988

• 0x44498c

• 0x444990

• 0x444994

• 0x444998

• 0x44499c

• 0x4449a0

• 0x4449a4

• 0x4449a8

• 0x4449ac

• 0x4449b0

• 0x4449b4

• 0x4449b8

• 0x4449bc

• 0x4449c0

• 0x4449c4

• 0x4449c8

• 0x4449cc

• 0x4449d0

• 0x4449d4

• 0x4449d8

• 0x4449dc

• 0x4449e0

• 0x4449e4

• 0x4449e8

• 0x4449ec

• 0x4449f0

• 0x4449f4

• 0x4449f8

• 0x4449fc

• 0x444a00

• 0x444a04

• 0x444a08

• 0x444a0c

• 0x444a10

• 0x444a14

• 0x444a18

• 0x444a1c

• 0x444a20

• 0x444a24

• 0x444a28

• 0x444a2c

• 0x444a30

• 0x444a34

• 0x444a38

• 0x444a3c

• 0x444a40

• 0x444a44

• 0x444a48

• 0x444a4c

• 0x444a50

• 0x444a54

• 0x444a58

• 0x444a5c

• 0x444a60

• 0x444a64

• 0x444a68

• 0x444a6c

• 0x444a70

• 0x444a74

• 0x444a78

• 0x444a7c

• 0x444a80

• 0x444a84

• 0x444a88

• 0x444a8c

• 0x444a90

• 0x444a94

• 0x444a98

• 0x444a9c

• 0x444aa0

• 0x444aa4

• 0x444aa8

• 0x444aac

• 0x444ab0

• 0x444ab4

• 0x444ab8

• 0x444abc

• 0x444ac0

• 0x444ac4

• 0x444ac8

• 0x444acc

• 0x444ad0

• 0x444ad4

• 0x444ad8

• 0x444adc

• 0x444ae0

• 0x444ae4

• 0x444ae8

• 0x444aec

• 0x444af0

• 0x444af4

• 0x444af8

• 0x444afc

• 0x444b00

• 0x444b04

• 0x444b08

• 0x444b0c

• 0x444b10

• 0x444b14

• 0x444b18

• 0x444b1c

• 0x444b20

• 0x444b24

• 0x444b28

• 0x444b2c

• 0x444b30

• 0x444b34

• 0x444b38

• 0x444b3c

• 0x444b40

• 0x444b44

• 0x444b48

• 0x444b4c

• 0x444b50

• 0x444b54

• 0x444b58

• 0x444b5c

• 0x444b60

• 0x444b64

• 0x444b68

• 0x444b6c

• 0x444b70

• 0x444b74

• 0x444b78

• 0x444b7c

• 0x444b80

• 0x444b84

• 0x444b88

• 0x444b8c

• 0x444b90

• 0x444b94

Library MSVCRT.dll:

• 0x444dd4 _setmbcp

• 0x444dd8 __CxxFrameHandler

• 0x444ddc _EH_prolog

• 0x444de0 atoi

• 0x444de4 _mbscmp

• 0x444de8 free

• 0x444dec malloc

• 0x444df0 wcscpy

• 0x444df4 wcslen

• 0x444df8 _ftol

• 0x444dfc wcscmp

• 0x444e00 memmove

• 0x444e04 __dllonexit

• 0x444e08 _onexit

• 0x444e0c ??1type_info@@UAE@XZ

• 0x444e10 _exit

• 0x444e14 _XcptFilter

• 0x444e18 exit

• 0x444e1c _acmdln

• 0x444e20 __getmainargs

• 0x444e24 _initterm

• 0x444e28 __setusermatherr

• 0x444e2c _adjust_fdiv

• 0x444e30 __p__commode

• 0x444e34 __p__fmode

• 0x444e38 __set_app_type

• 0x444e3c _except_handler3

• 0x444e40 _controlfp

• 0x444e44 printf

Library KERNEL32.dll:

• 0x44423c GetModuleHandleA

• 0x444240 SizeofResource

• 0x444244 OpenFileMappingA

• 0x444248 CreateFileMappingA

• 0x44424c MapViewOfFile

• 0x444250 UnmapViewOfFile

• 0x444254 CloseHandle

• 0x444258 MultiByteToWideChar

• 0x44425c lstrcmpiA

• 0x444260 FindResourceA

• 0x444264 LoadResource

• 0x444268 LockResource

• 0x44426c GetCPInfo

• 0x444270 lstrlenW

• 0x444274 lstrlenA

• 0x444278 GetVersion

• 0x44427c GetVersionExA

• 0x444280 MulDiv

• 0x444284 GetModuleFileNameA

• 0x444288 DeleteFileA

• 0x44428c GetTickCount

• 0x444290 LoadLibraryA

• 0x444294 FreeLibrary

• 0x444298 Sleep

• 0x44429c LoadLibraryExA

• 0x4442a0 GetProcAddress

• 0x4442a4 GetCurrentProcess

• 0x4442a8 GetStartupInfoA

Library USER32.dll:

• 0x444ec4 RemoveMenu

• 0x444ec8 TabbedTextOutA

• 0x444ecc GrayStringA

• 0x444ed0 LoadImageA

• 0x444ed4 DrawIcon

• 0x444ed8 SetRectEmpty

• 0x444edc IsMenu

• 0x444ee0 SetMenuDefaultItem

• 0x444ee4 SetForegroundWindow

• 0x444ee8 IsIconic

• 0x444eec GetLastActivePopup

• 0x444ef0 SetWindowRgn

• 0x444ef4 IsWindow

• 0x444ef8 FrameRect

• 0x444efc EnumChildWindows

• 0x444f00 GetAsyncKeyState

• 0x444f04 GetMenuItemID

• 0x444f08 KillTimer

• 0x444f0c GetWindowRect

• 0x444f10 SetTimer

• 0x444f14 ScreenToClient

• 0x444f18 PtInRect

• 0x444f1c EnableWindow

• 0x444f20 InvalidateRect

• 0x444f24 LoadIconA

• 0x444f28 GetDC

• 0x444f2c GetClientRect

• 0x444f30 LoadBitmapA

• 0x444f34 FillRect

• 0x444f38 ReleaseDC

• 0x444f3c UpdateWindow

• 0x444f40 GetSystemMenu

• 0x444f44 SendMessageA

• 0x444f48 ShowWindow

• 0x444f4c GetMenuState

• 0x444f50 ModifyMenuA

• 0x444f54 GetMenuItemCount

• 0x444f58 InsertMenuA

• 0x444f5c GetSystemMetrics

• 0x444f60 DrawTextA

• 0x444f64 DrawIconEx

• 0x444f68 DestroyIcon

• 0x444f6c DrawEdge

• 0x444f70 SetRect

• 0x444f74 GetMenuItemInfoA

• 0x444f78 PostMessageA

• 0x444f7c DeleteMenu

• 0x444f80 AppendMenuA

• 0x444f84 SetParent

• 0x444f88 wsprintfA

• 0x444f8c GetDCEx

• 0x444f90 ReleaseCapture

• 0x444f94 SetCapture

• 0x444f98 RedrawWindow

• 0x444f9c GetWindow

• 0x444fa0 GetClassLongA

• 0x444fa4 GetMenuStringA

• 0x444fa8 CreateMenu

• 0x444fac CreatePopupMenu

• 0x444fb0 GetSysColor

• 0x444fb4 GetSubMenu

• 0x444fb8 ClientToScreen

• 0x444fbc GetParent

• 0x444fc0 BeginDeferWindowPos

• 0x444fc4 EndDeferWindowPos

• 0x444fc8 IsRectEmpty

• 0x444fcc GetSysColorBrush

• 0x444fd0 GetCursorPos

• 0x444fd4 LoadCursorA

• 0x444fd8 GetKeyState

• 0x444fdc OffsetRect

• 0x444fe0 CopyRect

• 0x444fe4 InflateRect

• 0x444fe8 SystemParametersInfoA

• 0x444fec GetFocus

• 0x444ff0 IsChild

• 0x444ff4 IsWindowVisible

• 0x444ff8 GetDesktopWindow

• 0x444ffc SetMenu

• 0x445000 GetMenu

Library GDI32.dll:

• 0x444168 CreateSolidBrush

• 0x44416c GetTextExtentPoint32W

• 0x444170 GetTextExtentPoint32A

• 0x444174 Ellipse

• 0x444178 DeleteDC

• 0x44417c DeleteObject

• 0x444180 SelectObject

• 0x444184 CreateDIBSection

• 0x444188 SetPixel

• 0x44418c GetPixel

• 0x444190 PtVisible

• 0x444194 CreatePen

• 0x444198 TextOutA

• 0x44419c Escape

• 0x4441a0 Rectangle

• 0x4441a4 CreateHatchBrush

• 0x4441a8 RealizePalette

• 0x4441ac CreatePalette

• 0x4441b0 GetTextMetricsA

• 0x4441b4 GetCurrentObject

• 0x4441b8 ExtCreateRegion

• 0x4441bc GetDIBColorTable

• 0x4441c0 CreateHalftonePalette

• 0x4441c4 GetBkMode

• 0x4441c8 PatBlt

• 0x4441cc CreateCompatibleBitmap

• 0x4441d0 BitBlt

• 0x4441d4 GetTextColor

• 0x4441d8 GetDeviceCaps

• 0x4441dc GetObjectA

• 0x4441e0 CreateFontIndirectA

• 0x4441e4 ExtTextOutA

• 0x4441e8 RectVisible

• 0x4441ec EnumFontFamiliesA

• 0x4441f0 CreateCompatibleDC

Library ADVAPI32.dll:

• 0x4440e8 RegCloseKey

• 0x4440ec RegOpenKeyExA

• 0x4440f0 RegQueryValueExA

Library SHELL32.dll:

• 0x444e88 Shell_NotifyIconA

• 0x444e8c SHGetSpecialFolderLocation

• 0x444e90 SHGetPathFromIDListA

• 0x444e94 SHGetMalloc

Library COMCTL32.dll:

• 0x444120 ImageList_ReplaceIcon

• 0x444124 ImageList_GetIcon

• 0x444128 ImageList_AddMasked

• 0x44412c ImageList_Draw

• 0x444130 ImageList_GetImageCount

• 0x444134 ImageList_GetIconSize

Library ole32.dll:

• 0x4450a8 CoUninitialize

• 0x4450ac CoInitialize

• 0x4450b0 CoCreateInstance

Library WSOCK32.dll:

• 0x445070 inet_addr

• 0x445074 gethostname

• 0x445078 gethostbyname

Library MSVCP60.dll:

• 0x444d80 ??1Init@ios_base@std@@QAE@XZ

• 0x444d84 ??0Init@ios_base@std@@QAE@XZ

• 0x444d88 ??1_Winit@std@@QAE@XZ

• 0x444d8c ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

• 0x444d90 ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

• 0x444d94 ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z

• 0x444d98 ??1_Lockit@std@@QAE@XZ

• 0x444d9c ??0_Lockit@std@@QAE@XZ

• 0x444da0 ??0_Winit@std@@QAE@XZ

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	57874	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	55369	239.255.255.250	3702
192.168.56.101	57875	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	63432	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.