SmartHawk

11.6

0-day

48 个模型检测该样本为恶意！

重新分析

下载样本

79de3e25506af5034b6abfaab6487612ee1c943cd84e6e6dd6ea837fe1b972d5

752f40989dbe9165b539a76e264ccf39.exe

分析耗时

96s

最近分析

文件大小

5.9MB

静态报毒动态报毒 100% AI SCORE=100 AIDETECTVM ARTEMIS BSCOPE CONFIDENCE CUJKIJ DEALPLY GENERIC@ML GENERICKD HIGH CONFIDENCE KEYLOGGERGER MALICIOUS PE MALWARE1 MAUVAISERI MJ@51Y6AT RDML S5253574 SUFBOTOOL UNSAFE VR BROTHERS VRBROTHERS VYAW2KT3XXEMTTYWEH WACATAC 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Artemis!752F40989DBE	20200920	6.0.6.653
Alibaba		20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Adware-gen [Adw]	20200920	18.4.3895.0
Tencent		20200920	1.0.0.1
Kingsoft		20200920	2013.8.14.323
CrowdStrike	win/malicious_confidence_100% (D)	20190702	1.0

Checks if process is being debugged by a debugger (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1620780034.199249 IsDebuggerPresent		failed	0	0
1620780034.246249 IsDebuggerPresent		failed	0	0

This executable is signed

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620780029.840249 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)

section

.vmp0

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

The file contains an unknown PE resource name possibly indicative of a packer (2 个事件)

resource name	EXTERNAL
resource name	None

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)

suspicious_features

POST method with no referer header

suspicious_request

POST https://update.googleapis.com/service/update2?cup2key=10:2373200852&cup2hreq=d008bbf973d2c3f7242a743426c6bafccd830648b955479ba6e359bfdb1950d9

Performs some HTTP requests (7 个事件)

request	GET http://ad.vrbrothers.com/qmacro/v9/ad-mymacro.xml
request	GET http://hi.vrbrothers.com/xjl/mmcount.aspx?mm=000026A461DB0941E18975812691ED421FE3AF588380BE09B1012CB6775955C31999E50C696E2EF04F7F6738&randcode=000069F9A267380A9AF85809AAAB7A7201183AA6D2F4C00CDBF3ED51CB1347FB316A60A38596BBEF5D7A4196E972F6F21E813BF3D4CA16C88024569B91A9AAA2D58C76AD7AD840561D4E6FD3A41F63FC4F336738
request	GET http://down.vrbrothers.com/qmacro/up_mymacro/liveupdate8.dat
request	HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request	HEAD http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620750979&mv=m&mvi=1&pl=23&shardbypass=yes
request	HEAD http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=11d34bd67f3d2857&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620750979&mv=m&mvi=3
request	POST https://update.googleapis.com/service/update2?cup2key=10:2373200852&cup2hreq=d008bbf973d2c3f7242a743426c6bafccd830648b955479ba6e359bfdb1950d9

Sends data using the HTTP POST Method (1 个事件)

request

POST https://update.googleapis.com/service/update2?cup2key=10:2373200852&cup2hreq=d008bbf973d2c3f7242a743426c6bafccd830648b955479ba6e359bfdb1950d9

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620780034.324249 NtProtectVirtualMemory	process_identifier: 2252 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0056a000	success	0	0

Foreign language identified in PE resource (50 out of 59 个事件)

name

EXTERNAL

language

LANG_CHINESE

offset

0x002d2c84

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000007d0

name

RT_CURSOR

language

LANG_CHINESE

offset

0x002d3454

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000134

name

RT_BITMAP

language

LANG_CHINESE

offset

0x003bf56c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000182e2

name

RT_BITMAP

language

LANG_CHINESE

offset

0x003bf56c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000182e2

name

RT_BITMAP

language

LANG_CHINESE

offset

0x003bf56c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000182e2

name

RT_BITMAP

language

LANG_CHINESE

offset

0x003bf56c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000182e2

name

RT_BITMAP

language

LANG_CHINESE

offset

0x003bf56c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000182e2

name

RT_BITMAP

language

LANG_CHINESE

offset

0x003bf56c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000182e2

name

RT_BITMAP

language

LANG_CHINESE

offset

0x003bf56c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000182e2

name

RT_BITMAP

language

LANG_CHINESE

offset

0x003bf56c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000182e2

name

RT_BITMAP

language

LANG_CHINESE

offset

0x003bf56c

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000182e2

name

RT_ICON

language

LANG_CHINESE

offset

0x00432650

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00432650

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00432650

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00432650

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00432650

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00432650

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00432650

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00432650

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00432650

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_MENU

language

LANG_CHINESE

offset

0x00432ab8

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000010e

name

RT_DIALOG

language

LANG_CHINESE

offset

0x00434300

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000110

name

RT_DIALOG

language

LANG_CHINESE

offset

0x00434300

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000110

name

RT_DIALOG

language

LANG_CHINESE

offset

0x00434300

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000110

name

RT_DIALOG

language

LANG_CHINESE

offset

0x00434300

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000110

name

RT_DIALOG

language

LANG_CHINESE

offset

0x00434300

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000110

name

RT_DIALOG

language

LANG_CHINESE

offset

0x00434300

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000110

name

RT_DIALOG

language

LANG_CHINESE

offset

0x00434300

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000110

name

RT_DIALOG

language

LANG_CHINESE

offset

0x00434300

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000110

name

RT_DIALOG

language

LANG_CHINESE

offset

0x00434300

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000110

name

RT_DIALOG

language

LANG_CHINESE

offset

0x00434300

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000110

name

RT_DIALOG

language

LANG_CHINESE

offset

0x00434300

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000110

name

RT_DIALOG

language

LANG_CHINESE

offset

0x00434300

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000110

name

RT_DIALOG

language

LANG_CHINESE

offset

0x00434300

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000110

name

RT_DIALOG

language

LANG_CHINESE

offset

0x00434300

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000110

name

RT_DIALOG

language

LANG_CHINESE

offset

0x00434300

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000110

name

RT_DIALOG

language

LANG_CHINESE

offset

0x00434300

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000110

name

RT_DIALOG

language

LANG_CHINESE

offset

0x00434300

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000110

name

RT_STRING

language

LANG_CHINESE

offset

0x00435ab8

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000017e

name

RT_STRING

language

LANG_CHINESE

offset

0x00435ab8

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000017e

name

RT_STRING

language

LANG_CHINESE

offset

0x00435ab8

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000017e

name

RT_STRING

language

LANG_CHINESE

offset

0x00435ab8

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000017e

name

RT_STRING

language

LANG_CHINESE

offset

0x00435ab8

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000017e

name

RT_STRING

language

LANG_CHINESE

offset

0x00435ab8

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000017e

name

RT_STRING

language

LANG_CHINESE

offset

0x00435ab8

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000017e

name

RT_STRING

language

LANG_CHINESE

offset

0x00435ab8

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000017e

name

RT_STRING

language

LANG_CHINESE

offset

0x00435ab8

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000017e

name

RT_STRING

language

LANG_CHINESE

offset

0x00435ab8

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000017e

name

RT_STRING

language

LANG_CHINESE

offset

0x00435ab8

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000017e

name

RT_GROUP_CURSOR

language

LANG_CHINESE

offset

0x00435c38

filetype

Lotus unknown worksheet or configuration, revision 0x1

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000014

Creates executable files on the filesystem (7 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\plugin\FILE.DLL
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\plugin\REMOTEANSWER.DLL
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\cfgdll.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\plugin\REGDLL.DLL
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\plugin\WINDOW.DLL
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\mymacro\qdisp.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\plugin\SYS.DLL

Creates a suspicious process (4 个事件)

cmdline	"C:\Windows\System32\cmd.exe" /c attrib +s +a +h C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\*.ini /s /d
cmdline	"C:\Windows\System32\cmd.exe" /c attrib +s +a +h C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\*.dll /s /d
cmdline	"C:\Windows\System32\cmd.exe" /c attrib +s +a +h C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\plugin /s /d
cmdline	"C:\Windows\System32\cmd.exe" /c attrib +s +a +h C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\plugin\. /s /d

Drops an executable to the user AppData folder (8 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\plugin\REGDLL.DLL
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\plugin\SYS.DLL
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\mymacro\qdisp.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\plugin\FILE.DLL
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\qmacro\shield\SD001.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\plugin\WINDOW.DLL
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\cfgdll.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\plugin\REMOTEANSWER.DLL

A process created a hidden window (4 个事件)

Time & API	Arguments	Status	Return
1620780035.168249 ShellExecuteExW	parameters: /c attrib +s +a +h C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\*.ini /s /d filepath: cmd filepath_r: cmd show_type: 0	success	1
1620780035.215249 ShellExecuteExW	parameters: /c attrib +s +a +h C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\*.dll /s /d filepath: cmd filepath_r: cmd show_type: 0	success	1
1620780035.246249 ShellExecuteExW	parameters: /c attrib +s +a +h C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\plugin\. /s /d filepath: cmd filepath_r: cmd show_type: 0	success	1
1620780035.293249 ShellExecuteExW	parameters: /c attrib +s +a +h C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\plugin /s /d filepath: cmd filepath_r: cmd show_type: 0	success	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620780033.949249 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.998473493703505

section

{'size_of_data': '0x00165000', 'virtual_address': '0x0016d000', 'entropy': 7.998473493703505, 'name': '.vmp0', 'virtual_size': '0x00164748'}

description

A section with a high entropy has been found

entropy

0.35311572700296734

description

Overall entropy of this PE file is high

Uses Windows utilities for basic Windows functionality (12 个事件)

cmdline	attrib +s +a +h C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\*.dll /s /d
cmdline	"C:\Windows\System32\cmd.exe" /c attrib +s +a +h C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\*.ini /s /d
cmdline	"C:\Windows\System32\cmd.exe" /c attrib +s +a +h C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\*.dll /s /d
cmdline	cmd /c attrib +s +a +h C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\plugin\. /s /d
cmdline	attrib +s +a +h C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\plugin\. /s /d
cmdline	"C:\Windows\System32\cmd.exe" /c attrib +s +a +h C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\plugin /s /d
cmdline	cmd /c attrib +s +a +h C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\plugin /s /d
cmdline	attrib +s +a +h C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\*.ini /s /d
cmdline	cmd /c attrib +s +a +h C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\*.ini /s /d
cmdline	cmd /c attrib +s +a +h C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\*.dll /s /d
cmdline	"C:\Windows\System32\cmd.exe" /c attrib +s +a +h C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\plugin\. /s /d
cmdline	attrib +s +a +h C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\plugin /s /d

The executable is likely packed with VMProtect (1 个事件)

section

.vmp0

description

Section name indicates VMProtect

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Installs an hook procedure to monitor for mouse events (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620780034.184249 SetWindowsHookExA	thread_identifier: 0 callback_function: 0x04111180 module_address: 0x04110000 hook_identifier: 7 (WH_MOUSE)	success	197093	0

Creates a windows hook that monitors keyboard input (keylogger) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620780034.184249 SetWindowsHookExA	thread_identifier: 0 callback_function: 0x04111140 module_address: 0x04110000 hook_identifier: 2 (WH_KEYBOARD)	success	66023	0

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (15 个事件)

Time & API	Arguments	Status
1620780038.809249 RegSetValueExA	key_handle: 0x00000474 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1620780038.809249 RegSetValueExA	key_handle: 0x00000474 value: `ËF× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1620780038.809249 RegSetValueExA	key_handle: 0x00000474 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1620780038.809249 RegSetValueExW	key_handle: 0x00000474 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1620780038.809249 RegSetValueExA	key_handle: 0x000004bc value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1620780038.809249 RegSetValueExA	key_handle: 0x000004bc value: `ËF× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1620780038.809249 RegSetValueExA	key_handle: 0x000004bc value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1620780038.824249 RegSetValueExW	key_handle: 0x00000470 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success
1620780039.090249 RegSetValueExA	key_handle: 0x00000500 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1620780039.090249 RegSetValueExA	key_handle: 0x00000500 value: QLF× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1620780039.090249 RegSetValueExA	key_handle: 0x00000500 value: 0 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1620780039.090249 RegSetValueExW	key_handle: 0x00000500 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1620780039.090249 RegSetValueExA	key_handle: 0x000005b8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1620780039.090249 RegSetValueExA	key_handle: 0x000005b8 value: QLF× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1620780039.090249 RegSetValueExA	key_handle: 0x000005b8 value: 0 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Adware.GenericKD.3616647
FireEye	Generic.mg.752f40989dbe9165
CAT-QuickHeal	Trojan.MauvaiseRI.S5253574
McAfee	Artemis!752F40989DBE
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Adware ( 004dc2771 )
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.89dbe9
Arcabit	Adware.Generic.D372F87
Symantec	Trojan.Gen.MBT
APEX	Malicious
Avast	Win32:Adware-gen [Adw]
Kaspersky	not-a-virus:HEUR:AdWare.Win32.Generic
BitDefender	Adware.GenericKD.3616647
NANO-Antivirus	Trojan.Win32.KeyLogger.cujkij
Paloalto	generic.ml
Ad-Aware	Adware.GenericKD.3616647
Comodo	TrojWare.Win32.Sufbotool.MJ@51y6at
DrWeb	Trojan.KeyLogger.39547
Zillya	Trojan.Sufbotool.Win32.2
Invincea	VR Brothers (PUA)
Sophos	VR Brothers (PUA)
SentinelOne	DFI - Malicious PE
Jiangmin	Trojan/Sufbotool.a
Webroot	W32.Backdoor.Gen
Microsoft	Trojan:Win32/Wacatac.C!ml
ZoneAlarm	not-a-virus:HEUR:AdWare.Win32.Generic
GData	Win32.Adware.VrBrothers.C
Acronis	suspicious
ALYac	Adware.GenericKD.3616647
MAX	malware (ai score=100)
VBA32	BScope.Trojan.Keyloggerger
Malwarebytes	Adware.VRBrothers
ESET-NOD32	a variant of Win32/Adware.VrBrothers.AE potentially unwanted
Rising	Trojan.Generic@ML.88 (RDML:VYaW2Kt3xxEMTtyWeH/fvg)
Yandex	PUA.VrBrothers!
Ikarus	Trojan.Win32.Sufbotool
eGambit	Generic.Adware
Fortinet	Adware/Generic
MaxSecure	Adware.not.a.virus.WIN32.AdWare.DealPly.gen_186280
AVG	Win32:Adware-gen [Adw]
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	Win32/Virus.Adware.b51

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)

dead_host	216.58.200.46:443
dead_host	172.217.24.14:443
dead_host	172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2013-01-31 11:04:45

Imports

Library MFC42.DLL:

• 0x4b2328

• 0x4b232c

• 0x4b2330

• 0x4b2334

• 0x4b2338

• 0x4b233c

• 0x4b2340

• 0x4b2344

• 0x4b2348

• 0x4b234c

• 0x4b2350

• 0x4b2354

• 0x4b2358

• 0x4b235c

• 0x4b2360

• 0x4b2364

• 0x4b2368

• 0x4b236c

• 0x4b2370

• 0x4b2374

• 0x4b2378

• 0x4b237c

• 0x4b2380

• 0x4b2384

• 0x4b2388

• 0x4b238c

• 0x4b2390

• 0x4b2394

• 0x4b2398

• 0x4b239c

• 0x4b23a0

• 0x4b23a4

• 0x4b23a8

• 0x4b23ac

• 0x4b23b0

• 0x4b23b4

• 0x4b23b8

• 0x4b23bc

• 0x4b23c0

• 0x4b23c4

• 0x4b23c8

• 0x4b23cc

• 0x4b23d0

• 0x4b23d4

• 0x4b23d8

• 0x4b23dc

• 0x4b23e0

• 0x4b23e4

• 0x4b23e8

• 0x4b23ec

• 0x4b23f0

• 0x4b23f4

• 0x4b23f8

• 0x4b23fc

• 0x4b2400

• 0x4b2404

• 0x4b2408

• 0x4b240c

• 0x4b2410

• 0x4b2414

• 0x4b2418

• 0x4b241c

• 0x4b2420

• 0x4b2424

• 0x4b2428

• 0x4b242c

• 0x4b2430

• 0x4b2434

• 0x4b2438

• 0x4b243c

• 0x4b2440

• 0x4b2444

• 0x4b2448

• 0x4b244c

• 0x4b2450

• 0x4b2454

• 0x4b2458

• 0x4b245c

• 0x4b2460

• 0x4b2464

• 0x4b2468

• 0x4b246c

• 0x4b2470

• 0x4b2474

• 0x4b2478

• 0x4b247c

• 0x4b2480

• 0x4b2484

• 0x4b2488

• 0x4b248c

• 0x4b2490

• 0x4b2494

• 0x4b2498

• 0x4b249c

• 0x4b24a0

• 0x4b24a4

• 0x4b24a8

• 0x4b24ac

• 0x4b24b0

• 0x4b24b4

• 0x4b24b8

• 0x4b24bc

• 0x4b24c0

• 0x4b24c4

• 0x4b24c8

• 0x4b24cc

• 0x4b24d0

• 0x4b24d4

• 0x4b24d8

• 0x4b24dc

• 0x4b24e0

• 0x4b24e4

• 0x4b24e8

• 0x4b24ec

• 0x4b24f0

• 0x4b24f4

• 0x4b24f8

• 0x4b24fc

• 0x4b2500

• 0x4b2504

• 0x4b2508

• 0x4b250c

• 0x4b2510

• 0x4b2514

• 0x4b2518

• 0x4b251c

• 0x4b2520

• 0x4b2524

• 0x4b2528

• 0x4b252c

• 0x4b2530

• 0x4b2534

• 0x4b2538

• 0x4b253c

• 0x4b2540

• 0x4b2544

• 0x4b2548

• 0x4b254c

• 0x4b2550

• 0x4b2554

• 0x4b2558

• 0x4b255c

• 0x4b2560

• 0x4b2564

• 0x4b2568

• 0x4b256c

• 0x4b2570

• 0x4b2574

• 0x4b2578

• 0x4b257c

• 0x4b2580

• 0x4b2584

• 0x4b2588

• 0x4b258c

• 0x4b2590

• 0x4b2594

• 0x4b2598

• 0x4b259c

• 0x4b25a0

• 0x4b25a4

• 0x4b25a8

• 0x4b25ac

• 0x4b25b0

• 0x4b25b4

• 0x4b25b8

• 0x4b25bc

• 0x4b25c0

• 0x4b25c4

• 0x4b25c8

• 0x4b25cc

• 0x4b25d0

• 0x4b25d4

• 0x4b25d8

• 0x4b25dc

• 0x4b25e0

• 0x4b25e4

• 0x4b25e8

• 0x4b25ec

• 0x4b25f0

• 0x4b25f4

• 0x4b25f8

• 0x4b25fc

• 0x4b2600

• 0x4b2604

• 0x4b2608

• 0x4b260c

• 0x4b2610

• 0x4b2614

• 0x4b2618

• 0x4b261c

• 0x4b2620

• 0x4b2624

• 0x4b2628

• 0x4b262c

• 0x4b2630

• 0x4b2634

• 0x4b2638

• 0x4b263c

• 0x4b2640

• 0x4b2644

• 0x4b2648

• 0x4b264c

• 0x4b2650

• 0x4b2654

• 0x4b2658

• 0x4b265c

• 0x4b2660

• 0x4b2664

• 0x4b2668

• 0x4b266c

• 0x4b2670

• 0x4b2674

• 0x4b2678

• 0x4b267c

• 0x4b2680

• 0x4b2684

• 0x4b2688

• 0x4b268c

• 0x4b2690

• 0x4b2694

• 0x4b2698

• 0x4b269c

• 0x4b26a0

• 0x4b26a4

• 0x4b26a8

• 0x4b26ac

• 0x4b26b0

• 0x4b26b4

• 0x4b26b8

• 0x4b26bc

• 0x4b26c0

• 0x4b26c4

• 0x4b26c8

• 0x4b26cc

• 0x4b26d0

• 0x4b26d4

• 0x4b26d8

• 0x4b26dc

• 0x4b26e0

• 0x4b26e4

• 0x4b26e8

• 0x4b26ec

• 0x4b26f0

• 0x4b26f4

• 0x4b26f8

• 0x4b26fc

• 0x4b2700

• 0x4b2704

• 0x4b2708

• 0x4b270c

• 0x4b2710

• 0x4b2714

• 0x4b2718

• 0x4b271c

• 0x4b2720

• 0x4b2724

• 0x4b2728

• 0x4b272c

• 0x4b2730

• 0x4b2734

• 0x4b2738

• 0x4b273c

• 0x4b2740

• 0x4b2744

• 0x4b2748

• 0x4b274c

• 0x4b2750

• 0x4b2754

• 0x4b2758

• 0x4b275c

• 0x4b2760

• 0x4b2764

• 0x4b2768

• 0x4b276c

• 0x4b2770

• 0x4b2774

• 0x4b2778

• 0x4b277c

• 0x4b2780

• 0x4b2784

• 0x4b2788

• 0x4b278c

• 0x4b2790

• 0x4b2794

• 0x4b2798

• 0x4b279c

• 0x4b27a0

• 0x4b27a4

• 0x4b27a8

• 0x4b27ac

• 0x4b27b0

• 0x4b27b4

• 0x4b27b8

• 0x4b27bc

• 0x4b27c0

• 0x4b27c4

• 0x4b27c8

• 0x4b27cc

• 0x4b27d0

• 0x4b27d4

• 0x4b27d8

• 0x4b27dc

• 0x4b27e0

• 0x4b27e4

• 0x4b27e8

• 0x4b27ec

• 0x4b27f0

• 0x4b27f4

• 0x4b27f8

• 0x4b27fc

• 0x4b2800

• 0x4b2804

• 0x4b2808

• 0x4b280c

• 0x4b2810

• 0x4b2814

• 0x4b2818

• 0x4b281c

• 0x4b2820

• 0x4b2824

• 0x4b2828

• 0x4b282c

• 0x4b2830

• 0x4b2834

• 0x4b2838

• 0x4b283c

• 0x4b2840

• 0x4b2844

• 0x4b2848

• 0x4b284c

• 0x4b2850

• 0x4b2854

• 0x4b2858

• 0x4b285c

• 0x4b2860

• 0x4b2864

• 0x4b2868

• 0x4b286c

• 0x4b2870

• 0x4b2874

• 0x4b2878

• 0x4b287c

• 0x4b2880

• 0x4b2884

• 0x4b2888

• 0x4b288c

• 0x4b2890

• 0x4b2894

• 0x4b2898

• 0x4b289c

• 0x4b28a0

• 0x4b28a4

• 0x4b28a8

• 0x4b28ac

• 0x4b28b0

• 0x4b28b4

• 0x4b28b8

• 0x4b28bc

• 0x4b28c0

• 0x4b28c4

• 0x4b28c8

• 0x4b28cc

• 0x4b28d0

• 0x4b28d4

• 0x4b28d8

• 0x4b28dc

• 0x4b28e0

• 0x4b28e4

• 0x4b28e8

• 0x4b28ec

• 0x4b28f0

• 0x4b28f4

• 0x4b28f8

• 0x4b28fc

• 0x4b2900

• 0x4b2904

• 0x4b2908

• 0x4b290c

• 0x4b2910

• 0x4b2914

• 0x4b2918

• 0x4b291c

• 0x4b2920

• 0x4b2924

• 0x4b2928

• 0x4b292c

• 0x4b2930

• 0x4b2934

• 0x4b2938

• 0x4b293c

• 0x4b2940

• 0x4b2944

• 0x4b2948

• 0x4b294c

• 0x4b2950

• 0x4b2954

• 0x4b2958

• 0x4b295c

• 0x4b2960

• 0x4b2964

• 0x4b2968

• 0x4b296c

• 0x4b2970

• 0x4b2974

• 0x4b2978

• 0x4b297c

• 0x4b2980

• 0x4b2984

• 0x4b2988

• 0x4b298c

• 0x4b2990

• 0x4b2994

• 0x4b2998

• 0x4b299c

• 0x4b29a0

• 0x4b29a4

• 0x4b29a8

• 0x4b29ac

• 0x4b29b0

• 0x4b29b4

• 0x4b29b8

• 0x4b29bc

• 0x4b29c0

• 0x4b29c4

• 0x4b29c8

• 0x4b29cc

• 0x4b29d0

• 0x4b29d4

• 0x4b29d8

• 0x4b29dc

• 0x4b29e0

• 0x4b29e4

• 0x4b29e8

• 0x4b29ec

• 0x4b29f0

• 0x4b29f4

• 0x4b29f8

• 0x4b29fc

• 0x4b2a00

• 0x4b2a04

• 0x4b2a08

• 0x4b2a0c

• 0x4b2a10

• 0x4b2a14

• 0x4b2a18

• 0x4b2a1c

• 0x4b2a20

• 0x4b2a24

• 0x4b2a28

• 0x4b2a2c

• 0x4b2a30

• 0x4b2a34

• 0x4b2a38

• 0x4b2a3c

• 0x4b2a40

• 0x4b2a44

• 0x4b2a48

• 0x4b2a4c

• 0x4b2a50

• 0x4b2a54

• 0x4b2a58

• 0x4b2a5c

• 0x4b2a60

• 0x4b2a64

• 0x4b2a68

• 0x4b2a6c

• 0x4b2a70

• 0x4b2a74

• 0x4b2a78

• 0x4b2a7c

• 0x4b2a80

• 0x4b2a84

• 0x4b2a88

• 0x4b2a8c

• 0x4b2a90

• 0x4b2a94

• 0x4b2a98

• 0x4b2a9c

• 0x4b2aa0

• 0x4b2aa4

• 0x4b2aa8

• 0x4b2aac

• 0x4b2ab0

• 0x4b2ab4

• 0x4b2ab8

• 0x4b2abc

• 0x4b2ac0

• 0x4b2ac4

• 0x4b2ac8

• 0x4b2acc

• 0x4b2ad0

• 0x4b2ad4

• 0x4b2ad8

• 0x4b2adc

• 0x4b2ae0

• 0x4b2ae4

• 0x4b2ae8

• 0x4b2aec

• 0x4b2af0

• 0x4b2af4

• 0x4b2af8

• 0x4b2afc

• 0x4b2b00

• 0x4b2b04

• 0x4b2b08

• 0x4b2b0c

• 0x4b2b10

• 0x4b2b14

• 0x4b2b18

• 0x4b2b1c

• 0x4b2b20

• 0x4b2b24

• 0x4b2b28

• 0x4b2b2c

• 0x4b2b30

• 0x4b2b34

• 0x4b2b38

• 0x4b2b3c

• 0x4b2b40

• 0x4b2b44

• 0x4b2b48

• 0x4b2b4c

• 0x4b2b50

• 0x4b2b54

• 0x4b2b58

• 0x4b2b5c

• 0x4b2b60

• 0x4b2b64

• 0x4b2b68

• 0x4b2b6c

• 0x4b2b70

• 0x4b2b74

• 0x4b2b78

• 0x4b2b7c

• 0x4b2b80

• 0x4b2b84

• 0x4b2b88

• 0x4b2b8c

• 0x4b2b90

• 0x4b2b94

• 0x4b2b98

• 0x4b2b9c

• 0x4b2ba0

• 0x4b2ba4

• 0x4b2ba8

• 0x4b2bac

• 0x4b2bb0

• 0x4b2bb4

• 0x4b2bb8

• 0x4b2bbc

• 0x4b2bc0

• 0x4b2bc4

• 0x4b2bc8

• 0x4b2bcc

• 0x4b2bd0

• 0x4b2bd4

• 0x4b2bd8

• 0x4b2bdc

• 0x4b2be0

• 0x4b2be4

• 0x4b2be8

• 0x4b2bec

• 0x4b2bf0

• 0x4b2bf4

• 0x4b2bf8

• 0x4b2bfc

• 0x4b2c00

• 0x4b2c04

• 0x4b2c08

• 0x4b2c0c

• 0x4b2c10

• 0x4b2c14

• 0x4b2c18

• 0x4b2c1c

• 0x4b2c20

• 0x4b2c24

• 0x4b2c28

• 0x4b2c2c

• 0x4b2c30

• 0x4b2c34

• 0x4b2c38

• 0x4b2c3c

• 0x4b2c40

• 0x4b2c44

• 0x4b2c48

• 0x4b2c4c

• 0x4b2c50

• 0x4b2c54

• 0x4b2c58

• 0x4b2c5c

• 0x4b2c60

• 0x4b2c64

• 0x4b2c68

• 0x4b2c6c

• 0x4b2c70

• 0x4b2c74

• 0x4b2c78

• 0x4b2c7c

• 0x4b2c80

• 0x4b2c84

• 0x4b2c88

• 0x4b2c8c

• 0x4b2c90

• 0x4b2c94

• 0x4b2c98

• 0x4b2c9c

• 0x4b2ca0

• 0x4b2ca4

• 0x4b2ca8

• 0x4b2cac

• 0x4b2cb0

• 0x4b2cb4

• 0x4b2cb8

• 0x4b2cbc

• 0x4b2cc0

• 0x4b2cc4

• 0x4b2cc8

• 0x4b2ccc

• 0x4b2cd0

• 0x4b2cd4

• 0x4b2cd8

• 0x4b2cdc

• 0x4b2ce0

• 0x4b2ce4

• 0x4b2ce8

• 0x4b2cec

• 0x4b2cf0

• 0x4b2cf4

• 0x4b2cf8

• 0x4b2cfc

• 0x4b2d00

• 0x4b2d04

• 0x4b2d08

• 0x4b2d0c

• 0x4b2d10

• 0x4b2d14

• 0x4b2d18

• 0x4b2d1c

• 0x4b2d20

• 0x4b2d24

• 0x4b2d28

• 0x4b2d2c

• 0x4b2d30

• 0x4b2d34

• 0x4b2d38

• 0x4b2d3c

• 0x4b2d40

• 0x4b2d44

• 0x4b2d48

• 0x4b2d4c

• 0x4b2d50

• 0x4b2d54

• 0x4b2d58

• 0x4b2d5c

• 0x4b2d60

• 0x4b2d64

• 0x4b2d68

• 0x4b2d6c

• 0x4b2d70

• 0x4b2d74

• 0x4b2d78

• 0x4b2d7c

• 0x4b2d80

• 0x4b2d84

• 0x4b2d88

• 0x4b2d8c

• 0x4b2d90

• 0x4b2d94

• 0x4b2d98

• 0x4b2d9c

• 0x4b2da0

Library MSVCRT.dll:

• 0x4b2ef4 ?terminate@@YAXXZ

• 0x4b2ef8 _exit

• 0x4b2efc _XcptFilter

• 0x4b2f00 exit

• 0x4b2f04 _acmdln

• 0x4b2f08 __getmainargs

• 0x4b2f0c _initterm

• 0x4b2f10 __setusermatherr

• 0x4b2f14 _adjust_fdiv

• 0x4b2f18 __p__commode

• 0x4b2f1c __p__fmode

• 0x4b2f20 __set_app_type

• 0x4b2f24 _controlfp

• 0x4b2f28 _strnicmp

• 0x4b2f2c _beginthreadex

• 0x4b2f30 _mbstok

• 0x4b2f34 _pctype

• 0x4b2f38 _isctype

• 0x4b2f3c __mb_cur_max

• 0x4b2f40 _setmbcp

• 0x4b2f44 ??1type_info@@UAE@XZ

• 0x4b2f48 _onexit

• 0x4b2f4c __dllonexit

• 0x4b2f50 isxdigit

• 0x4b2f54 printf

• 0x4b2f58 qsort

• 0x4b2f5c strncmp

• 0x4b2f60 _iob

• 0x4b2f64 fprintf

• 0x4b2f68 _stricmp

• 0x4b2f6c calloc

• 0x4b2f70 _getch

• 0x4b2f74 _tempnam

• 0x4b2f78 _itoa

• 0x4b2f7c _CxxThrowException

• 0x4b2f80 ??0exception@@QAE@ABQBD@Z

• 0x4b2f84 ??1exception@@UAE@XZ

• 0x4b2f88 ??0exception@@QAE@ABV0@@Z

• 0x4b2f8c _mbsnbicmp

• 0x4b2f90 _mbspbrk

• 0x4b2f94 _ismbcspace

• 0x4b2f98 tolower

• 0x4b2f9c _mbschr

• 0x4b2fa0 isspace

• 0x4b2fa4 _except_handler3

• 0x4b2fa8 _mbsicmp

• 0x4b2fac strncpy

• 0x4b2fb0 fwrite

• 0x4b2fb4 _strdup

• 0x4b2fb8 _splitpath

• 0x4b2fbc isprint

• 0x4b2fc0 islower

• 0x4b2fc4 isalnum

• 0x4b2fc8 _mbsstr

• 0x4b2fcc strstr

• 0x4b2fd0 strchr

• 0x4b2fd4 isalpha

• 0x4b2fd8 sprintf

• 0x4b2fdc _mbsnbcpy

• 0x4b2fe0 _purecall

• 0x4b2fe4 memmove

• 0x4b2fe8 _ftol

• 0x4b2fec wcslen

• 0x4b2ff0 wcscpy

• 0x4b2ff4 malloc

• 0x4b2ff8 ftell

• 0x4b2ffc rewind

• 0x4b3000 fread

• 0x4b3004 free

• 0x4b3008 fgets

• 0x4b300c fopen

• 0x4b3010 fseek

• 0x4b3014 fgetc

• 0x4b3018 fclose

• 0x4b301c fputc

• 0x4b3020 rand

• 0x4b3024 time

• 0x4b3028 srand

• 0x4b302c _mbscmp

• 0x4b3030 __CxxFrameHandler

• 0x4b3034 sscanf

• 0x4b3038 atoi

• 0x4b303c ??8type_info@@QBEHABV0@@Z

Library KERNEL32.dll:

• 0x4b2120 GlobalSize

• 0x4b2124 GlobalReAlloc

• 0x4b2128 SetUnhandledExceptionFilter

• 0x4b212c Module32Next

• 0x4b2130 Module32First

• 0x4b2134 CreateToolhelp32Snapshot

• 0x4b2138 MulDiv

• 0x4b213c SystemTimeToFileTime

• 0x4b2140 GetFileSizeEx

• 0x4b2144 SleepEx

• 0x4b2148 TerminateThread

• 0x4b214c FileTimeToSystemTime

• 0x4b2150 SetFilePointer

• 0x4b2154 GetFileInformationByHandle

• 0x4b2158 WriteFile

• 0x4b215c GetLocalTime

• 0x4b2160 LocalFileTimeToFileTime

• 0x4b2164 SetFileTime

• 0x4b2168 VirtualFree

• 0x4b216c VirtualQuery

• 0x4b2170 GetSystemInfo

• 0x4b2174 LCMapStringA

• 0x4b2178 GetStringTypeExA

• 0x4b217c GetUserDefaultLCID

• 0x4b2180 InterlockedCompareExchange

• 0x4b2184 FlushInstructionCache

• 0x4b2188 VirtualAlloc

• 0x4b218c GetStartupInfoA

• 0x4b2190 LocalFree

• 0x4b2194 ReleaseMutex

• 0x4b2198 CreateMutexA

• 0x4b219c ReadProcessMemory

• 0x4b21a0 OutputDebugStringA

• 0x4b21a4 GetCurrentThread

• 0x4b21a8 SuspendThread

• 0x4b21ac CopyFileA

• 0x4b21b0 FormatMessageA

• 0x4b21b4 LocalAlloc

• 0x4b21b8 GetFileSize

• 0x4b21bc ReadFile

• 0x4b21c0 GlobalFree

• 0x4b21c4 GetACP

• 0x4b21c8 WaitForMultipleObjects

• 0x4b21cc PulseEvent

• 0x4b21d0 ResumeThread

• 0x4b21d4 TlsAlloc

• 0x4b21d8 TlsSetValue

• 0x4b21dc SetEnvironmentVariableA

• 0x4b21e0 VirtualProtect

• 0x4b21e4 InterlockedIncrement

• 0x4b21e8 SetEvent

• 0x4b21ec ResetEvent

• 0x4b21f0 Beep

• 0x4b21f4 IsDebuggerPresent

• 0x4b21f8 GlobalAlloc

• 0x4b21fc GlobalLock

• 0x4b2200 GlobalUnlock

• 0x4b2204 GetCurrentDirectoryA

• 0x4b2208 GetFileAttributesExA

• 0x4b220c InterlockedExchange

• 0x4b2210 GetCurrentThreadId

• 0x4b2214 QueryPerformanceFrequency

• 0x4b2218 OpenProcess

• 0x4b221c GetCurrentProcessId

• 0x4b2220 MoveFileA

• 0x4b2224 OpenMutexA

• 0x4b2228 CreateFileMappingA

• 0x4b222c MapViewOfFile

• 0x4b2230 UnmapViewOfFile

• 0x4b2234 GetFileAttributesA

• 0x4b2238 SizeofResource

• 0x4b223c SetCurrentDirectoryA

• 0x4b2240 GetSystemDirectoryA

• 0x4b2244 IsDBCSLeadByte

• 0x4b2248 InterlockedDecrement

• 0x4b224c EnterCriticalSection

• 0x4b2250 LeaveCriticalSection

• 0x4b2254 GetModuleHandleA

• 0x4b2258 GetModuleFileNameA

• 0x4b225c GetTempFileNameA

• 0x4b2260 GetPrivateProfileStringA

• 0x4b2264 CreateFileA

• 0x4b2268 DeviceIoControl

• 0x4b226c GetProcAddress

• 0x4b2270 CompareStringA

• 0x4b2274 lstrcatA

• 0x4b2278 WinExec

• 0x4b227c lstrcpyA

• 0x4b2280 GetWindowsDirectoryA

• 0x4b2284 LoadLibraryA

• 0x4b2288 FreeLibrary

• 0x4b228c lstrcpynA

• 0x4b2290 GetProcessHeap

• 0x4b2294 HeapAlloc

• 0x4b2298 HeapFree

• 0x4b229c CreateThread

• 0x4b22a0 GetLastError

• 0x4b22a4 CreateEventA

• 0x4b22a8 CloseHandle

• 0x4b22ac Sleep

• 0x4b22b0 GetCurrentProcess

• 0x4b22b4 SetPriorityClass

• 0x4b22b8 WritePrivateProfileStringA

• 0x4b22bc GetPrivateProfileIntA

• 0x4b22c0 lstrcmpiA

• 0x4b22c4 FindResourceA

• 0x4b22c8 LoadResource

• 0x4b22cc LockResource

• 0x4b22d0 GetCPInfo

• 0x4b22d4 lstrlenW

• 0x4b22d8 WideCharToMultiByte

• 0x4b22dc lstrlenA

• 0x4b22e0 MultiByteToWideChar

• 0x4b22e4 GetVersion

• 0x4b22e8 GetVersionExA

• 0x4b22ec DeleteCriticalSection

• 0x4b22f0 InitializeCriticalSection

• 0x4b22f4 CreateProcessA

• 0x4b22f8 WaitForSingleObject

• 0x4b22fc GetTempPathA

• 0x4b2300 CreateDirectoryA

• 0x4b2304 DeleteFileA

• 0x4b2308 IsBadReadPtr

• 0x4b230c SetFileAttributesA

• 0x4b2310 MoveFileExA

• 0x4b2314 GetTickCount

• 0x4b2318 QueryPerformanceCounter

• 0x4b231c SetLastError

• 0x4b2320 OpenEventA

Library USER32.dll:

• 0x4b30bc GetSystemMetrics

• 0x4b30c0 AppendMenuA

• 0x4b30c4 GetMenuItemCount

• 0x4b30c8 GetDC

• 0x4b30cc DrawTextA

• 0x4b30d0 ReleaseDC

• 0x4b30d4 ModifyMenuA

• 0x4b30d8 GetMenuState

• 0x4b30dc GetMenuItemID

• 0x4b30e0 CreatePopupMenu

• 0x4b30e4 DrawIconEx

• 0x4b30e8 DestroyIcon

• 0x4b30ec GetSysColor

• 0x4b30f0 CopyRect

• 0x4b30f4 FillRect

• 0x4b30f8 DrawEdge

• 0x4b30fc SetRect

• 0x4b3100 GetMenuItemInfoA

• 0x4b3104 EnableWindow

• 0x4b3108 SendMessageA

• 0x4b310c GetParent

• 0x4b3110 RedrawWindow

• 0x4b3114 IsWindow

• 0x4b3118 CreateMenu

• 0x4b311c GetMenuStringA

• 0x4b3120 GetSysColorBrush

• 0x4b3124 GetKeyState

• 0x4b3128 SystemParametersInfoA

• 0x4b312c SetWindowLongA

• 0x4b3130 SetWindowPos

• 0x4b3134 KillTimer

• 0x4b3138 SetTimer

• 0x4b313c LoadBitmapA

• 0x4b3140 PostMessageA

• 0x4b3144 GetDesktopWindow

• 0x4b3148 GetSubMenu

• 0x4b314c TabbedTextOutA

• 0x4b3150 GrayStringA

• 0x4b3154 IsWindowVisible

• 0x4b3158 GetClientRect

• 0x4b315c GetWindowRect

• 0x4b3160 GetWindowLongA

• 0x4b3164 MessageBoxA

• 0x4b3168 SetCursorPos

• 0x4b316c ClipCursor

• 0x4b3170 GetAsyncKeyState

• 0x4b3174 EqualRect

• 0x4b3178 SetParent

• 0x4b317c GetWindowDC

• 0x4b3180 GetMessageA

• 0x4b3184 GetForegroundWindow

• 0x4b3188 GetGUIThreadInfo

• 0x4b318c DestroyWindow

• 0x4b3190 PostThreadMessageA

• 0x4b3194 PeekMessageA

• 0x4b3198 TranslateMessage

• 0x4b319c DispatchMessageA

• 0x4b31a0 CallNextHookEx

• 0x4b31a4 UnhookWindowsHookEx

• 0x4b31a8 GetWindowThreadProcessId

• 0x4b31ac SetWindowsHookExA

• 0x4b31b0 GetCursorPos

• 0x4b31b4 ScreenToClient

• 0x4b31b8 IsIconic

• 0x4b31bc DrawIcon

• 0x4b31c0 LoadIconA

• 0x4b31c4 LoadMenuA

• 0x4b31c8 LoadCursorA

• 0x4b31cc CopyIcon

• 0x4b31d0 PtInRect

• 0x4b31d4 ReleaseCapture

• 0x4b31d8 SetCapture

• 0x4b31dc wsprintfA

• 0x4b31e0 SetForegroundWindow

• 0x4b31e4 IsMenu

• 0x4b31e8 SetWindowTextA

• 0x4b31ec EndDialog

• 0x4b31f0 LoadImageA

• 0x4b31f4 GetIconInfo

• 0x4b31f8 SendInput

• 0x4b31fc UnregisterHotKey

• 0x4b3200 RegisterHotKey

• 0x4b3204 MapVirtualKeyA

• 0x4b3208 GetDoubleClickTime

• 0x4b320c CheckMenuItem

• 0x4b3210 SetCaretPos

• 0x4b3214 GetCapture

• 0x4b3218 CloseClipboard

• 0x4b321c SetClipboardData

• 0x4b3220 EmptyClipboard

• 0x4b3224 OpenClipboard

• 0x4b3228 EnumDisplaySettingsA

• 0x4b322c DefWindowProcA

• 0x4b3230 UnregisterClassA

• 0x4b3234 CreateWindowExA

• 0x4b3238 RegisterClassA

• 0x4b323c ShowWindow

• 0x4b3240 EnumWindows

• 0x4b3244 SetClassLongA

• 0x4b3248 GetClassLongA

• 0x4b324c SetRectEmpty

• 0x4b3250 GetFocus

• 0x4b3254 RegisterWindowMessageA

• 0x4b3258 IsRectEmpty

• 0x4b325c UpdateWindow

• 0x4b3260 LockWindowUpdate

• 0x4b3264 BringWindowToTop

• 0x4b3268 GetClassInfoA

• 0x4b326c DrawFrameControl

• 0x4b3270 ShowScrollBar

• 0x4b3274 LoadStringA

• 0x4b3278 DrawStateA

• 0x4b327c FrameRect

• 0x4b3280 InflateRect

• 0x4b3284 OffsetRect

• 0x4b3288 DrawFocusRect

• 0x4b328c ClientToScreen

• 0x4b3290 WindowFromPoint

• 0x4b3294 GetActiveWindow

• 0x4b3298 InvalidateRect

• 0x4b329c SetCursor

• 0x4b32a0 GetDlgCtrlID

• 0x4b32a4 PostQuitMessage

• 0x4b32a8 GetNextDlgTabItem

• 0x4b32ac DestroyCursor

Library GDI32.dll:

• 0x4b206c GetNearestColor

• 0x4b2070 SetPixelV

• 0x4b2074 CreateRectRgn

• 0x4b2078 GetCurrentObject

• 0x4b207c GetBkColor

• 0x4b2080 GetBrushOrgEx

• 0x4b2084 SetBrushOrgEx

• 0x4b2088 RoundRect

• 0x4b208c SetDIBits

• 0x4b2090 TextOutA

• 0x4b2094 Rectangle

• 0x4b2098 RectVisible

• 0x4b209c GetDeviceCaps

• 0x4b20a0 GetBkMode

• 0x4b20a4 CreatePen

• 0x4b20a8 ExtTextOutA

• 0x4b20ac Escape

• 0x4b20b0 GetStockObject

• 0x4b20b4 SetTextColor

• 0x4b20b8 SetBkColor

• 0x4b20bc CreateBitmap

• 0x4b20c0 CreateRectRgnIndirect

• 0x4b20c4 GetDIBits

• 0x4b20c8 CreateDCA

• 0x4b20cc CreateSolidBrush

• 0x4b20d0 CreateFontIndirectA

• 0x4b20d4 CreateCompatibleDC

• 0x4b20d8 CreateCompatibleBitmap

• 0x4b20dc GetTextExtentPoint32W

• 0x4b20e0 GetTextExtentPoint32A

• 0x4b20e4 Ellipse

• 0x4b20e8 DeleteDC

• 0x4b20ec DeleteObject

• 0x4b20f0 BitBlt

• 0x4b20f4 SelectObject

• 0x4b20f8 CreateDIBSection

• 0x4b20fc SetPixel

• 0x4b2100 GetPixel

• 0x4b2104 GetObjectA

• 0x4b2108 PtVisible

• 0x4b210c PatBlt

Library ADVAPI32.dll:

• 0x4b2000 CloseServiceHandle

• 0x4b2004 RegCreateKeyExA

• 0x4b2008 CreateServiceA

• 0x4b200c DeleteService

• 0x4b2010 OpenServiceA

• 0x4b2014 StartServiceA

• 0x4b2018 ControlService

• 0x4b201c OpenSCManagerA

• 0x4b2020 RegCloseKey

• 0x4b2024 RegQueryValueExA

• 0x4b2028 RegQueryValueA

• 0x4b202c RegDeleteValueA

• 0x4b2030 RegOpenKeyExA

• 0x4b2034 RegSetValueExA

Library SHELL32.dll:

• 0x4b3094 SHGetSpecialFolderPathA

• 0x4b3098 Shell_NotifyIconA

• 0x4b309c SHBrowseForFolderA

• 0x4b30a0 SHGetPathFromIDListA

• 0x4b30a4 ShellExecuteExA

• 0x4b30a8 ShellExecuteA

Library COMCTL32.dll:

• 0x4b203c ImageList_GetImageCount

• 0x4b2040 ImageList_GetImageInfo

• 0x4b2044 ImageList_GetBkColor

• 0x4b2048 ImageList_SetBkColor

• 0x4b204c ImageList_GetIcon

• 0x4b2050 ImageList_AddMasked

• 0x4b2054 ImageList_ReplaceIcon

• 0x4b2058 _TrackMouseEvent

• 0x4b205c ImageList_Draw

Library ole32.dll:

• 0x4b32d8 CLSIDFromString

• 0x4b32dc CLSIDFromProgID

• 0x4b32e0 StgCreateDocfileOnILockBytes

• 0x4b32e4 CoInitializeEx

• 0x4b32e8 CoUninitialize

• 0x4b32ec OleRun

• 0x4b32f0 StgCreateDocfile

• 0x4b32f4 CreateStreamOnHGlobal

• 0x4b32f8 CreateILockBytesOnHGlobal

• 0x4b32fc StgOpenStorageOnILockBytes

• 0x4b3300 CoFreeUnusedLibraries

• 0x4b3304 ProgIDFromCLSID

• 0x4b3308 CoTaskMemFree

• 0x4b330c StringFromCLSID

• 0x4b3310 CoInitialize

• 0x4b3314 CoCreateInstance

Library OLEAUT32.dll:

• 0x4b3044 SysAllocStringByteLen

• 0x4b3048 SafeArrayCreateVector

• 0x4b304c SafeArrayPutElement

• 0x4b3050 SafeArrayDestroy

• 0x4b3054 SysStringLen

• 0x4b3058 SysAllocStringLen

• 0x4b305c VariantCopy

• 0x4b3060 LoadTypeLib

• 0x4b3064 SysAllocString

• 0x4b3068 VariantInit

• 0x4b306c VariantClear

• 0x4b3070 SysFreeString

• 0x4b3074 GetErrorInfo

Library urlmon.dll:

• 0x4b331c URLDownloadToFileA

Library MSVCP60.dll:

• 0x4b2da8 ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z

• 0x4b2dac ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z

• 0x4b2db0 ??_7runtime_error@std@@6B@

• 0x4b2db4 ??0runtime_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z

• 0x4b2db8 ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z

• 0x4b2dbc ?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z

• 0x4b2dc0 ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z

• 0x4b2dc4 ??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z

• 0x4b2dc8 ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z

• 0x4b2dcc ??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z

• 0x4b2dd0 ??0runtime_error@std@@QAE@ABV01@@Z

• 0x4b2dd4 ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z

• 0x4b2dd8 ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z

• 0x4b2ddc ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z

• 0x4b2de0 ??Ostd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z

• 0x4b2de4 ??Nstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z

• 0x4b2de8 ??1runtime_error@std@@UAE@XZ

• 0x4b2dec ??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z

• 0x4b2df0 ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD0@Z

• 0x4b2df4 ?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ

• 0x4b2df8 ?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ

• 0x4b2dfc ?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IID@Z

• 0x4b2e00 ??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z

• 0x4b2e04 ?_Doraise@runtime_error@std@@MBEXXZ

• 0x4b2e08 ?what@runtime_error@std@@UBEPBDXZ

• 0x4b2e0c ??1logic_error@std@@UAE@XZ

• 0x4b2e10 ??0bad_exception@std@@QAE@ABV01@@Z

• 0x4b2e14 ??1bad_exception@std@@UAE@XZ

• 0x4b2e18 ??_7bad_exception@std@@6B@

• 0x4b2e1c ?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PAD0PBD1@Z

• 0x4b2e20 ?_Xran@std@@YAXXZ

• 0x4b2e24 ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ

• 0x4b2e28 ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z

• 0x4b2e2c ??_7logic_error@std@@6B@

• 0x4b2e30 ??8std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z

• 0x4b2e34 ??0logic_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z

• 0x4b2e38 ?what@logic_error@std@@UBEPBDXZ

• 0x4b2e3c ?_Xlen@std@@YAXXZ

• 0x4b2e40 ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z

• 0x4b2e44 ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

• 0x4b2e48 ??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z

• 0x4b2e4c ?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHPBD@Z

• 0x4b2e50 ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

• 0x4b2e54 ??_8?$basic_ifstream@DU?$char_traits@D@std@@@std@@7B@

• 0x4b2e58 ??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@

• 0x4b2e5c ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z

• 0x4b2e60 ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ

• 0x4b2e64 ??0locale@std@@QAE@XZ

• 0x4b2e68 ??_7?$basic_filebuf@DU?$char_traits@D@std@@@std@@6B@

• 0x4b2e6c ??0Init@ios_base@std@@QAE@XZ

• 0x4b2e70 ??1Init@ios_base@std@@QAE@XZ

• 0x4b2e74 ??0_Winit@std@@QAE@XZ

• 0x4b2e78 ??1_Winit@std@@QAE@XZ

• 0x4b2e7c ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ

• 0x4b2e80 ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

• 0x4b2e84 ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ

• 0x4b2e88 ??1ios_base@std@@UAE@XZ

• 0x4b2e8c ??1locale@std@@QAE@XZ

• 0x4b2e90 ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB

• 0x4b2e94 ??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@

• 0x4b2e98 ??1_Lockit@std@@QAE@XZ

• 0x4b2e9c ??0_Lockit@std@@QAE@XZ

• 0x4b2ea0 ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z

• 0x4b2ea4 ??0logic_error@std@@QAE@ABV01@@Z

• 0x4b2ea8 ??0out_of_range@std@@QAE@ABV01@@Z

• 0x4b2eac ??1out_of_range@std@@UAE@XZ

• 0x4b2eb0 ??_7out_of_range@std@@6B@

• 0x4b2eb4 ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z

• 0x4b2eb8 ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

• 0x4b2ebc ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z

• 0x4b2ec0 ?clear@ios_base@std@@QAEXH_N@Z

• 0x4b2ec4 ?_Stinit@?1??_Init@?$basic_filebuf@DU?$char_traits@D@std@@@std@@IAEXPAU_iobuf@@W4_Initfl@23@@Z@4HA

• 0x4b2ec8 ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z

• 0x4b2ecc ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z

• 0x4b2ed0 ?_Init@?$basic_filebuf@DU?$char_traits@D@std@@@std@@IAEXPAU_iobuf@@W4_Initfl@12@@Z

• 0x4b2ed4 ??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ

• 0x4b2ed8 ??1?$basic_filebuf@DU?$char_traits@D@std@@@std@@UAE@XZ

• 0x4b2edc ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ

• 0x4b2ee0 ?close@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@XZ

• 0x4b2ee4 ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z

• 0x4b2ee8 ?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PBDH@Z

• 0x4b2eec ??_7?$basic_ifstream@DU?$char_traits@D@std@@@std@@6B@

Library WINMM.dll:

• 0x4b32bc timeGetTime

• 0x4b32c0 PlaySoundA

Library SHLWAPI.dll:

• 0x4b30b0 SHDeleteKeyA

• 0x4b30b4 PathFileExistsA

Library WS2_32.dll:

• 0x4b32c8 gethostbyname

Library RPCRT4.dll:

• 0x4b3084 RpcStringFreeA

• 0x4b3088 UuidCreate

• 0x4b308c UuidToStringA

Library IMAGEHLP.dll:

• 0x4b2114 MakeSureDirectoryPathExists

• 0x4b2118 ImageNtHeader

Library DINPUT8.dll:

• 0x4b2064 DirectInput8Create

Library UxTheme.dll:

• 0x4b32b4 SetThemeAppProperties

Library comdlg32.dll:

• 0x4b32d0 GetOpenFileNameA

Exports

Ordinal	Address	Name
1	0x4b4e30	?interfaceMap@CCustomControlSite@@1UAFX_INTERFACEMAP@@B

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
down.vrbrothers.com	A 117.27.139.134	117.27.139.134
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
r3---sn-j5o7dn7e.gvt1.com	CNAME r3.sn-j5o7dn7e.gvt1.com A 113.108.239.196	113.108.239.196
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1
dns.msftncsi.com	A 131.107.255.255
hi.vrbrothers.com	A 117.27.139.134	117.27.139.134
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com A 216.58.200.46	216.58.200.78
r1---sn-j5o7dn7e.gvt1.com	A 113.108.239.194 CNAME r1.sn-j5o7dn7e.gvt1.com	113.108.239.194
redirector.gvt1.com	A 203.208.41.33	113.108.239.161
update.googleapis.com	A 203.208.40.98	180.163.151.162
ad.vrbrothers.com	A 117.27.139.134	117.27.139.134
teredo.ipv6.microsoft.com

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49216	113.108.239.194 r1---sn-j5o7dn7e.gvt1.com	80
192.168.56.101	49217	113.108.239.196 r3---sn-j5o7dn7e.gvt1.com	80
192.168.56.101	49195	117.27.139.134 ad.vrbrothers.com	80
192.168.56.101	49196	117.27.139.134 ad.vrbrothers.com	80
192.168.56.101	49197	117.27.139.134 ad.vrbrothers.com	80
192.168.56.101	49214	203.208.40.98 update.googleapis.com	443
192.168.56.101	49215	203.208.41.33 redirector.gvt1.com	80

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	54178	114.114.114.114	53
192.168.56.101	54260	114.114.114.114	53
192.168.56.101	55169	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56743	114.114.114.114	53
192.168.56.101	57236	114.114.114.114	53
192.168.56.101	57367	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	60221	114.114.114.114	53
192.168.56.101	61522	114.114.114.114	53
192.168.56.101	62912	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355

HTTP & HTTPS Requests

URI	Data
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=11d34bd67f3d2857&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620750979&mv=m&mvi=3	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=11d34bd67f3d2857&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620750979&mv=m&mvi=3 HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: r3---sn-j5o7dn7e.gvt1.com
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: redirector.gvt1.com
http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620750979&mv=m&mvi=1&pl=23&shardbypass=yes	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620750979&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: r1---sn-j5o7dn7e.gvt1.com
http://hi.vrbrothers.com/xjl/mmcount.aspx?mm=000026A461DB0941E18975812691ED421FE3AF588380BE09B1012CB6775955C31999E50C696E2EF04F7F6738&randcode=000069F9A267380A9AF85809AAAB7A7201183AA6D2F4C00CDBF3ED51CB1347FB316A60A38596BBEF5D7A4196E972F6F21E813BF3D4CA16C88024569B91A9AAA2D58C76AD7AD840561D4E6FD3A41F63FC4F336738	GET /xjl/mmcount.aspx?mm=000026A461DB0941E18975812691ED421FE3AF588380BE09B1012CB6775955C31999E50C696E2EF04F7F6738&randcode=000069F9A267380A9AF85809AAAB7A7201183AA6D2F4C00CDBF3ED51CB1347FB316A60A38596BBEF5D7A4196E972F6F21E813BF3D4CA16C88024569B91A9AAA2D58C76AD7AD840561D4E6FD3A41F63FC4F336738 HTTP/1.1 User-Agent: 752f40989dbe9165b539a76e264ccf39 Host: hi.vrbrothers.com
http://ad.vrbrothers.com/qmacro/v9/ad-mymacro.xml	GET /qmacro/v9/ad-mymacro.xml HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: ad.vrbrothers.com Connection: Keep-Alive
http://down.vrbrothers.com/qmacro/up_mymacro/liveupdate8.dat	GET /qmacro/up_mymacro/liveupdate8.dat HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: down.vrbrothers.com Connection: Keep-Alive

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.