SmartHawk

5.4

中危

54 个模型检测该样本为恶意！

重新分析

下载样本

9440cf0fb866d579dd3c99d88fbf0c57302f2c8dc1bfea781c8a280f431495b4

7a87486cf062b43d0bd3b2a74b9b0ed9.exe

分析耗时

78s

最近分析

文件大小

588.5KB

静态报毒动态报毒 100% 3G4K99HBNUY AI SCORE=87 AIDETECTVM ATTRIBUTE CONFIDENCE COSSTA DELF DOWNLOADER33 EGXE ELDORADO EMPE FAREIT FSGU GENCIRC GENERIC@ML GENETIC GJWB HIGH CONFIDENCE HIGHCONFIDENCE HKCLGN KGX@AIS@LSNC MALICIOUS PE MALWARE2 MALWARE@#2OWME9V75DCQL R06EC0DIK20 R335716 RATX RDMK REMCOS RSQGQCYNSSEYFWX+JHLRMG SCORE STATIC AI UJRYU WACATAC ZELPHICO 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Trojan-FSGU!7A87486CF062	20201229	6.0.6.653
Alibaba	TrojanDownloader:Win32/Cossta.3bb5d713	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:RATX-gen [Trj]	20201229	21.1.5827.0
Tencent	Malware.Win32.Gencirc.116f94ad	20201229	1.0.0.1
Kingsoft		20201229	2017.9.26.565
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

WAVE

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619649283.766205 __exception__	stacktrace: registers.esp: 58785276 registers.edi: 56004588 registers.eax: 0 registers.ebp: 0 registers.edx: 0 registers.ebx: 36 registers.esi: 16 registers.ecx: 0 exception.instruction_r: 8b 41 3c 99 03 04 24 13 54 24 04 83 c4 08 89 04 exception.instruction: mov eax, dword ptr [ecx + 0x3c] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x35688a5	success	0	0

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619649226.078205 NtAllocateVirtualMemory	process_identifier: 1068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e0000	success	0	0

Downloads a file or document from Google Drive (1 个事件)

domain

drive.google.com

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619649252.094205 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619649254.657205 RegSetValueExA	key_handle: 0x0000037c value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619649254.657205 RegSetValueExA	key_handle: 0x0000037c value: àZ¨ <× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619649254.657205 RegSetValueExA	key_handle: 0x0000037c value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619649254.657205 RegSetValueExW	key_handle: 0x0000037c value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619649254.672205 RegSetValueExA	key_handle: 0x00000394 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619649254.672205 RegSetValueExA	key_handle: 0x00000394 value: àZ¨ <× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619649254.672205 RegSetValueExA	key_handle: 0x00000394 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619649254.688205 RegSetValueExW	key_handle: 0x00000378 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

108.160.167.148:443

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Empe.1.Gen
FireEye	Generic.mg.7a87486cf062b43d
McAfee	Trojan-FSGU!7A87486CF062
Malwarebytes	Trojan.Downloader
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Win32.Agent.b!c
K7AntiVirus	Trojan-Downloader ( 0056607e1 )
Alibaba	TrojanDownloader:Win32/Cossta.3bb5d713
K7GW	Trojan-Downloader ( 0056607e1 )
Cybereason	malicious.cf062b
Arcabit	Trojan.Empe.1.Gen
Cyren	W32/Delf.KM.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:RATX-gen [Trj]
ClamAV	Win.Dropper.Remcos-7769411-0
Kaspersky	HEUR:Trojan-Dropper.Win32.Agent.gen
BitDefender	Trojan.Empe.1.Gen
NANO-Antivirus	Trojan.Win32.Delf.hkclgn
Tencent	Malware.Win32.Gencirc.116f94ad
Ad-Aware	Trojan.Empe.1.Gen
Sophos	Mal/Generic-S
Comodo	Malware@#2owme9v75dcql
F-Secure	Trojan.TR/Dldr.Delf.ujryu
DrWeb	Trojan.DownLoader33.39078
TrendMicro	TROJ_GEN.R06EC0DIK20
McAfee-GW-Edition	Trojan-FSGU!7A87486CF062
Emsisoft	Trojan.Empe.1.Gen (B)
Paloalto	generic.ml
Jiangmin	TrojanDropper.Agent.gjwb
Avira	TR/Dldr.Delf.ujryu
MAX	malware (ai score=87)
Antiy-AVL	Trojan/Win32.Wacatac
Microsoft	PWS:Win32/Fareit.ART!MTB
ZoneAlarm	HEUR:Trojan-Dropper.Win32.Agent.gen
GData	Trojan.Empe.1.Gen
Cynet	Malicious (score: 85)
AhnLab-V3	Trojan/Win32.Agent.R335716
BitDefenderTheta	Gen:NN.ZelphiCO.34700.KGX@ais@Lsnc
ALYac	Trojan.Empe.1.Gen
VBA32	TrojanDropper.Agent
ESET-NOD32	Win32/TrojanDownloader.Delf.CXL
TrendMicro-HouseCall	TROJ_GEN.R06EC0DIK20
Rising	Trojan.Generic@ML.98 (RDMK:rsqgqcYNsSeYFWx+JHLRmg)
Yandex	Trojan.DL.Delf!3g4K99hbNuY
SentinelOne	Static AI - Malicious PE
Fortinet	W32/Injector.EGXE!tr
Webroot	W32.Trojan.Gen

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x464140 DeleteCriticalSection

• 0x464144 LeaveCriticalSection

• 0x464148 EnterCriticalSection

• 0x46414c InitializeCriticalSection

• 0x464150 VirtualFree

• 0x464154 VirtualAlloc

• 0x464158 LocalFree

• 0x46415c LocalAlloc

• 0x464160 GetTickCount

• 0x464164 QueryPerformanceCounter

• 0x464168 GetVersion

• 0x46416c GetCurrentThreadId

• 0x464170 InterlockedDecrement

• 0x464174 InterlockedIncrement

• 0x464178 VirtualQuery

• 0x46417c WideCharToMultiByte

• 0x464180 MultiByteToWideChar

• 0x464184 lstrlenA

• 0x464188 lstrcpynA

• 0x46418c LoadLibraryExA

• 0x464190 GetThreadLocale

• 0x464194 GetStartupInfoA

• 0x464198 GetProcAddress

• 0x46419c GetModuleHandleA

• 0x4641a0 GetModuleFileNameA

• 0x4641a4 GetLocaleInfoA

• 0x4641a8 GetCommandLineA

• 0x4641ac FreeLibrary

• 0x4641b0 FindFirstFileA

• 0x4641b4 FindClose

• 0x4641b8 ExitProcess

• 0x4641bc WriteFile

• 0x4641c0 UnhandledExceptionFilter

• 0x4641c4 RtlUnwind

• 0x4641c8 RaiseException

• 0x4641cc GetStdHandle

Library user32.dll:

• 0x4641d4 GetKeyboardType

• 0x4641d8 LoadStringA

• 0x4641dc MessageBoxA

• 0x4641e0 CharNextA

Library advapi32.dll:

• 0x4641e8 RegQueryValueExA

• 0x4641ec RegOpenKeyExA

• 0x4641f0 RegCloseKey

Library oleaut32.dll:

• 0x4641f8 SysFreeString

• 0x4641fc SysReAllocStringLen

• 0x464200 SysAllocStringLen

Library kernel32.dll:

• 0x464208 TlsSetValue

• 0x46420c TlsGetValue

• 0x464210 LocalAlloc

• 0x464214 GetModuleHandleA

Library advapi32.dll:

• 0x46421c RegSetValueExA

• 0x464220 RegQueryValueExA

• 0x464224 RegOpenKeyExA

• 0x464228 RegCreateKeyExA

• 0x46422c RegCloseKey

Library kernel32.dll:

• 0x464234 lstrcpyA

• 0x464238 WriteFile

• 0x46423c WaitForSingleObject

• 0x464240 VirtualQuery

• 0x464244 VirtualProtect

• 0x464248 VirtualAlloc

• 0x46424c Sleep

• 0x464250 SizeofResource

• 0x464254 SetThreadLocale

• 0x464258 SetFilePointer

• 0x46425c SetEvent

• 0x464260 SetErrorMode

• 0x464264 SetEndOfFile

• 0x464268 ResetEvent

• 0x46426c ReadFile

• 0x464270 MulDiv

• 0x464274 LockResource

• 0x464278 LoadResource

• 0x46427c LoadLibraryA

• 0x464280 LeaveCriticalSection

• 0x464284 InitializeCriticalSection

• 0x464288 GlobalUnlock

• 0x46428c GlobalReAlloc

• 0x464290 GlobalHandle

• 0x464294 GlobalLock

• 0x464298 GlobalFree

• 0x46429c GlobalFindAtomA

• 0x4642a0 GlobalDeleteAtom

• 0x4642a4 GlobalAlloc

• 0x4642a8 GlobalAddAtomA

• 0x4642ac GetVersionExA

• 0x4642b0 GetVersion

• 0x4642b4 GetTickCount

• 0x4642b8 GetThreadLocale

• 0x4642bc GetSystemInfo

• 0x4642c0 GetStringTypeExA

• 0x4642c4 GetStdHandle

• 0x4642c8 GetProcAddress

• 0x4642cc GetModuleHandleA

• 0x4642d0 GetModuleFileNameA

• 0x4642d4 GetLocaleInfoA

• 0x4642d8 GetLocalTime

• 0x4642dc GetLastError

• 0x4642e0 GetFullPathNameA

• 0x4642e4 GetDiskFreeSpaceA

• 0x4642e8 GetDateFormatA

• 0x4642ec GetCurrentThreadId

• 0x4642f0 GetCurrentProcessId

• 0x4642f4 GetCPInfo

• 0x4642f8 GetACP

• 0x4642fc FreeResource

• 0x464300 InterlockedExchange

• 0x464304 FreeLibrary

• 0x464308 FormatMessageA

• 0x46430c FindResourceA

• 0x464310 ExitProcess

• 0x464314 EnumCalendarInfoA

• 0x464318 EnterCriticalSection

• 0x46431c DeleteCriticalSection

• 0x464320 CreateThread

• 0x464324 CreateFileA

• 0x464328 CreateEventA

• 0x46432c CompareStringA

• 0x464330 CloseHandle

Library version.dll:

• 0x464338 VerQueryValueA

• 0x46433c GetFileVersionInfoSizeA

• 0x464340 GetFileVersionInfoA

Library gdi32.dll:

• 0x464348 UnrealizeObject

• 0x46434c StretchBlt

• 0x464350 SetWindowOrgEx

• 0x464354 SetViewportOrgEx

• 0x464358 SetTextColor

• 0x46435c SetStretchBltMode

• 0x464360 SetROP2

• 0x464364 SetPixel

• 0x464368 SetMapMode

• 0x46436c SetDIBColorTable

• 0x464370 SetBrushOrgEx

• 0x464374 SetBkMode

• 0x464378 SetBkColor

• 0x46437c SetBitmapBits

• 0x464380 SelectPalette

• 0x464384 SelectObject

• 0x464388 SaveDC

• 0x46438c RestoreDC

• 0x464390 RectVisible

• 0x464394 RealizePalette

• 0x464398 PatBlt

• 0x46439c MoveToEx

• 0x4643a0 MaskBlt

• 0x4643a4 LineTo

• 0x4643a8 IntersectClipRect

• 0x4643ac GetWindowOrgEx

• 0x4643b0 GetTextMetricsA

• 0x4643b4 GetTextExtentPoint32A

• 0x4643b8 GetSystemPaletteEntries

• 0x4643bc GetStockObject

• 0x4643c0 GetPixel

• 0x4643c4 GetPaletteEntries

• 0x4643c8 GetObjectA

• 0x4643cc GetMapMode

• 0x4643d0 GetDeviceCaps

• 0x4643d4 GetDIBits

• 0x4643d8 GetDIBColorTable

• 0x4643dc GetDCOrgEx

• 0x4643e0 GetCurrentPositionEx

• 0x4643e4 GetClipBox

• 0x4643e8 GetBrushOrgEx

• 0x4643ec GetBitmapBits

• 0x4643f0 ExcludeClipRect

• 0x4643f4 DeleteObject

• 0x4643f8 DeleteDC

• 0x4643fc CreateSolidBrush

• 0x464400 CreatePenIndirect

• 0x464404 CreatePalette

• 0x464408 CreateHalftonePalette

• 0x46440c CreateFontIndirectA

• 0x464410 CreateFontA

• 0x464414 CreateDIBitmap

• 0x464418 CreateDIBSection

• 0x46441c CreateCompatibleDC

• 0x464420 CreateCompatibleBitmap

• 0x464424 CreateBrushIndirect

• 0x464428 CreateBitmap

• 0x46442c BitBlt

Library user32.dll:

• 0x464434 CreateWindowExA

• 0x464438 WindowFromPoint

• 0x46443c WinHelpA

• 0x464440 WaitMessage

• 0x464444 UpdateWindow

• 0x464448 UnregisterClassA

• 0x46444c UnionRect

• 0x464450 UnhookWindowsHookEx

• 0x464454 TranslateMessage

• 0x464458 TranslateMDISysAccel

• 0x46445c TrackPopupMenu

• 0x464460 SystemParametersInfoA

• 0x464464 ShowWindow

• 0x464468 ShowScrollBar

• 0x46446c ShowOwnedPopups

• 0x464470 ShowCursor

• 0x464474 SetWindowsHookExA

• 0x464478 SetWindowPos

• 0x46447c SetWindowPlacement

• 0x464480 SetWindowLongA

• 0x464484 SetTimer

• 0x464488 SetScrollRange

• 0x46448c SetScrollPos

• 0x464490 SetScrollInfo

• 0x464494 SetRect

• 0x464498 SetPropA

• 0x46449c SetParent

• 0x4644a0 SetMenuItemInfoA

• 0x4644a4 SetMenu

• 0x4644a8 SetForegroundWindow

• 0x4644ac SetFocus

• 0x4644b0 SetCursor

• 0x4644b4 SetClassLongA

• 0x4644b8 SetCapture

• 0x4644bc SetActiveWindow

• 0x4644c0 SendMessageA

• 0x4644c4 ScrollWindow

• 0x4644c8 ScreenToClient

• 0x4644cc RemovePropA

• 0x4644d0 RemoveMenu

• 0x4644d4 ReleaseDC

• 0x4644d8 ReleaseCapture

• 0x4644dc RegisterWindowMessageA

• 0x4644e0 RegisterClipboardFormatA

• 0x4644e4 RegisterClassExA

• 0x4644e8 RegisterClassA

• 0x4644ec RedrawWindow

• 0x4644f0 PtInRect

• 0x4644f4 PostQuitMessage

• 0x4644f8 PostMessageA

• 0x4644fc PeekMessageA

• 0x464500 OffsetRect

• 0x464504 OemToCharA

• 0x464508 MessageBoxA

• 0x46450c MapWindowPoints

• 0x464510 MapVirtualKeyA

• 0x464514 LoadStringA

• 0x464518 LoadKeyboardLayoutA

• 0x46451c LoadImageA

• 0x464520 LoadIconA

• 0x464524 LoadCursorA

• 0x464528 LoadBitmapA

• 0x46452c KillTimer

• 0x464530 IsZoomed

• 0x464534 IsWindowVisible

• 0x464538 IsWindowEnabled

• 0x46453c IsWindow

• 0x464540 IsRectEmpty

• 0x464544 IsIconic

• 0x464548 IsDialogMessageA

• 0x46454c IsChild

• 0x464550 InvalidateRect

• 0x464554 IntersectRect

• 0x464558 InsertMenuItemA

• 0x46455c InsertMenuA

• 0x464560 InflateRect

• 0x464564 GetWindowThreadProcessId

• 0x464568 GetWindowTextA

• 0x46456c GetWindowRect

• 0x464570 GetWindowPlacement

• 0x464574 GetWindowLongA

• 0x464578 GetWindowDC

• 0x46457c GetTopWindow

• 0x464580 GetSystemMetrics

• 0x464584 GetSystemMenu

• 0x464588 GetSysColorBrush

• 0x46458c GetSysColor

• 0x464590 GetSubMenu

• 0x464594 GetScrollRange

• 0x464598 GetScrollPos

• 0x46459c GetScrollInfo

• 0x4645a0 GetPropA

• 0x4645a4 GetParent

• 0x4645a8 GetWindow

• 0x4645ac GetMenuStringA

• 0x4645b0 GetMenuState

• 0x4645b4 GetMenuItemInfoA

• 0x4645b8 GetMenuItemID

• 0x4645bc GetMenuItemCount

• 0x4645c0 GetMenu

• 0x4645c4 GetLastActivePopup

• 0x4645c8 GetKeyboardState

• 0x4645cc GetKeyboardLayoutList

• 0x4645d0 GetKeyboardLayout

• 0x4645d4 GetKeyState

• 0x4645d8 GetKeyNameTextA

• 0x4645dc GetIconInfo

• 0x4645e0 GetForegroundWindow

• 0x4645e4 GetFocus

• 0x4645e8 GetDesktopWindow

• 0x4645ec GetDCEx

• 0x4645f0 GetDC

• 0x4645f4 GetCursorPos

• 0x4645f8 GetCursor

• 0x4645fc GetClientRect

• 0x464600 GetClassNameA

• 0x464604 GetClassInfoA

• 0x464608 GetCapture

• 0x46460c GetActiveWindow

• 0x464610 FrameRect

• 0x464614 FindWindowA

• 0x464618 FillRect

• 0x46461c EqualRect

• 0x464620 EnumWindows

• 0x464624 EnumThreadWindows

• 0x464628 EndPaint

• 0x46462c EnableWindow

• 0x464630 EnableScrollBar

• 0x464634 EnableMenuItem

• 0x464638 DrawTextA

• 0x46463c DrawMenuBar

• 0x464640 DrawIconEx

• 0x464644 DrawIcon

• 0x464648 DrawFrameControl

• 0x46464c DrawEdge

• 0x464650 DispatchMessageA

• 0x464654 DestroyWindow

• 0x464658 DestroyMenu

• 0x46465c DestroyIcon

• 0x464660 DestroyCursor

• 0x464664 DeleteMenu

• 0x464668 DefWindowProcA

• 0x46466c DefMDIChildProcA

• 0x464670 DefFrameProcA

• 0x464674 CreatePopupMenu

• 0x464678 CreateMenu

• 0x46467c CreateIcon

• 0x464680 CopyImage

• 0x464684 ClientToScreen

• 0x464688 CheckMenuItem

• 0x46468c CallWindowProcA

• 0x464690 CallNextHookEx

• 0x464694 BeginPaint

• 0x464698 CharNextA

• 0x46469c CharLowerA

• 0x4646a0 CharToOemA

• 0x4646a4 AdjustWindowRectEx

• 0x4646a8 ActivateKeyboardLayout

Library winmm.dll:

• 0x4646b0 PlaySoundA

Library shell32.dll:

• 0x4646b8 ShellExecuteA

Library kernel32.dll:

• 0x4646c0 Sleep

Library oleaut32.dll:

• 0x4646c8 SafeArrayPtrOfIndex

• 0x4646cc SafeArrayGetUBound

• 0x4646d0 SafeArrayGetLBound

• 0x4646d4 SafeArrayCreate

• 0x4646d8 VariantChangeType

• 0x4646dc VariantCopy

• 0x4646e0 VariantClear

• 0x4646e4 VariantInit

Library comctl32.dll:

• 0x4646ec ImageList_SetIconSize

• 0x4646f0 ImageList_GetIconSize

• 0x4646f4 ImageList_Write

• 0x4646f8 ImageList_Read

• 0x4646fc ImageList_GetDragImage

• 0x464700 ImageList_DragShowNolock

• 0x464704 ImageList_SetDragCursorImage

• 0x464708 ImageList_DragMove

• 0x46470c ImageList_DragLeave

• 0x464710 ImageList_DragEnter

• 0x464714 ImageList_EndDrag

• 0x464718 ImageList_BeginDrag

• 0x46471c ImageList_Remove

• 0x464720 ImageList_DrawEx

• 0x464724 ImageList_Draw

• 0x464728 ImageList_GetBkColor

• 0x46472c ImageList_SetBkColor

• 0x464730 ImageList_ReplaceIcon

• 0x464734 ImageList_Add

• 0x464738 ImageList_SetImageCount

• 0x46473c ImageList_GetImageCount

• 0x464740 ImageList_Destroy

• 0x464744 ImageList_Create

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
drive.google.com	A 108.160.167.148	104.16.251.55
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.