SmartHawk

8.6

极危

49 个模型检测该样本为恶意！

重新分析

下载样本

983537aabc518bf222e4dbd06f338c9bebacf94c6995002e8550f76ce3af702a

7c537cb61b9be08ce2788e9678073ff8.exe

分析耗时

90s

最近分析

文件大小

308.0KB

静态报毒动态报毒 100% AI SCORE=100 ATTRIBUTE BSCOPE CLASSIC CONFIDENCE DOWNLOADER33 ELDORADO EMOTET EMOTETU ENCPK GENCIRC GHZOU HDOP HIGH CONFIDENCE HIGHCONFIDENCE KCLOUD KRYPTIK MALWARE@#3I7I6GVBC65DH MALWAREX R + MAL SCORE TQ0@A41CRULI TQ0@B41CRULI TRICKBOT UNSAFE W32KRYPTIK ZEXAF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Emotet-FQU!7C537CB61B9B	20201211	6.0.6.653
Alibaba	Trojan:Win32/Emotet.6ec5f295	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0
Avast	Win32:MalwareX-gen [Trj]	20201210	21.1.5827.0
Tencent	Malware.Win32.Gencirc.10cdd0e8	20201211	1.0.0.1
Baidu		20190318	1.0.0.2
Kingsoft	Win32.Hack.Undef.(kcloud)	20201211	2017.9.26.565

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619658908.0015 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (4 个事件)

Time & API	Arguments	Status	Return
1619658892.9695 CryptGenKey	crypto_handle: 0x002f3590 algorithm_identifier: 0x0000660e () provider_handle: 0x002f2790 flags: 1 key: fXW¸£I¯·þe{ÕÑ	success	1
1619658908.0795 CryptExportKey	crypto_handle: 0x002f3590 crypto_export_handle: 0x002f2858 buffer: f¤0ÑtfÆsY ÎC^n¶;¿ÈÏÓ<Søù<to²{E+"Ç Íw_w»4êÀ¢+Y0b6]1hlñ:<ÁÅÇxºDqÃÝ&Wgç¾¦NN blob_type: 1 flags: 64	success	1
1619658941.3445 CryptExportKey	crypto_handle: 0x002f3590 crypto_export_handle: 0x002f2858 buffer: f¤ ®!@{N×TUÝ¥®>ÌÓÖc \|eq»áï¶¦YÖæMû©BRMÚ½4O$c&EuGIíWFø¹Im;ÆñKö,5®o0×ð6Þ£@ blob_type: 1 flags: 64	success	1
1619658946.0635 CryptExportKey	crypto_handle: 0x002f3590 crypto_export_handle: 0x002f2858 buffer: f¤¯¡3 Ê;td_ïJn9õ-½ÒLv¥ünÕ»le>ÿ9Á÷h=]>¦P-\|x<=bÔO(°æ+B¢Õ-ì.É.ôög\|ÙÜ«&03dUGBjÊ blob_type: 1 flags: 64	success	1

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1619649224.253605 NtAllocateVirtualMemory	process_identifier: 2424 region_size: 40960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x003c0000	success
1619658529.520021 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0000000004120000	success
1619658888.5945 NtAllocateVirtualMemory	process_identifier: 2864 region_size: 40960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00690000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619649227.925605 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7c537cb61b9be08ce2788e9678073ff8.exe newfilepath: C:\Windows\SysWOW64\netid\netid.exe newfilepath_r: C:\Windows\SysWOW64\netid\netid.exe flags: 3 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7c537cb61b9be08ce2788e9678073ff8.exe	success	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619658908.4385 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

netid.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619658908.1575 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (4 个事件)

host	103.83.81.141
host	170.81.48.2
host	172.217.24.14
host	190.47.227.130

Installs itself for autorun at Windows startup (1 个事件)

service_name

netid

service_path

C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\netid\netid.exe"

Created a service where a service was also not started (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619649228.253605 CreateServiceW	service_start_name: start_type: 2 service_handle: 0x02256ba0 display_name: netid error_control: 0 service_name: netid filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\netid\netid.exe" filepath_r: "C:\Windows\SysWOW64\netid\netid.exe" service_manager_handle: 0x02251320 desired_access: 2 service_type: 16 password:	success	36006816	0

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619658911.0165 RegSetValueExA	key_handle: 0x000003a0 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619658911.0165 RegSetValueExA	key_handle: 0x000003a0 value: 2mô{<× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619658911.0165 RegSetValueExA	key_handle: 0x000003a0 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619658911.0165 RegSetValueExW	key_handle: 0x000003a0 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619658911.0165 RegSetValueExA	key_handle: 0x000003b8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619658911.0165 RegSetValueExA	key_handle: 0x000003b8 value: 2mô{<× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619658911.0165 RegSetValueExA	key_handle: 0x000003b8 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619658911.0485 RegSetValueExW	key_handle: 0x0000039c value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Windows\SysWOW64\netid\netid.exe:Zone.Identifier

File has been identified by 49 AntiVirus engines on VirusTotal as malicious (49 个事件)

Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader33.44766
MicroWorld-eScan	Trojan.EmotetU.Gen.tq0@b41cRUli
FireEye	Trojan.EmotetU.Gen.tq0@b41cRUli
McAfee	Emotet-FQU!7C537CB61B9B
Cylance	Unsafe
Zillya	Trojan.Emotet.Win32.20834
Sangfor	Malware
K7AntiVirus	Trojan ( 005675131 )
Alibaba	Trojan:Win32/Emotet.6ec5f295
K7GW	Trojan ( 005675131 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.EmotetU.Gen.EB275C
BitDefenderTheta	Gen:NN.ZexaF.34670.tq0@a41cRUli
Cyren	W32/Trickbot.DU.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.HDOP
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
ClamAV	Win.Malware.Emotet-7997984-0
Kaspersky	HEUR:Backdoor.Win32.Emotet.pef
BitDefender	Trojan.EmotetU.Gen.tq0@b41cRUli
Paloalto	generic.ml
Tencent	Malware.Win32.Gencirc.10cdd0e8
Ad-Aware	Trojan.EmotetU.Gen.tq0@b41cRUli
Sophos	Mal/Generic-R + Mal/EncPk-APM
Comodo	Malware@#3i7i6gvbc65dh
F-Secure	Trojan.TR/Crypt.Agent.ghzou
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Emotet.fh
Emsisoft	Trojan.Emotet (A)
Jiangmin	Backdoor.Emotet.gn
Avira	TR/Crypt.Agent.ghzou
MAX	malware (ai score=100)
Antiy-AVL	Trojan[Banker]/Win32.Emotet
Kingsoft	Win32.Hack.Undef.(kcloud)
Microsoft	Trojan:Win32/Emotet.DEY!MTB
ZoneAlarm	HEUR:Backdoor.Win32.Emotet.pef
GData	Trojan.EmotetU.Gen.tq0@b41cRUli
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.Generic.C4106689
VBA32	BScope.Trojan.Downloader
Malwarebytes	Trojan.Emotet
Rising	Trojan.Kryptik!1.C699 (CLASSIC)
Ikarus	Trojan-Banker.Emotet
Fortinet	W32Kryptik.HDOP!tr
AVG	Win32:MalwareX-gen [Trj]
Panda	Trj/Emotet.C
Qihoo-360	Win32/Backdoor.30b

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (4 个事件)

dead_host	192.168.56.101:49181
dead_host	190.47.227.130:80
dead_host	103.83.81.141:8080
dead_host	170.81.48.2:80

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-05-22 18:46:07

Imports

Library KERNEL32.dll:

• 0x42f0ec RtlUnwind

• 0x42f0f0 GetStartupInfoA

• 0x42f0f4 GetCommandLineA

• 0x42f0f8 ExitProcess

• 0x42f0fc TerminateProcess

• 0x42f100 ExitThread

• 0x42f104 CreateThread

• 0x42f108 HeapReAlloc

• 0x42f10c HeapSize

• 0x42f110 HeapDestroy

• 0x42f114 HeapCreate

• 0x42f118 VirtualFree

• 0x42f11c IsBadWritePtr

• 0x42f120 SetUnhandledExceptionFilter

• 0x42f124 GetStdHandle

• 0x42f128 UnhandledExceptionFilter

• 0x42f12c FreeEnvironmentStringsA

• 0x42f130 GetEnvironmentStrings

• 0x42f134 FreeEnvironmentStringsW

• 0x42f138 GetEnvironmentStringsW

• 0x42f13c SetHandleCount

• 0x42f140 VirtualQuery

• 0x42f144 QueryPerformanceCounter

• 0x42f148 GetTickCount

• 0x42f14c GetCurrentProcessId

• 0x42f150 GetSystemTimeAsFileTime

• 0x42f154 LCMapStringA

• 0x42f158 LCMapStringW

• 0x42f15c GetStringTypeA

• 0x42f160 GetStringTypeW

• 0x42f164 GetTimeZoneInformation

• 0x42f168 IsBadReadPtr

• 0x42f16c IsBadCodePtr

• 0x42f170 SetStdHandle

• 0x42f174 SetEnvironmentVariableA

• 0x42f178 GetSystemInfo

• 0x42f17c VirtualAlloc

• 0x42f180 VirtualProtect

• 0x42f184 HeapFree

• 0x42f188 HeapAlloc

• 0x42f18c SetErrorMode

• 0x42f190 LocalFileTimeToFileTime

• 0x42f194 FileTimeToLocalFileTime

• 0x42f198 SystemTimeToFileTime

• 0x42f19c FileTimeToSystemTime

• 0x42f1a0 GetShortPathNameA

• 0x42f1a4 CreateFileA

• 0x42f1a8 GetVolumeInformationA

• 0x42f1ac FindFirstFileA

• 0x42f1b0 FindClose

• 0x42f1b4 DuplicateHandle

• 0x42f1b8 GetFileSize

• 0x42f1bc SetEndOfFile

• 0x42f1c0 UnlockFile

• 0x42f1c4 LockFile

• 0x42f1c8 FlushFileBuffers

• 0x42f1cc SetFilePointer

• 0x42f1d0 WriteFile

• 0x42f1d4 ReadFile

• 0x42f1d8 DeleteFileA

• 0x42f1dc MoveFileA

• 0x42f1e0 WritePrivateProfileStringA

• 0x42f1e4 GetOEMCP

• 0x42f1e8 GetCPInfo

• 0x42f1ec InterlockedIncrement

• 0x42f1f0 RaiseException

• 0x42f1f4 InterlockedDecrement

• 0x42f1f8 TlsFree

• 0x42f1fc LocalReAlloc

• 0x42f200 TlsSetValue

• 0x42f204 TlsAlloc

• 0x42f208 TlsGetValue

• 0x42f20c GlobalHandle

• 0x42f210 GlobalReAlloc

• 0x42f214 LocalAlloc

• 0x42f218 GlobalFlags

• 0x42f21c GetDiskFreeSpaceA

• 0x42f220 GetFullPathNameA

• 0x42f224 GetTempFileNameA

• 0x42f228 GetFileTime

• 0x42f22c SetFileTime

• 0x42f230 GetFileAttributesA

• 0x42f234 SuspendThread

• 0x42f238 GetCurrentThread

• 0x42f23c lstrcmpA

• 0x42f240 GetModuleFileNameA

• 0x42f244 ConvertDefaultLocale

• 0x42f248 EnumResourceLanguagesA

• 0x42f24c lstrcpyA

• 0x42f250 FreeResource

• 0x42f254 GetCurrentThreadId

• 0x42f258 GlobalFindAtomA

• 0x42f25c GlobalDeleteAtom

• 0x42f260 LoadLibraryA

• 0x42f264 FreeLibrary

• 0x42f268 lstrcatA

• 0x42f26c lstrcmpW

• 0x42f270 GetModuleHandleA

• 0x42f274 GetProcAddress

• 0x42f278 SetLastError

• 0x42f27c GlobalFree

• 0x42f280 MulDiv

• 0x42f284 GlobalAlloc

• 0x42f288 FormatMessageA

• 0x42f28c LocalFree

• 0x42f290 lstrcpynA

• 0x42f294 GlobalLock

• 0x42f298 GlobalUnlock

• 0x42f29c GlobalGetAtomNameA

• 0x42f2a0 GlobalAddAtomA

• 0x42f2a4 EnterCriticalSection

• 0x42f2a8 LeaveCriticalSection

• 0x42f2ac CreateEventA

• 0x42f2b0 SetEvent

• 0x42f2b4 WaitForSingleObject

• 0x42f2b8 Sleep

• 0x42f2bc ResumeThread

• 0x42f2c0 SetThreadPriority

• 0x42f2c4 InitializeCriticalSection

• 0x42f2c8 LoadLibraryExW

• 0x42f2cc LoadLibraryExA

• 0x42f2d0 GetCurrentProcess

• 0x42f2d4 DeleteCriticalSection

• 0x42f2d8 CloseHandle

• 0x42f2dc FindResourceA

• 0x42f2e0 LoadResource

• 0x42f2e4 LockResource

• 0x42f2e8 SizeofResource

• 0x42f2ec GetStringTypeExA

• 0x42f2f0 CompareStringW

• 0x42f2f4 CompareStringA

• 0x42f2f8 lstrlenA

• 0x42f2fc lstrcmpiA

• 0x42f300 GetVersion

• 0x42f304 GetLastError

• 0x42f308 WideCharToMultiByte

• 0x42f30c MultiByteToWideChar

• 0x42f310 GetVersionExA

• 0x42f314 GetThreadLocale

• 0x42f318 GetLocaleInfoA

• 0x42f31c GetACP

• 0x42f320 GetFileType

• 0x42f324 InterlockedExchange

Library USER32.dll:

• 0x42f364 LoadCursorA

• 0x42f368 GetSysColorBrush

• 0x42f36c GetMenuItemInfoA

• 0x42f370 InflateRect

• 0x42f374 EndPaint

• 0x42f378 BeginPaint

• 0x42f37c GetWindowDC

• 0x42f380 ReleaseDC

• 0x42f384 GetDC

• 0x42f388 ClientToScreen

• 0x42f38c GrayStringA

• 0x42f390 DrawTextExA

• 0x42f394 DrawTextA

• 0x42f398 TabbedTextOutA

• 0x42f39c FillRect

• 0x42f3a0 GetMessageA

• 0x42f3a4 TranslateMessage

• 0x42f3a8 GetCursorPos

• 0x42f3ac ValidateRect

• 0x42f3b0 ShowOwnedPopups

• 0x42f3b4 PostQuitMessage

• 0x42f3b8 CreateDialogIndirectParamA

• 0x42f3bc GetNextDlgTabItem

• 0x42f3c0 EndDialog

• 0x42f3c4 SetMenuItemBitmaps

• 0x42f3c8 ModifyMenuA

• 0x42f3cc EnableMenuItem

• 0x42f3d0 CheckMenuItem

• 0x42f3d4 GetMenuCheckMarkDimensions

• 0x42f3d8 LoadBitmapA

• 0x42f3dc SetWindowTextA

• 0x42f3e0 IsDialogMessageA

• 0x42f3e4 CreateWindowExA

• 0x42f3e8 SetWindowsHookExA

• 0x42f3ec CallNextHookEx

• 0x42f3f0 GetClassLongA

• 0x42f3f4 GetClassInfoExA

• 0x42f3f8 SetPropA

• 0x42f3fc GetPropA

• 0x42f400 RemovePropA

• 0x42f404 IsChild

• 0x42f408 GetWindowTextA

• 0x42f40c GetForegroundWindow

• 0x42f410 DispatchMessageA

• 0x42f414 BeginDeferWindowPos

• 0x42f418 EndDeferWindowPos

• 0x42f41c GetTopWindow

• 0x42f420 DestroyWindow

• 0x42f424 UnhookWindowsHookEx

• 0x42f428 GetMessageTime

• 0x42f42c MapWindowPoints

• 0x42f430 MessageBoxA

• 0x42f434 TrackPopupMenu

• 0x42f438 SetForegroundWindow

• 0x42f43c AdjustWindowRectEx

• 0x42f440 ScreenToClient

• 0x42f444 DeferWindowPos

• 0x42f448 RegisterClassA

• 0x42f44c UnregisterClassA

• 0x42f450 DefWindowProcA

• 0x42f454 CallWindowProcA

• 0x42f458 SystemParametersInfoA

• 0x42f45c GetWindowPlacement

• 0x42f460 GetWindowRect

• 0x42f464 GetSystemMetrics

• 0x42f468 PtInRect

• 0x42f46c GetMenuState

• 0x42f470 SendDlgItemMessageA

• 0x42f474 CharUpperA

• 0x42f478 EnableWindow

• 0x42f47c GetSystemMenu

• 0x42f480 InvalidateRect

• 0x42f484 SetRect

• 0x42f488 OffsetRect

• 0x42f48c GetClientRect

• 0x42f490 TranslateAcceleratorA

• 0x42f494 SendMessageA

• 0x42f498 IsWindowEnabled

• 0x42f49c RegisterWindowMessageA

• 0x42f4a0 wsprintfA

• 0x42f4a4 LoadMenuA

• 0x42f4a8 DestroyMenu

• 0x42f4ac GetClassNameA

• 0x42f4b0 GetSysColor

• 0x42f4b4 SetWindowPos

• 0x42f4b8 WinHelpA

• 0x42f4bc SetFocus

• 0x42f4c0 GetActiveWindow

• 0x42f4c4 GetFocus

• 0x42f4c8 EqualRect

• 0x42f4cc GetDlgItem

• 0x42f4d0 SetWindowLongA

• 0x42f4d4 GetKeyState

• 0x42f4d8 GetDlgCtrlID

• 0x42f4dc GetMenu

• 0x42f4e0 UnpackDDElParam

• 0x42f4e4 ReuseDDElParam

• 0x42f4e8 LoadIconA

• 0x42f4ec GetClassInfoA

• 0x42f4f0 SetCursor

• 0x42f4f4 PeekMessageA

• 0x42f4f8 GetMessagePos

• 0x42f4fc DestroyIcon

• 0x42f500 GetWindow

• 0x42f504 GetDesktopWindow

• 0x42f508 IsWindow

• 0x42f50c GetWindowLongA

• 0x42f510 ShowWindow

• 0x42f514 SetMenu

• 0x42f518 PostMessageA

• 0x42f51c BringWindowToTop

• 0x42f520 GetLastActivePopup

• 0x42f524 CopyRect

• 0x42f528 SetRectEmpty

• 0x42f52c IntersectRect

• 0x42f530 CreatePopupMenu

• 0x42f534 GetMenuItemCount

• 0x42f538 GetMenuItemID

• 0x42f53c GetSubMenu

• 0x42f540 InsertMenuItemA

• 0x42f544 IsIconic

• 0x42f548 GetCapture

• 0x42f54c ReleaseCapture

• 0x42f550 LoadAcceleratorsA

• 0x42f554 GetParent

• 0x42f558 SetActiveWindow

• 0x42f55c IsWindowVisible

• 0x42f560 UpdateWindow

Library GDI32.dll:

• 0x42f04c CreatePen

• 0x42f050 CreateSolidBrush

• 0x42f054 CreateFontIndirectA

• 0x42f058 GetTextExtentPoint32A

• 0x42f05c GetStockObject

• 0x42f060 CreatePatternBrush

• 0x42f064 DeleteDC

• 0x42f068 ScaleWindowExtEx

• 0x42f06c BitBlt

• 0x42f070 SetWindowExtEx

• 0x42f074 ScaleViewportExtEx

• 0x42f078 SetViewportExtEx

• 0x42f07c OffsetViewportOrgEx

• 0x42f080 SetViewportOrgEx

• 0x42f084 SelectObject

• 0x42f088 Escape

• 0x42f08c ExtTextOutA

• 0x42f090 TextOutA

• 0x42f094 RectVisible

• 0x42f098 PtVisible

• 0x42f09c Ellipse

• 0x42f0a0 DeleteObject

• 0x42f0a4 MoveToEx

• 0x42f0a8 LineTo

• 0x42f0ac SetMapMode

• 0x42f0b0 SetBkMode

• 0x42f0b4 RestoreDC

• 0x42f0b8 SaveDC

• 0x42f0bc CreateBitmap

• 0x42f0c0 GetObjectA

• 0x42f0c4 SetBkColor

• 0x42f0c8 SetTextColor

• 0x42f0cc GetClipBox

• 0x42f0d0 GetDeviceCaps

• 0x42f0d4 CreateCompatibleDC

• 0x42f0d8 CreateCompatibleBitmap

• 0x42f0dc GdiFlush

• 0x42f0e0 Rectangle

• 0x42f0e4 GetPixel

Library comdlg32.dll:

• 0x42f578 GetOpenFileNameA

• 0x42f57c GetSaveFileNameA

• 0x42f580 GetFileTitleA

Library WINSPOOL.DRV:

• 0x42f568 OpenPrinterA

• 0x42f56c DocumentPropertiesA

• 0x42f570 ClosePrinter

Library ADVAPI32.dll:

• 0x42f000 RegSetValueA

• 0x42f004 RegOpenKeyA

• 0x42f008 RegQueryValueExA

• 0x42f00c RegOpenKeyExA

• 0x42f010 RegDeleteKeyA

• 0x42f014 RegEnumKeyA

• 0x42f018 RegQueryValueA

• 0x42f01c SetFileSecurityA

• 0x42f020 GetFileSecurityA

• 0x42f024 RegCreateKeyExA

• 0x42f028 RegCreateKeyA

• 0x42f02c RegCloseKey

• 0x42f030 RegSetValueExA

Library SHELL32.dll:

• 0x42f33c DragQueryFileA

• 0x42f340 ExtractIconA

• 0x42f344 SHGetFileInfoA

• 0x42f348 DragFinish

Library COMCTL32.dll:

• 0x42f038 ImageList_Draw

• 0x42f03c ImageList_GetImageInfo

• 0x42f040

• 0x42f044 ImageList_Destroy

Library SHLWAPI.dll:

• 0x42f350 PathFindFileNameA

• 0x42f354 PathStripToRootA

• 0x42f358 PathFindExtensionA

• 0x42f35c PathIsUNCA

Library OLEAUT32.dll:

• 0x42f32c VariantClear

• 0x42f330 VariantChangeType

• 0x42f334 VariantInit

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.