SmartHawk

7.6

高危

该样本未表现出任何异常！

重新分析

下载样本

41393d40adabe7eb82029b42a5b3d5b5e1ea9129e102f5590462ab3a26ccf514

7f9b739ce08e70fe28c7ddd039fad444.exe

分析耗时

112s

最近分析

文件大小

634.5KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619722579.772625 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (4 个事件)

Time & API	Arguments	Status	Return
1619722568.210625 CryptGenKey	crypto_handle: 0x005759a8 algorithm_identifier: 0x0000660e () provider_handle: 0x0061cfd0 flags: 1 key: f ·xÄ L=ª.	success	1
1619722579.788625 CryptExportKey	crypto_handle: 0x005759a8 crypto_export_handle: 0x005758e8 buffer: f¤d µYk´q¶gÙål¯Êo.J ñ-¶Mþhë,F)¥îñD9ßTnewáÍ&é3]þÄ¹%aÌP6DÂ¼&ER<H_ù²òà¨¢=çÿ blob_type: 1 flags: 64	success	1
1619722610.819625 CryptExportKey	crypto_handle: 0x005759a8 crypto_export_handle: 0x005758e8 buffer: f¤%gÊïo¤R8l¾Ç®Ñ;uýÄlýj%§âK}aCü·0Yû¤\|ÁèÆÖÓ3lG4 7>ûÇ+ÏkjÌ\|+ì2¢ÜÆ]Ò¸¦ÂÕ blob_type: 1 flags: 64	success	1
1619722616.507625 CryptExportKey	crypto_handle: 0x005759a8 crypto_export_handle: 0x005758e8 buffer: f¤zÏlÐÿÅ¡ÝBÃ¦)h½é';¼µ][3öÉÕ ÈæXÃaéÙø¹ÓTÅQ0Ì¤ç<r&Ta·æk´Y4*¤ C0W'x(õìú blob_type: 1 flags: 64	success	1

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

None

Allocates read-write-execute memory (usually to unpack itself) (5 个事件)

Time & API	Arguments	Status
1619722561.5535 NtAllocateVirtualMemory	process_identifier: 1916 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01e90000	success
1619722561.5535 NtAllocateVirtualMemory	process_identifier: 1916 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01eb0000	success
1619722623.803625 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0000000003e80000	success
1619722567.975625 NtAllocateVirtualMemory	process_identifier: 2976 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00510000	success
1619722567.975625 NtAllocateVirtualMemory	process_identifier: 2976 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01dd0000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619722562.1475 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7f9b739ce08e70fe28c7ddd039fad444.exe newfilepath: C:\Windows\SysWOW64\KBDINBE1\mfds.exe newfilepath_r: C:\Windows\SysWOW64\KBDINBE1\mfds.exe flags: 3 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7f9b739ce08e70fe28c7ddd039fad444.exe	success	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619722584.100625 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

mfds.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619722582.522625 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (5 个事件)

host	172.217.24.14
host	209.236.123.42
host	45.16.226.117
host	91.121.54.71
host	37.139.21.175

Installs itself for autorun at Windows startup (1 个事件)

service_name

mfds

service_path

C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\KBDINBE1\mfds.exe"

Created a service where a service was also not started (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619722566.3665 CreateServiceW	service_start_name: start_type: 2 service_handle: 0x02a3cd60 display_name: mfds error_control: 0 service_name: mfds filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\KBDINBE1\mfds.exe" filepath_r: "C:\Windows\SysWOW64\KBDINBE1\mfds.exe" service_manager_handle: 0x02a3cf90 desired_access: 2 service_type: 16 password:	success	44289376	0

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619722586.663625 RegSetValueExA	key_handle: 0x000003c4 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619722586.678625 RegSetValueExA	key_handle: 0x000003c4 value: p&=× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619722586.678625 RegSetValueExA	key_handle: 0x000003c4 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619722586.678625 RegSetValueExW	key_handle: 0x000003c4 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619722586.678625 RegSetValueExA	key_handle: 0x000003dc value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619722586.678625 RegSetValueExA	key_handle: 0x000003dc value: p&=× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619722586.678625 RegSetValueExA	key_handle: 0x000003dc value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619722586.694625 RegSetValueExW	key_handle: 0x000003c0 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Windows\SysWOW64\KBDINBE1\mfds.exe:Zone.Identifier

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (6 个事件)

dead_host	172.217.27.142:443
dead_host	172.217.24.14:443
dead_host	192.168.56.101:49188
dead_host	209.236.123.42:8080
dead_host	91.121.54.71:8080
dead_host	45.16.226.117:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-28 21:37:36

Imports

Library KERNEL32.dll:

• 0x4490e0 RaiseException

• 0x4490e4 RtlUnwind

• 0x4490e8 GetCommandLineA

• 0x4490ec GetStartupInfoA

• 0x4490f0 HeapAlloc

• 0x4490f4 HeapFree

• 0x4490f8 VirtualProtect

• 0x4490fc GetSystemInfo

• 0x449100 VirtualQuery

• 0x449104 HeapReAlloc

• 0x449108 Sleep

• 0x44910c HeapSize

• 0x449110 GetStdHandle

• 0x449114 FreeEnvironmentStringsA

• 0x449118 GetEnvironmentStrings

• 0x44911c FreeEnvironmentStringsW

• 0x449120 GetEnvironmentStringsW

• 0x449124 SetHandleCount

• 0x449128 GetFileType

• 0x44912c HeapCreate

• 0x449130 VirtualFree

• 0x449134 QueryPerformanceCounter

• 0x449138 IsDebuggerPresent

• 0x44913c GetACP

• 0x449140 IsValidCodePage

• 0x449144 InitializeCriticalSectionAndSpinCount

• 0x449148 GetStringTypeA

• 0x44914c GetStringTypeW

• 0x449150 GetTimeZoneInformation

• 0x449154 GetConsoleCP

• 0x449158 GetConsoleMode

• 0x44915c LCMapStringA

• 0x449160 LCMapStringW

• 0x449164 SetStdHandle

• 0x449168 WriteConsoleA

• 0x44916c GetConsoleOutputCP

• 0x449170 WriteConsoleW

• 0x449174 CompareStringW

• 0x449178 SetEnvironmentVariableA

• 0x44917c SetUnhandledExceptionFilter

• 0x449180 UnhandledExceptionFilter

• 0x449184 TerminateProcess

• 0x449188 GetTickCount

• 0x44918c GetFileTime

• 0x449190 GetFileSizeEx

• 0x449194 GetFileAttributesA

• 0x449198 FileTimeToLocalFileTime

• 0x44919c SetErrorMode

• 0x4491a0 CreateFileA

• 0x4491a4 GetFullPathNameA

• 0x4491a8 GetVolumeInformationA

• 0x4491ac FindFirstFileA

• 0x4491b0 FindClose

• 0x4491b4 GetCurrentProcess

• 0x4491b8 DuplicateHandle

• 0x4491bc GetFileSize

• 0x4491c0 SetEndOfFile

• 0x4491c4 UnlockFile

• 0x4491c8 LockFile

• 0x4491cc FlushFileBuffers

• 0x4491d0 SetFilePointer

• 0x4491d4 WriteFile

• 0x4491d8 ReadFile

• 0x4491dc WritePrivateProfileStringA

• 0x4491e0 FileTimeToSystemTime

• 0x4491e4 GetThreadLocale

• 0x4491e8 GetModuleHandleW

• 0x4491ec GetOEMCP

• 0x4491f0 GetCPInfo

• 0x4491f4 InterlockedIncrement

• 0x4491f8 GlobalFlags

• 0x4491fc TlsFree

• 0x449200 DeleteCriticalSection

• 0x449204 LocalReAlloc

• 0x449208 TlsSetValue

• 0x44920c TlsAlloc

• 0x449210 InitializeCriticalSection

• 0x449214 GlobalHandle

• 0x449218 GlobalReAlloc

• 0x44921c EnterCriticalSection

• 0x449220 TlsGetValue

• 0x449224 LeaveCriticalSection

• 0x449228 LocalAlloc

• 0x44922c CloseHandle

• 0x449230 GetCurrentThread

• 0x449234 ConvertDefaultLocale

• 0x449238 EnumResourceLanguagesA

• 0x44923c GetLocaleInfoA

• 0x449240 InterlockedExchange

• 0x449244 lstrcmpA

• 0x449248 GetCurrentProcessId

• 0x44924c GetModuleFileNameA

• 0x449250 InterlockedDecrement

• 0x449254 GetModuleFileNameW

• 0x449258 GlobalFree

• 0x44925c GlobalAlloc

• 0x449260 GlobalLock

• 0x449264 GlobalUnlock

• 0x449268 FormatMessageA

• 0x44926c LocalFree

• 0x449270 MulDiv

• 0x449274 lstrlenA

• 0x449278 FreeResource

• 0x44927c GetCurrentThreadId

• 0x449280 GlobalGetAtomNameA

• 0x449284 GlobalAddAtomA

• 0x449288 GlobalFindAtomA

• 0x44928c GlobalDeleteAtom

• 0x449290 FreeLibrary

• 0x449294 CompareStringA

• 0x449298 LoadLibraryA

• 0x44929c GetLastError

• 0x4492a0 SetLastError

• 0x4492a4 MultiByteToWideChar

• 0x4492a8 lstrcmpW

• 0x4492ac GetModuleHandleA

• 0x4492b0 GetProcAddress

• 0x4492b4 GetVersionExA

• 0x4492b8 VirtualAlloc

• 0x4492bc ExitProcess

• 0x4492c0 WideCharToMultiByte

• 0x4492c4 FindResourceA

• 0x4492c8 LoadResource

• 0x4492cc LockResource

• 0x4492d0 GetSystemTimeAsFileTime

• 0x4492d4 SizeofResource

Library USER32.dll:

• 0x449330 RegisterClipboardFormatA

• 0x449334 PostThreadMessageA

• 0x449338 ReleaseCapture

• 0x44933c WindowFromPoint

• 0x449340 SetCapture

• 0x449344 UnregisterClassA

• 0x449348 DestroyMenu

• 0x44934c SetRectEmpty

• 0x449350 IsZoomed

• 0x449354 SetWindowContextHelpId

• 0x449358 MapDialogRect

• 0x44935c GetDesktopWindow

• 0x449360 CreateDialogIndirectParamA

• 0x449364 GetNextDlgTabItem

• 0x449368 EndDialog

• 0x44936c SetCursor

• 0x449370 GetMessageA

• 0x449374 TranslateMessage

• 0x449378 GetActiveWindow

• 0x44937c ValidateRect

• 0x449380 PostQuitMessage

• 0x449384 GetWindowThreadProcessId

• 0x449388 EndPaint

• 0x44938c BeginPaint

• 0x449390 GetWindowDC

• 0x449394 ClientToScreen

• 0x449398 GrayStringA

• 0x44939c DrawTextExA

• 0x4493a0 DrawTextA

• 0x4493a4 TabbedTextOutA

• 0x4493a8 IsWindowEnabled

• 0x4493ac ShowWindow

• 0x4493b0 MoveWindow

• 0x4493b4 SetWindowTextA

• 0x4493b8 IsDialogMessageA

• 0x4493bc SetDlgItemInt

• 0x4493c0 GetDlgItemInt

• 0x4493c4 SetMenuItemBitmaps

• 0x4493c8 GetMenuCheckMarkDimensions

• 0x4493cc ModifyMenuA

• 0x4493d0 GetMenuState

• 0x4493d4 EnableMenuItem

• 0x4493d8 CheckMenuItem

• 0x4493dc RegisterWindowMessageA

• 0x4493e0 SendDlgItemMessageA

• 0x4493e4 WinHelpA

• 0x4493e8 IsChild

• 0x4493ec GetCapture

• 0x4493f0 SetWindowsHookExA

• 0x4493f4 CallNextHookEx

• 0x4493f8 GetClassLongA

• 0x4493fc GetClassNameA

• 0x449400 SetPropA

• 0x449404 GetPropA

• 0x449408 RemovePropA

• 0x44940c GetFocus

• 0x449410 IsWindow

• 0x449414 SetFocus

• 0x449418 GetWindowTextA

• 0x44941c GetForegroundWindow

• 0x449420 GetLastActivePopup

• 0x449424 SetActiveWindow

• 0x449428 DispatchMessageA

• 0x44942c BeginDeferWindowPos

• 0x449430 EndDeferWindowPos

• 0x449434 GetDlgItem

• 0x449438 GetTopWindow

• 0x44943c DestroyWindow

• 0x449440 UnhookWindowsHookEx

• 0x449444 GetMessageTime

• 0x449448 GetMessagePos

• 0x44944c PeekMessageA

• 0x449450 MapWindowPoints

• 0x449454 GetKeyState

• 0x449458 SetMenu

• 0x44945c GetScrollRange

• 0x449460 SetScrollPos

• 0x449464 GetScrollPos

• 0x449468 DrawStateA

• 0x44946c EqualRect

• 0x449470 DrawFocusRect

• 0x449474 GetClientRect

• 0x449478 SetForegroundWindow

• 0x44947c ShowScrollBar

• 0x449480 IsWindowVisible

• 0x449484 UpdateWindow

• 0x449488 PostMessageA

• 0x44948c GetSubMenu

• 0x449490 GetMenuItemID

• 0x449494 GetMenuItemCount

• 0x449498 CreateWindowExA

• 0x44949c GetClassInfoExA

• 0x4494a0 RegisterClassA

• 0x4494a4 GetSysColor

• 0x4494a8 AdjustWindowRectEx

• 0x4494ac MessageBeep

• 0x4494b0 GetNextDlgGroupItem

• 0x4494b4 InvalidateRgn

• 0x4494b8 SetRect

• 0x4494bc GetParent

• 0x4494c0 DeferWindowPos

• 0x4494c4 IsRectEmpty

• 0x4494c8 CopyAcceleratorTableA

• 0x4494cc CharNextA

• 0x4494d0 CharUpperA

• 0x4494d4 ScreenToClient

• 0x4494d8 GetDC

• 0x4494dc ReleaseDC

• 0x4494e0 EnableScrollBar

• 0x4494e4 SetTimer

• 0x4494e8 KillTimer

• 0x4494ec EnableWindow

• 0x4494f0 LoadCursorA

• 0x4494f4 GetCursorPos

• 0x4494f8 GetSysColorBrush

• 0x4494fc DefWindowProcA

• 0x449500 GetClassInfoA

• 0x449504 MessageBoxA

• 0x449508 LoadStringA

• 0x44950c DrawIcon

• 0x449510 SendMessageA

• 0x449514 IsIconic

• 0x449518 InvalidateRect

• 0x44951c LoadIconA

• 0x449520 GetSystemMetrics

• 0x449524 LoadBitmapA

• 0x449528 GetWindow

• 0x44952c GetWindowRect

• 0x449530 GetWindowPlacement

• 0x449534 SystemParametersInfoA

• 0x449538 IntersectRect

• 0x44953c OffsetRect

• 0x449540 SetWindowPos

• 0x449544 SetWindowLongA

• 0x449548 GetWindowLongA

• 0x44954c GetMenu

• 0x449550 CallWindowProcA

• 0x449554 GetDlgCtrlID

• 0x449558 PtInRect

• 0x44955c CopyRect

• 0x449560 SetScrollInfo

• 0x449564 GetScrollInfo

Library GDI32.dll:

• 0x449038 ExtSelectClipRgn

• 0x44903c DeleteDC

• 0x449040 GetStockObject

• 0x449044 GetMapMode

• 0x449048 GetTextMetricsA

• 0x44904c GetTextExtentPoint32A

• 0x449050 GetBkColor

• 0x449054 GetTextColor

• 0x449058 GetRgnBox

• 0x44905c ScaleWindowExtEx

• 0x449060 SetWindowExtEx

• 0x449064 ScaleViewportExtEx

• 0x449068 SetViewportExtEx

• 0x44906c OffsetViewportOrgEx

• 0x449070 SetViewportOrgEx

• 0x449074 Escape

• 0x449078 ExtTextOutA

• 0x44907c TextOutA

• 0x449080 RectVisible

• 0x449084 CreateRectRgnIndirect

• 0x449088 CreatePen

• 0x44908c GetWindowExtEx

• 0x449090 GetViewportExtEx

• 0x449094 DeleteObject

• 0x449098 IntersectClipRect

• 0x44909c ExcludeClipRect

• 0x4490a0 SetMapMode

• 0x4490a4 RestoreDC

• 0x4490a8 SaveDC

• 0x4490ac GetDeviceCaps

• 0x4490b0 CreateBitmap

• 0x4490b4 GetObjectA

• 0x4490b8 SetBkColor

• 0x4490bc SetTextColor

• 0x4490c0 GetClipBox

• 0x4490c4 BitBlt

• 0x4490c8 Polyline

• 0x4490cc SelectObject

• 0x4490d0 CreateCompatibleDC

• 0x4490d4 CreateCompatibleBitmap

• 0x4490d8 PtVisible

Library MSIMG32.dll:

• 0x4492dc TransparentBlt

Library COMDLG32.dll:

• 0x449030 GetFileTitleA

Library WINSPOOL.DRV:

• 0x44956c DocumentPropertiesA

• 0x449570 ClosePrinter

• 0x449574 OpenPrinterA

Library ADVAPI32.dll:

• 0x449000 RegOpenKeyA

• 0x449004 RegSetValueExA

• 0x449008 RegCreateKeyExA

• 0x44900c RegQueryValueA

• 0x449010 RegCloseKey

• 0x449014 RegEnumKeyA

• 0x449018 RegDeleteKeyA

• 0x44901c RegOpenKeyExA

• 0x449020 RegQueryValueExA

Library COMCTL32.dll:

• 0x449028

Library SHLWAPI.dll:

• 0x44931c PathFindFileNameA

• 0x449320 PathStripToRootA

• 0x449324 PathIsUNCA

• 0x449328 PathFindExtensionA

Library oledlg.dll:

• 0x4495bc

Library ole32.dll:

• 0x44957c CoRevokeClassObject

• 0x449580 OleInitialize

• 0x449584 CoFreeUnusedLibraries

• 0x449588 OleUninitialize

• 0x44958c CreateILockBytesOnHGlobal

• 0x449590 StgCreateDocfileOnILockBytes

• 0x449594 StgOpenStorageOnILockBytes

• 0x449598 CoGetClassObject

• 0x44959c OleIsCurrentClipboard

• 0x4495a0 CLSIDFromString

• 0x4495a4 CLSIDFromProgID

• 0x4495a8 CoTaskMemAlloc

• 0x4495ac CoTaskMemFree

• 0x4495b0 OleFlushClipboard

• 0x4495b4 CoRegisterMessageFilter

Library OLEAUT32.dll:

• 0x4492e4 VariantChangeType

• 0x4492e8 VariantInit

• 0x4492ec SysAllocStringLen

• 0x4492f0 SysStringLen

• 0x4492f4 SysFreeString

• 0x4492f8 SysAllocStringByteLen

• 0x4492fc VariantCopy

• 0x449300 VariantClear

• 0x449304 SafeArrayDestroy

• 0x449308 VariantTimeToSystemTime

• 0x44930c SystemTimeToVariantTime

• 0x449310 OleCreateFontIndirect

• 0x449314 SysAllocString

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
teredo.ipv6.microsoft.com		127.0.0.1
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
clients2.google.com	CNAME clients.l.google.com A 172.217.27.142	172.217.160.78

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	60221	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57236	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	58970	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.