SmartHawk

3.0

中危

1 个模型检测该样本为恶意！

重新分析

下载样本

b683e8edb43379544fa615ae686fcfcefd85e7fdb3e087c868e7f37268c012bc

83d4b718948476b6cfcda059cc659bc3.exe

分析耗时

85s

查杀引擎	查杀时间	查杀版本
McAfee	20181203	6.0.6.653
Alibaba	20180921	0.1.0.2
Baidu	20181203	1.0.0.2
Avast	20181203	18.4.3895.0
Tencent	20181203	1.0.0.1
Kingsoft	20181203	2013.8.14.323
CrowdStrike	20181022	1.0

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2018-10-31 21:39:53

Imports

Library encoding-conversion.dll:

• 0x555880 _SLConvertUTF16ToUTF8@16

• 0x555884 _SLConvertUnicodeToACP@16

• 0x555888 _SLConvertACPToUnicode@16

• 0x55588c _SLConvertUTF8ToUTF16@16

Library PSAPI.DLL:

• 0x5555d8 GetModuleFileNameExW

Library USER32.dll:

• 0x5555e0 LoadCursorW

• 0x5555e4 SetWindowLongW

• 0x5555e8 GetWindowLongW

• 0x5555ec DestroyWindow

• 0x5555f0 CreateWindowExW

• 0x5555f4 GetClassInfoExW

• 0x5555f8 RegisterClassExW

• 0x5555fc UnregisterClassW

• 0x555600 CallWindowProcW

• 0x555604 DefWindowProcW

• 0x555608 PostMessageW

• 0x55560c RegisterWindowMessageW

• 0x555610 CharNextW

• 0x555614 LoadStringW

• 0x555618 TranslateMessage

• 0x55561c GetMessageW

• 0x555620 DispatchMessageW

• 0x555624 PostThreadMessageW

• 0x555628 CharUpperW

• 0x55562c MessageBoxW

Library WTSAPI32.dll:

• 0x5556d4 WTSQueryUserToken

Library msi.dll:

• 0x5558b8

Library VERSION.dll:

• 0x555690 GetFileVersionInfoSizeW

• 0x555694 GetFileVersionInfoW

• 0x555698 VerQueryValueW

Library KERNEL32.dll:

• 0x5550b0 LoadLibraryExW

• 0x5550b4 LoadResource

• 0x5550b8 SizeofResource

• 0x5550bc FindResourceW

• 0x5550c0 LoadLibraryW

• 0x5550c4 lstrcmpiW

• 0x5550c8 MultiByteToWideChar

• 0x5550cc SetLastError

• 0x5550d0 GetCurrentThreadId

• 0x5550d4 CloseHandle

• 0x5550d8 DuplicateHandle

• 0x5550dc SetEvent

• 0x5550e0 ReleaseSemaphore

• 0x5550e4 WaitForSingleObjectEx

• 0x5550e8 CreateEventA

• 0x5550ec GetCurrentProcess

• 0x5550f0 GetCurrentProcessId

• 0x5550f4 ProcessIdToSessionId

• 0x5550f8 OpenProcess

• 0x5550fc GetTickCount

• 0x555100 CreateFileMappingW

• 0x555104 GetModuleHandleA

• 0x555108 CreateSemaphoreA

• 0x55510c LocalFree

• 0x555110 FormatMessageW

• 0x555114 Sleep

• 0x555118 GetProcAddress

• 0x55511c HeapAlloc

• 0x555120 HeapReAlloc

• 0x555124 HeapFree

• 0x555128 HeapSize

• 0x55512c GetProcessHeap

• 0x555130 DecodePointer

• 0x555134 WaitForSingleObject

• 0x555138 TerminateProcess

• 0x55513c GetExitCodeProcess

• 0x555140 CreateToolhelp32Snapshot

• 0x555144 Process32FirstW

• 0x555148 Process32NextW

• 0x55514c GetCommandLineW

• 0x555150 CreateEventW

• 0x555154 CreateThread

• 0x555158 LocalAlloc

• 0x55515c OpenEventA

• 0x555160 ResetEvent

• 0x555164 QueryPerformanceCounter

• 0x555168 FormatMessageA

• 0x55516c CreateFileW

• 0x555170 GetModuleFileNameW

• 0x555174 FreeLibrary

• 0x555178 DeleteCriticalSection

• 0x55517c InitializeCriticalSectionEx

• 0x555180 LeaveCriticalSection

• 0x555184 EnterCriticalSection

• 0x555188 GetLastError

• 0x55518c RaiseException

• 0x555190 UnhandledExceptionFilter

• 0x555194 GetModuleHandleW

• 0x555198 InitializeCriticalSectionAndSpinCount

• 0x55519c QueryPerformanceFrequency

• 0x5551a0 SystemTimeToFileTime

• 0x5551a4 LCMapStringW

• 0x5551a8 AreFileApisANSI

• 0x5551ac LoadLibraryA

• 0x5551b0 GetStringTypeExW

• 0x5551b4 CreateWaitableTimerA

• 0x5551b8 GetSystemTimeAsFileTime

• 0x5551bc TlsFree

• 0x5551c0 TlsSetValue

• 0x5551c4 TlsGetValue

• 0x5551c8 TlsAlloc

• 0x5551cc SetWaitableTimer

• 0x5551d0 WaitForMultipleObjectsEx

• 0x5551d4 LoadLibraryExA

• 0x5551d8 VirtualFree

• 0x5551dc VirtualAlloc

• 0x5551e0 IsProcessorFeaturePresent

• 0x5551e4 FlushInstructionCache

• 0x5551e8 InterlockedPushEntrySList

• 0x5551ec InterlockedPopEntrySList

• 0x5551f0 InitializeSListHead

• 0x5551f4 EncodePointer

• 0x5551f8 OutputDebugStringW

• 0x5551fc IsDebuggerPresent

• 0x555200 GetComputerNameW

• 0x555204 WideCharToMultiByte

• 0x555208 GetFileAttributesExW

• 0x55520c GetWindowsDirectoryW

• 0x555210 HeapDestroy

• 0x555214 SetUnhandledExceptionFilter

• 0x555218 GetStartupInfoW

• 0x55521c GlobalFree

• 0x555220 GetUserDefaultLCID

• 0x555224 DeviceIoControl

• 0x555228 GetFileAttributesW

Library ADVAPI32.dll:

• 0x555000 CryptAcquireContextA

• 0x555004 ImpersonateLoggedOnUser

• 0x555008 RevertToSelf

• 0x55500c LookupAccountSidW

• 0x555010 AdjustTokenPrivileges

• 0x555014 LookupPrivilegeValueW

• 0x555018 CryptGenRandom

• 0x55501c CryptReleaseContext

• 0x555020 CryptAcquireContextW

• 0x555024 CreateProcessAsUserW

• 0x555028 DuplicateTokenEx

• 0x55502c StartServiceCtrlDispatcherW

• 0x555030 SetServiceStatus

• 0x555034 RegisterServiceCtrlHandlerW

• 0x555038 OpenServiceW

• 0x55503c OpenSCManagerW

• 0x555040 DeleteService

• 0x555044 CreateServiceW

• 0x555048 ControlService

• 0x55504c CloseServiceHandle

• 0x555050 ReportEventW

• 0x555054 RegisterEventSourceW

• 0x555058 DeregisterEventSource

• 0x55505c RegQueryValueExW

• 0x555060 ConvertSidToStringSidW

• 0x555064 IsValidSid

• 0x555068 GetTokenInformation

• 0x55506c GetLengthSid

• 0x555070 CopySid

• 0x555074 OpenProcessToken

• 0x555078 SetSecurityDescriptorDacl

• 0x55507c InitializeSecurityDescriptor

• 0x555080 GetSecurityDescriptorLength

• 0x555084 RegSetValueExW

• 0x555088 RegQueryInfoKeyW

• 0x55508c RegOpenKeyExW

• 0x555090 RegEnumKeyExW

• 0x555094 RegDeleteValueW

• 0x555098 RegDeleteKeyW

• 0x55509c RegCreateKeyExW

• 0x5550a0 RegCloseKey

Library ole32.dll:

• 0x5558c0 StringFromGUID2

• 0x5558c4 ProgIDFromCLSID

• 0x5558c8 CoTaskMemRealloc

• 0x5558cc CoTaskMemFree

• 0x5558d0 CoCreateInstance

• 0x5558d4 CoInitializeSecurity

• 0x5558d8 CoUninitialize

• 0x5558dc CoSetProxyBlanket

• 0x5558e0 CoInitializeEx

• 0x5558e4 CoRegisterClassObject

• 0x5558e8 CoRevokeClassObject

• 0x5558ec CoResumeClassObjects

• 0x5558f0 CoAddRefServerProcess

• 0x5558f4 CoTaskMemAlloc

• 0x5558f8 CoReleaseServerProcess

Library OLEAUT32.dll:

• 0x55559c SysFreeString

• 0x5555a0 SysAllocString

• 0x5555a4 VariantCopy

• 0x5555a8 SysStringLen

• 0x5555ac VariantInit

• 0x5555b0 VariantClear

• 0x5555b4 VarUI4FromStr

• 0x5555b8 LoadTypeLib

• 0x5555bc LoadRegTypeLib

• 0x5555c0 SetErrorInfo

• 0x5555c4 CreateErrorInfo

• 0x5555c8 RegisterTypeLib

• 0x5555cc UnRegisterTypeLib

• 0x5555d0 SysAllocStringLen

Library atom.dll:

• 0x555858 _CreateSingletonStaticData@16

• 0x55585c _SLGetAtomFromString@8

• 0x555860 _CleanupSingletonStaticDataStorage@0

• 0x555864 _IsSingletonStaticDataStorageAvailable@0

• 0x555868 _CalculateSequenceHash@12

• 0x55586c _GetSingletonStaticData@12

• 0x555870 _SLGetStringFromAtom@8

Library root-service-provider.dll:

• 0x555900 _ServiceProviderGetServiceObject@12

• 0x555904 _ServiceProviderSetModulesRootDirectory@16

• 0x555908 _ServiceProviderCleanup@0

Library brand.dll:

• 0x555878 _GetDefaultSettingsRelativePathDll@4

Library IPHLPAPI.DLL:

• 0x5550a8 GetAdaptersInfo

Library MSVCP140.dll:

• 0x555230 ?do_always_noconv@?$codecvt@_WDU_Mbstatet@@@std@@MBE_NXZ

• 0x555234 ?do_length@?$codecvt@_WDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z

• 0x555238 ?do_unshift@?$codecvt@_WDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PAD1AAPAD@Z

• 0x55523c ?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@AA_W@Z

• 0x555240 ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z

• 0x555244 ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z

• 0x555248 ?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z

• 0x55524c ?sync@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEHXZ

• 0x555250 ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z

• 0x555254 ?putback@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z

• 0x555258 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z

• 0x55525c ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z

• 0x555260 ??0_Lockit@std@@QAE@H@Z

• 0x555264 ??1_Lockit@std@@QAE@XZ

• 0x555268 ?uncaught_exception@std@@YA_NXZ

• 0x55526c ?_Xinvalid_argument@std@@YAXPBD@Z

• 0x555270 ?_Xlength_error@std@@YAXPBD@Z

• 0x555274 ?_Xout_of_range@std@@YAXPBD@Z

• 0x555278 ??Bid@locale@std@@QAEIXZ

• 0x55527c ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ

• 0x555280 ?getloc@ios_base@std@@QBE?AVlocale@2@XZ

• 0x555284 ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ

• 0x555288 ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ

• 0x55528c ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z

• 0x555290 ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z

• 0x555294 ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ

• 0x555298 ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ

• 0x55529c ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z

• 0x5552a0 ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ

• 0x5552a4 ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

• 0x5552a8 ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ

• 0x5552ac ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ

• 0x5552b0 ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ

• 0x5552b4 ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z

• 0x5552b8 ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ

• 0x5552bc ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@PBD3@Z

• 0x5552c0 ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z

• 0x5552c4 ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ

• 0x5552c8 ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ

• 0x5552cc ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z

• 0x5552d0 ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z

• 0x5552d4 ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ

• 0x5552d8 ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ

• 0x5552dc ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ

• 0x5552e0 ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z

• 0x5552e4 ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z

• 0x5552e8 ?_BADOFF@std@@3_JB

• 0x5552ec ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A

• 0x5552f0 ?_Xbad_function_call@std@@YAXXZ

• 0x5552f4 ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z

• 0x5552f8 ?is@?$ctype@_W@std@@QBE_NF_W@Z

• 0x5552fc ?widen@?$ctype@_W@std@@QBE_WD@Z

• 0x555300 ?narrow@?$ctype@_W@std@@QBED_WD@Z

• 0x555304 ?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z

• 0x555308 ??Bios_base@std@@QBE_NXZ

• 0x55530c ?fail@ios_base@std@@QBE_NXZ

• 0x555310 ?exceptions@ios_base@std@@QAEXH@Z

• 0x555314 ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ

• 0x555318 ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ

• 0x55531c ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z

• 0x555320 ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z

• 0x555324 ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ

• 0x555328 ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ

• 0x55532c ?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z

• 0x555330 ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z

• 0x555334 ?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z

• 0x555338 ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z

• 0x55533c ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ

• 0x555340 ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z

• 0x555344 ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ

• 0x555348 ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ

• 0x55534c ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z

• 0x555350 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z

• 0x555354 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z

• 0x555358 ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ

• 0x55535c ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AA_N@Z

• 0x555360 ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAK@Z

• 0x555364 ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z

• 0x555368 ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ

• 0x55536c ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ

• 0x555370 ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ

• 0x555374 ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z

• 0x555378 ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z

• 0x55537c ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ

• 0x555380 ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ

• 0x555384 ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ

• 0x555388 ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z

• 0x55538c ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z

• 0x555390 ?id@?$ctype@_W@std@@2V0locale@2@A

• 0x555394 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z

• 0x555398 ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z

• 0x55539c ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z

• 0x5553a0 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z

• 0x5553a4 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z

• 0x5553a8 ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z

• 0x5553ac ?_Xbad_alloc@std@@YAXXZ

• 0x5553b0 _Mbrtowc

• 0x5553b4 ?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ

• 0x5553b8 ??0_Locinfo@std@@QAE@PBD@Z

• 0x5553bc ??1_Locinfo@std@@QAE@XZ

• 0x5553c0 ?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ

• 0x5553c4 ?_Getfalse@_Locinfo@std@@QBEPBDXZ

• 0x5553c8 ?_Gettrue@_Locinfo@std@@QBEPBDXZ

• 0x5553cc ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z

• 0x5553d0 ??0facet@locale@std@@IAE@I@Z

• 0x5553d4 ??1facet@locale@std@@MAE@XZ

• 0x5553d8 ?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z

• 0x5553dc ?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z

• 0x5553e0 ?classic@locale@std@@SAABV12@XZ

• 0x5553e4 ?tolower@?$ctype@D@std@@QBEDD@Z

• 0x5553e8 ?widen@?$ctype@D@std@@QBEDD@Z

• 0x5553ec ?narrow@?$ctype@D@std@@QBEDDD@Z

• 0x5553f0 ?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z

• 0x5553f4 ?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z

• 0x5553f8 ?_Syserror_map@std@@YAPBDH@Z

• 0x5553fc ?imbue@ios_base@std@@QAE?AVlocale@2@ABV32@@Z

• 0x555400 ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ

• 0x555404 ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ

• 0x555408 ?_Getcat@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z

• 0x55540c ??1?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MAE@XZ

• 0x555410 ??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z

• 0x555414 ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z

• 0x555418 ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z

• 0x55541c ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z

• 0x555420 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z

• 0x555424 ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

• 0x555428 ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ

• 0x55542c ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z

• 0x555430 ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z

• 0x555434 ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ

• 0x555438 ?putback@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z

• 0x55543c ?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ

• 0x555440 ?_Incref@facet@locale@std@@UAEXXZ

• 0x555444 ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAG@Z

• 0x555448 ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAI@Z

• 0x55544c ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z

• 0x555450 ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAK@Z

• 0x555454 ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAM@Z

• 0x555458 ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAN@Z

• 0x55545c ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAO@Z

• 0x555460 ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z

• 0x555464 ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z

• 0x555468 ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z

• 0x55546c ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z

• 0x555470 ?id@?$numpunct@D@std@@2V0locale@2@A

• 0x555474 ?id@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A

• 0x555478 ?toupper@?$ctype@_W@std@@QBE_W_W@Z

• 0x55547c ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z

• 0x555480 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_K@Z

• 0x555484 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PBX@Z

• 0x555488 ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A

• 0x55548c ??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ

• 0x555490 ??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z

• 0x555494 ?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z

• 0x555498 ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z

• 0x55549c ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z

• 0x5554a0 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z

• 0x5554a4 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z

• 0x5554a8 ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PAV32@@Z

• 0x5554ac ?id@?$numpunct@_W@std@@2V0locale@2@A

• 0x5554b0 ?_Throw_C_error@std@@YAXH@Z

• 0x5554b4 _Mtx_lock

• 0x5554b8 _Mtx_unlock

• 0x5554bc _Mtx_init_in_situ

• 0x5554c0 _Mtx_destroy_in_situ

• 0x5554c4 ?uncaught_exceptions@std@@YAHXZ

• 0x5554c8 ?toupper@?$ctype@D@std@@QBEDD@Z

• 0x5554cc _Cnd_wait

• 0x5554d0 _Cnd_broadcast

• 0x5554d4 _Cnd_init_in_situ

• 0x5554d8 _Cnd_destroy_in_situ

• 0x5554dc _Cnd_register_at_thread_exit

• 0x5554e0 _Cnd_unregister_at_thread_exit

• 0x5554e4 ?_Release_chore@details@Concurrency@@YAXPAU_Threadpool_chore@12@@Z

• 0x5554e8 ?_Schedule_chore@details@Concurrency@@YAHPAU_Threadpool_chore@12@@Z

• 0x5554ec ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ

• 0x5554f0 ?_Capture@_ContextCallback@details@Concurrency@@AAEXXZ

• 0x5554f4 ?_Reset@_ContextCallback@details@Concurrency@@AAEXXZ

• 0x5554f8 ?_CallInContext@_ContextCallback@details@Concurrency@@QBEXV?$function@$$A6AXXZ@std@@_N@Z

• 0x5554fc ?__ExceptionPtrCopy@@YAXPAXPBX@Z

• 0x555500 ?__ExceptionPtrDestroy@@YAXPAX@Z

• 0x555504 ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AAEXXZ

• 0x555508 ?_ReportUnobservedException@details@Concurrency@@YAXXZ

• 0x55550c ?__ExceptionPtrRethrow@@YAXPBX@Z

• 0x555510 ??0task_continuation_context@Concurrency@@AAE@XZ

• 0x555514 ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QAEXXZ

• 0x555518 ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ

• 0x55551c ?__ExceptionPtrCurrentException@@YAXPAX@Z

• 0x555520 ?__ExceptionPtrCreate@@YAXPAX@Z

• 0x555524 ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QAEX_N@Z

• 0x555528 ?_Throw_future_error@std@@YAXABVerror_code@1@@Z

• 0x55552c ?__ExceptionPtrToBool@@YA_NPBX@Z

• 0x555530 ?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z

• 0x555534 ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QAEXXZ

• 0x555538 ?__ExceptionPtrAssign@@YAXPAXPBX@Z

• 0x55553c ?_XGetLastError@std@@YAXXZ

• 0x555540 ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ

• 0x555544 ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ

• 0x555548 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z

• 0x55554c _Lock_shared_ptr_spin_lock

• 0x555550 _Unlock_shared_ptr_spin_lock

• 0x555554 ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z

• 0x555558 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z

• 0x55555c ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z

• 0x555560 ?id@?$collate@_W@std@@2V0locale@2@A

• 0x555564 _Wcsxfrm

• 0x555568 _Wcscoll

• 0x55556c ?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ

• 0x555570 ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z

• 0x555574 ?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z

• 0x555578 ?tolower@?$ctype@_W@std@@QBE_W_W@Z

• 0x55557c ?readsome@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_JPAD_J@Z

• 0x555580 ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z

• 0x555584 ?set_new_handler@std@@YAP6AXXZP6AXXZ@Z

• 0x555588 ?id@?$ctype@D@std@@2V0locale@2@A

Library USERENV.dll:

• 0x555634 DestroyEnvironmentBlock

• 0x555638 LoadUserProfileW

• 0x55563c UnloadUserProfile

• 0x555640 CreateEnvironmentBlock

Library VCRUNTIME140.dll:

• 0x555648 _CxxThrowException

• 0x55564c __std_exception_destroy

• 0x555650 __std_exception_copy

• 0x555654 memcpy

• 0x555658 __CxxFrameHandler3

• 0x55565c _purecall

• 0x555660 __std_terminate

• 0x555664 memmove

• 0x555668 _except_handler4_common

• 0x55566c __RTDynamicCast

• 0x555670 strchr

• 0x555674 wcschr

• 0x555678 memchr

• 0x55567c __std_type_info_name

• 0x555680 __std_type_info_compare

• 0x555684 memset

• 0x555688 wcsstr

Library api-ms-win-crt-runtime-l1-1-0.dll:

• 0x555758 _initialize_onexit_table

• 0x55575c _crt_atexit

• 0x555760 strerror

• 0x555764 _cexit

• 0x555768 _wassert

• 0x55576c _seh_filter_exe

• 0x555770 abort

• 0x555774 _set_app_type

• 0x555778 _errno

• 0x55577c _invalid_parameter_noinfo_noreturn

• 0x555780 _invalid_parameter_noinfo

• 0x555784 _get_errno

• 0x555788 _register_onexit_function

• 0x55578c _controlfp_s

• 0x555790 _set_errno

• 0x555794 _resetstkoflw

• 0x555798 _register_thread_local_exe_atexit_callback

• 0x55579c _c_exit

• 0x5557a0 _exit

• 0x5557a4 exit

• 0x5557a8 _initterm_e

• 0x5557ac _initterm

• 0x5557b0 _get_wide_winmain_command_line

• 0x5557b4 _initialize_wide_environment

• 0x5557b8 terminate

• 0x5557bc _configure_wide_argv

Library api-ms-win-crt-heap-l1-1-0.dll:

• 0x555710 free

• 0x555714 _aligned_free

• 0x555718 malloc

• 0x55571c _recalloc

• 0x555720 _aligned_malloc

• 0x555724 calloc

• 0x555728 _set_new_mode

• 0x55572c realloc

• 0x555730 _msize

• 0x555734 _callnewh

Library api-ms-win-crt-convert-l1-1-0.dll:

• 0x5556dc _wcstoui64

• 0x5556e0 atoi

• 0x5556e4 _ui64toa_s

• 0x5556e8 strtoll

• 0x5556ec _wcstoi64

• 0x5556f0 _gcvt_s

• 0x5556f4 _wtoi

• 0x5556f8 strtol

• 0x5556fc _i64toa_s

• 0x555700 _ultoa_s

• 0x555704 wcstod

• 0x555708 _itoa_s

Exports

Ordinal	Address	Name
1	0x4a7340	??0?$oserializer@Vxml_woarchive@archive@boost@@UCreateProcessResponse@KernelBridgeProxy@@@detail@archive@boost@@QAE@XZ
2	0x4a7370	??0?$singleton@V?$extended_type_info_typeid@UCreateProcessRequest@KernelBridgeProxy@@@serialization@boost@@@serialization@boost@@QAE@XZ
3	0x4a7380	??0?$singleton@V?$extended_type_info_typeid@UCreateProcessResponse@KernelBridgeProxy@@@serialization@boost@@@serialization@boost@@QAE@XZ
4	0x4a7390	??0?$singleton@V?$extended_type_info_typeid@VPreviewerSwitcherContext@WS@@@serialization@boost@@@serialization@boost@@QAE@XZ
5	0x4a73a0	??0?$singleton@V?$extended_type_info_typeid@VSessionIdContext@WS@@@serialization@boost@@@serialization@boost@@QAE@XZ
6	0x4a7600	??1?$singleton@V?$extended_type_info_typeid@UCreateProcessRequest@KernelBridgeProxy@@@serialization@boost@@@serialization@boost@@QAE@XZ
7	0x4a7660	??1?$singleton@V?$extended_type_info_typeid@UCreateProcessResponse@KernelBridgeProxy@@@serialization@boost@@@serialization@boost@@QAE@XZ
8	0x4a76c0	??1?$singleton@V?$extended_type_info_typeid@VPreviewerSwitcherContext@WS@@@serialization@boost@@@serialization@boost@@QAE@XZ
9	0x4a7720	??1?$singleton@V?$extended_type_info_typeid@VSessionIdContext@WS@@@serialization@boost@@@serialization@boost@@QAE@XZ
10	0x4ac1e0	?get_const_instance@?$singleton@V?$extended_type_info_typeid@UCreateProcessRequest@KernelBridgeProxy@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UCreateProcessRequest@KernelBridgeProxy@@@23@XZ

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	142.250.66.110
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53380	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62912	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.

resource name	REGISTRY
resource name	TYPELIB

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443

host	113.108.239.161
host	113.108.239.162
host	172.217.24.14