SmartHawk

7.0

高危

59 个模型检测该样本为恶意！

重新分析

下载样本

295c508d5a38496e158e8ae8795196bfa24a12d1aabc2e528a133b41e6723ed2

88aca8bfdae09a19633e8e704ac40791.exe

分析耗时

28s

最近分析

文件大小

630.0KB

静态报毒动态报毒 100% AGEN AI SCORE=82 CLASSIC CONFIDENCE DELF DELPHILESS ECKQ ELDORADO ELXR EMBG FAREIT FORMBOOK HIGH CONFIDENCE HKLLWU KRYPTIK LOKI LOKIBOT MALWARE@#53Y0WV26ESZZ NGX@AIYUXEOI QVM05 R + MAL SCORE SMAD1 STATIC AI SUSPICIOUS PE TRJGEN TSCOPE UNSAFE X2066 ZCSFHB5SO2S ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FTB!88ACA8BFDAE0	20201211	6.0.6.653
Alibaba	Trojan:Win32/Kryptik.9700b64b	20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Avast	Win32:Malware-gen	20201210	21.1.5827.0
Kingsoft		20201211	2017.9.26.565
Tencent	Win32.Trojan.Kryptik.Eckq	20201211	1.0.0.1

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (4 个事件)

Time & API	Arguments	Status
1619685930.2345 NtAllocateVirtualMemory	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003d0000	success
1619685930.5155 NtProtectVirtualMemory	process_identifier: 2308 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 36864 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00453000	success
1619685930.5315 NtAllocateVirtualMemory	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00790000	success
1619685930.984125 NtAllocateVirtualMemory	process_identifier: 1932 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00860000	success

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (3 个事件)

Time & API	Arguments	Status	Return
1619685930.5315 Process32NextW	process_name: wsqmcons.exe snapshot_handle: 0x000000fc process_identifier: 2120	success	1
1619685930.5315 Process32NextW	process_name: mobsync.exe snapshot_handle: 0x000000fc process_identifier: 2772	success	1
1619685930.5315 Process32NextW	process_name: 88aca8bfdae09a19633e8e704ac40791.exe snapshot_handle: 0x000000fc process_identifier: 2308	success	1

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.365645763493635

section

{'size_of_data': '0x00038800', 'virtual_address': '0x0006b000', 'entropy': 7.365645763493635, 'name': '.rsrc', 'virtual_size': '0x00038674'}

description

A section with a high entropy has been found

entropy

0.35958631662688945

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2308 called NtSetContextThread to modify thread in remote process 1932
1619685930.6565 NtSetContextThread	thread_handle: 0x00000100 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4306624 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1932	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2308 resumed a thread in remote process 1932
1619685930.7505 NtResumeThread	thread_handle: 0x00000100 suspend_count: 1 process_identifier: 1932	success	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

172.217.160.110:443

Executed a process and injected code into it, probably while unpacking (6 个事件)

Time & API	Arguments	Status	Return
1619685930.6405 CreateProcessInternalW	thread_identifier: 2760 thread_handle: 0x00000100 process_identifier: 1932 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\88aca8bfdae09a19633e8e704ac40791.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000104 inherit_handles: 0	success	1
1619685930.6405 NtUnmapViewOfSection	process_identifier: 1932 region_size: 4096 process_handle: 0x00000104 base_address: 0x00400000	success	0
1619685930.6405 NtMapViewOfSection	section_handle: 0x0000010c process_identifier: 1932 commit_size: 172032 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000104 allocation_type: 0 () section_offset: 0 view_size: 172032 base_address: 0x00400000	success	0
1619685930.6565 NtGetContextThread	thread_handle: 0x00000100	success	0
1619685930.6565 NtSetContextThread	thread_handle: 0x00000100 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4306624 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1932	success	0
1619685930.7505 NtResumeThread	thread_handle: 0x00000100 suspend_count: 1 process_identifier: 1932	success	0

File has been identified by 59 AntiVirus engines on VirusTotal as malicious (50 out of 59 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Delf.FareIt.Gen.7
FireEye	Generic.mg.88aca8bfdae09a19
McAfee	Fareit-FTB!88ACA8BFDAE0
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Trojan:Win32/Kryptik.9700b64b
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_90% (W)
Arcabit	Trojan.Delf.FareIt.Gen.7
BitDefenderTheta	Gen:NN.ZelphiF.34670.NGX@aiyUXEoi
Cyren	W32/Injector.ABY.gen!Eldorado
Symantec	Trojan.Gen.MBT
APEX	Malicious
Avast	Win32:Malware-gen
ClamAV	Win.Malware.Fareit-7861483-0
Kaspersky	HEUR:Trojan.Win32.Kryptik.gen
BitDefender	Trojan.Delf.FareIt.Gen.7
NANO-Antivirus	Trojan.Win32.TrjGen.hkllwu
Paloalto	generic.ml
Rising	Trojan.Kryptik!1.C6D9 (CLASSIC)
Ad-Aware	Trojan.Delf.FareIt.Gen.7
Emsisoft	Trojan.Delf.FareIt.Gen.7 (B)
Comodo	Malware@#53y0wv26eszz
F-Secure	Heuristic.HEUR/AGEN.1136311
DrWeb	Trojan.PWS.Stealer.27790
Zillya	Trojan.Injector.Win32.739620
TrendMicro	TrojanSpy.Win32.LOKI.SMAD1.hp
McAfee-GW-Edition	BehavesLike.Win32.Fareit.jc
Sophos	Mal/Generic-R + Mal/Fareit-AA
SentinelOne	Static AI - Suspicious PE
Jiangmin	Trojan.Kryptik.avl
Avira	HEUR/AGEN.1136311
Antiy-AVL	Trojan/Win32.Kryptik
Gridinsoft	Trojan.Win32.Kryptik.ba!s1
Microsoft	Trojan:Win32/Fareit.VP!MSR
AegisLab	Trojan.Win32.FareIt.4!c
ZoneAlarm	HEUR:Trojan.Win32.Kryptik.gen
GData	Trojan.Delf.FareIt.Gen.7
Cynet	Malicious (score: 100)
AhnLab-V3	Suspicious/Win.Delphiless.X2066
Acronis	suspicious
VBA32	TScope.Trojan.Delf
ALYac	Trojan.Agent.FormBook
MAX	malware (ai score=82)
Malwarebytes	Spyware.LokiBot
Zoner	Trojan.Win32.89717
ESET-NOD32	a variant of Win32/Injector.EMBG

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x45f12c DeleteCriticalSection

• 0x45f130 LeaveCriticalSection

• 0x45f134 EnterCriticalSection

• 0x45f138 InitializeCriticalSection

• 0x45f13c VirtualFree

• 0x45f140 VirtualAlloc

• 0x45f144 LocalFree

• 0x45f148 LocalAlloc

• 0x45f14c GetVersion

• 0x45f150 GetCurrentThreadId

• 0x45f154 InterlockedDecrement

• 0x45f158 InterlockedIncrement

• 0x45f15c VirtualQuery

• 0x45f160 WideCharToMultiByte

• 0x45f164 MultiByteToWideChar

• 0x45f168 lstrlenA

• 0x45f16c lstrcpynA

• 0x45f170 LoadLibraryExA

• 0x45f174 GetThreadLocale

• 0x45f178 GetStartupInfoA

• 0x45f17c GetProcAddress

• 0x45f180 GetModuleHandleA

• 0x45f184 GetModuleFileNameA

• 0x45f188 GetLocaleInfoA

• 0x45f18c GetCommandLineA

• 0x45f190 FreeLibrary

• 0x45f194 FindFirstFileA

• 0x45f198 FindClose

• 0x45f19c ExitProcess

• 0x45f1a0 WriteFile

• 0x45f1a4 UnhandledExceptionFilter

• 0x45f1a8 RtlUnwind

• 0x45f1ac RaiseException

• 0x45f1b0 GetStdHandle

Library user32.dll:

• 0x45f1b8 GetKeyboardType

• 0x45f1bc LoadStringA

• 0x45f1c0 MessageBoxA

• 0x45f1c4 CharNextA

Library advapi32.dll:

• 0x45f1cc RegQueryValueExA

• 0x45f1d0 RegOpenKeyExA

• 0x45f1d4 RegCloseKey

Library oleaut32.dll:

• 0x45f1dc SysFreeString

• 0x45f1e0 SysReAllocStringLen

• 0x45f1e4 SysAllocStringLen

Library kernel32.dll:

• 0x45f1ec TlsSetValue

• 0x45f1f0 TlsGetValue

• 0x45f1f4 LocalAlloc

• 0x45f1f8 GetModuleHandleA

Library advapi32.dll:

• 0x45f200 RegQueryValueExA

• 0x45f204 RegOpenKeyExA

• 0x45f208 RegCloseKey

Library kernel32.dll:

• 0x45f210 lstrcpyA

• 0x45f214 WriteFile

• 0x45f218 WaitForSingleObject

• 0x45f21c VirtualQuery

• 0x45f220 VirtualAlloc

• 0x45f224 Sleep

• 0x45f228 SizeofResource

• 0x45f22c SetThreadLocale

• 0x45f230 SetFilePointer

• 0x45f234 SetEvent

• 0x45f238 SetErrorMode

• 0x45f23c SetEndOfFile

• 0x45f240 ResetEvent

• 0x45f244 ReadFile

• 0x45f248 MulDiv

• 0x45f24c LockResource

• 0x45f250 LoadResource

• 0x45f254 LoadLibraryA

• 0x45f258 LeaveCriticalSection

• 0x45f25c InitializeCriticalSection

• 0x45f260 GlobalUnlock

• 0x45f264 GlobalReAlloc

• 0x45f268 GlobalHandle

• 0x45f26c GlobalLock

• 0x45f270 GlobalFree

• 0x45f274 GlobalFindAtomA

• 0x45f278 GlobalDeleteAtom

• 0x45f27c GlobalAlloc

• 0x45f280 GlobalAddAtomA

• 0x45f284 GetVersionExA

• 0x45f288 GetVersion

• 0x45f28c GetTickCount

• 0x45f290 GetThreadLocale

• 0x45f294 GetSystemTimeAsFileTime

• 0x45f298 GetSystemTime

• 0x45f29c GetSystemInfo

• 0x45f2a0 GetStringTypeExA

• 0x45f2a4 GetStdHandle

• 0x45f2a8 GetProcAddress

• 0x45f2ac GetModuleHandleA

• 0x45f2b0 GetModuleFileNameA

• 0x45f2b4 GetLocaleInfoA

• 0x45f2b8 GetLocalTime

• 0x45f2bc GetLastError

• 0x45f2c0 GetFullPathNameA

• 0x45f2c4 GetDiskFreeSpaceA

• 0x45f2c8 GetDateFormatA

• 0x45f2cc GetCurrentThreadId

• 0x45f2d0 GetCurrentProcessId

• 0x45f2d4 GetCPInfo

• 0x45f2d8 GetACP

• 0x45f2dc FreeResource

• 0x45f2e0 InterlockedExchange

• 0x45f2e4 FreeLibrary

• 0x45f2e8 FormatMessageA

• 0x45f2ec FindResourceA

• 0x45f2f0 FileTimeToSystemTime

• 0x45f2f4 ExitThread

• 0x45f2f8 EnumCalendarInfoA

• 0x45f2fc EnterCriticalSection

• 0x45f300 DeleteCriticalSection

• 0x45f304 CreateThread

• 0x45f308 CreateFileA

• 0x45f30c CreateEventA

• 0x45f310 CompareStringA

• 0x45f314 CloseHandle

Library version.dll:

• 0x45f31c VerQueryValueA

• 0x45f320 GetFileVersionInfoSizeA

• 0x45f324 GetFileVersionInfoA

Library gdi32.dll:

• 0x45f32c UnrealizeObject

• 0x45f330 StretchBlt

• 0x45f334 SetWindowOrgEx

• 0x45f338 SetViewportOrgEx

• 0x45f33c SetTextColor

• 0x45f340 SetStretchBltMode

• 0x45f344 SetROP2

• 0x45f348 SetPixel

• 0x45f34c SetDIBColorTable

• 0x45f350 SetBrushOrgEx

• 0x45f354 SetBkMode

• 0x45f358 SetBkColor

• 0x45f35c SelectPalette

• 0x45f360 SelectObject

• 0x45f364 SaveDC

• 0x45f368 RestoreDC

• 0x45f36c Rectangle

• 0x45f370 RectVisible

• 0x45f374 RealizePalette

• 0x45f378 PatBlt

• 0x45f37c MoveToEx

• 0x45f380 MaskBlt

• 0x45f384 LineTo

• 0x45f388 IntersectClipRect

• 0x45f38c GetWindowOrgEx

• 0x45f390 GetTextMetricsA

• 0x45f394 GetTextExtentPoint32A

• 0x45f398 GetSystemPaletteEntries

• 0x45f39c GetStockObject

• 0x45f3a0 GetPixel

• 0x45f3a4 GetPaletteEntries

• 0x45f3a8 GetObjectA

• 0x45f3ac GetDeviceCaps

• 0x45f3b0 GetDIBits

• 0x45f3b4 GetDIBColorTable

• 0x45f3b8 GetDCOrgEx

• 0x45f3bc GetCurrentPositionEx

• 0x45f3c0 GetClipBox

• 0x45f3c4 GetBrushOrgEx

• 0x45f3c8 GetBitmapBits

• 0x45f3cc GetArcDirection

• 0x45f3d0 ExcludeClipRect

• 0x45f3d4 DeleteObject

• 0x45f3d8 DeleteDC

• 0x45f3dc CreateSolidBrush

• 0x45f3e0 CreatePenIndirect

• 0x45f3e4 CreatePen

• 0x45f3e8 CreatePalette

• 0x45f3ec CreateHalftonePalette

• 0x45f3f0 CreateFontIndirectA

• 0x45f3f4 CreateDIBitmap

• 0x45f3f8 CreateDIBSection

• 0x45f3fc CreateCompatibleDC

• 0x45f400 CreateCompatibleBitmap

• 0x45f404 CreateBrushIndirect

• 0x45f408 CreateBitmap

• 0x45f40c BitBlt

Library user32.dll:

• 0x45f414 CreateWindowExA

• 0x45f418 WindowFromPoint

• 0x45f41c WinHelpA

• 0x45f420 WaitMessage

• 0x45f424 ValidateRect

• 0x45f428 UpdateWindow

• 0x45f42c UnregisterClassA

• 0x45f430 UnhookWindowsHookEx

• 0x45f434 TranslateMessage

• 0x45f438 TranslateMDISysAccel

• 0x45f43c TrackPopupMenu

• 0x45f440 SystemParametersInfoA

• 0x45f444 ShowWindow

• 0x45f448 ShowScrollBar

• 0x45f44c ShowOwnedPopups

• 0x45f450 ShowCursor

• 0x45f454 SetWindowsHookExA

• 0x45f458 SetWindowPos

• 0x45f45c SetWindowPlacement

• 0x45f460 SetWindowLongA

• 0x45f464 SetTimer

• 0x45f468 SetScrollRange

• 0x45f46c SetScrollPos

• 0x45f470 SetScrollInfo

• 0x45f474 SetRect

• 0x45f478 SetPropA

• 0x45f47c SetParent

• 0x45f480 SetMenuItemInfoA

• 0x45f484 SetMenu

• 0x45f488 SetForegroundWindow

• 0x45f48c SetFocus

• 0x45f490 SetCursor

• 0x45f494 SetClassLongA

• 0x45f498 SetCapture

• 0x45f49c SetActiveWindow

• 0x45f4a0 SendMessageA

• 0x45f4a4 ScrollWindow

• 0x45f4a8 ScreenToClient

• 0x45f4ac RemovePropA

• 0x45f4b0 RemoveMenu

• 0x45f4b4 ReleaseDC

• 0x45f4b8 ReleaseCapture

• 0x45f4bc RegisterWindowMessageA

• 0x45f4c0 RegisterClipboardFormatA

• 0x45f4c4 RegisterClassA

• 0x45f4c8 RedrawWindow

• 0x45f4cc PtInRect

• 0x45f4d0 PostQuitMessage

• 0x45f4d4 PostMessageA

• 0x45f4d8 PeekMessageA

• 0x45f4dc OffsetRect

• 0x45f4e0 OemToCharA

• 0x45f4e4 MessageBoxA

• 0x45f4e8 MapWindowPoints

• 0x45f4ec MapVirtualKeyA

• 0x45f4f0 LoadStringA

• 0x45f4f4 LoadKeyboardLayoutA

• 0x45f4f8 LoadIconA

• 0x45f4fc LoadCursorA

• 0x45f500 LoadBitmapA

• 0x45f504 KillTimer

• 0x45f508 IsZoomed

• 0x45f50c IsWindowVisible

• 0x45f510 IsWindowEnabled

• 0x45f514 IsWindow

• 0x45f518 IsRectEmpty

• 0x45f51c IsIconic

• 0x45f520 IsDialogMessageA

• 0x45f524 IsChild

• 0x45f528 InvalidateRect

• 0x45f52c IntersectRect

• 0x45f530 InsertMenuItemA

• 0x45f534 InsertMenuA

• 0x45f538 InflateRect

• 0x45f53c GetWindowThreadProcessId

• 0x45f540 GetWindowTextA

• 0x45f544 GetWindowRect

• 0x45f548 GetWindowPlacement

• 0x45f54c GetWindowLongA

• 0x45f550 GetWindowDC

• 0x45f554 GetTopWindow

• 0x45f558 GetSystemMetrics

• 0x45f55c GetSystemMenu

• 0x45f560 GetSysColorBrush

• 0x45f564 GetSysColor

• 0x45f568 GetSubMenu

• 0x45f56c GetScrollRange

• 0x45f570 GetScrollPos

• 0x45f574 GetScrollInfo

• 0x45f578 GetPropA

• 0x45f57c GetParent

• 0x45f580 GetWindow

• 0x45f584 GetMenuStringA

• 0x45f588 GetMenuState

• 0x45f58c GetMenuItemInfoA

• 0x45f590 GetMenuItemID

• 0x45f594 GetMenuItemCount

• 0x45f598 GetMenu

• 0x45f59c GetLastActivePopup

• 0x45f5a0 GetKeyboardState

• 0x45f5a4 GetKeyboardLayoutList

• 0x45f5a8 GetKeyboardLayout

• 0x45f5ac GetKeyState

• 0x45f5b0 GetKeyNameTextA

• 0x45f5b4 GetIconInfo

• 0x45f5b8 GetForegroundWindow

• 0x45f5bc GetFocus

• 0x45f5c0 GetDesktopWindow

• 0x45f5c4 GetDCEx

• 0x45f5c8 GetDC

• 0x45f5cc GetCursorPos

• 0x45f5d0 GetCursor

• 0x45f5d4 GetClientRect

• 0x45f5d8 GetClassNameA

• 0x45f5dc GetClassInfoA

• 0x45f5e0 GetCapture

• 0x45f5e4 GetActiveWindow

• 0x45f5e8 FrameRect

• 0x45f5ec FindWindowA

• 0x45f5f0 FillRect

• 0x45f5f4 EqualRect

• 0x45f5f8 EnumWindows

• 0x45f5fc EnumThreadWindows

• 0x45f600 EndPaint

• 0x45f604 EnableWindow

• 0x45f608 EnableScrollBar

• 0x45f60c EnableMenuItem

• 0x45f610 DrawTextA

• 0x45f614 DrawMenuBar

• 0x45f618 DrawIconEx

• 0x45f61c DrawIcon

• 0x45f620 DrawFrameControl

• 0x45f624 DrawEdge

• 0x45f628 DispatchMessageA

• 0x45f62c DestroyWindow

• 0x45f630 DestroyMenu

• 0x45f634 DestroyIcon

• 0x45f638 DestroyCursor

• 0x45f63c DeleteMenu

• 0x45f640 DefWindowProcA

• 0x45f644 DefMDIChildProcA

• 0x45f648 DefFrameProcA

• 0x45f64c CreatePopupMenu

• 0x45f650 CreateMenu

• 0x45f654 CreateIcon

• 0x45f658 ClientToScreen

• 0x45f65c CheckMenuItem

• 0x45f660 CallWindowProcA

• 0x45f664 CallNextHookEx

• 0x45f668 BeginPaint

• 0x45f66c CharNextA

• 0x45f670 CharLowerA

• 0x45f674 CharToOemA

• 0x45f678 AdjustWindowRectEx

• 0x45f67c ActivateKeyboardLayout

Library kernel32.dll:

• 0x45f684 Sleep

Library oleaut32.dll:

• 0x45f68c SafeArrayPtrOfIndex

• 0x45f690 SafeArrayGetUBound

• 0x45f694 SafeArrayGetLBound

• 0x45f698 SafeArrayCreate

• 0x45f69c VariantChangeType

• 0x45f6a0 VariantCopy

• 0x45f6a4 VariantClear

• 0x45f6a8 VariantInit

Library comctl32.dll:

• 0x45f6b0 ImageList_SetIconSize

• 0x45f6b4 ImageList_GetIconSize

• 0x45f6b8 ImageList_Write

• 0x45f6bc ImageList_Read

• 0x45f6c0 ImageList_GetDragImage

• 0x45f6c4 ImageList_DragShowNolock

• 0x45f6c8 ImageList_SetDragCursorImage

• 0x45f6cc ImageList_DragMove

• 0x45f6d0 ImageList_DragLeave

• 0x45f6d4 ImageList_DragEnter

• 0x45f6d8 ImageList_EndDrag

• 0x45f6dc ImageList_BeginDrag

• 0x45f6e0 ImageList_Remove

• 0x45f6e4 ImageList_DrawEx

• 0x45f6e8 ImageList_Draw

• 0x45f6ec ImageList_GetBkColor

• 0x45f6f0 ImageList_SetBkColor

• 0x45f6f4 ImageList_ReplaceIcon

• 0x45f6f8 ImageList_Add

• 0x45f6fc ImageList_GetImageCount

• 0x45f700 ImageList_Destroy

• 0x45f704 ImageList_Create

• 0x45f708 InitCommonControls

Library comdlg32.dll:

• 0x45f710 ChooseColorA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	53238	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	62194	239.255.255.250	1900
192.168.56.101	63430	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.