SmartHawk

5.2

中危

58 个模型检测该样本为恶意！

重新分析

下载样本

f676bb147213f1d6de105f1db19301dda642704d6f1d1c63b3ed5a756c48bfa8

9312ff5862bb766e9768392b54ee84fd.exe

分析耗时

81s

最近分析

文件大小

1.1MB

静态报毒动态报毒 0NA103E720 100% AI SCORE=83 AIDETECTVM AUTOG BTGE1T CLASSIC CONFIDENCE DELF EHX@AQSR9AEI EJYS ELDORADO ELUJ EMPE FAKEXLS@CV FAREIT GENCIRC GENERICRXKK HIGH CONFIDENCE HKFOUG IGENT KRYPTIK MALWARE2 MALWARE@#31D8QV7HOL7FV R335512 REMCOS RKWNE S + TROJ SCORE SIGGEN8 SONBOKLI STATIC AI SUSGEN SUSPICIOUS PE TRJGEN TSCOPE UNSAFE WACATAC ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	GenericRXKK-ZW!9312FF5862BB	20201119	6.0.6.653
Alibaba	Backdoor:Win32/Injector.c62ad1cd	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20201119	20.10.5736.0
Kingsoft		20201119	2017.9.26.565
Tencent	Malware.Win32.Gencirc.116f9324	20201119	1.0.0.1
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619709771.481875 __exception__	stacktrace: 0x54 registers.esp: 66059748 registers.edi: 0 registers.eax: 0 registers.ebp: 66059776 registers.edx: 0 registers.ebx: 0 registers.esi: 66059792 registers.ecx: 0 exception.instruction_r: 8b 40 3c 99 03 04 24 13 54 24 04 83 c4 08 89 44 exception.instruction: mov eax, dword ptr [eax + 0x3c] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x21187b6	success	0	0

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619709718.793875 NtAllocateVirtualMemory	process_identifier: 3064 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00620000	success	0	0

Downloads a file or document from Google Drive (1 个事件)

domain

drive.google.com

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619709740.106875 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619709742.684875 RegSetValueExA	key_handle: 0x000003c0 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619709742.684875 RegSetValueExA	key_handle: 0x000003c0 value: 'ôÇÐ<× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619709742.684875 RegSetValueExA	key_handle: 0x000003c0 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619709742.684875 RegSetValueExW	key_handle: 0x000003c0 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619709742.684875 RegSetValueExA	key_handle: 0x000003d8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619709742.684875 RegSetValueExA	key_handle: 0x000003d8 value: 'ôÇÐ<× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619709742.684875 RegSetValueExA	key_handle: 0x000003d8 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619709742.731875 RegSetValueExW	key_handle: 0x000003bc value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

104.244.46.208:443

File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Empe.1.Gen
FireEye	Generic.mg.9312ff5862bb766e
McAfee	GenericRXKK-ZW!9312FF5862BB
Cylance	Unsafe
Zillya	Trojan.Injector.Win32.728748
K7AntiVirus	Trojan ( 005662c31 )
Alibaba	Backdoor:Win32/Injector.c62ad1cd
K7GW	Trojan ( 005662c31 )
Cybereason	malicious.65cfbe
Arcabit	Trojan.Empe.1.Gen
Invincea	Mal/Generic-S + Troj/AutoG-HV
BitDefenderTheta	Gen:NN.ZelphiF.34634.eHX@aqSr9aei
Cyren	W32/Delf_Troj.O.gen!Eldorado
Symantec	Trojan.Gen.MBT
APEX	Malicious
Avast	Win32:Trojan-gen
ClamAV	Win.Dropper.Remcos-7771461-0
Kaspersky	HEUR:Backdoor.Win32.Delf.gen
BitDefender	Trojan.Empe.1.Gen
NANO-Antivirus	Trojan.Win32.TrjGen.hkfoug
Paloalto	generic.ml
Rising	Malware.FakeXLS@CV!1.9C3D (CLASSIC)
Ad-Aware	Trojan.Empe.1.Gen
Emsisoft	Trojan.Empe.1.Gen (B)
Comodo	Malware@#31d8qv7hol7fv
F-Secure	Trojan.TR/Kryptik.rkwne
DrWeb	Trojan.Siggen8.46567
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_FRS.0NA103E720
McAfee-GW-Edition	GenericRXKK-ZW!9312FF5862BB
Sophos	Troj/AutoG-HV
SentinelOne	Static AI - Suspicious PE
eGambit	Unsafe.AI_Score_51%
Avira	TR/Kryptik.rkwne
Antiy-AVL	Trojan/Win32.Wacatac
Microsoft	PWS:Win32/Fareit.ART!MTB
AegisLab	Trojan.Win32.Remcos.m!c
ZoneAlarm	HEUR:Backdoor.Win32.Delf.gen
GData	Trojan.Empe.1.Gen
AhnLab-V3	Trojan/Win32.Sonbokli.R335512
VBA32	TScope.Trojan.Delf
ALYac	Trojan.Empe.1.Gen
MAX	malware (ai score=83)
Malwarebytes	Trojan.MalPack.SMY.Generic
ESET-NOD32	a variant of Win32/Injector.ELUJ
TrendMicro-HouseCall	TROJ_FRS.0NA103E720
Tencent	Malware.Win32.Gencirc.116f9324
Yandex	Trojan.Igent.bTGE1T.9

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x478140 DeleteCriticalSection

• 0x478144 LeaveCriticalSection

• 0x478148 EnterCriticalSection

• 0x47814c InitializeCriticalSection

• 0x478150 VirtualFree

• 0x478154 VirtualAlloc

• 0x478158 LocalFree

• 0x47815c LocalAlloc

• 0x478160 GetVersion

• 0x478164 GetCurrentThreadId

• 0x478168 InterlockedDecrement

• 0x47816c InterlockedIncrement

• 0x478170 VirtualQuery

• 0x478174 WideCharToMultiByte

• 0x478178 MultiByteToWideChar

• 0x47817c lstrlenA

• 0x478180 lstrcpynA

• 0x478184 LoadLibraryExA

• 0x478188 GetThreadLocale

• 0x47818c GetStartupInfoA

• 0x478190 GetProcAddress

• 0x478194 GetModuleHandleA

• 0x478198 GetModuleFileNameA

• 0x47819c GetLocaleInfoA

• 0x4781a0 GetCommandLineA

• 0x4781a4 FreeLibrary

• 0x4781a8 FindFirstFileA

• 0x4781ac FindClose

• 0x4781b0 ExitProcess

• 0x4781b4 WriteFile

• 0x4781b8 UnhandledExceptionFilter

• 0x4781bc RtlUnwind

• 0x4781c0 RaiseException

• 0x4781c4 GetStdHandle

Library user32.dll:

• 0x4781cc GetKeyboardType

• 0x4781d0 LoadStringA

• 0x4781d4 MessageBoxA

• 0x4781d8 CharNextA

Library advapi32.dll:

• 0x4781e0 RegQueryValueExA

• 0x4781e4 RegOpenKeyExA

• 0x4781e8 RegCloseKey

Library oleaut32.dll:

• 0x4781f0 SysFreeString

• 0x4781f4 SysReAllocStringLen

• 0x4781f8 SysAllocStringLen

Library kernel32.dll:

• 0x478200 TlsSetValue

• 0x478204 TlsGetValue

• 0x478208 LocalAlloc

• 0x47820c GetModuleHandleA

Library advapi32.dll:

• 0x478214 RegQueryValueExA

• 0x478218 RegOpenKeyExA

• 0x47821c RegCloseKey

Library kernel32.dll:

• 0x478224 lstrcpyA

• 0x478228 WriteFile

• 0x47822c WaitForSingleObject

• 0x478230 VirtualQuery

• 0x478234 VirtualProtect

• 0x478238 VirtualAlloc

• 0x47823c Sleep

• 0x478240 SizeofResource

• 0x478244 SetThreadLocale

• 0x478248 SetFilePointer

• 0x47824c SetEvent

• 0x478250 SetErrorMode

• 0x478254 SetEndOfFile

• 0x478258 ResetEvent

• 0x47825c ReadFile

• 0x478260 MulDiv

• 0x478264 LockResource

• 0x478268 LoadResource

• 0x47826c LoadLibraryA

• 0x478270 LeaveCriticalSection

• 0x478274 InitializeCriticalSection

• 0x478278 GlobalUnlock

• 0x47827c GlobalReAlloc

• 0x478280 GlobalHandle

• 0x478284 GlobalLock

• 0x478288 GlobalFree

• 0x47828c GlobalFindAtomA

• 0x478290 GlobalDeleteAtom

• 0x478294 GlobalAlloc

• 0x478298 GlobalAddAtomA

• 0x47829c GetVersionExA

• 0x4782a0 GetVersion

• 0x4782a4 GetTickCount

• 0x4782a8 GetThreadLocale

• 0x4782ac GetSystemInfo

• 0x4782b0 GetStringTypeExA

• 0x4782b4 GetStdHandle

• 0x4782b8 GetProcAddress

• 0x4782bc GetModuleHandleA

• 0x4782c0 GetModuleFileNameA

• 0x4782c4 GetLocaleInfoA

• 0x4782c8 GetLocalTime

• 0x4782cc GetLastError

• 0x4782d0 GetFullPathNameA

• 0x4782d4 GetDiskFreeSpaceA

• 0x4782d8 GetDateFormatA

• 0x4782dc GetCurrentThreadId

• 0x4782e0 GetCurrentProcessId

• 0x4782e4 GetCPInfo

• 0x4782e8 GetACP

• 0x4782ec FreeResource

• 0x4782f0 InterlockedExchange

• 0x4782f4 FreeLibrary

• 0x4782f8 FormatMessageA

• 0x4782fc FindResourceA

• 0x478300 EnumCalendarInfoA

• 0x478304 EnterCriticalSection

• 0x478308 DeleteCriticalSection

• 0x47830c CreateThread

• 0x478310 CreateFileA

• 0x478314 CreateEventA

• 0x478318 CompareStringA

• 0x47831c CloseHandle

Library version.dll:

• 0x478324 VerQueryValueA

• 0x478328 GetFileVersionInfoSizeA

• 0x47832c GetFileVersionInfoA

Library gdi32.dll:

• 0x478334 UnrealizeObject

• 0x478338 StretchBlt

• 0x47833c SetWindowOrgEx

• 0x478340 SetWinMetaFileBits

• 0x478344 SetViewportOrgEx

• 0x478348 SetTextColor

• 0x47834c SetStretchBltMode

• 0x478350 SetROP2

• 0x478354 SetPixel

• 0x478358 SetEnhMetaFileBits

• 0x47835c SetDIBColorTable

• 0x478360 SetBrushOrgEx

• 0x478364 SetBkMode

• 0x478368 SetBkColor

• 0x47836c SelectPalette

• 0x478370 SelectObject

• 0x478374 SelectClipRgn

• 0x478378 SaveDC

• 0x47837c RestoreDC

• 0x478380 Rectangle

• 0x478384 RectVisible

• 0x478388 RealizePalette

• 0x47838c Polyline

• 0x478390 PlayEnhMetaFile

• 0x478394 PatBlt

• 0x478398 MoveToEx

• 0x47839c MaskBlt

• 0x4783a0 LineTo

• 0x4783a4 IntersectClipRect

• 0x4783a8 GetWindowOrgEx

• 0x4783ac GetWinMetaFileBits

• 0x4783b0 GetTextMetricsA

• 0x4783b4 GetTextExtentPointA

• 0x4783b8 GetTextExtentPoint32A

• 0x4783bc GetSystemPaletteEntries

• 0x4783c0 GetStockObject

• 0x4783c4 GetRgnBox

• 0x4783c8 GetPixel

• 0x4783cc GetPaletteEntries

• 0x4783d0 GetObjectA

• 0x4783d4 GetEnhMetaFilePaletteEntries

• 0x4783d8 GetEnhMetaFileHeader

• 0x4783dc GetEnhMetaFileBits

• 0x4783e0 GetDeviceCaps

• 0x4783e4 GetDIBits

• 0x4783e8 GetDIBColorTable

• 0x4783ec GetDCOrgEx

• 0x4783f0 GetCurrentPositionEx

• 0x4783f4 GetClipRgn

• 0x4783f8 GetClipBox

• 0x4783fc GetBrushOrgEx

• 0x478400 GetBitmapBits

• 0x478404 ExcludeClipRect

• 0x478408 DeleteObject

• 0x47840c DeleteEnhMetaFile

• 0x478410 DeleteDC

• 0x478414 CreateSolidBrush

• 0x478418 CreateRectRgn

• 0x47841c CreatePenIndirect

• 0x478420 CreatePalette

• 0x478424 CreateHalftonePalette

• 0x478428 CreateFontIndirectA

• 0x47842c CreateDIBitmap

• 0x478430 CreateDIBSection

• 0x478434 CreateCompatibleDC

• 0x478438 CreateCompatibleBitmap

• 0x47843c CreateBrushIndirect

• 0x478440 CreateBitmap

• 0x478444 CopyEnhMetaFileA

• 0x478448 CombineRgn

• 0x47844c BitBlt

Library user32.dll:

• 0x478454 CreateWindowExA

• 0x478458 WindowFromPoint

• 0x47845c WinHelpA

• 0x478460 WaitMessage

• 0x478464 UpdateWindow

• 0x478468 UnregisterClassA

• 0x47846c UnhookWindowsHookEx

• 0x478470 TranslateMessage

• 0x478474 TranslateMDISysAccel

• 0x478478 TrackPopupMenu

• 0x47847c SystemParametersInfoA

• 0x478480 ShowWindow

• 0x478484 ShowScrollBar

• 0x478488 ShowOwnedPopups

• 0x47848c ShowCursor

• 0x478490 SetWindowsHookExA

• 0x478494 SetWindowTextA

• 0x478498 SetWindowPos

• 0x47849c SetWindowPlacement

• 0x4784a0 SetWindowLongA

• 0x4784a4 SetTimer

• 0x4784a8 SetScrollRange

• 0x4784ac SetScrollPos

• 0x4784b0 SetScrollInfo

• 0x4784b4 SetRect

• 0x4784b8 SetPropA

• 0x4784bc SetParent

• 0x4784c0 SetMenuItemInfoA

• 0x4784c4 SetMenu

• 0x4784c8 SetForegroundWindow

• 0x4784cc SetFocus

• 0x4784d0 SetCursor

• 0x4784d4 SetClipboardData

• 0x4784d8 SetClassLongA

• 0x4784dc SetCapture

• 0x4784e0 SetActiveWindow

• 0x4784e4 SendMessageA

• 0x4784e8 ScrollWindow

• 0x4784ec ScreenToClient

• 0x4784f0 RemovePropA

• 0x4784f4 RemoveMenu

• 0x4784f8 ReleaseDC

• 0x4784fc ReleaseCapture

• 0x478500 RegisterWindowMessageA

• 0x478504 RegisterClipboardFormatA

• 0x478508 RegisterClassA

• 0x47850c RedrawWindow

• 0x478510 PtInRect

• 0x478514 PostQuitMessage

• 0x478518 PostMessageA

• 0x47851c PeekMessageA

• 0x478520 OpenClipboard

• 0x478524 OffsetRect

• 0x478528 OemToCharA

• 0x47852c MessageBoxA

• 0x478530 MessageBeep

• 0x478534 MapWindowPoints

• 0x478538 MapVirtualKeyA

• 0x47853c LoadStringA

• 0x478540 LoadKeyboardLayoutA

• 0x478544 LoadIconA

• 0x478548 LoadCursorA

• 0x47854c LoadBitmapA

• 0x478550 KillTimer

• 0x478554 IsZoomed

• 0x478558 IsWindowVisible

• 0x47855c IsWindowEnabled

• 0x478560 IsWindow

• 0x478564 IsRectEmpty

• 0x478568 IsIconic

• 0x47856c IsDialogMessageA

• 0x478570 IsChild

• 0x478574 InvalidateRect

• 0x478578 IntersectRect

• 0x47857c InsertMenuItemA

• 0x478580 InsertMenuA

• 0x478584 InflateRect

• 0x478588 GetWindowThreadProcessId

• 0x47858c GetWindowTextA

• 0x478590 GetWindowRect

• 0x478594 GetWindowPlacement

• 0x478598 GetWindowLongA

• 0x47859c GetWindowDC

• 0x4785a0 GetTopWindow

• 0x4785a4 GetSystemMetrics

• 0x4785a8 GetSystemMenu

• 0x4785ac GetSysColorBrush

• 0x4785b0 GetSysColor

• 0x4785b4 GetSubMenu

• 0x4785b8 GetScrollRange

• 0x4785bc GetScrollPos

• 0x4785c0 GetScrollInfo

• 0x4785c4 GetPropA

• 0x4785c8 GetParent

• 0x4785cc GetWindow

• 0x4785d0 GetMenuStringA

• 0x4785d4 GetMenuState

• 0x4785d8 GetMenuItemInfoA

• 0x4785dc GetMenuItemID

• 0x4785e0 GetMenuItemCount

• 0x4785e4 GetMenu

• 0x4785e8 GetLastActivePopup

• 0x4785ec GetKeyboardState

• 0x4785f0 GetKeyboardLayoutList

• 0x4785f4 GetKeyboardLayout

• 0x4785f8 GetKeyState

• 0x4785fc GetKeyNameTextA

• 0x478600 GetIconInfo

• 0x478604 GetForegroundWindow

• 0x478608 GetFocus

• 0x47860c GetDlgItem

• 0x478610 GetDesktopWindow

• 0x478614 GetDCEx

• 0x478618 GetDC

• 0x47861c GetCursorPos

• 0x478620 GetCursor

• 0x478624 GetClipboardData

• 0x478628 GetClientRect

• 0x47862c GetClassNameA

• 0x478630 GetClassInfoA

• 0x478634 GetCapture

• 0x478638 GetActiveWindow

• 0x47863c FrameRect

• 0x478640 FindWindowA

• 0x478644 FillRect

• 0x478648 EqualRect

• 0x47864c EnumWindows

• 0x478650 EnumThreadWindows

• 0x478654 EndPaint

• 0x478658 EnableWindow

• 0x47865c EnableScrollBar

• 0x478660 EnableMenuItem

• 0x478664 EmptyClipboard

• 0x478668 DrawTextA

• 0x47866c DrawMenuBar

• 0x478670 DrawIconEx

• 0x478674 DrawIcon

• 0x478678 DrawFrameControl

• 0x47867c DrawFocusRect

• 0x478680 DrawEdge

• 0x478684 DispatchMessageA

• 0x478688 DestroyWindow

• 0x47868c DestroyMenu

• 0x478690 DestroyIcon

• 0x478694 DestroyCursor

• 0x478698 DeleteMenu

• 0x47869c DefWindowProcA

• 0x4786a0 DefMDIChildProcA

• 0x4786a4 DefFrameProcA

• 0x4786a8 CreatePopupMenu

• 0x4786ac CreateMenu

• 0x4786b0 CreateIcon

• 0x4786b4 CloseClipboard

• 0x4786b8 ClientToScreen

• 0x4786bc CheckMenuItem

• 0x4786c0 CallWindowProcA

• 0x4786c4 CallNextHookEx

• 0x4786c8 BeginPaint

• 0x4786cc CharNextA

• 0x4786d0 CharLowerBuffA

• 0x4786d4 CharLowerA

• 0x4786d8 CharUpperBuffA

• 0x4786dc CharToOemA

• 0x4786e0 AdjustWindowRectEx

• 0x4786e4 ActivateKeyboardLayout

Library kernel32.dll:

• 0x4786ec Sleep

Library oleaut32.dll:

• 0x4786f4 SafeArrayPtrOfIndex

• 0x4786f8 SafeArrayGetUBound

• 0x4786fc SafeArrayGetLBound

• 0x478700 SafeArrayCreate

• 0x478704 VariantChangeType

• 0x478708 VariantCopy

• 0x47870c VariantClear

• 0x478710 VariantInit

Library comctl32.dll:

• 0x478718 ImageList_SetIconSize

• 0x47871c ImageList_GetIconSize

• 0x478720 ImageList_Write

• 0x478724 ImageList_Read

• 0x478728 ImageList_GetDragImage

• 0x47872c ImageList_DragShowNolock

• 0x478730 ImageList_SetDragCursorImage

• 0x478734 ImageList_DragMove

• 0x478738 ImageList_DragLeave

• 0x47873c ImageList_DragEnter

• 0x478740 ImageList_EndDrag

• 0x478744 ImageList_BeginDrag

• 0x478748 ImageList_Remove

• 0x47874c ImageList_DrawEx

• 0x478750 ImageList_Draw

• 0x478754 ImageList_GetBkColor

• 0x478758 ImageList_SetBkColor

• 0x47875c ImageList_ReplaceIcon

• 0x478760 ImageList_Add

• 0x478764 ImageList_SetImageCount

• 0x478768 ImageList_GetImageCount

• 0x47876c ImageList_Destroy

• 0x478770 ImageList_Create

• 0x478774 InitCommonControls

Library comdlg32.dll:

• 0x47877c GetSaveFileNameA

• 0x478780 GetOpenFileNameA

Library URL.DLL:

• 0x478788 InetIsOffline

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
drive.google.com	A 104.244.46.208	31.13.73.17
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	53237	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	53658	239.255.255.250	3702
192.168.56.101	53660	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	60124	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.