SmartHawk

6.2

高危

60 个模型检测该样本为恶意！

重新分析

下载样本

905e423c6811d4ccacf71a39ae8b3c8fd39ae1ce4def6c2ac0431d731659b4f2

a09e4dc84f6ff99d31c8adad8eebd68d.exe

分析耗时

47s

最近分析

文件大小

2.1MB

静态报毒动态报毒 7HZPTSNQSA AGEN AI SCORE=86 AIDETECTVM BSCOPE CLASSIC CONFIDENCE DKW@AYJAZO ELDORADO ENCPK GENCIRC GENETIC HBR@8QRQPO HCQT HIGH CONFIDENCE HIJXNI INJECT3 KRYPTIK MALICIOUS PE MALWARE1 MINT PINKSBOT QAKBOT QBOT QVM20 R + MAL R331912 RAZY REGOTET SCORE STATIC AI SUSGEN TROJANBANKER UNSAFE ZEXAF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	W32/PinkSbot-GN!A09E4DC84F6F	20201229	6.0.6.653
Alibaba	TrojanBanker:Win32/Qakbot.a9be605c	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20201229	21.1.5827.0
Kingsoft		20201229	2017.9.26.565
Tencent	Malware.Win32.Gencirc.10b9c233	20201229	1.0.0.1
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0

Queries for the computername (3 个事件)

Time & API	Arguments	Status	Return
1619781470.406375 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619781484.359375 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619781471.42275 GetComputerNameW	computer_name: OSKAR-PC	success	1

Command line console output was observed (28 个事件)

Time & API	Arguments	Status	Return
1619815725.638749 WriteConsoleA	buffer: ÕýÔÚ Ping 127.0.0.1 console_handle: 0x00000007	success	1
1619815725.653749 WriteConsoleA	buffer: ¾ßÓÐ 32 ×Ö½ÚµÄÊý¾Ý: console_handle: 0x00000007	success	1
1619815725.653749 WriteConsoleA	buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´: console_handle: 0x00000007	success	1
1619815725.653749 WriteConsoleA	buffer: ×Ö½Ú=32 console_handle: 0x00000007	success	1
1619815725.653749 WriteConsoleA	buffer: Ê±¼ä<1ms console_handle: 0x00000007	success	1
1619815725.653749 WriteConsoleA	buffer: TTL=128 console_handle: 0x00000007	success	1
1619815726.653749 WriteConsoleA	buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´: console_handle: 0x00000007	success	1
1619815726.653749 WriteConsoleA	buffer: ×Ö½Ú=32 console_handle: 0x00000007	success	1
1619815726.653749 WriteConsoleA	buffer: Ê±¼ä<1ms console_handle: 0x00000007	success	1
1619815726.653749 WriteConsoleA	buffer: TTL=128 console_handle: 0x00000007	success	1
1619815727.653749 WriteConsoleA	buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´: console_handle: 0x00000007	success	1
1619815727.653749 WriteConsoleA	buffer: ×Ö½Ú=32 console_handle: 0x00000007	success	1
1619815727.653749 WriteConsoleA	buffer: Ê±¼ä<1ms console_handle: 0x00000007	success	1
1619815727.653749 WriteConsoleA	buffer: TTL=128 console_handle: 0x00000007	success	1
1619815728.653749 WriteConsoleA	buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´: console_handle: 0x00000007	success	1
1619815728.653749 WriteConsoleA	buffer: ×Ö½Ú=32 console_handle: 0x00000007	success	1
1619815728.653749 WriteConsoleA	buffer: Ê±¼ä<1ms console_handle: 0x00000007	success	1
1619815728.653749 WriteConsoleA	buffer: TTL=128 console_handle: 0x00000007	success	1
1619815729.684749 WriteConsoleA	buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´: console_handle: 0x00000007	success	1
1619815729.684749 WriteConsoleA	buffer: ×Ö½Ú=32 console_handle: 0x00000007	success	1
1619815729.684749 WriteConsoleA	buffer: Ê±¼ä<1ms console_handle: 0x00000007	success	1
1619815729.684749 WriteConsoleA	buffer: TTL=128 console_handle: 0x00000007	success	1
1619815730.684749 WriteConsoleA	buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´: console_handle: 0x00000007	success	1
1619815730.684749 WriteConsoleA	buffer: ×Ö½Ú=32 console_handle: 0x00000007	success	1
1619815730.684749 WriteConsoleA	buffer: Ê±¼ä<1ms console_handle: 0x00000007	success	1
1619815730.684749 WriteConsoleA	buffer: TTL=128 console_handle: 0x00000007	success	1
1619815730.731749 WriteConsoleA	buffer: 127.0.0.1 µÄ Ping Í³¼ÆÐÅÏ¢: Êý¾Ý°ü: ÒÑ·¢ËÍ = 6£¬ÒÑ½ÓÊÕ = 6£¬¶ªÊ§ = 0 (0% ¶ªÊ§)£¬ console_handle: 0x00000007	success	1
1619815730.747749 WriteConsoleA	buffer: Íù·µÐÐ³ÌµÄ¹À¼ÆÊ±¼ä(ÒÔºÁÃëÎªµ¥Î»): ×î¶Ì = 0ms£¬×î³¤ = 0ms£¬Æ½¾ù = 0ms console_handle: 0x00000007	success	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619815725.606749 GlobalMemoryStatusEx		success	1	0

One or more processes crashed (4 个事件)

Time & API	Arguments	Status
1619781484.359375 __exception__	stacktrace: RtlConvertSidToUnicodeString+0x28 RtlFormatCurrentUserKeyPath-0x257 ntdll+0x3aeea @ 0x77d6aeea ConvertSidToStringSidW+0x24 CopySid-0xe6 advapi32+0x14368 @ 0x76554368 a09e4dc84f6ff99d31c8adad8eebd68d+0xa5b6 @ 0x40a5b6 a09e4dc84f6ff99d31c8adad8eebd68d+0x8853 @ 0x408853 a09e4dc84f6ff99d31c8adad8eebd68d+0x8451 @ 0x408451 a09e4dc84f6ff99d31c8adad8eebd68d+0x8ec9 @ 0x408ec9 a09e4dc84f6ff99d31c8adad8eebd68d+0x17cc @ 0x4017cc a09e4dc84f6ff99d31c8adad8eebd68d+0x1c66 @ 0x401c66 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1632744 registers.edi: 0 registers.eax: 9460301 registers.ebp: 1632784 registers.edx: 7373588 registers.ebx: 1 registers.esi: 9460301 registers.ecx: 9460301 exception.instruction_r: 8a 08 80 e1 0f 80 f9 01 75 24 8a 48 01 80 f9 0f exception.symbol: RtlValidSid+0x17 RtlCopySid-0x3e ntdll+0x392a9 exception.instruction: mov cl, byte ptr [eax] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 234153 exception.address: 0x77d692a9	success
1619781484.640375 __exception__	stacktrace: EqualSid+0x19 EqualPrefixSid-0xc kernelbase+0x1bfe3 @ 0x778fbfe3 a09e4dc84f6ff99d31c8adad8eebd68d+0x84c8 @ 0x4084c8 a09e4dc84f6ff99d31c8adad8eebd68d+0xa27c @ 0x40a27c a09e4dc84f6ff99d31c8adad8eebd68d+0xa2b7 @ 0x40a2b7 a09e4dc84f6ff99d31c8adad8eebd68d+0x8f66 @ 0x408f66 a09e4dc84f6ff99d31c8adad8eebd68d+0x17cc @ 0x4017cc a09e4dc84f6ff99d31c8adad8eebd68d+0x1c66 @ 0x401c66 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1634132 registers.edi: 9460301 registers.eax: 1281 registers.ebp: 1634140 registers.edx: 0 registers.ebx: 40237320 registers.esi: 40237320 registers.ecx: 2130563072 exception.instruction_r: 66 3b 07 0f 85 e1 ef ff ff 0f b6 4e 01 33 c0 8d exception.symbol: RtlEqualSid+0x10 RtlSetCriticalSectionSpinCount-0x26 ntdll+0x394c1 exception.instruction: cmp ax, word ptr [edi] exception.module: ntdll.dll exception.exception_code: 0xc0000005 exception.offset: 234689 exception.address: 0x77d694c1	success
1619781472.37575 __exception__	stacktrace: a09e4dc84f6ff99d31c8adad8eebd68d+0x3daa @ 0x403daa a09e4dc84f6ff99d31c8adad8eebd68d+0x1b23 @ 0x401b23 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637624 registers.edi: 0 registers.eax: 1447909480 registers.ebp: 1637684 registers.edx: 22104 registers.ebx: 1 registers.esi: 7150528 registers.ecx: 10 exception.instruction_r: ed 89 5d e4 89 4d e0 5a 59 5b 58 83 4d fc ff eb exception.symbol: a09e4dc84f6ff99d31c8adad8eebd68d+0x33cc exception.instruction: in eax, dx exception.module: a09e4dc84f6ff99d31c8adad8eebd68d.exe exception.exception_code: 0xc0000096 exception.offset: 13260 exception.address: 0x4033cc	success
1619781472.39075 __exception__	stacktrace: a09e4dc84f6ff99d31c8adad8eebd68d+0x3db3 @ 0x403db3 a09e4dc84f6ff99d31c8adad8eebd68d+0x1b23 @ 0x401b23 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637628 registers.edi: 0 registers.eax: 1447909480 registers.ebp: 1637684 registers.edx: 22104 registers.ebx: 1 registers.esi: 7150528 registers.ecx: 20 exception.instruction_r: ed 89 45 e4 5a 59 5b 58 83 4d fc ff eb 11 33 c0 exception.symbol: a09e4dc84f6ff99d31c8adad8eebd68d+0x3465 exception.instruction: in eax, dx exception.module: a09e4dc84f6ff99d31c8adad8eebd68d.exe exception.exception_code: 0xc0000096 exception.offset: 13413 exception.address: 0x403465	success

Allocates read-write-execute memory (usually to unpack itself) (6 个事件)

Time & API	Arguments	Status
1619781470.312375 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 233472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00610000	success
1619781470.312375 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00650000	success
1619781470.312375 NtProtectVirtualMemory	process_identifier: 2344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 245760 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1619781471.40675 NtAllocateVirtualMemory	process_identifier: 1916 region_size: 233472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00610000	success
1619781471.40675 NtAllocateVirtualMemory	process_identifier: 1916 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00650000	success
1619781471.40675 NtProtectVirtualMemory	process_identifier: 1916 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 245760 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success

Creates executable files on the filesystem (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a09e4dc84f6ff99d31c8adad8eebd68d.exe

Creates a suspicious process (2 个事件)

cmdline	cmd.exe /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a09e4dc84f6ff99d31c8adad8eebd68d.exe"
cmdline	"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a09e4dc84f6ff99d31c8adad8eebd68d.exe"

A process created a hidden window (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619781471.265375 CreateProcessInternalW	thread_identifier: 1940 thread_handle: 0x0000013c process_identifier: 1916 current_directory: filepath: track: 1 command_line: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a09e4dc84f6ff99d31c8adad8eebd68d.exe /C filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) process_handle: 0x00000140 inherit_handles: 0	success	1	0
1619781485.484375 ShellExecuteExW	parameters: /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a09e4dc84f6ff99d31c8adad8eebd68d.exe" filepath: cmd.exe filepath_r: cmd.exe show_type: 0	success	1	0

Uses Windows utilities for basic Windows functionality (3 个事件)

cmdline	cmd.exe /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a09e4dc84f6ff99d31c8adad8eebd68d.exe"
cmdline	ping.exe -n 6 127.0.0.1
cmdline	"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\a09e4dc84f6ff99d31c8adad8eebd68d.exe"

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Detects VMWare through the in instruction feature (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619781472.37575 __exception__	stacktrace: a09e4dc84f6ff99d31c8adad8eebd68d+0x3daa @ 0x403daa a09e4dc84f6ff99d31c8adad8eebd68d+0x1b23 @ 0x401b23 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637624 registers.edi: 0 registers.eax: 1447909480 registers.ebp: 1637684 registers.edx: 22104 registers.ebx: 1 registers.esi: 7150528 registers.ecx: 10 exception.instruction_r: ed 89 5d e4 89 4d e0 5a 59 5b 58 83 4d fc ff eb exception.symbol: a09e4dc84f6ff99d31c8adad8eebd68d+0x33cc exception.instruction: in eax, dx exception.module: a09e4dc84f6ff99d31c8adad8eebd68d.exe exception.exception_code: 0xc0000096 exception.offset: 13260 exception.address: 0x4033cc	success	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

172.217.160.78:443

File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Heur.Mint.Regotet.1
FireEye	Generic.mg.a09e4dc84f6ff99d
CAT-QuickHeal	Trojan.Qbot
McAfee	W32/PinkSbot-GN!A09E4DC84F6F
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Trojan ( 005652be1 )
Alibaba	TrojanBanker:Win32/Qakbot.a9be605c
K7GW	Trojan ( 005652be1 )
Cybereason	malicious.84f6ff
Arcabit	Trojan.Mint.Regotet.1
BitDefenderTheta	Gen:NN.ZexaF.34700.dkW@ayjaZO
Cyren	W32/S-4cd6deb0!Eldorado
Symantec	Packed.Generic.459
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Malware.Razy-7659589-0
Kaspersky	HEUR:Trojan-Banker.Win32.Qbot.vho
BitDefender	Gen:Heur.Mint.Regotet.1
NANO-Antivirus	Trojan.Win32.Inject3.hijxni
Avast	Win32:Trojan-gen
Rising	Trojan.Kryptik!1.C427 (CLASSIC)
Ad-Aware	Gen:Heur.Mint.Regotet.1
Sophos	Mal/Generic-R + Mal/EncPk-APV
Comodo	TrojWare.Win32.Kryptik.HBR@8qrqpo
F-Secure	Heuristic.HEUR/AGEN.1133397
DrWeb	Trojan.Inject3.38145
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Backdoor.Win32.QAKBOT.SME
McAfee-GW-Edition	W32/PinkSbot-GN!A09E4DC84F6F
Emsisoft	Gen:Heur.Mint.Regotet.1 (B)
SentinelOne	Static AI - Malicious PE
Jiangmin	Trojan.Banker.Qbot.mm
Avira	HEUR/AGEN.1133397
MAX	malware (ai score=86)
Antiy-AVL	Trojan/Win32.Kryptik
Gridinsoft	Trojan.Win32.Kryptik.ba!s2
Microsoft	Trojan:Win32/Qakbot.CK!MTB
ViRobot	Trojan.Win32.Z.Qbot.2153472.A
ZoneAlarm	HEUR:Trojan-Banker.Win32.Qbot.vho
GData	Gen:Heur.Mint.Regotet.1
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Qbot.R331912
Acronis	suspicious
VBA32	BScope.TrojanBanker.Qbot
ALYac	Gen:Heur.Mint.Regotet.1
Malwarebytes	Backdoor.Qbot
ESET-NOD32	a variant of Win32/Kryptik.HCQT

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-04-08 21:07:51

Imports

Library KERNEL32.dll:

• 0x60e3ec VirtualAlloc

• 0x60e3f0 GetModuleHandleW

Library USER32.dll:

• 0x60e3f8 LoadIconA

• 0x60e3fc CharLowerA

• 0x60e400 InSendMessage

• 0x60e404 ReleaseCapture

• 0x60e408 GetFocus

• 0x60e40c GetQueueStatus

• 0x60e410 OpenIcon

• 0x60e414 AnyPopup

• 0x60e418 GetDoubleClickTime

• 0x60e41c CountClipboardFormats

• 0x60e420 DestroyCursor

• 0x60e424 GetClipboardOwner

• 0x60e428 CharNextA

• 0x60e42c GetKeyboardType

• 0x60e430 OemKeyScan

• 0x60e434 GetMenuItemID

• 0x60e438 GetSubMenu

• 0x60e43c GetMenu

• 0x60e440 RegisterClassA

• 0x60e444 GetClassInfoA

• 0x60e448 WinHelpA

• 0x60e44c GetCapture

• 0x60e450 GetTopWindow

• 0x60e454 CopyRect

• 0x60e458 GetClientRect

• 0x60e45c AdjustWindowRectEx

• 0x60e460 SetFocus

• 0x60e464 GetSysColor

• 0x60e468 MapWindowPoints

• 0x60e46c ShowWindow

• 0x60e470 LoadCursorA

• 0x60e474 GetSysColorBrush

• 0x60e478 DestroyMenu

• 0x60e47c DestroyWindow

• 0x60e480 CreateWindowExA

• 0x60e484 GetClassLongA

• 0x60e488 SetPropA

• 0x60e48c GetPropA

• 0x60e490 CallWindowProcA

• 0x60e494 RemovePropA

• 0x60e498 DefWindowProcA

• 0x60e49c GetMessageTime

• 0x60e4a0 GetForegroundWindow

• 0x60e4a4 SetForegroundWindow

• 0x60e4a8 SetWindowLongA

• 0x60e4ac SetWindowPos

• 0x60e4b0 RegisterWindowMessageA

• 0x60e4b4 SystemParametersInfoA

• 0x60e4b8 IsIconic

• 0x60e4bc GetWindowPlacement

• 0x60e4c0 GetSystemMetrics

• 0x60e4c4 LoadStringA

• 0x60e4c8 GrayStringA

• 0x60e4cc DrawTextA

• 0x60e4d0 TabbedTextOutA

• 0x60e4d4 ReleaseDC

• 0x60e4d8 GetDC

• 0x60e4dc GetMenuItemCount

• 0x60e4e0 wsprintfA

• 0x60e4e4 UnhookWindowsHookEx

• 0x60e4e8 GetLastActivePopup

• 0x60e4ec IsWindowEnabled

• 0x60e4f0 MessageBoxA

• 0x60e4f4 GetWindowTextA

• 0x60e4f8 SetWindowTextA

• 0x60e4fc ClientToScreen

• 0x60e500 GetWindow

• 0x60e504 GetDlgCtrlID

• 0x60e508 GetWindowRect

• 0x60e50c PtInRect

• 0x60e510 GetWindowLongA

• 0x60e514 GetClassNameA

• 0x60e518 GetMenuCheckMarkDimensions

• 0x60e51c LoadBitmapA

• 0x60e520 GetMenuState

• 0x60e524 ModifyMenuA

• 0x60e528 SetMenuItemBitmaps

• 0x60e52c CheckMenuItem

• 0x60e530 EnableMenuItem

• 0x60e534 GetParent

• 0x60e538 GetNextDlgTabItem

• 0x60e53c SetCursor

• 0x60e540 GetMessageA

• 0x60e544 TranslateMessage

• 0x60e548 DispatchMessageA

• 0x60e54c GetActiveWindow

• 0x60e550 SendMessageA

• 0x60e554 PostQuitMessage

• 0x60e558 PostMessageA

• 0x60e55c GetDlgItem

• 0x60e560 GetMessagePos

• 0x60e564 GetKeyState

• 0x60e568 CallNextHookEx

• 0x60e56c ValidateRect

• 0x60e570 IsWindowVisible

• 0x60e574 PeekMessageA

• 0x60e578 GetCursorPos

• 0x60e57c SetWindowsHookExA

• 0x60e580 EnableWindow

Library GDI32.dll:

• 0x60e588 GetStockObject

• 0x60e58c GetEnhMetaFileA

• 0x60e590 GetObjectType

• 0x60e594 GdiGetBatchLimit

• 0x60e598 CreateMetaFileW

• 0x60e59c GetPolyFillMode

• 0x60e5a0 CreateSolidBrush

• 0x60e5a4 CloseMetaFile

• 0x60e5a8 GetTextCharset

• 0x60e5ac GetSystemPaletteUse

• 0x60e5b0 EndPage

• 0x60e5b4 GetDCBrushColor

Library ADVAPI32.dll:

• 0x60e5bc RegOpenKeyA

• 0x60e5c0 RegQueryValueExA

• 0x60e5c4 RegSetValueExA

• 0x60e5c8 RegCloseKey

• 0x60e5cc RegOpenKeyExA

• 0x60e5d0 RegCreateKeyExA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
teredo.ipv6.microsoft.com		127.0.0.1
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com	216.58.200.238

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	49236	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.