SmartHawk

5.2

中危

该样本未表现出任何异常！

重新分析

下载样本

7694229a90ab023ff68f950eb19bf6f2b240588a417e13097ea5f945fedb3645

a9ac1b508a610c3a64ecac90a9712ed1.exe

分析耗时

84s

最近分析

文件大小

937.5KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1621021170.872498 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (3 个事件)

Time & API	Arguments	Status	Return
1621021158.044498 CryptGenKey	crypto_handle: 0x0069de10 algorithm_identifier: 0x0000660e () provider_handle: 0x005f6480 flags: 1 key: fpUiÆä*¶Å1ïÛÔ¡ð	success	1
1621021170.919498 CryptExportKey	crypto_handle: 0x0069de10 crypto_export_handle: 0x005f6440 buffer: f¤½²Sª!=iRjÕ¥*AÉ<PèB+dCYÜAßðkûøØA¥bwYGsµ?G7ä9dÜ^3UpnßÕ{Ðn=©êa³uôÅyr blob_type: 1 flags: 64	success	1
1621021219.747498 CryptExportKey	crypto_handle: 0x0069de10 crypto_export_handle: 0x005f6440 buffer: f¤ú(ì=¿.fÃB·FÜïF\|ñ½ð#XËÃ)X¯ª¡17DHØÊTD{ÍÒë*4#ó÷ÈôQ"¯ ÚS'Óù:ÒX:õ$4½Üþª= blob_type: 1 flags: 64	success	1

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)

section

.didat

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1621021157.200498 NtAllocateVirtualMemory	process_identifier: 3068 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01ea0000	success	0	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (3 个事件)

Time & API	Arguments	Status	Return
1621021219.747498 Process32NextW	process_name: mscorsvw.exe snapshot_handle: 0x000001cc process_identifier: 2944	success	1
1621021219.747498 Process32NextW	process_name: GoogleUpdate.exe snapshot_handle: 0x000001cc process_identifier: 176	success	1
1621021219.747498 Process32NextW	process_name: GoogleUpdate.exe snapshot_handle: 0x000001cc process_identifier: 1936	success	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1621021173.294498 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

The binary likely contains encrypted or compressed data indicative of a packer (1 个事件)

entropy

6.941199532464936

section

{'size_of_data': '0x0000dc00', 'virtual_address': '0x000e3000', 'entropy': 6.941199532464936, 'name': '.rsrc', 'virtual_size': '0x0000db5e'}

description

A section with a high entropy has been found

Expresses interest in specific running processes (1 个事件)

process

a9ac1b508a610c3a64ecac90a9712ed1.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1621021171.512498 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (4 个事件)

host	104.18.21.226
host	172.217.24.14
host	185.94.252.13
host	24.249.135.121

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1621021176.028498 RegSetValueExA	key_handle: 0x000003c8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1621021176.028498 RegSetValueExA	key_handle: 0x000003c8 value: Ðo©æêH× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1621021176.028498 RegSetValueExA	key_handle: 0x000003c8 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1621021176.028498 RegSetValueExW	key_handle: 0x000003c8 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1621021176.044498 RegSetValueExA	key_handle: 0x000003e0 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1621021176.044498 RegSetValueExA	key_handle: 0x000003e0 value: Ðo©æêH× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1621021176.044498 RegSetValueExA	key_handle: 0x000003e0 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1621021176.106498 RegSetValueExW	key_handle: 0x000003c4 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

24.249.135.121:80

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-07-30 05:13:05

Imports

Library SHLWAPI.dll:

• 0x4df3cc PathFindExtensionA

• 0x4df3d0 PathRemoveExtensionA

• 0x4df3d4 PathFindFileNameA

• 0x4df3d8 PathStripToRootA

• 0x4df3dc PathIsUNCA

• 0x4df3e0 StrRetToStrA

• 0x4df3e4 PathRemoveFileSpecW

Library KERNEL32.dll:

• 0x4def50 GetFileSizeEx

• 0x4def54 GetFileTime

• 0x4def58 RtlUnwind

• 0x4def5c RaiseException

• 0x4def60 GetCommandLineA

• 0x4def64 GetStartupInfoA

• 0x4def68 HeapAlloc

• 0x4def6c HeapFree

• 0x4def70 VirtualProtect

• 0x4def74 VirtualAlloc

• 0x4def78 GetSystemInfo

• 0x4def7c VirtualQuery

• 0x4def80 HeapReAlloc

• 0x4def84 Sleep

• 0x4def88 ExitProcess

• 0x4def8c ExitThread

• 0x4def90 CreateThread

• 0x4def94 HeapSize

• 0x4def98 TerminateProcess

• 0x4def9c UnhandledExceptionFilter

• 0x4defa0 SetUnhandledExceptionFilter

• 0x4defa4 IsDebuggerPresent

• 0x4defa8 GetACP

• 0x4defac IsValidCodePage

• 0x4defb0 CompareStringW

• 0x4defb4 GetStdHandle

• 0x4defb8 FreeEnvironmentStringsA

• 0x4defbc GetEnvironmentStrings

• 0x4defc0 FreeEnvironmentStringsW

• 0x4defc4 SetFileAttributesA

• 0x4defc8 SetHandleCount

• 0x4defcc GetFileType

• 0x4defd0 HeapCreate

• 0x4defd4 HeapDestroy

• 0x4defd8 VirtualFree

• 0x4defdc QueryPerformanceCounter

• 0x4defe0 GetSystemTimeAsFileTime

• 0x4defe4 FatalAppExitA

• 0x4defe8 GetTimeZoneInformation

• 0x4defec GetDriveTypeA

• 0x4deff0 SetConsoleCtrlHandler

• 0x4deff4 InitializeCriticalSectionAndSpinCount

• 0x4deff8 GetStringTypeA

• 0x4deffc GetStringTypeW

• 0x4df000 LCMapStringA

• 0x4df004 LCMapStringW

• 0x4df008 GetTimeFormatA

• 0x4df00c GetDateFormatA

• 0x4df010 GetUserDefaultLCID

• 0x4df014 EnumSystemLocalesA

• 0x4df018 IsValidLocale

• 0x4df01c GetConsoleCP

• 0x4df020 GetConsoleMode

• 0x4df024 GetLocaleInfoW

• 0x4df028 SetCurrentDirectoryA

• 0x4df02c SetStdHandle

• 0x4df030 WriteConsoleA

• 0x4df034 GetConsoleOutputCP

• 0x4df038 WriteConsoleW

• 0x4df03c SetEnvironmentVariableA

• 0x4df040 SetFileTime

• 0x4df044 LocalFileTimeToFileTime

• 0x4df048 SetErrorMode

• 0x4df04c CreateFileA

• 0x4df050 GetShortPathNameA

• 0x4df054 GetFullPathNameA

• 0x4df058 GetVolumeInformationA

• 0x4df05c DuplicateHandle

• 0x4df060 GetFileSize

• 0x4df064 SetEndOfFile

• 0x4df068 UnlockFile

• 0x4df06c LockFile

• 0x4df070 FlushFileBuffers

• 0x4df074 SetFilePointer

• 0x4df078 WriteFile

• 0x4df07c ReadFile

• 0x4df080 lstrcmpiA

• 0x4df084 GetStringTypeExA

• 0x4df088 DeleteFileA

• 0x4df08c MoveFileA

• 0x4df090 GetCurrentDirectoryA

• 0x4df094 GetPrivateProfileStringA

• 0x4df098 WritePrivateProfileStringA

• 0x4df09c GetPrivateProfileIntA

• 0x4df0a0 SystemTimeToFileTime

• 0x4df0a4 GetThreadLocale

• 0x4df0a8 GetAtomNameA

• 0x4df0ac GetOEMCP

• 0x4df0b0 GetCPInfo

• 0x4df0b4 GlobalFlags

• 0x4df0b8 InterlockedIncrement

• 0x4df0bc GetModuleHandleW

• 0x4df0c0 TlsFree

• 0x4df0c4 DeleteCriticalSection

• 0x4df0c8 LocalReAlloc

• 0x4df0cc TlsSetValue

• 0x4df0d0 TlsAlloc

• 0x4df0d4 InitializeCriticalSection

• 0x4df0d8 GlobalHandle

• 0x4df0dc GlobalReAlloc

• 0x4df0e0 EnterCriticalSection

• 0x4df0e4 TlsGetValue

• 0x4df0e8 LeaveCriticalSection

• 0x4df0ec LocalAlloc

• 0x4df0f0 InterlockedDecrement

• 0x4df0f4 GetModuleFileNameW

• 0x4df0f8 GetCurrentProcessId

• 0x4df0fc CreateEventA

• 0x4df100 SuspendThread

• 0x4df104 SetEvent

• 0x4df108 WaitForSingleObject

• 0x4df10c ResumeThread

• 0x4df110 SetThreadPriority

• 0x4df114 CloseHandle

• 0x4df118 GetCurrentThread

• 0x4df11c ConvertDefaultLocale

• 0x4df120 EnumResourceLanguagesA

• 0x4df124 GetModuleFileNameA

• 0x4df128 GetLocaleInfoA

• 0x4df12c InterlockedExchange

• 0x4df130 FindFirstFileA

• 0x4df134 FileTimeToLocalFileTime

• 0x4df138 FileTimeToSystemTime

• 0x4df13c FindNextFileA

• 0x4df140 FindClose

• 0x4df144 lstrcmpA

• 0x4df148 FreeResource

• 0x4df14c GetCurrentThreadId

• 0x4df150 GlobalGetAtomNameA

• 0x4df154 GlobalAddAtomA

• 0x4df158 GlobalFindAtomA

• 0x4df15c GlobalDeleteAtom

• 0x4df160 FreeLibrary

• 0x4df164 CompareStringA

• 0x4df168 LoadLibraryA

• 0x4df16c lstrcmpW

• 0x4df170 GetModuleHandleA

• 0x4df174 GetVersionExA

• 0x4df178 GlobalFree

• 0x4df17c CopyFileA

• 0x4df180 GlobalSize

• 0x4df184 GlobalAlloc

• 0x4df188 GlobalLock

• 0x4df18c GlobalUnlock

• 0x4df190 FormatMessageA

• 0x4df194 LocalFree

• 0x4df198 lstrlenW

• 0x4df19c MulDiv

• 0x4df1a0 lstrlenA

• 0x4df1a4 GetLastError

• 0x4df1a8 SetLastError

• 0x4df1ac LoadLibraryExW

• 0x4df1b0 LoadLibraryExA

• 0x4df1b4 GetProcAddress

• 0x4df1b8 GetCurrentProcess

• 0x4df1bc GetTickCount

• 0x4df1c0 GetFileAttributesA

• 0x4df1c4 MultiByteToWideChar

• 0x4df1c8 WideCharToMultiByte

• 0x4df1cc FindResourceA

• 0x4df1d0 LoadResource

• 0x4df1d4 LockResource

• 0x4df1d8 SizeofResource

• 0x4df1dc GetEnvironmentStringsW

Library USER32.dll:

• 0x4df418 InsertMenuItemA

• 0x4df41c LoadAcceleratorsA

• 0x4df420 GetMenuBarInfo

• 0x4df424 LoadMenuA

• 0x4df428 ReuseDDElParam

• 0x4df42c UnpackDDElParam

• 0x4df430 RegisterClipboardFormatA

• 0x4df434 SetTimer

• 0x4df438 KillTimer

• 0x4df43c SetParent

• 0x4df440 UnionRect

• 0x4df444 PostThreadMessageA

• 0x4df448 GetDCEx

• 0x4df44c LockWindowUpdate

• 0x4df450 CreatePopupMenu

• 0x4df454 BringWindowToTop

• 0x4df458 TranslateAcceleratorA

• 0x4df45c SetRectEmpty

• 0x4df460 UnregisterClassA

• 0x4df464 MessageBeep

• 0x4df468 GetNextDlgGroupItem

• 0x4df46c InvalidateRgn

• 0x4df470 InvalidateRect

• 0x4df474 SetRect

• 0x4df478 IsRectEmpty

• 0x4df47c CopyAcceleratorTableA

• 0x4df480 CharNextA

• 0x4df484 GetDialogBaseUnits

• 0x4df488 CharUpperA

• 0x4df48c DestroyIcon

• 0x4df490 WaitMessage

• 0x4df494 ReleaseCapture

• 0x4df498 WindowFromPoint

• 0x4df49c SetCapture

• 0x4df4a0 DeleteMenu

• 0x4df4a4 LoadCursorA

• 0x4df4a8 GetSysColorBrush

• 0x4df4ac EndPaint

• 0x4df4b0 BeginPaint

• 0x4df4b4 GetWindowDC

• 0x4df4b8 ClientToScreen

• 0x4df4bc GrayStringA

• 0x4df4c0 DrawTextExA

• 0x4df4c4 DrawTextA

• 0x4df4c8 TabbedTextOutA

• 0x4df4cc FillRect

• 0x4df4d0 DestroyMenu

• 0x4df4d4 GetMenuItemInfoA

• 0x4df4d8 InflateRect

• 0x4df4dc SetWindowContextHelpId

• 0x4df4e0 MapDialogRect

• 0x4df4e4 GetDesktopWindow

• 0x4df4e8 CreateDialogIndirectParamA

• 0x4df4ec GetNextDlgTabItem

• 0x4df4f0 EndDialog

• 0x4df4f4 GetWindowThreadProcessId

• 0x4df4f8 ShowOwnedPopups

• 0x4df4fc SetCursor

• 0x4df500 GetMessageA

• 0x4df504 TranslateMessage

• 0x4df508 GetActiveWindow

• 0x4df50c GetCursorPos

• 0x4df510 ValidateRect

• 0x4df514 PostQuitMessage

• 0x4df518 ScrollWindowEx

• 0x4df51c IsWindowEnabled

• 0x4df520 ShowWindow

• 0x4df524 MoveWindow

• 0x4df528 IsDialogMessageA

• 0x4df52c IsDlgButtonChecked

• 0x4df530 SetDlgItemTextA

• 0x4df534 SetDlgItemInt

• 0x4df538 GetDlgItemTextA

• 0x4df53c GetDlgItemInt

• 0x4df540 CheckRadioButton

• 0x4df544 CheckDlgButton

• 0x4df548 SetMenuItemBitmaps

• 0x4df54c GetMenuCheckMarkDimensions

• 0x4df550 LoadBitmapA

• 0x4df554 ModifyMenuA

• 0x4df558 EnableMenuItem

• 0x4df55c CheckMenuItem

• 0x4df560 MapVirtualKeyA

• 0x4df564 GetKeyNameTextA

• 0x4df568 ReleaseDC

• 0x4df56c GetDC

• 0x4df570 RegisterWindowMessageA

• 0x4df574 SendDlgItemMessageA

• 0x4df578 WinHelpA

• 0x4df57c IsChild

• 0x4df580 GetCapture

• 0x4df584 SetWindowsHookExA

• 0x4df588 CallNextHookEx

• 0x4df58c GetClassLongA

• 0x4df590 GetClassNameA

• 0x4df594 SetPropA

• 0x4df598 GetPropA

• 0x4df59c RemovePropA

• 0x4df5a0 GetFocus

• 0x4df5a4 IsWindow

• 0x4df5a8 SetFocus

• 0x4df5ac GetWindowTextLengthA

• 0x4df5b0 GetWindowTextA

• 0x4df5b4 GetForegroundWindow

• 0x4df5b8 GetLastActivePopup

• 0x4df5bc SetActiveWindow

• 0x4df5c0 DispatchMessageA

• 0x4df5c4 SendMessageA

• 0x4df5c8 GetParent

• 0x4df5cc SetWindowTextA

• 0x4df5d0 EnableWindow

• 0x4df5d4 BeginDeferWindowPos

• 0x4df5d8 EndDeferWindowPos

• 0x4df5dc GetDlgItem

• 0x4df5e0 GetTopWindow

• 0x4df5e4 DestroyWindow

• 0x4df5e8 UnhookWindowsHookEx

• 0x4df5ec GetMessageTime

• 0x4df5f0 GetMessagePos

• 0x4df5f4 PeekMessageA

• 0x4df5f8 MapWindowPoints

• 0x4df5fc ScrollWindow

• 0x4df600 TrackPopupMenuEx

• 0x4df604 TrackPopupMenu

• 0x4df608 GetKeyState

• 0x4df60c SetMenu

• 0x4df610 SetScrollRange

• 0x4df614 GetScrollRange

• 0x4df618 SetScrollPos

• 0x4df61c GetScrollPos

• 0x4df620 SetForegroundWindow

• 0x4df624 ShowScrollBar

• 0x4df628 DrawIcon

• 0x4df62c AppendMenuA

• 0x4df630 GetSystemMenu

• 0x4df634 IsIconic

• 0x4df638 GetClientRect

• 0x4df63c LoadIconA

• 0x4df640 GetSystemMetrics

• 0x4df644 RemoveMenu

• 0x4df648 GetSubMenu

• 0x4df64c GetMenuItemCount

• 0x4df650 InsertMenuA

• 0x4df654 GetMenuItemID

• 0x4df658 GetMenuStringA

• 0x4df65c GetMenuState

• 0x4df660 GetWindow

• 0x4df664 GetWindowRect

• 0x4df668 GetWindowPlacement

• 0x4df66c SystemParametersInfoA

• 0x4df670 IntersectRect

• 0x4df674 OffsetRect

• 0x4df678 SetWindowPos

• 0x4df67c SetWindowLongA

• 0x4df680 GetWindowLongA

• 0x4df684 GetMenu

• 0x4df688 CallWindowProcA

• 0x4df68c DefWindowProcA

• 0x4df690 GetDlgCtrlID

• 0x4df694 SetWindowPlacement

• 0x4df698 PtInRect

• 0x4df69c CopyRect

• 0x4df6a0 SetScrollInfo

• 0x4df6a4 GetScrollInfo

• 0x4df6a8 DeferWindowPos

• 0x4df6ac EqualRect

• 0x4df6b0 ScreenToClient

• 0x4df6b4 AdjustWindowRectEx

• 0x4df6b8 GetSysColor

• 0x4df6bc RegisterClassA

• 0x4df6c0 IsWindowVisible

• 0x4df6c4 UpdateWindow

• 0x4df6c8 PostMessageA

• 0x4df6cc MessageBoxA

• 0x4df6d0 CreateWindowExA

• 0x4df6d4 GetClassInfoExA

• 0x4df6d8 GetClassInfoA

Library GDI32.dll:

• 0x4ded74 EnumMetaFile

• 0x4ded78 PlayMetaFile

• 0x4ded7c CreatePen

• 0x4ded80 ExtCreatePen

• 0x4ded84 CreateSolidBrush

• 0x4ded88 CreateHatchBrush

• 0x4ded8c SetRectRgn

• 0x4ded90 CombineRgn

• 0x4ded94 GetMapMode

• 0x4ded98 GetObjectType

• 0x4ded9c GetTextMetricsA

• 0x4deda0 GetBkColor

• 0x4deda4 GetTextColor

• 0x4deda8 GetRgnBox

• 0x4dedac GetCharWidthA

• 0x4dedb0 CreateFontA

• 0x4dedb4 StretchDIBits

• 0x4dedb8 CreateCompatibleBitmap

• 0x4dedbc SelectPalette

• 0x4dedc0 PlayMetaFileRecord

• 0x4dedc4 GetStockObject

• 0x4dedc8 CreatePatternBrush

• 0x4dedcc CreateDIBPatternBrushPt

• 0x4dedd0 DeleteDC

• 0x4dedd4 ExtSelectClipRgn

• 0x4dedd8 PolyBezierTo

• 0x4deddc PolylineTo

• 0x4dede0 PolyDraw

• 0x4dede4 ArcTo

• 0x4dede8 GetCurrentPositionEx

• 0x4dedec CopyMetaFileA

• 0x4dedf0 DPtoLP

• 0x4dedf4 GetDeviceCaps

• 0x4dedf8 SetWindowExtEx

• 0x4dedfc OffsetWindowOrgEx

• 0x4dee00 SetWindowOrgEx

• 0x4dee04 ScaleViewportExtEx

• 0x4dee08 SetViewportExtEx

• 0x4dee0c OffsetViewportOrgEx

• 0x4dee10 SetViewportOrgEx

• 0x4dee14 SelectObject

• 0x4dee18 Escape

• 0x4dee1c TextOutA

• 0x4dee20 RectVisible

• 0x4dee24 PtVisible

• 0x4dee28 StartDocA

• 0x4dee2c GetPixel

• 0x4dee30 GetWindowExtEx

• 0x4dee34 GetViewportExtEx

• 0x4dee38 SelectClipPath

• 0x4dee3c CreateRectRgn

• 0x4dee40 GetClipRgn

• 0x4dee44 SelectClipRgn

• 0x4dee48 DeleteObject

• 0x4dee4c SetColorAdjustment

• 0x4dee50 SetArcDirection

• 0x4dee54 SetMapperFlags

• 0x4dee58 SetTextCharacterExtra

• 0x4dee5c SetTextJustification

• 0x4dee60 SetTextAlign

• 0x4dee64 MoveToEx

• 0x4dee68 LineTo

• 0x4dee6c OffsetClipRgn

• 0x4dee70 IntersectClipRect

• 0x4dee74 ExcludeClipRect

• 0x4dee78 SetMapMode

• 0x4dee7c ModifyWorldTransform

• 0x4dee80 SetWorldTransform

• 0x4dee84 SetGraphicsMode

• 0x4dee88 SetStretchBltMode

• 0x4dee8c SetROP2

• 0x4dee90 SetPolyFillMode

• 0x4dee94 SetBkMode

• 0x4dee98 RestoreDC

• 0x4dee9c SaveDC

• 0x4deea0 GetTextExtentPoint32A

• 0x4deea4 ExtTextOutA

• 0x4deea8 BitBlt

• 0x4deeac CreateCompatibleDC

• 0x4deeb0 CreateFontIndirectA

• 0x4deeb4 CreateBitmap

• 0x4deeb8 PatBlt

• 0x4deebc CreateRectRgnIndirect

• 0x4deec0 GetObjectA

• 0x4deec4 SetBkColor

• 0x4deec8 SetTextColor

• 0x4deecc GetClipBox

• 0x4deed0 GetDCOrgEx

• 0x4deed4 CreateDCA

• 0x4deed8 ScaleWindowExtEx

Library COMDLG32.dll:

• 0x4ded44 GetFileTitleA

Library WINSPOOL.DRV:

• 0x4df794 OpenPrinterA

• 0x4df798 DocumentPropertiesA

• 0x4df79c ClosePrinter

Library ADVAPI32.dll:

• 0x4dece0 RegSetValueExA

• 0x4dece4 RegCreateKeyA

• 0x4dece8 RegCreateKeyExA

• 0x4decec RegQueryValueA

• 0x4decf0 RegOpenKeyA

• 0x4decf4 RegEnumKeyA

• 0x4decf8 RegDeleteKeyA

• 0x4decfc RegOpenKeyExA

• 0x4ded00 RegQueryValueExA

• 0x4ded04 RegSetValueA

• 0x4ded08 RegCloseKey

• 0x4ded0c RegDeleteValueA

Library SHELL32.dll:

• 0x4df380 DragQueryFileA

• 0x4df384 DragFinish

• 0x4df388 ExtractIconA

• 0x4df38c SHGetSpecialFolderLocation

• 0x4df390 SHGetDesktopFolder

• 0x4df394 SHGetMalloc

• 0x4df398 SHGetFileInfoA

Library oledlg.dll:

• 0x4df8a0

Library ole32.dll:

• 0x4df7cc OleIsCurrentClipboard

• 0x4df7d0 OleSetClipboard

• 0x4df7d4 CoRevokeClassObject

• 0x4df7d8 CoRegisterClassObject

• 0x4df7dc OleInitialize

• 0x4df7e0 CoFreeUnusedLibraries

• 0x4df7e4 OleUninitialize

• 0x4df7e8 OleRun

• 0x4df7ec CoInitializeEx

• 0x4df7f0 CoUninitialize

• 0x4df7f4 CreateILockBytesOnHGlobal

• 0x4df7f8 StgCreateDocfileOnILockBytes

• 0x4df7fc StgOpenStorageOnILockBytes

• 0x4df800 CoGetClassObject

• 0x4df804 CoCreateInstance

• 0x4df808 OleFlushClipboard

• 0x4df80c StringFromGUID2

• 0x4df810 CLSIDFromString

• 0x4df814 CLSIDFromProgID

• 0x4df818 OleDuplicateData

• 0x4df81c CoTaskMemAlloc

• 0x4df820 ReleaseStgMedium

• 0x4df824 CreateBindCtx

• 0x4df828 CoTreatAsClass

• 0x4df82c StringFromCLSID

• 0x4df830 ReadClassStg

• 0x4df834 ReadFmtUserTypeStg

• 0x4df838 OleRegGetUserType

• 0x4df83c WriteClassStg

• 0x4df840 WriteFmtUserTypeStg

• 0x4df844 SetConvertStg

• 0x4df848 CoTaskMemFree

• 0x4df84c CoRegisterMessageFilter

• 0x4df850 CreateStreamOnHGlobal

• 0x4df854 CoDisconnectObject

Library OLEAUT32.dll:

• 0x4df28c SafeArrayAllocData

• 0x4df290 OleCreateFontIndirect

• 0x4df294 VarBstrFromDate

• 0x4df298 VarCyFromStr

• 0x4df29c VarDecFromStr

• 0x4df2a0 VarBstrFromDec

• 0x4df2a4 VarBstrFromCy

• 0x4df2a8 VarDateFromStr

• 0x4df2ac SysAllocStringLen

• 0x4df2b0 VariantClear

• 0x4df2b4 VariantChangeType

• 0x4df2b8 VariantInit

• 0x4df2bc SysStringLen

• 0x4df2c0 SysFreeString

• 0x4df2c4 SysAllocStringByteLen

• 0x4df2c8 SysStringByteLen

• 0x4df2cc RegisterTypeLib

• 0x4df2d0 LoadTypeLib

• 0x4df2d4 LoadRegTypeLib

• 0x4df2d8 SafeArrayUnaccessData

• 0x4df2dc SafeArrayAccessData

• 0x4df2e0 SafeArrayGetUBound

• 0x4df2e4 SafeArrayGetLBound

• 0x4df2e8 SafeArrayGetElemsize

• 0x4df2ec SafeArrayGetDim

• 0x4df2f0 SafeArrayCreate

• 0x4df2f4 SafeArrayRedim

• 0x4df2f8 VariantCopy

• 0x4df2fc SysReAllocStringLen

• 0x4df300 SafeArrayAllocDescriptor

• 0x4df304 SafeArrayCopy

• 0x4df308 SafeArrayGetElement

• 0x4df30c SafeArrayPtrOfIndex

• 0x4df310 SafeArrayPutElement

• 0x4df314 SafeArrayLock

• 0x4df318 SafeArrayUnlock

• 0x4df31c SafeArrayDestroy

• 0x4df320 SafeArrayDestroyData

• 0x4df324 SafeArrayDestroyDescriptor

• 0x4df328 VariantTimeToSystemTime

• 0x4df32c SystemTimeToVariantTime

• 0x4df330 SysAllocString

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	CNAME clients.l.google.com A 172.217.27.142	172.217.27.142
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	57874	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	65005	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.