SmartHawk

7.0

高危

43 个模型检测该样本为恶意！

重新分析

下载样本

221d40ec46ffe10e642d109ed79f2e1336032d0cfcc5bb245315041c8fd77546

acc92da952c1338499591e4fce432e36.exe

分析耗时

76s

最近分析

文件大小

432.1KB

静态报毒动态报毒 AI SCORE=89 AIDETECTVM BVLK CJSB CLOUD EMOTET GENERICKDZ GENETIC GENOME HCEJ HIGH CONFIDENCE HRYMJR IQWCW KRYPTIK MALWARE2 THHBDBO UNSAFE ZDFFE@0 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Emotet-FRV!ACC92DA952C1	20200824	6.0.6.653
Alibaba	Trojan:Win32/Emotet.9e816c6b	20190527	0.3.0.5
CrowdStrike		20190702	1.0
Tencent		20200824	1.0.0.1
Baidu		20190318	1.0.0.2
Kingsoft		20200824	2013.8.14.323

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619826896.327372 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (5 个事件)

Time & API	Arguments	Status	Return
1619826880.624372 CryptGenKey	crypto_handle: 0x005e4500 algorithm_identifier: 0x0000660e () provider_handle: 0x005e37e8 flags: 1 key: fA8=ø'u>îgdù	success	1
1619826896.343372 CryptExportKey	crypto_handle: 0x005e4500 crypto_export_handle: 0x005e44c0 buffer: f¤úG!U¼Û§«G!hDæ¶¸U¹fÀb·ÿ'ì6É9:@÷æÏDsGIbÕìë\D6¹9þT®`BVE$>ý0³R,ðuÿïÒNèÏ blob_type: 1 flags: 64	success	1
1619826932.327372 CryptExportKey	crypto_handle: 0x005e4500 crypto_export_handle: 0x005e44c0 buffer: f¤j{o 6äÏôt5dØ¦ wÐ$îþn +U1Õ"ÿîPbxå{p÷]zsÎýK]£v¬eÈ?gK=&ø°iõ*}Û±;êÙµHÓ>íûN¶=Ýr® PK blob_type: 1 flags: 64	success	1
1619826937.890372 CryptExportKey	crypto_handle: 0x005e4500 crypto_export_handle: 0x005e44c0 buffer: f¤%tû×McÂhúaôè0Qin®«¹ÍÂÚ76Ë®XÕÌÏ&ÒâÆ\|bB4 ØY~á&\|·J½À³¦[..\É\|ýçÛAJ]ÿz«¼ø95^"é blob_type: 1 flags: 64	success	1
1619826942.874372 CryptExportKey	crypto_handle: 0x005e4500 crypto_export_handle: 0x005e44c0 buffer: f¤ !óUcËjYq÷",è(Íäåq¼Ah +TgO=æ´ñ+Áõ¼Y;3ÎSJÇm=ND1lÁðÀÖ(¯xwKYGNnC:þø8*OKXt©k6JiF blob_type: 1 flags: 64	success	1

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619826879.858372 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00590000	success	0	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619826880.327372 Process32NextW	process_name: sdclt.exe snapshot_handle: 0x00000154 process_identifier: 2900	success	1	0
1619826880.327372 Process32NextW	process_name: dllhost.exe snapshot_handle: 0x00000154 process_identifier: 2864	success	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619826896.843372 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.4413135413711595

section

{'size_of_data': '0x00033000', 'virtual_address': '0x0003d000', 'entropy': 7.4413135413711595, 'name': '.rsrc', 'virtual_size': '0x00032430'}

description

A section with a high entropy has been found

entropy

0.4766355140186916

description

Overall entropy of this PE file is high

Expresses interest in specific running processes (1 个事件)

process

acc92da952c1338499591e4fce432e36.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619826896.499372 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (5 个事件)

host	162.249.220.190
host	172.217.24.14
host	178.128.14.92
host	181.113.229.139
host	85.25.207.108

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619826899.436372 RegSetValueExA	key_handle: 0x000003b8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619826899.436372 RegSetValueExA	key_handle: 0x000003b8 value: ßmZù=× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619826899.436372 RegSetValueExA	key_handle: 0x000003b8 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619826899.436372 RegSetValueExW	key_handle: 0x000003b8 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619826899.436372 RegSetValueExA	key_handle: 0x000003d0 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619826899.436372 RegSetValueExA	key_handle: 0x000003d0 value: ßmZù=× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619826899.436372 RegSetValueExA	key_handle: 0x000003d0 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619826899.452372 RegSetValueExW	key_handle: 0x000003b4 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

File has been identified by 43 AntiVirus engines on VirusTotal as malicious (43 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
DrWeb	Trojan.Emotet.1003
MicroWorld-eScan	Trojan.GenericKDZ.69660
FireEye	Trojan.GenericKDZ.69660
McAfee	Emotet-FRV!ACC92DA952C1
Cylance	Unsafe
K7AntiVirus	Trojan ( 005600f21 )
Alibaba	Trojan:Win32/Emotet.9e816c6b
K7GW	Trojan ( 005600f21 )
Arcabit	Trojan.Generic.D1101C
Cyren	W32/Trojan.BVLK-8441
Symantec	Trojan.Emotet
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Backdoor.Win32.Emotet.cjsb
BitDefender	Trojan.GenericKDZ.69660
NANO-Antivirus	Trojan.Win32.Emotet.hrymjr
AegisLab	Trojan.Win32.Emotet.L!c
Ad-Aware	Trojan.GenericKDZ.69660
Comodo	TrojWare.Win32.Genome.zdffe@0
F-Secure	Trojan.TR/AD.Emotet.iqwcw
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TrojanSpy.Win32.EMOTET.THHBDBO
Sophos	Troj/Emotet-CLQ
Avira	TR/AD.Emotet.iqwcw
MAX	malware (ai score=89)
Microsoft	Trojan:Win32/Emotet.ARJ!MTB
ViRobot	Trojan.Win32.Z.Emotet.442463.TC
ZoneAlarm	Backdoor.Win32.Emotet.cjsb
GData	Trojan.GenericKDZ.69660
AhnLab-V3	Trojan/Win32.Emotet.C4185422
ALYac	Trojan.GenericKDZ.69660
TACHYON	Banker/W32.Emotet.442463
Malwarebytes	Trojan.Emotet
ESET-NOD32	Win32/Emotet.CD
TrendMicro-HouseCall	TrojanSpy.Win32.EMOTET.THHBDBO
Rising	Trojan.Kryptik!8.8 (CLOUD)
Ikarus	Trojan-Banker.Emotet
Fortinet	W32/Kryptik.HCEJ!tr
AVG	Win32:Malware-gen
Panda	Trj/Genetic.gen
Qihoo-360	Win32/Backdoor.4e6

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (5 个事件)

dead_host	192.168.56.101:49181
dead_host	85.25.207.108:8080
dead_host	162.249.220.190:80
dead_host	192.168.56.101:49180
dead_host	178.128.14.92:8080

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-21 19:29:05

Imports

Library KERNEL32.dll:

• 0x42c178 GetStartupInfoA

• 0x42c17c GetCommandLineA

• 0x42c180 TerminateProcess

• 0x42c184 HeapFree

• 0x42c188 CreateThread

• 0x42c18c ExitThread

• 0x42c190 RaiseException

• 0x42c194 HeapReAlloc

• 0x42c198 HeapSize

• 0x42c19c GetACP

• 0x42c1a0 GetTimeZoneInformation

• 0x42c1a4 GetSystemTime

• 0x42c1a8 GetLocalTime

• 0x42c1ac LCMapStringA

• 0x42c1b0 LCMapStringW

• 0x42c1b4 FatalAppExitA

• 0x42c1b8 Sleep

• 0x42c1bc HeapDestroy

• 0x42c1c0 HeapCreate

• 0x42c1c4 VirtualFree

• 0x42c1c8 VirtualAlloc

• 0x42c1cc IsBadWritePtr

• 0x42c1d0 UnhandledExceptionFilter

• 0x42c1d4 FreeEnvironmentStringsA

• 0x42c1d8 FreeEnvironmentStringsW

• 0x42c1dc HeapAlloc

• 0x42c1e0 GetEnvironmentStringsW

• 0x42c1e4 SetHandleCount

• 0x42c1e8 GetStdHandle

• 0x42c1ec GetFileType

• 0x42c1f0 SetUnhandledExceptionFilter

• 0x42c1f4 GetStringTypeA

• 0x42c1f8 GetStringTypeW

• 0x42c1fc IsBadReadPtr

• 0x42c200 IsBadCodePtr

• 0x42c204 IsValidLocale

• 0x42c208 IsValidCodePage

• 0x42c20c GetLocaleInfoA

• 0x42c210 EnumSystemLocalesA

• 0x42c214 GetUserDefaultLCID

• 0x42c218 GetVersionExA

• 0x42c21c SetConsoleCtrlHandler

• 0x42c220 SetStdHandle

• 0x42c224 GetLocaleInfoW

• 0x42c228 CompareStringA

• 0x42c22c CompareStringW

• 0x42c230 SetEnvironmentVariableA

• 0x42c234 RtlUnwind

• 0x42c238 GetProfileStringA

• 0x42c23c InterlockedExchange

• 0x42c240 FileTimeToLocalFileTime

• 0x42c244 FileTimeToSystemTime

• 0x42c248 SetFileAttributesA

• 0x42c24c SetFileTime

• 0x42c250 SystemTimeToFileTime

• 0x42c254 LocalFileTimeToFileTime

• 0x42c258 GetFileTime

• 0x42c25c GetFileSize

• 0x42c260 GetFileAttributesA

• 0x42c264 GetShortPathNameA

• 0x42c268 GetThreadLocale

• 0x42c26c GetStringTypeExA

• 0x42c270 GetFullPathNameA

• 0x42c274 GetVolumeInformationA

• 0x42c278 FindFirstFileA

• 0x42c27c FindClose

• 0x42c280 DeleteFileA

• 0x42c284 MoveFileA

• 0x42c288 SetEndOfFile

• 0x42c28c UnlockFile

• 0x42c290 LockFile

• 0x42c294 FlushFileBuffers

• 0x42c298 SetFilePointer

• 0x42c29c WriteFile

• 0x42c2a0 ReadFile

• 0x42c2a4 CreateFileA

• 0x42c2a8 GetCurrentProcess

• 0x42c2ac DuplicateHandle

• 0x42c2b0 SetErrorMode

• 0x42c2b4 FormatMessageA

• 0x42c2b8 GetOEMCP

• 0x42c2bc GetCPInfo

• 0x42c2c0 SizeofResource

• 0x42c2c4 GetProcessVersion

• 0x42c2c8 GetLastError

• 0x42c2cc GetCurrentDirectoryA

• 0x42c2d0 WritePrivateProfileStringA

• 0x42c2d4 GetPrivateProfileStringA

• 0x42c2d8 GetPrivateProfileIntA

• 0x42c2dc GlobalFlags

• 0x42c2e0 TlsGetValue

• 0x42c2e4 LocalReAlloc

• 0x42c2e8 TlsSetValue

• 0x42c2ec EnterCriticalSection

• 0x42c2f0 GlobalReAlloc

• 0x42c2f4 LeaveCriticalSection

• 0x42c2f8 TlsFree

• 0x42c2fc GlobalHandle

• 0x42c300 DeleteCriticalSection

• 0x42c304 TlsAlloc

• 0x42c308 InitializeCriticalSection

• 0x42c30c LocalFree

• 0x42c310 LocalAlloc

• 0x42c314 lstrcpynA

• 0x42c318 MulDiv

• 0x42c31c ExitProcess

• 0x42c320 SetLastError

• 0x42c324 MultiByteToWideChar

• 0x42c328 WideCharToMultiByte

• 0x42c32c lstrlenA

• 0x42c330 InterlockedIncrement

• 0x42c334 InterlockedDecrement

• 0x42c338 LoadLibraryA

• 0x42c33c FreeLibrary

• 0x42c340 GetVersion

• 0x42c344 lstrcatA

• 0x42c348 GlobalGetAtomNameA

• 0x42c34c GlobalAddAtomA

• 0x42c350 GlobalFindAtomA

• 0x42c354 lstrcpyA

• 0x42c358 GetModuleHandleA

• 0x42c35c GetProcAddress

• 0x42c360 GlobalUnlock

• 0x42c364 GlobalFree

• 0x42c368 LockResource

• 0x42c36c FindResourceA

• 0x42c370 LoadResource

• 0x42c374 CreateEventA

• 0x42c378 SuspendThread

• 0x42c37c SetThreadPriority

• 0x42c380 ResumeThread

• 0x42c384 SetEvent

• 0x42c388 WaitForSingleObject

• 0x42c38c CloseHandle

• 0x42c390 GetModuleFileNameA

• 0x42c394 GlobalLock

• 0x42c398 GlobalAlloc

• 0x42c39c GlobalDeleteAtom

• 0x42c3a0 lstrcmpA

• 0x42c3a4 lstrcmpiA

• 0x42c3a8 GetCurrentThread

• 0x42c3ac GetCurrentThreadId

• 0x42c3b0 GetEnvironmentStrings

Library USER32.dll:

• 0x42c3c4 ScrollWindow

• 0x42c3c8 EndDeferWindowPos

• 0x42c3cc CopyRect

• 0x42c3d0 BeginDeferWindowPos

• 0x42c3d4 DeferWindowPos

• 0x42c3d8 ScreenToClient

• 0x42c3dc AdjustWindowRectEx

• 0x42c3e0 SetFocus

• 0x42c3e4 MapWindowPoints

• 0x42c3e8 SendDlgItemMessageA

• 0x42c3ec CheckDlgButton

• 0x42c3f0 CheckRadioButton

• 0x42c3f4 GetDlgItemInt

• 0x42c3f8 GetDlgItemTextA

• 0x42c3fc SetDlgItemInt

• 0x42c400 SetDlgItemTextA

• 0x42c404 IsDlgButtonChecked

• 0x42c408 ScrollWindowEx

• 0x42c40c IsDialogMessageA

• 0x42c410 SetWindowTextA

• 0x42c414 MoveWindow

• 0x42c418 wvsprintfA

• 0x42c41c CharToOemA

• 0x42c420 OemToCharA

• 0x42c424 LoadStringA

• 0x42c428 DestroyMenu

• 0x42c42c ClientToScreen

• 0x42c430 GetWindowDC

• 0x42c434 BeginPaint

• 0x42c438 EndPaint

• 0x42c43c TabbedTextOutA

• 0x42c440 DrawTextA

• 0x42c444 GrayStringA

• 0x42c448 InflateRect

• 0x42c44c GetClassNameA

• 0x42c450 GetDesktopWindow

• 0x42c454 InsertMenuA

• 0x42c458 DeleteMenu

• 0x42c45c GetMenuStringA

• 0x42c460 LoadCursorA

• 0x42c464 GetSysColorBrush

• 0x42c468 GetDialogBaseUnits

• 0x42c46c CharUpperA

• 0x42c470 GetScrollRange

• 0x42c474 SetScrollRange

• 0x42c478 GetScrollPos

• 0x42c47c SetScrollPos

• 0x42c480 GetTopWindow

• 0x42c484 IsChild

• 0x42c488 GetCapture

• 0x42c48c WinHelpA

• 0x42c490 wsprintfA

• 0x42c494 GetClassInfoA

• 0x42c498 RegisterClassA

• 0x42c49c GetMenu

• 0x42c4a0 GetMenuItemCount

• 0x42c4a4 GetMenuItemID

• 0x42c4a8 TrackPopupMenu

• 0x42c4ac SetWindowPlacement

• 0x42c4b0 GetWindowTextLengthA

• 0x42c4b4 GetWindowTextA

• 0x42c4b8 GetDlgCtrlID

• 0x42c4bc DefWindowProcA

• 0x42c4c0 CreateWindowExA

• 0x42c4c4 GetClassLongA

• 0x42c4c8 SetPropA

• 0x42c4cc UnhookWindowsHookEx

• 0x42c4d0 GetPropA

• 0x42c4d4 CallWindowProcA

• 0x42c4d8 GetScrollInfo

• 0x42c4dc GetMessageTime

• 0x42c4e0 GetMessagePos

• 0x42c4e4 GetForegroundWindow

• 0x42c4e8 SetForegroundWindow

• 0x42c4ec GetWindow

• 0x42c4f0 SetWindowLongA

• 0x42c4f4 SetWindowPos

• 0x42c4f8 RegisterWindowMessageA

• 0x42c4fc OffsetRect

• 0x42c500 IntersectRect

• 0x42c504 GetWindowPlacement

• 0x42c508 GetWindowRect

• 0x42c50c EndDialog

• 0x42c510 SetActiveWindow

• 0x42c514 IsWindow

• 0x42c518 CreateDialogIndirectParamA

• 0x42c51c DestroyWindow

• 0x42c520 GetDlgItem

• 0x42c524 GetMenuCheckMarkDimensions

• 0x42c528 GetMenuState

• 0x42c52c ModifyMenuA

• 0x42c530 SetMenuItemBitmaps

• 0x42c534 CheckMenuItem

• 0x42c538 EnableMenuItem

• 0x42c53c GetFocus

• 0x42c540 GetNextDlgTabItem

• 0x42c544 GetMessageA

• 0x42c548 TranslateMessage

• 0x42c54c DispatchMessageA

• 0x42c550 GetActiveWindow

• 0x42c554 GetKeyState

• 0x42c558 CallNextHookEx

• 0x42c55c ValidateRect

• 0x42c560 IsWindowVisible

• 0x42c564 PeekMessageA

• 0x42c568 GetCursorPos

• 0x42c56c SetWindowsHookExA

• 0x42c570 GetParent

• 0x42c574 GetLastActivePopup

• 0x42c578 IsWindowEnabled

• 0x42c57c GetWindowLongA

• 0x42c580 MessageBoxA

• 0x42c584 SetCursor

• 0x42c588 ShowOwnedPopups

• 0x42c58c PostMessageA

• 0x42c590 PostQuitMessage

• 0x42c594 LoadBitmapA

• 0x42c598 InvalidateRect

• 0x42c59c UpdateWindow

• 0x42c5a0 GetSysColor

• 0x42c5a4 EqualRect

• 0x42c5a8 IsRectEmpty

• 0x42c5ac GetDC

• 0x42c5b0 ReleaseDC

• 0x42c5b4 LoadIconA

• 0x42c5b8 UnregisterClassA

• 0x42c5bc HideCaret

• 0x42c5c0 ShowCaret

• 0x42c5c4 ExcludeUpdateRgn

• 0x42c5c8 DrawFocusRect

• 0x42c5cc DefDlgProcA

• 0x42c5d0 CharNextA

• 0x42c5d4 LoadImageA

• 0x42c5d8 EnableWindow

• 0x42c5dc LoadMenuA

• 0x42c5e0 PtInRect

• 0x42c5e4 GetSubMenu

• 0x42c5e8 IsIconic

• 0x42c5ec GetSystemMetrics

• 0x42c5f0 GetClientRect

• 0x42c5f4 DrawIcon

• 0x42c5f8 SetScrollInfo

• 0x42c5fc RemovePropA

• 0x42c600 ShowScrollBar

• 0x42c604 GetSystemMenu

• 0x42c608 AppendMenuA

• 0x42c60c SendMessageA

• 0x42c610 ShowWindow

• 0x42c614 IsWindowUnicode

• 0x42c618 SystemParametersInfoA

Library GDI32.dll:

• 0x42c02c DeleteDC

• 0x42c030 StartDocA

• 0x42c034 SaveDC

• 0x42c038 RestoreDC

• 0x42c03c SelectObject

• 0x42c040 GetStockObject

• 0x42c044 SelectPalette

• 0x42c048 SetBkMode

• 0x42c04c SetPolyFillMode

• 0x42c050 SetROP2

• 0x42c054 SetStretchBltMode

• 0x42c058 SetMapMode

• 0x42c05c SetViewportOrgEx

• 0x42c060 OffsetViewportOrgEx

• 0x42c064 SetViewportExtEx

• 0x42c068 ScaleViewportExtEx

• 0x42c06c SetWindowOrgEx

• 0x42c070 OffsetWindowOrgEx

• 0x42c074 SetWindowExtEx

• 0x42c078 ScaleWindowExtEx

• 0x42c07c SelectClipRgn

• 0x42c080 ExcludeClipRect

• 0x42c084 IntersectClipRect

• 0x42c088 OffsetClipRgn

• 0x42c08c MoveToEx

• 0x42c090 LineTo

• 0x42c094 SetTextAlign

• 0x42c098 SetTextJustification

• 0x42c09c SetTextCharacterExtra

• 0x42c0a0 SetMapperFlags

• 0x42c0a4 GetCurrentPositionEx

• 0x42c0a8 ArcTo

• 0x42c0ac SetArcDirection

• 0x42c0b0 PolyDraw

• 0x42c0b4 SetBkColor

• 0x42c0b8 SetColorAdjustment

• 0x42c0bc PolyBezierTo

• 0x42c0c0 DeleteObject

• 0x42c0c4 GetClipRgn

• 0x42c0c8 CreateRectRgn

• 0x42c0cc SelectClipPath

• 0x42c0d0 ExtSelectClipRgn

• 0x42c0d4 PlayMetaFileRecord

• 0x42c0d8 GetObjectType

• 0x42c0dc EnumMetaFile

• 0x42c0e0 PlayMetaFile

• 0x42c0e4 GetDeviceCaps

• 0x42c0e8 GetViewportExtEx

• 0x42c0ec GetWindowExtEx

• 0x42c0f0 CreatePen

• 0x42c0f4 ExtCreatePen

• 0x42c0f8 CreateSolidBrush

• 0x42c0fc CreateHatchBrush

• 0x42c100 CreatePatternBrush

• 0x42c104 CreateDIBPatternBrushPt

• 0x42c108 PtVisible

• 0x42c10c RectVisible

• 0x42c110 TextOutA

• 0x42c114 ExtTextOutA

• 0x42c118 Escape

• 0x42c11c GetMapMode

• 0x42c120 PatBlt

• 0x42c124 SetRectRgn

• 0x42c128 CombineRgn

• 0x42c12c CreateRectRgnIndirect

• 0x42c130 CreateFontIndirectA

• 0x42c134 DPtoLP

• 0x42c138 GetTextExtentPoint32A

• 0x42c13c GetTextMetricsA

• 0x42c140 SetTextColor

• 0x42c144 GetClipBox

• 0x42c148 GetDCOrgEx

• 0x42c14c CreateBitmap

• 0x42c150 StretchBlt

• 0x42c154 CreateCompatibleDC

• 0x42c158 BitBlt

• 0x42c15c GetObjectA

• 0x42c160 CreateCompatibleBitmap

• 0x42c164 PolylineTo

• 0x42c168 CreateDIBitmap

• 0x42c16c GetTextExtentPointA

• 0x42c170 SetBitmapBits

Library comdlg32.dll:

• 0x42c630 GetOpenFileNameA

• 0x42c634 GetSaveFileNameA

• 0x42c638 GetFileTitleA

Library WINSPOOL.DRV:

• 0x42c620 OpenPrinterA

• 0x42c624 DocumentPropertiesA

• 0x42c628 ClosePrinter

Library ADVAPI32.dll:

• 0x42c000 RegSetValueExA

• 0x42c004 RegOpenKeyA

• 0x42c008 RegDeleteKeyA

• 0x42c00c RegDeleteValueA

• 0x42c010 RegCloseKey

• 0x42c014 RegQueryValueExA

• 0x42c018 RegOpenKeyExA

• 0x42c01c RegCreateKeyExA

Library SHELL32.dll:

• 0x42c3b8 DragAcceptFiles

• 0x42c3bc SHGetFileInfoA

Library COMCTL32.dll:

• 0x42c024

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.