SmartHawk

1.2

低危

该样本未表现出任何异常！

重新分析

下载样本

1d96495169c7795fcf3023bb1416e2a7601cf533b051c7f9d1446a748c3bb8cc

b1f841882a5cfc238c9f177d11d6546f.exe

分析耗时

73s

查杀引擎	查杀时间	查杀版本
McAfee	20210202	6.0.6.653
CrowdStrike	20190702	1.0
Avast	20210202	21.1.5827.0
Alibaba	20190527	0.3.0.5
Baidu	20190318	1.0.0.2
Kingsoft	20210207	2017.9.26.565
Tencent	20210202	1.0.0.1

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2019-10-08 02:25:56

Imports

Library encoding-conversion.dll:

• 0x4f3968 _SLConvertUTF8ToUTF16@16

• 0x4f396c _SLConvertACPToUnicode@16

• 0x4f3970 _SLConvertUnicodeToACP@16

• 0x4f3974 _SLConvertUTF16ToUTF8@16

Library USER32.dll:

• 0x4f369c PostThreadMessageW

• 0x4f36a0 DispatchMessageW

• 0x4f36a4 TranslateMessage

• 0x4f36a8 GetMessageW

• 0x4f36ac LoadCursorW

• 0x4f36b0 SetWindowLongW

• 0x4f36b4 DestroyWindow

• 0x4f36b8 CreateWindowExW

• 0x4f36bc GetClassInfoExW

• 0x4f36c0 RegisterClassExW

• 0x4f36c4 UnregisterClassW

• 0x4f36c8 CallWindowProcW

• 0x4f36cc DefWindowProcW

• 0x4f36d0 PostMessageW

• 0x4f36d4 MessageBoxW

• 0x4f36d8 GetWindowLongW

• 0x4f36dc CharUpperW

• 0x4f36e0 RegisterWindowMessageW

• 0x4f36e4 wsprintfW

• 0x4f36e8 LoadStringW

• 0x4f36ec CharNextW

Library WTSAPI32.dll:

• 0x4f3780 WTSEnumerateSessionsW

• 0x4f3784 WTSQueryUserToken

Library KERNEL32.dll:

• 0x4f30d0 GetProcessHeap

• 0x4f30d4 LocalAlloc

• 0x4f30d8 WideCharToMultiByte

• 0x4f30dc DecodePointer

• 0x4f30e0 GetCommandLineW

• 0x4f30e4 WaitForSingleObject

• 0x4f30e8 CreateEventW

• 0x4f30ec CreateThread

• 0x4f30f0 OpenEventA

• 0x4f30f4 ResetEvent

• 0x4f30f8 GetCurrentProcessId

• 0x4f30fc HeapSize

• 0x4f3100 OpenProcess

• 0x4f3104 CreateToolhelp32Snapshot

• 0x4f3108 Process32FirstW

• 0x4f310c Process32NextW

• 0x4f3110 CreateProcessW

• 0x4f3114 CreateFileW

• 0x4f3118 FormatMessageA

• 0x4f311c GetCurrentProcess

• 0x4f3120 HeapReAlloc

• 0x4f3124 HeapAlloc

• 0x4f3128 HeapDestroy

• 0x4f312c SetLastError

• 0x4f3130 MultiByteToWideChar

• 0x4f3134 lstrcmpiW

• 0x4f3138 LoadLibraryW

• 0x4f313c FindResourceW

• 0x4f3140 SizeofResource

• 0x4f3144 LoadResource

• 0x4f3148 LoadLibraryExW

• 0x4f314c GetProcAddress

• 0x4f3150 GetModuleHandleW

• 0x4f3154 GetModuleFileNameW

• 0x4f3158 FreeLibrary

• 0x4f315c GetCurrentThreadId

• 0x4f3160 CreateEventA

• 0x4f3164 WaitForSingleObjectEx

• 0x4f3168 SetEvent

• 0x4f316c DeleteCriticalSection

• 0x4f3170 InitializeCriticalSectionEx

• 0x4f3174 LeaveCriticalSection

• 0x4f3178 EnterCriticalSection

• 0x4f317c GetLastError

• 0x4f3180 RaiseException

• 0x4f3184 CloseHandle

• 0x4f3188 FormatMessageW

• 0x4f318c LocalFree

• 0x4f3190 Sleep

• 0x4f3194 DeviceIoControl

• 0x4f3198 AreFileApisANSI

• 0x4f319c UnhandledExceptionFilter

• 0x4f31a0 SetUnhandledExceptionFilter

• 0x4f31a4 TerminateProcess

• 0x4f31a8 InitializeCriticalSectionAndSpinCount

• 0x4f31ac GetStartupInfoW

• 0x4f31b0 GetSystemTimeAsFileTime

• 0x4f31b4 LoadLibraryA

• 0x4f31b8 GetStringTypeExW

• 0x4f31bc LCMapStringW

• 0x4f31c0 GetUserDefaultLCID

• 0x4f31c4 TlsFree

• 0x4f31c8 TlsSetValue

• 0x4f31cc TlsGetValue

• 0x4f31d0 TlsAlloc

• 0x4f31d4 ReleaseSemaphore

• 0x4f31d8 QueryPerformanceCounter

• 0x4f31dc LoadLibraryExA

• 0x4f31e0 VirtualFree

• 0x4f31e4 VirtualAlloc

• 0x4f31e8 IsProcessorFeaturePresent

• 0x4f31ec FlushInstructionCache

• 0x4f31f0 InterlockedPushEntrySList

• 0x4f31f4 InterlockedPopEntrySList

• 0x4f31f8 InitializeSListHead

• 0x4f31fc EncodePointer

• 0x4f3200 OutputDebugStringW

• 0x4f3204 IsDebuggerPresent

• 0x4f3208 SystemTimeToFileTime

• 0x4f320c GetCurrentDirectoryW

• 0x4f3210 LocalFileTimeToFileTime

• 0x4f3214 GetFileAttributesW

• 0x4f3218 SetFilePointer

• 0x4f321c SetFileTime

• 0x4f3220 WriteFile

• 0x4f3224 ReadFile

• 0x4f3228 CreateDirectoryW

• 0x4f322c FileTimeToSystemTime

• 0x4f3230 GetSystemTime

• 0x4f3234 IsWow64Process

• 0x4f3238 FindClose

• 0x4f323c GetWindowsDirectoryW

• 0x4f3240 GetFileAttributesExW

• 0x4f3244 ProcessIdToSessionId

• 0x4f3248 FindNextFileW

• 0x4f324c DeleteFileW

• 0x4f3250 K32GetModuleFileNameExW

• 0x4f3254 FindFirstFileW

• 0x4f3258 RemoveDirectoryW

• 0x4f325c HeapFree

• 0x4f3260 GlobalFree

Library ADVAPI32.dll:

• 0x4f3000 AddAce

• 0x4f3004 SetNamedSecurityInfoW

• 0x4f3008 GetSidLengthRequired

• 0x4f300c InitializeSid

• 0x4f3010 GetSidSubAuthority

• 0x4f3014 GetAclInformation

• 0x4f3018 GetAce

• 0x4f301c GetNamedSecurityInfoW

• 0x4f3020 RegCreateKeyExW

• 0x4f3024 RegDeleteKeyW

• 0x4f3028 IsValidSid

• 0x4f302c CopySid

• 0x4f3030 RevertToSelf

• 0x4f3034 ImpersonateLoggedOnUser

• 0x4f3038 CryptReleaseContext

• 0x4f303c CryptGenRandom

• 0x4f3040 CryptAcquireContextW

• 0x4f3044 InitializeAcl

• 0x4f3048 GetLengthSid

• 0x4f304c LookupPrivilegeValueW

• 0x4f3050 LookupAccountSidW

• 0x4f3054 RegCloseKey

• 0x4f3058 AdjustTokenPrivileges

• 0x4f305c CreateProcessAsUserW

• 0x4f3060 ConvertSidToStringSidW

• 0x4f3064 GetTokenInformation

• 0x4f3068 DuplicateTokenEx

• 0x4f306c OpenProcessToken

• 0x4f3070 StartServiceCtrlDispatcherW

• 0x4f3074 SetServiceStatus

• 0x4f3078 RegisterServiceCtrlHandlerW

• 0x4f307c OpenServiceW

• 0x4f3080 OpenSCManagerW

• 0x4f3084 DeleteService

• 0x4f3088 CreateServiceW

• 0x4f308c ControlService

• 0x4f3090 CloseServiceHandle

• 0x4f3094 RegQueryValueExW

• 0x4f3098 ReportEventW

• 0x4f309c RegisterEventSourceW

• 0x4f30a0 DeregisterEventSource

• 0x4f30a4 GetSecurityDescriptorLength

• 0x4f30a8 RegSetValueExW

• 0x4f30ac RegQueryInfoKeyW

• 0x4f30b0 RegOpenKeyExW

• 0x4f30b4 RegEnumKeyExW

• 0x4f30b8 RegDeleteValueW

Library ole32.dll:

• 0x4f39b0 CoInitialize

• 0x4f39b4 CoSetProxyBlanket

• 0x4f39b8 StringFromGUID2

• 0x4f39bc CoInitializeSecurity

• 0x4f39c0 CoReleaseServerProcess

• 0x4f39c4 CoAddRefServerProcess

• 0x4f39c8 CoResumeClassObjects

• 0x4f39cc CoRevokeClassObject

• 0x4f39d0 CoRegisterClassObject

• 0x4f39d4 CoInitializeEx

• 0x4f39d8 CoUninitialize

• 0x4f39dc OleRun

• 0x4f39e0 CoCreateInstance

• 0x4f39e4 CoTaskMemFree

• 0x4f39e8 CoTaskMemRealloc

• 0x4f39ec CoTaskMemAlloc

• 0x4f39f0 ProgIDFromCLSID

Library OLEAUT32.dll:

• 0x4f364c GetErrorInfo

• 0x4f3650 VariantCopy

• 0x4f3654 SysAllocStringLen

• 0x4f3658 VariantClear

• 0x4f365c VariantInit

• 0x4f3660 UnRegisterTypeLib

• 0x4f3664 RegisterTypeLib

• 0x4f3668 SysAllocString

• 0x4f366c CreateErrorInfo

• 0x4f3670 SetErrorInfo

• 0x4f3674 LoadRegTypeLib

• 0x4f3678 LoadTypeLib

• 0x4f367c VarUI4FromStr

• 0x4f3680 SafeArrayUnaccessData

• 0x4f3684 SafeArrayAccessData

• 0x4f3688 SysStringLen

• 0x4f368c SysFreeString

Library atom.dll:

• 0x4f3940 _CreateSingletonStaticData@16

• 0x4f3944 _CleanupSingletonStaticDataStorage@0

• 0x4f3948 _GetSingletonStaticData@12

• 0x4f394c _SLGetStringFromAtom@8

• 0x4f3950 _SLGetAtomFromString@8

• 0x4f3954 _IsSingletonStaticDataStorageAvailable@0

Library root-service-provider.dll:

• 0x4f39f8 _ServiceProviderCleanup@0

• 0x4f39fc _ServiceProviderGetServiceObject@12

• 0x4f3a00 _ServiceProviderSetModulesRootDirectory@16

Library SHLWAPI.dll:

• 0x4f3694 PathFileExistsW

Library MSVCP140.dll:

• 0x4f3268 ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z

• 0x4f326c ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ

• 0x4f3270 ?is@?$ctype@_W@std@@QBE_NF_W@Z

• 0x4f3274 ?widen@?$ctype@_W@std@@QBE_WD@Z

• 0x4f3278 ?narrow@?$ctype@_W@std@@QBED_WD@Z

• 0x4f327c ?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z

• 0x4f3280 ?exceptions@ios_base@std@@QAEXH@Z

• 0x4f3284 ?getloc@ios_base@std@@QBE?AVlocale@2@XZ

• 0x4f3288 ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ

• 0x4f328c ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ

• 0x4f3290 ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z

• 0x4f3294 ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z

• 0x4f3298 ?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ

• 0x4f329c ?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ

• 0x4f32a0 ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ

• 0x4f32a4 ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ

• 0x4f32a8 ?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z

• 0x4f32ac ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z

• 0x4f32b0 ?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z

• 0x4f32b4 ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z

• 0x4f32b8 ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ

• 0x4f32bc ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z

• 0x4f32c0 ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ

• 0x4f32c4 ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ

• 0x4f32c8 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z

• 0x4f32cc ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z

• 0x4f32d0 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z

• 0x4f32d4 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z

• 0x4f32d8 ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ

• 0x4f32dc ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z

• 0x4f32e0 ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ

• 0x4f32e4 ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ

• 0x4f32e8 ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ

• 0x4f32ec ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z

• 0x4f32f0 ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z

• 0x4f32f4 ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ

• 0x4f32f8 ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ

• 0x4f32fc ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ

• 0x4f3300 ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z

• 0x4f3304 ?_Xout_of_range@std@@YAXPBD@Z

• 0x4f3308 ?_BADOFF@std@@3_JB

• 0x4f330c ?id@?$ctype@_W@std@@2V0locale@2@A

• 0x4f3310 ?_Xbad_function_call@std@@YAXXZ

• 0x4f3314 ?_Xbad_alloc@std@@YAXXZ

• 0x4f3318 ?_Xinvalid_argument@std@@YAXPBD@Z

• 0x4f331c _Wcscoll

• 0x4f3320 _Wcsxfrm

• 0x4f3324 ??0_Locinfo@std@@QAE@PBD@Z

• 0x4f3328 ??1_Locinfo@std@@QAE@XZ

• 0x4f332c ?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ

• 0x4f3330 ?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ

• 0x4f3334 ?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ

• 0x4f3338 ?_Getfalse@_Locinfo@std@@QBEPBDXZ

• 0x4f333c ?_Gettrue@_Locinfo@std@@QBEPBDXZ

• 0x4f3340 ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z

• 0x4f3344 ?c_str@?$_Yarn@D@std@@QBEPBDXZ

• 0x4f3348 ??0facet@locale@std@@IAE@I@Z

• 0x4f334c ??1facet@locale@std@@MAE@XZ

• 0x4f3350 ?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z

• 0x4f3354 ?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z

• 0x4f3358 ?classic@locale@std@@SAABV12@XZ

• 0x4f335c ?tolower@?$ctype@D@std@@QBEDD@Z

• 0x4f3360 ?widen@?$ctype@D@std@@QBEDD@Z

• 0x4f3364 ?narrow@?$ctype@D@std@@QBEDDD@Z

• 0x4f3368 ?_Xlength_error@std@@YAXPBD@Z

• 0x4f336c ?tolower@?$ctype@_W@std@@QBE_W_W@Z

• 0x4f3370 ?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z

• 0x4f3374 ?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z

• 0x4f3378 ?_Syserror_map@std@@YAPBDH@Z

• 0x4f337c ?imbue@ios_base@std@@QAE?AVlocale@2@ABV32@@Z

• 0x4f3380 ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ

• 0x4f3384 ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ

• 0x4f3388 ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ

• 0x4f338c ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ

• 0x4f3390 ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z

• 0x4f3394 ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z

• 0x4f3398 ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ

• 0x4f339c ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ

• 0x4f33a0 ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ

• 0x4f33a4 ?_Getcat@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z

• 0x4f33a8 ??1?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MAE@XZ

• 0x4f33ac ??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z

• 0x4f33b0 ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ

• 0x4f33b4 ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z

• 0x4f33b8 ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z

• 0x4f33bc ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z

• 0x4f33c0 ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z

• 0x4f33c4 ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z

• 0x4f33c8 ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ

• 0x4f33cc ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

• 0x4f33d0 ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ

• 0x4f33d4 ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ

• 0x4f33d8 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z

• 0x4f33dc ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ

• 0x4f33e0 ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

• 0x4f33e4 ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ

• 0x4f33e8 ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z

• 0x4f33ec ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z

• 0x4f33f0 ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ

• 0x4f33f4 ?putback@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z

• 0x4f33f8 ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@PBD3@Z

• 0x4f33fc ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z

• 0x4f3400 ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z

• 0x4f3404 ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z

• 0x4f3408 ?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ

• 0x4f340c ?_Incref@facet@locale@std@@UAEXXZ

• 0x4f3410 ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ

• 0x4f3414 ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ

• 0x4f3418 ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAG@Z

• 0x4f341c ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAI@Z

• 0x4f3420 ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z

• 0x4f3424 ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAK@Z

• 0x4f3428 ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAM@Z

• 0x4f342c ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAN@Z

• 0x4f3430 ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAO@Z

• 0x4f3434 ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z

• 0x4f3438 ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z

• 0x4f343c ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z

• 0x4f3440 ?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z

• 0x4f3444 ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z

• 0x4f3448 ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z

• 0x4f344c ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ

• 0x4f3450 ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ

• 0x4f3454 ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ

• 0x4f3458 ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z

• 0x4f345c ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z

• 0x4f3460 ?id@?$ctype@D@std@@2V0locale@2@A

• 0x4f3464 ?id@?$numpunct@D@std@@2V0locale@2@A

• 0x4f3468 ?id@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A

• 0x4f346c ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A

• 0x4f3470 ?id@?$collate@_W@std@@2V0locale@2@A

• 0x4f3474 _Mbrtowc

• 0x4f3478 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z

• 0x4f347c ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z

• 0x4f3480 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z

• 0x4f3484 _Lock_shared_ptr_spin_lock

• 0x4f3488 _Unlock_shared_ptr_spin_lock

• 0x4f348c _Thrd_start

• 0x4f3490 _Xtime_get_ticks

• 0x4f3494 _Thrd_join

• 0x4f3498 _Thrd_id

• 0x4f349c _Mtx_init

• 0x4f34a0 _Mtx_destroy

• 0x4f34a4 _Mtx_init_in_situ

• 0x4f34a8 _Mtx_destroy_in_situ

• 0x4f34ac _Mtx_current_owns

• 0x4f34b0 _Mtx_lock

• 0x4f34b4 _Mtx_unlock

• 0x4f34b8 _Cnd_init

• 0x4f34bc _Cnd_destroy

• 0x4f34c0 _Cnd_init_in_situ

• 0x4f34c4 _Cnd_destroy_in_situ

• 0x4f34c8 _Cnd_wait

• 0x4f34cc _Cnd_timedwait

• 0x4f34d0 _Cnd_broadcast

• 0x4f34d4 _Cnd_signal

• 0x4f34d8 _Cnd_do_broadcast_at_thread_exit

• 0x4f34dc ?_Throw_C_error@std@@YAXH@Z

• 0x4f34e0 ?_Throw_Cpp_error@std@@YAXH@Z

• 0x4f34e4 ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z

• 0x4f34e8 ?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z

• 0x4f34ec ??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z

• 0x4f34f0 ??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ

• 0x4f34f4 ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z

• 0x4f34f8 ?uncaught_exception@std@@YA_NXZ

• 0x4f34fc ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PAV32@@Z

• 0x4f3500 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z

• 0x4f3504 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z

• 0x4f3508 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z

• 0x4f350c ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z

• 0x4f3510 ?toupper@?$ctype@_W@std@@QBE_W_W@Z

• 0x4f3514 ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z

• 0x4f3518 ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ

• 0x4f351c ?toupper@?$ctype@D@std@@QBEDD@Z

• 0x4f3520 _Cnd_register_at_thread_exit

• 0x4f3524 _Cnd_unregister_at_thread_exit

• 0x4f3528 ?_Release_chore@details@Concurrency@@YAXPAU_Threadpool_chore@12@@Z

• 0x4f352c ?_Schedule_chore@details@Concurrency@@YAHPAU_Threadpool_chore@12@@Z

• 0x4f3530 ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ

• 0x4f3534 ?_Capture@_ContextCallback@details@Concurrency@@AAEXXZ

• 0x4f3538 ?_Reset@_ContextCallback@details@Concurrency@@AAEXXZ

• 0x4f353c ?_CallInContext@_ContextCallback@details@Concurrency@@QBEXV?$function@$$A6AXXZ@std@@_N@Z

• 0x4f3540 ?__ExceptionPtrCopy@@YAXPAXPBX@Z

• 0x4f3544 ?__ExceptionPtrDestroy@@YAXPAX@Z

• 0x4f3548 ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AAEXXZ

• 0x4f354c ?_ReportUnobservedException@details@Concurrency@@YAXXZ

• 0x4f3550 ?__ExceptionPtrRethrow@@YAXPBX@Z

• 0x4f3554 ??0task_continuation_context@Concurrency@@AAE@XZ

• 0x4f3558 ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QAEXXZ

• 0x4f355c ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ

• 0x4f3560 ?__ExceptionPtrCurrentException@@YAXPAX@Z

• 0x4f3564 ?__ExceptionPtrCreate@@YAXPAX@Z

• 0x4f3568 ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QAEX_N@Z

• 0x4f356c ?_Throw_future_error@std@@YAXABVerror_code@1@@Z

• 0x4f3570 ?__ExceptionPtrToBool@@YA_NPBX@Z

• 0x4f3574 ?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z

• 0x4f3578 ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QAEXXZ

• 0x4f357c ?__ExceptionPtrAssign@@YAXPAXPBX@Z

• 0x4f3580 ?_XGetLastError@std@@YAXXZ

• 0x4f3584 ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ

• 0x4f3588 ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ

• 0x4f358c ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z

• 0x4f3590 ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UAE@XZ

• 0x4f3594 ?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z

• 0x4f3598 ?always_noconv@codecvt_base@std@@QBE_NXZ

• 0x4f359c ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z

• 0x4f35a0 ?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z

• 0x4f35a4 ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z

• 0x4f35a8 ?id@?$numpunct@_W@std@@2V0locale@2@A

• 0x4f35ac ??_D?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ

• 0x4f35b0 ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z

• 0x4f35b4 ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ

• 0x4f35b8 ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ

• 0x4f35bc ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z

• 0x4f35c0 ?getline@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_W_J@Z

• 0x4f35c4 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z

• 0x4f35c8 ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ

• 0x4f35cc ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A

• 0x4f35d0 ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z

• 0x4f35d4 ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z

• 0x4f35d8 ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ

• 0x4f35dc ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ

• 0x4f35e0 ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ

• 0x4f35e4 ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z

• 0x4f35e8 ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z

• 0x4f35ec ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z

• 0x4f35f0 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z

• 0x4f35f4 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z

• 0x4f35f8 ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AA_N@Z

• 0x4f35fc ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAI@Z

• 0x4f3600 ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_N@Z

• 0x4f3604 ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z

• 0x4f3608 ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ

• 0x4f360c ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_N@Z

• 0x4f3610 ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z

• 0x4f3614 ?readsome@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_JPAD_J@Z

• 0x4f3618 ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z

• 0x4f361c ??1_Lockit@std@@QAE@XZ

• 0x4f3620 ??0_Lockit@std@@QAE@H@Z

• 0x4f3624 ??Bid@locale@std@@QAEIXZ

• 0x4f3628 ?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z

• 0x4f362c ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z

• 0x4f3630 ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A

• 0x4f3634 ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z

• 0x4f3638 ?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PB_W_J@Z

Library USERENV.dll:

• 0x4f36f4 CreateEnvironmentBlock

• 0x4f36f8 LoadUserProfileW

• 0x4f36fc UnloadUserProfile

• 0x4f3700 DestroyEnvironmentBlock

Library VCRUNTIME140.dll:

• 0x4f3708 _except_handler4_common

• 0x4f370c wcschr

• 0x4f3710 __std_type_info_name

• 0x4f3714 _purecall

• 0x4f3718 __std_terminate

• 0x4f371c __std_exception_copy

• 0x4f3720 __std_exception_destroy

• 0x4f3724 __std_type_info_compare

• 0x4f3728 _CxxThrowException

• 0x4f372c __CxxFrameHandler3

• 0x4f3730 memcpy

• 0x4f3734 memmove

• 0x4f3738 memset

• 0x4f373c wcsstr

• 0x4f3740 strchr

• 0x4f3744 memchr

Library api-ms-win-crt-runtime-l1-1-0.dll:

• 0x4f3808 _initterm_e

• 0x4f380c _initialize_wide_environment

• 0x4f3810 _get_wide_winmain_command_line

• 0x4f3814 _configure_wide_argv

• 0x4f3818 _set_app_type

• 0x4f381c _seh_filter_exe

• 0x4f3820 _get_errno

• 0x4f3824 _set_errno

• 0x4f3828 _invalid_parameter_noinfo_noreturn

• 0x4f382c _invalid_parameter_noinfo

• 0x4f3830 _errno

• 0x4f3834 _cexit

• 0x4f3838 _resetstkoflw

• 0x4f383c strerror

• 0x4f3840 _crt_atexit

• 0x4f3844 _wassert

• 0x4f3848 _controlfp_s

• 0x4f384c _register_onexit_function

• 0x4f3850 _register_thread_local_exe_atexit_callback

• 0x4f3854 _c_exit

• 0x4f3858 _initialize_onexit_table

• 0x4f385c _exit

• 0x4f3860 abort

• 0x4f3864 exit

• 0x4f3868 terminate

• 0x4f386c _initterm

Library api-ms-win-crt-string-l1-1-0.dll:

• 0x4f38e0 wcscat_s

• 0x4f38e4 iswprint

• 0x4f38e8 _wcsnicmp

• 0x4f38ec iswspace

• 0x4f38f0 strnlen

• 0x4f38f4 ispunct

• 0x4f38f8 wcscpy_s

• 0x4f38fc wcsncpy_s

• 0x4f3900 strncpy

• 0x4f3904 wmemcpy_s

• 0x4f3908 wcsnlen

• 0x4f390c wcsncmp

• 0x4f3910 _wcsicmp

• 0x4f3914 strncmp

• 0x4f3918 tolower

• 0x4f391c isspace

• 0x4f3920 isdigit

• 0x4f3924 _strlwr_s

Library api-ms-win-crt-heap-l1-1-0.dll:

• 0x4f37c8 _recalloc

• 0x4f37cc malloc

• 0x4f37d0 realloc

• 0x4f37d4 _callnewh

• 0x4f37d8 _msize

• 0x4f37dc _set_new_mode

• 0x4f37e0 calloc

• 0x4f37e4 free

Library api-ms-win-crt-stdio-l1-1-0.dll:

• 0x4f3874 ungetwc

• 0x4f3878 _set_fmode

• 0x4f387c __p__commode

• 0x4f3880 __stdio_common_vswprintf_s

• 0x4f3884 fputwc

• 0x4f3888 ungetc

• 0x4f388c fflush

• 0x4f3890 setvbuf

• 0x4f3894 fclose

• 0x4f3898 fgetwc

• 0x4f389c fgetc

• 0x4f38a0 _get_stream_buffer_pointers

• 0x4f38a4 __stdio_common_vsprintf

• 0x4f38a8 __stdio_common_vswprintf

• 0x4f38ac __stdio_common_vsprintf_s

• 0x4f38b0 fwrite

• 0x4f38b4 fgetpos

• 0x4f38b8 _fseeki64

• 0x4f38bc _ftelli64

• 0x4f38c0 fread

• 0x4f38c4 __stdio_common_vsnwprintf_s

• 0x4f38c8 _putws

• 0x4f38cc ferror

• 0x4f38d0 fsetpos

• 0x4f38d4 _wfopen

• 0x4f38d8 fputc

Library api-ms-win-crt-convert-l1-1-0.dll:

• 0x4f378c strtol

• 0x4f3790 strtoll

• 0x4f3794 _ui64toa_s

• 0x4f3798 _i64toa_s

• 0x4f379c wcstod

• 0x4f37a0 _itoa_s

• 0x4f37a4 _wcstoui64

• 0x4f37a8 _gcvt_s

• 0x4f37ac _wtoi

• 0x4f37b0 _wcstoi64

• 0x4f37b4 _ultoa_s

Library api-ms-win-crt-time-l1-1-0.dll:

• 0x4f392c _time64

• 0x4f3930 _gmtime64

• 0x4f3934 _difftime64

• 0x4f3938 _gmtime64_s

Library api-ms-win-crt-math-l1-1-0.dll:

• 0x4f37f4 __setusermatherr

• 0x4f37f8 _fpclass

• 0x4f37fc _libm_sse2_pow_precise

• 0x4f3800 _except1

Exports

Ordinal	Address	Name
1	0x4581d0	??0?$oserializer@Vxml_woarchive@archive@boost@@VPreviewerSwitcherContext@WS@@@detail@archive@boost@@QAE@XZ
2	0x458740	??0?$oserializer@Vxml_woarchive@archive@boost@@VSessionIdContext@WS@@@detail@archive@boost@@QAE@XZ
3	0x409340	??0?$singleton@V?$extended_type_info_typeid@VPreviewerSwitcherContext@WS@@@serialization@boost@@@serialization@boost@@IAE@XZ
4	0x409340	??0?$singleton@V?$extended_type_info_typeid@VSessionIdContext@WS@@@serialization@boost@@@serialization@boost@@IAE@XZ
5	0x458200	?get_const_instance@?$singleton@V?$extended_type_info_typeid@VPreviewerSwitcherContext@WS@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@VPreviewerSwitcherContext@WS@@@23@XZ
6	0x458770	?get_const_instance@?$singleton@V?$extended_type_info_typeid@VSessionIdContext@WS@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@VSessionIdContext@WS@@@23@XZ
7	0x4d46b0	?get_const_instance@?$singleton@V?$map@Vxml_woarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vxml_woarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
8	0x4d38c0	?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ
9	0x4d3410	?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
10	0x458090	?get_const_instance@?$singleton@V?$oserializer@Vxml_woarchive@archive@boost@@VPreviewerSwitcherContext@WS@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vxml_woarchive@archive@boost@@VPreviewerSwitcherContext@WS@@@detail@archive@3@XZ

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	49238	239.255.255.250	1900
192.168.56.101	50003	239.255.255.250	3702
192.168.56.101	50005	239.255.255.250	3702
192.168.56.101	57757	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.

resource name	REGISTRY
resource name	TYPELIB