SmartHawk

5.4

中危

该样本未表现出任何异常！

重新分析

下载样本

01fcf0e844ec177aa8e07cbdc1cd0bd5bbd7ef38b8335b58a2eb383b83885f1c

b52fbac548ebe7f8f074b2db88bda94b.exe

分析耗时

84s

最近分析

文件大小

918.7KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

This executable is signed

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1621012136.030125 __exception__	stacktrace: 0x2090712 0x209087c DriverCallback+0x4e waveOutOpen-0xa2e winmm+0x3af0 @ 0x750c3af0 timeEndPeriod+0x54a timeKillEvent-0x57 winmm+0xa535 @ 0x750ca535 timeEndPeriod+0x449 timeKillEvent-0x158 winmm+0xa434 @ 0x750ca434 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 54984176 registers.edi: 34146312 registers.eax: 0 registers.ebp: 54984256 registers.edx: 0 registers.ebx: 2139955341 registers.esi: 16 registers.ecx: 9112888 exception.instruction_r: 8b 40 3c 99 03 04 24 13 54 24 04 83 c4 08 89 45 exception.instruction: mov eax, dword ptr [eax + 0x3c] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x207d35d	success	0	0

Time & API

Arguments

Status

Return

Repeated

1621012136.030125
__exception__

stacktrace:

0x2090712
0x209087c
DriverCallback+0x4e waveOutOpen-0xa2e winmm+0x3af0 @ 0x750c3af0
timeEndPeriod+0x54a timeKillEvent-0x57 winmm+0xa535 @ 0x750ca535
timeEndPeriod+0x449 timeKillEvent-0x158 winmm+0xa434 @ 0x750ca434
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 54984176
registers.edi: 34146312
registers.eax: 0
registers.ebp: 54984256
registers.edx: 0
registers.ebx: 2139955341
registers.esi: 16
registers.ecx: 9112888
exception.instruction_r: 8b 40 3c 99 03 04 24 13 54 24 04 83 c4 08 89 45
exception.instruction: mov eax, dword ptr [eax + 0x3c]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x207d35d

success

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1621012075.890125 NtAllocateVirtualMemory	process_identifier: 1476 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01ef0000	success	0	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1621012093.546125 NtProtectVirtualMemory	process_identifier: 1476 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 131072 protection: 32 (PAGE_EXECUTE_READ) process_handle: 0xffffffff base_address: 0x02071000	success	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1621012104.280125 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Disables proxy possibly for traffic interception (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1621012103.937125 RegSetValueExA	key_handle: 0x0000029c value: 0 regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	success	0	0

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1621012106.874125 RegSetValueExA	key_handle: 0x000003b0 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1621012106.874125 RegSetValueExA	key_handle: 0x000003b0 value: p s«®H× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1621012106.874125 RegSetValueExA	key_handle: 0x000003b0 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1621012106.874125 RegSetValueExW	key_handle: 0x000003b0 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1621012106.874125 RegSetValueExA	key_handle: 0x000003cc value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1621012106.874125 RegSetValueExA	key_handle: 0x000003cc value: p s«®H× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1621012106.874125 RegSetValueExA	key_handle: 0x000003cc value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1621012106.905125 RegSetValueExW	key_handle: 0x000003ac value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Network activity contains more than one unique useragent (2 个事件)

process	b52fbac548ebe7f8f074b2db88bda94b.exe				useragent	Internal
process	b52fbac548ebe7f8f074b2db88bda94b.exe				useragent	b52fbac548ebe7f8f074b2db88bda94b.exe

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

108.160.169.186:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x4c2154 DeleteCriticalSection

• 0x4c2158 LeaveCriticalSection

• 0x4c215c EnterCriticalSection

• 0x4c2160 InitializeCriticalSection

• 0x4c2164 VirtualFree

• 0x4c2168 VirtualAlloc

• 0x4c216c LocalFree

• 0x4c2170 LocalAlloc

• 0x4c2174 GetTickCount

• 0x4c2178 QueryPerformanceCounter

• 0x4c217c GetVersion

• 0x4c2180 GetCurrentThreadId

• 0x4c2184 InterlockedDecrement

• 0x4c2188 InterlockedIncrement

• 0x4c218c VirtualQuery

• 0x4c2190 WideCharToMultiByte

• 0x4c2194 MultiByteToWideChar

• 0x4c2198 lstrlenA

• 0x4c219c lstrcpynA

• 0x4c21a0 LoadLibraryExA

• 0x4c21a4 GetThreadLocale

• 0x4c21a8 GetStartupInfoA

• 0x4c21ac GetProcAddress

• 0x4c21b0 GetModuleHandleA

• 0x4c21b4 GetModuleFileNameA

• 0x4c21b8 GetLocaleInfoA

• 0x4c21bc GetCommandLineA

• 0x4c21c0 FreeLibrary

• 0x4c21c4 FindFirstFileA

• 0x4c21c8 FindClose

• 0x4c21cc ExitProcess

• 0x4c21d0 WriteFile

• 0x4c21d4 UnhandledExceptionFilter

• 0x4c21d8 RtlUnwind

• 0x4c21dc RaiseException

• 0x4c21e0 GetStdHandle

Library user32.dll:

• 0x4c21e8 GetKeyboardType

• 0x4c21ec LoadStringA

• 0x4c21f0 MessageBoxA

• 0x4c21f4 CharNextA

Library advapi32.dll:

• 0x4c21fc RegQueryValueExA

• 0x4c2200 RegOpenKeyExA

• 0x4c2204 RegCloseKey

Library oleaut32.dll:

• 0x4c220c SysFreeString

• 0x4c2210 SysReAllocStringLen

• 0x4c2214 SysAllocStringLen

Library kernel32.dll:

• 0x4c221c TlsSetValue

• 0x4c2220 TlsGetValue

• 0x4c2224 LocalAlloc

• 0x4c2228 GetModuleHandleA

Library advapi32.dll:

• 0x4c2230 RegQueryValueExA

• 0x4c2234 RegOpenKeyExA

• 0x4c2238 RegCloseKey

Library kernel32.dll:

• 0x4c2240 lstrcpyA

• 0x4c2244 lstrcmpiA

• 0x4c2248 WriteFile

• 0x4c224c WaitForSingleObject

• 0x4c2250 VirtualQuery

• 0x4c2254 VirtualProtect

• 0x4c2258 VirtualAlloc

• 0x4c225c Sleep

• 0x4c2260 SizeofResource

• 0x4c2264 SetThreadLocale

• 0x4c2268 SetFilePointer

• 0x4c226c SetEvent

• 0x4c2270 SetErrorMode

• 0x4c2274 SetEndOfFile

• 0x4c2278 ResetEvent

• 0x4c227c ReadFile

• 0x4c2280 MultiByteToWideChar

• 0x4c2284 MulDiv

• 0x4c2288 LockResource

• 0x4c228c LoadResource

• 0x4c2290 LoadLibraryA

• 0x4c2294 LeaveCriticalSection

• 0x4c2298 InitializeCriticalSection

• 0x4c229c GlobalUnlock

• 0x4c22a0 GlobalReAlloc

• 0x4c22a4 GlobalHandle

• 0x4c22a8 GlobalLock

• 0x4c22ac GlobalFree

• 0x4c22b0 GlobalFindAtomA

• 0x4c22b4 GlobalDeleteAtom

• 0x4c22b8 GlobalAlloc

• 0x4c22bc GlobalAddAtomA

• 0x4c22c0 GetVersionExA

• 0x4c22c4 GetVersion

• 0x4c22c8 GetTickCount

• 0x4c22cc GetThreadLocale

• 0x4c22d0 GetSystemInfo

• 0x4c22d4 GetStringTypeExA

• 0x4c22d8 GetStdHandle

• 0x4c22dc GetProcAddress

• 0x4c22e0 GetModuleHandleA

• 0x4c22e4 GetModuleFileNameA

• 0x4c22e8 GetLocaleInfoA

• 0x4c22ec GetLocalTime

• 0x4c22f0 GetLastError

• 0x4c22f4 GetFullPathNameA

• 0x4c22f8 GetDiskFreeSpaceA

• 0x4c22fc GetDateFormatA

• 0x4c2300 GetCurrentThreadId

• 0x4c2304 GetCurrentProcessId

• 0x4c2308 GetCPInfo

• 0x4c230c GetACP

• 0x4c2310 FreeResource

• 0x4c2314 InterlockedExchange

• 0x4c2318 FreeLibrary

• 0x4c231c FormatMessageA

• 0x4c2320 FindResourceA

• 0x4c2324 EnumCalendarInfoA

• 0x4c2328 EnterCriticalSection

• 0x4c232c DeleteCriticalSection

• 0x4c2330 CreateThread

• 0x4c2334 CreateFileA

• 0x4c2338 CreateEventA

• 0x4c233c CompareStringA

• 0x4c2340 CloseHandle

Library version.dll:

• 0x4c2348 VerQueryValueA

• 0x4c234c GetFileVersionInfoSizeA

• 0x4c2350 GetFileVersionInfoA

Library gdi32.dll:

• 0x4c2358 UnrealizeObject

• 0x4c235c StretchBlt

• 0x4c2360 SetWindowOrgEx

• 0x4c2364 SetWinMetaFileBits

• 0x4c2368 SetViewportOrgEx

• 0x4c236c SetTextColor

• 0x4c2370 SetStretchBltMode

• 0x4c2374 SetROP2

• 0x4c2378 SetPixel

• 0x4c237c SetEnhMetaFileBits

• 0x4c2380 SetDIBColorTable

• 0x4c2384 SetBrushOrgEx

• 0x4c2388 SetBkMode

• 0x4c238c SetBkColor

• 0x4c2390 SelectPalette

• 0x4c2394 SelectObject

• 0x4c2398 SelectClipRgn

• 0x4c239c SaveDC

• 0x4c23a0 RestoreDC

• 0x4c23a4 Rectangle

• 0x4c23a8 RectVisible

• 0x4c23ac RealizePalette

• 0x4c23b0 Polyline

• 0x4c23b4 PlayEnhMetaFile

• 0x4c23b8 PatBlt

• 0x4c23bc MoveToEx

• 0x4c23c0 MaskBlt

• 0x4c23c4 LineTo

• 0x4c23c8 IntersectClipRect

• 0x4c23cc GetWindowOrgEx

• 0x4c23d0 GetWinMetaFileBits

• 0x4c23d4 GetTextMetricsA

• 0x4c23d8 GetTextExtentPoint32A

• 0x4c23dc GetSystemPaletteEntries

• 0x4c23e0 GetStockObject

• 0x4c23e4 GetPixel

• 0x4c23e8 GetPaletteEntries

• 0x4c23ec GetObjectA

• 0x4c23f0 GetEnhMetaFilePaletteEntries

• 0x4c23f4 GetEnhMetaFileHeader

• 0x4c23f8 GetEnhMetaFileBits

• 0x4c23fc GetDeviceCaps

• 0x4c2400 GetDIBits

• 0x4c2404 GetDIBColorTable

• 0x4c2408 GetDCOrgEx

• 0x4c240c GetCurrentPositionEx

• 0x4c2410 GetClipBox

• 0x4c2414 GetBrushOrgEx

• 0x4c2418 GetBitmapBits

• 0x4c241c GdiFlush

• 0x4c2420 ExtTextOutA

• 0x4c2424 ExcludeClipRect

• 0x4c2428 DeleteObject

• 0x4c242c DeleteEnhMetaFile

• 0x4c2430 DeleteDC

• 0x4c2434 CreateSolidBrush

• 0x4c2438 CreatePenIndirect

• 0x4c243c CreatePalette

• 0x4c2440 CreateHalftonePalette

• 0x4c2444 CreateFontIndirectA

• 0x4c2448 CreateDIBitmap

• 0x4c244c CreateDIBSection

• 0x4c2450 CreateCompatibleDC

• 0x4c2454 CreateCompatibleBitmap

• 0x4c2458 CreateBrushIndirect

• 0x4c245c CreateBitmap

• 0x4c2460 CopyEnhMetaFileA

• 0x4c2464 BitBlt

Library user32.dll:

• 0x4c246c CreateWindowExA

• 0x4c2470 WindowFromPoint

• 0x4c2474 WinHelpA

• 0x4c2478 WaitMessage

• 0x4c247c UpdateWindow

• 0x4c2480 UnregisterClassA

• 0x4c2484 UnhookWindowsHookEx

• 0x4c2488 TranslateMessage

• 0x4c248c TranslateMDISysAccel

• 0x4c2490 TrackPopupMenu

• 0x4c2494 SystemParametersInfoA

• 0x4c2498 ShowWindow

• 0x4c249c ShowScrollBar

• 0x4c24a0 ShowOwnedPopups

• 0x4c24a4 ShowCursor

• 0x4c24a8 SetWindowsHookExA

• 0x4c24ac SetWindowTextA

• 0x4c24b0 SetWindowPos

• 0x4c24b4 SetWindowPlacement

• 0x4c24b8 SetWindowLongA

• 0x4c24bc SetTimer

• 0x4c24c0 SetScrollRange

• 0x4c24c4 SetScrollPos

• 0x4c24c8 SetScrollInfo

• 0x4c24cc SetRect

• 0x4c24d0 SetPropA

• 0x4c24d4 SetParent

• 0x4c24d8 SetMenuItemInfoA

• 0x4c24dc SetMenu

• 0x4c24e0 SetKeyboardState

• 0x4c24e4 SetForegroundWindow

• 0x4c24e8 SetFocus

• 0x4c24ec SetCursor

• 0x4c24f0 SetClipboardData

• 0x4c24f4 SetClassLongA

• 0x4c24f8 SetCapture

• 0x4c24fc SetActiveWindow

• 0x4c2500 SendMessageA

• 0x4c2504 ScrollWindow

• 0x4c2508 ScreenToClient

• 0x4c250c RemovePropA

• 0x4c2510 RemoveMenu

• 0x4c2514 ReleaseDC

• 0x4c2518 ReleaseCapture

• 0x4c251c RegisterWindowMessageA

• 0x4c2520 RegisterClipboardFormatA

• 0x4c2524 RegisterClassA

• 0x4c2528 RedrawWindow

• 0x4c252c PtInRect

• 0x4c2530 PostQuitMessage

• 0x4c2534 PostMessageA

• 0x4c2538 PeekMessageA

• 0x4c253c OpenClipboard

• 0x4c2540 OffsetRect

• 0x4c2544 OemToCharA

• 0x4c2548 MessageBoxA

• 0x4c254c MessageBeep

• 0x4c2550 MapWindowPoints

• 0x4c2554 MapVirtualKeyA

• 0x4c2558 LoadStringA

• 0x4c255c LoadKeyboardLayoutA

• 0x4c2560 LoadIconA

• 0x4c2564 LoadCursorA

• 0x4c2568 LoadBitmapA

• 0x4c256c KillTimer

• 0x4c2570 IsZoomed

• 0x4c2574 IsWindowVisible

• 0x4c2578 IsWindowEnabled

• 0x4c257c IsWindow

• 0x4c2580 IsRectEmpty

• 0x4c2584 IsIconic

• 0x4c2588 IsDialogMessageA

• 0x4c258c IsChild

• 0x4c2590 IsCharAlphaNumericA

• 0x4c2594 IsCharAlphaA

• 0x4c2598 InvalidateRect

• 0x4c259c IntersectRect

• 0x4c25a0 InsertMenuItemA

• 0x4c25a4 InsertMenuA

• 0x4c25a8 InflateRect

• 0x4c25ac GetWindowThreadProcessId

• 0x4c25b0 GetWindowTextA

• 0x4c25b4 GetWindowRect

• 0x4c25b8 GetWindowPlacement

• 0x4c25bc GetWindowLongA

• 0x4c25c0 GetWindowDC

• 0x4c25c4 GetTopWindow

• 0x4c25c8 GetSystemMetrics

• 0x4c25cc GetSystemMenu

• 0x4c25d0 GetSysColorBrush

• 0x4c25d4 GetSysColor

• 0x4c25d8 GetSubMenu

• 0x4c25dc GetScrollRange

• 0x4c25e0 GetScrollPos

• 0x4c25e4 GetScrollInfo

• 0x4c25e8 GetPropA

• 0x4c25ec GetParent

• 0x4c25f0 GetWindow

• 0x4c25f4 GetMenuStringA

• 0x4c25f8 GetMenuState

• 0x4c25fc GetMenuItemInfoA

• 0x4c2600 GetMenuItemID

• 0x4c2604 GetMenuItemCount

• 0x4c2608 GetMenu

• 0x4c260c GetLastActivePopup

• 0x4c2610 GetKeyboardState

• 0x4c2614 GetKeyboardLayoutList

• 0x4c2618 GetKeyboardLayout

• 0x4c261c GetKeyState

• 0x4c2620 GetKeyNameTextA

• 0x4c2624 GetIconInfo

• 0x4c2628 GetForegroundWindow

• 0x4c262c GetFocus

• 0x4c2630 GetDesktopWindow

• 0x4c2634 GetDCEx

• 0x4c2638 GetDC

• 0x4c263c GetCursorPos

• 0x4c2640 GetCursor

• 0x4c2644 GetClipboardData

• 0x4c2648 GetClientRect

• 0x4c264c GetClassNameA

• 0x4c2650 GetClassInfoA

• 0x4c2654 GetCapture

• 0x4c2658 GetActiveWindow

• 0x4c265c FrameRect

• 0x4c2660 FindWindowA

• 0x4c2664 FillRect

• 0x4c2668 EqualRect

• 0x4c266c EnumWindows

• 0x4c2670 EnumThreadWindows

• 0x4c2674 EnumClipboardFormats

• 0x4c2678 EndPaint

• 0x4c267c EnableWindow

• 0x4c2680 EnableScrollBar

• 0x4c2684 EnableMenuItem

• 0x4c2688 EmptyClipboard

• 0x4c268c DrawTextA

• 0x4c2690 DrawMenuBar

• 0x4c2694 DrawIconEx

• 0x4c2698 DrawIcon

• 0x4c269c DrawFrameControl

• 0x4c26a0 DrawFocusRect

• 0x4c26a4 DrawEdge

• 0x4c26a8 DispatchMessageA

• 0x4c26ac DestroyWindow

• 0x4c26b0 DestroyMenu

• 0x4c26b4 DestroyIcon

• 0x4c26b8 DestroyCursor

• 0x4c26bc DeleteMenu

• 0x4c26c0 DefWindowProcA

• 0x4c26c4 DefMDIChildProcA

• 0x4c26c8 DefFrameProcA

• 0x4c26cc CreatePopupMenu

• 0x4c26d0 CreateMenu

• 0x4c26d4 CreateIcon

• 0x4c26d8 CloseClipboard

• 0x4c26dc ClientToScreen

• 0x4c26e0 CheckMenuItem

• 0x4c26e4 CallWindowProcA

• 0x4c26e8 CallNextHookEx

• 0x4c26ec BeginPaint

• 0x4c26f0 CharNextA

• 0x4c26f4 CharLowerBuffA

• 0x4c26f8 CharLowerA

• 0x4c26fc CharUpperBuffA

• 0x4c2700 CharToOemA

• 0x4c2704 AdjustWindowRectEx

• 0x4c2708 ActivateKeyboardLayout

Library kernel32.dll:

• 0x4c2710 Sleep

Library oleaut32.dll:

• 0x4c2718 SafeArrayPtrOfIndex

• 0x4c271c SafeArrayPutElement

• 0x4c2720 SafeArrayGetElement

• 0x4c2724 SafeArrayUnaccessData

• 0x4c2728 SafeArrayAccessData

• 0x4c272c SafeArrayGetUBound

• 0x4c2730 SafeArrayGetLBound

• 0x4c2734 SafeArrayCreate

• 0x4c2738 VariantChangeType

• 0x4c273c VariantCopyInd

• 0x4c2740 VariantCopy

• 0x4c2744 VariantClear

• 0x4c2748 VariantInit

Library ole32.dll:

• 0x4c2750 CoUninitialize

• 0x4c2754 CoInitialize

Library oleaut32.dll:

• 0x4c275c GetErrorInfo

• 0x4c2760 SysFreeString

Library comctl32.dll:

• 0x4c2768 ImageList_SetIconSize

• 0x4c276c ImageList_GetIconSize

• 0x4c2770 ImageList_Write

• 0x4c2774 ImageList_Read

• 0x4c2778 ImageList_GetDragImage

• 0x4c277c ImageList_DragShowNolock

• 0x4c2780 ImageList_SetDragCursorImage

• 0x4c2784 ImageList_DragMove

• 0x4c2788 ImageList_DragLeave

• 0x4c278c ImageList_DragEnter

• 0x4c2790 ImageList_EndDrag

• 0x4c2794 ImageList_BeginDrag

• 0x4c2798 ImageList_Remove

• 0x4c279c ImageList_DrawEx

• 0x4c27a0 ImageList_Draw

• 0x4c27a4 ImageList_GetBkColor

• 0x4c27a8 ImageList_SetBkColor

• 0x4c27ac ImageList_ReplaceIcon

• 0x4c27b0 ImageList_Add

• 0x4c27b4 ImageList_SetImageCount

• 0x4c27b8 ImageList_GetImageCount

• 0x4c27bc ImageList_Destroy

• 0x4c27c0 ImageList_Create

• 0x4c27c4 InitCommonControls

Library advapi32.dll:

• 0x4c27cc QueryServiceStatus

• 0x4c27d0 OpenServiceA

• 0x4c27d4 OpenSCManagerA

• 0x4c27d8 CloseServiceHandle

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
www.microsoft.com	CNAME www.microsoft.com-c-3.edgekey.net CNAME www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net CNAME e13678.ca2.s.tl88.net A 183.61.93.182	183.61.93.182
cdn.discordapp.com	A 108.160.169.186	108.160.169.186
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	57874	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58370	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.