SmartHawk

5.4

中危

44 个模型检测该样本为恶意！

重新分析

下载样本

a29316ffc7793cbbc5eff96b1dde6ec7284c41e3bd09a667d9b2918a88894e56

bc21ef005b4bf62db29a3b1cb1a4034c.exe

分析耗时

88s

最近分析

文件大小

514.0KB

静态报毒动态报毒 AI SCORE=87 AIDETECTVM ATTRIBUTE BLUTEAL BSCOPE CLOUD DELF DPIE FAREIT GDSDA GENKRYPTIK GGW@ACGGXYJI HIGHCONFIDENCE HPQOLE IGENERIC KGFSN@0 KRYPTIK MALICIOUS MALWARE2 NWHJB OZZB PFSR QVM05 R002C0PGU20 REMCOS SCORE SGENERIC SUSGEN UMAL UNSAFE ZELPHICO ZUSY 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	TrojanDownloader:Win32/Bluteal.1ed803e3	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Kingsoft		20200825	2013.8.14.323
McAfee	Fareit-FVP!BC21EF005B4B	20200825	6.0.6.653
Tencent	Win32.Trojan-downloader.Delf.Pfsr	20200825	1.0.0.1
CrowdStrike		20190702	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619870294.549125 __exception__	stacktrace: 0x337987c DriverCallback+0x4e waveOutOpen-0xa2e winmm+0x3af0 @ 0x74693af0 timeEndPeriod+0x54a timeKillEvent-0x57 winmm+0xa535 @ 0x7469a535 timeEndPeriod+0x449 timeKillEvent-0x158 winmm+0xa434 @ 0x7469a434 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 57605016 registers.edi: 57605060 registers.eax: 0 registers.ebp: 57605644 registers.edx: 0 registers.ebx: 0 registers.esi: 0 registers.ecx: 7667711 exception.instruction_r: 8b 40 3c 99 03 04 24 13 54 24 04 83 c4 08 89 44 exception.instruction: mov eax, dword ptr [eax + 0x3c] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x3378c44	success	0	0

Time & API

Arguments

Status

Return

Repeated

1619870294.549125
__exception__

stacktrace:

0x337987c
DriverCallback+0x4e waveOutOpen-0xa2e winmm+0x3af0 @ 0x74693af0
timeEndPeriod+0x54a timeKillEvent-0x57 winmm+0xa535 @ 0x7469a535
timeEndPeriod+0x449 timeKillEvent-0x158 winmm+0xa434 @ 0x7469a434
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 57605016
registers.edi: 57605060
registers.eax: 0
registers.ebp: 57605644
registers.edx: 0
registers.ebx: 0
registers.esi: 0
registers.ecx: 7667711
exception.instruction_r: 8b 40 3c 99 03 04 24 13 54 24 04 83 c4 08 89 44
exception.instruction: mov eax, dword ptr [eax + 0x3c]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x3378c44

success

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619870248.095125 NtAllocateVirtualMemory	process_identifier: 3056 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00590000	success	0	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Disables proxy possibly for traffic interception (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619870294.470125 RegSetValueExA	key_handle: 0x000002dc value: 0 regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	success	0	0

Network activity contains more than one unique useragent (2 个事件)

process	bc21ef005b4bf62db29a3b1cb1a4034c.exe				useragent	Internal
process	bc21ef005b4bf62db29a3b1cb1a4034c.exe				useragent	WIN

File has been identified by 44 AntiVirus engines on VirusTotal as malicious (44 个事件)

Bkav	W32.AIDetectVM.malware2
MicroWorld-eScan	Gen:Variant.Zusy.310255
FireEye	Gen:Variant.Zusy.310255
CAT-QuickHeal	Trojan.IGENERIC
ALYac	Gen:Variant.Zusy.310255
Cylance	Unsafe
K7AntiVirus	Trojan-Downloader ( 0056bacc1 )
Alibaba	TrojanDownloader:Win32/Bluteal.1ed803e3
K7GW	Trojan-Downloader ( 0056bacc1 )
BitDefenderTheta	Gen:NN.ZelphiCO.34196.GGW@aCggXYji
Cyren	W32/Trojan.OZZB-8968
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-Downloader.Win32.Delf.gen
BitDefender	Gen:Variant.Zusy.310255
NANO-Antivirus	Trojan.Win32.Kryptik.hpqole
Rising	Trojan.Kryptik!1.C56D (CLOUD)
Ad-Aware	Gen:Variant.Zusy.310255
Comodo	TrojWare.Win32.UMal.kgfsn@0
F-Secure	Trojan.TR/Dldr.Delf.nwhjb
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0PGU20
Sophos	Mal/Generic-S
Avira	TR/Dldr.Delf.nwhjb
MAX	malware (ai score=87)
Antiy-AVL	Trojan/Win32.SGeneric
Microsoft	Trojan:Win32/Bluteal!rfn
Arcabit	Trojan.Zusy.D4BBEF
ViRobot	Trojan.Win32.Z.Zusy.526336.G
ZoneAlarm	HEUR:Trojan-Downloader.Win32.Delf.gen
GData	Gen:Variant.Zusy.310255
Cynet	Malicious (score: 85)
McAfee	Fareit-FVP!BC21EF005B4B
VBA32	BScope.Backdoor.Remcos
ESET-NOD32	Win32/TrojanDownloader.Delf.CYV
TrendMicro-HouseCall	TROJ_GEN.R002C0PGU20
Tencent	Win32.Trojan-downloader.Delf.Pfsr
Ikarus	Trojan.Inject
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/GenKryptik.DPIE!tr
AVG	Win32:Trojan-gen
Panda	Trj/GdSda.A
Qihoo-360	Generic/HEUR/QVM05.1.F3EC.Malware.Gen

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x46d17c DeleteCriticalSection

• 0x46d180 LeaveCriticalSection

• 0x46d184 EnterCriticalSection

• 0x46d188 InitializeCriticalSection

• 0x46d18c VirtualFree

• 0x46d190 VirtualAlloc

• 0x46d194 LocalFree

• 0x46d198 LocalAlloc

• 0x46d19c GetTickCount

• 0x46d1a0 QueryPerformanceCounter

• 0x46d1a4 GetVersion

• 0x46d1a8 GetCurrentThreadId

• 0x46d1ac InterlockedDecrement

• 0x46d1b0 InterlockedIncrement

• 0x46d1b4 VirtualQuery

• 0x46d1b8 WideCharToMultiByte

• 0x46d1bc MultiByteToWideChar

• 0x46d1c0 lstrlenA

• 0x46d1c4 lstrcpynA

• 0x46d1c8 LoadLibraryExA

• 0x46d1cc GetThreadLocale

• 0x46d1d0 GetStartupInfoA

• 0x46d1d4 GetProcAddress

• 0x46d1d8 GetModuleHandleA

• 0x46d1dc GetModuleFileNameA

• 0x46d1e0 GetLocaleInfoA

• 0x46d1e4 GetCommandLineA

• 0x46d1e8 FreeLibrary

• 0x46d1ec FindFirstFileA

• 0x46d1f0 FindClose

• 0x46d1f4 ExitProcess

• 0x46d1f8 WriteFile

• 0x46d1fc UnhandledExceptionFilter

• 0x46d200 RtlUnwind

• 0x46d204 RaiseException

• 0x46d208 GetStdHandle

Library user32.dll:

• 0x46d210 GetKeyboardType

• 0x46d214 LoadStringA

• 0x46d218 MessageBoxA

• 0x46d21c CharNextA

Library advapi32.dll:

• 0x46d224 RegQueryValueExA

• 0x46d228 RegOpenKeyExA

• 0x46d22c RegCloseKey

Library oleaut32.dll:

• 0x46d234 SysFreeString

• 0x46d238 SysReAllocStringLen

• 0x46d23c SysAllocStringLen

Library kernel32.dll:

• 0x46d244 TlsSetValue

• 0x46d248 TlsGetValue

• 0x46d24c LocalAlloc

• 0x46d250 GetModuleHandleA

Library advapi32.dll:

• 0x46d258 RegQueryValueExA

• 0x46d25c RegOpenKeyExA

• 0x46d260 RegCloseKey

Library kernel32.dll:

• 0x46d268 lstrcpyA

• 0x46d26c WriteFile

• 0x46d270 WaitForSingleObject

• 0x46d274 VirtualQuery

• 0x46d278 VirtualProtect

• 0x46d27c VirtualAlloc

• 0x46d280 Sleep

• 0x46d284 SizeofResource

• 0x46d288 SetThreadLocale

• 0x46d28c SetFilePointer

• 0x46d290 SetEvent

• 0x46d294 SetErrorMode

• 0x46d298 SetEndOfFile

• 0x46d29c ResetEvent

• 0x46d2a0 ReadFile

• 0x46d2a4 MultiByteToWideChar

• 0x46d2a8 MulDiv

• 0x46d2ac LockResource

• 0x46d2b0 LoadResource

• 0x46d2b4 LoadLibraryA

• 0x46d2b8 LeaveCriticalSection

• 0x46d2bc InitializeCriticalSection

• 0x46d2c0 GlobalUnlock

• 0x46d2c4 GlobalReAlloc

• 0x46d2c8 GlobalHandle

• 0x46d2cc GlobalLock

• 0x46d2d0 GlobalFree

• 0x46d2d4 GlobalFindAtomA

• 0x46d2d8 GlobalDeleteAtom

• 0x46d2dc GlobalAlloc

• 0x46d2e0 GlobalAddAtomA

• 0x46d2e4 GetVersionExA

• 0x46d2e8 GetVersion

• 0x46d2ec GetTickCount

• 0x46d2f0 GetThreadLocale

• 0x46d2f4 GetSystemInfo

• 0x46d2f8 GetStringTypeExA

• 0x46d2fc GetStdHandle

• 0x46d300 GetProcAddress

• 0x46d304 GetModuleHandleA

• 0x46d308 GetModuleFileNameA

• 0x46d30c GetLocaleInfoA

• 0x46d310 GetLocalTime

• 0x46d314 GetLastError

• 0x46d318 GetFullPathNameA

• 0x46d31c GetDiskFreeSpaceA

• 0x46d320 GetDateFormatA

• 0x46d324 GetCurrentThreadId

• 0x46d328 GetCurrentProcessId

• 0x46d32c GetComputerNameA

• 0x46d330 GetCPInfo

• 0x46d334 GetACP

• 0x46d338 FreeResource

• 0x46d33c InterlockedExchange

• 0x46d340 FreeLibrary

• 0x46d344 FormatMessageA

• 0x46d348 FindResourceA

• 0x46d34c EnumCalendarInfoA

• 0x46d350 EnterCriticalSection

• 0x46d354 DeleteCriticalSection

• 0x46d358 CreateThread

• 0x46d35c CreateFileA

• 0x46d360 CreateEventA

• 0x46d364 CompareStringA

• 0x46d368 CloseHandle

Library version.dll:

• 0x46d370 VerQueryValueA

• 0x46d374 GetFileVersionInfoSizeA

• 0x46d378 GetFileVersionInfoA

Library gdi32.dll:

• 0x46d380 UnrealizeObject

• 0x46d384 StretchBlt

• 0x46d388 SetWindowOrgEx

• 0x46d38c SetWinMetaFileBits

• 0x46d390 SetViewportOrgEx

• 0x46d394 SetTextColor

• 0x46d398 SetStretchBltMode

• 0x46d39c SetROP2

• 0x46d3a0 SetPixel

• 0x46d3a4 SetEnhMetaFileBits

• 0x46d3a8 SetDIBColorTable

• 0x46d3ac SetBrushOrgEx

• 0x46d3b0 SetBkMode

• 0x46d3b4 SetBkColor

• 0x46d3b8 SelectPalette

• 0x46d3bc SelectObject

• 0x46d3c0 SelectClipRgn

• 0x46d3c4 SaveDC

• 0x46d3c8 RestoreDC

• 0x46d3cc Rectangle

• 0x46d3d0 RectVisible

• 0x46d3d4 RealizePalette

• 0x46d3d8 Polyline

• 0x46d3dc PlayEnhMetaFile

• 0x46d3e0 PatBlt

• 0x46d3e4 MoveToEx

• 0x46d3e8 MaskBlt

• 0x46d3ec LineTo

• 0x46d3f0 IntersectClipRect

• 0x46d3f4 GetWindowOrgEx

• 0x46d3f8 GetWinMetaFileBits

• 0x46d3fc GetTextMetricsA

• 0x46d400 GetTextExtentPoint32A

• 0x46d404 GetSystemPaletteEntries

• 0x46d408 GetStockObject

• 0x46d40c GetPixel

• 0x46d410 GetPaletteEntries

• 0x46d414 GetObjectA

• 0x46d418 GetEnhMetaFilePaletteEntries

• 0x46d41c GetEnhMetaFileHeader

• 0x46d420 GetEnhMetaFileBits

• 0x46d424 GetDeviceCaps

• 0x46d428 GetDIBits

• 0x46d42c GetDIBColorTable

• 0x46d430 GetDCOrgEx

• 0x46d434 GetCurrentPositionEx

• 0x46d438 GetClipBox

• 0x46d43c GetBrushOrgEx

• 0x46d440 GetBitmapBits

• 0x46d444 ExcludeClipRect

• 0x46d448 DeleteObject

• 0x46d44c DeleteEnhMetaFile

• 0x46d450 DeleteDC

• 0x46d454 CreateSolidBrush

• 0x46d458 CreatePenIndirect

• 0x46d45c CreatePalette

• 0x46d460 CreateHalftonePalette

• 0x46d464 CreateFontIndirectA

• 0x46d468 CreateDIBitmap

• 0x46d46c CreateDIBSection

• 0x46d470 CreateCompatibleDC

• 0x46d474 CreateCompatibleBitmap

• 0x46d478 CreateBrushIndirect

• 0x46d47c CreateBitmap

• 0x46d480 CopyEnhMetaFileA

• 0x46d484 BitBlt

Library user32.dll:

• 0x46d48c CreateWindowExA

• 0x46d490 WindowFromPoint

• 0x46d494 WinHelpA

• 0x46d498 WaitMessage

• 0x46d49c UpdateWindow

• 0x46d4a0 UnregisterClassA

• 0x46d4a4 UnhookWindowsHookEx

• 0x46d4a8 TranslateMessage

• 0x46d4ac TranslateMDISysAccel

• 0x46d4b0 TrackPopupMenu

• 0x46d4b4 SystemParametersInfoA

• 0x46d4b8 ShowWindow

• 0x46d4bc ShowScrollBar

• 0x46d4c0 ShowOwnedPopups

• 0x46d4c4 ShowCursor

• 0x46d4c8 SetWindowsHookExA

• 0x46d4cc SetWindowTextA

• 0x46d4d0 SetWindowPos

• 0x46d4d4 SetWindowPlacement

• 0x46d4d8 SetWindowLongA

• 0x46d4dc SetTimer

• 0x46d4e0 SetScrollRange

• 0x46d4e4 SetScrollPos

• 0x46d4e8 SetScrollInfo

• 0x46d4ec SetRect

• 0x46d4f0 SetPropA

• 0x46d4f4 SetParent

• 0x46d4f8 SetMenuItemInfoA

• 0x46d4fc SetMenu

• 0x46d500 SetForegroundWindow

• 0x46d504 SetFocus

• 0x46d508 SetCursor

• 0x46d50c SetClassLongA

• 0x46d510 SetCapture

• 0x46d514 SetActiveWindow

• 0x46d518 SendMessageA

• 0x46d51c ScrollWindow

• 0x46d520 ScreenToClient

• 0x46d524 RemovePropA

• 0x46d528 RemoveMenu

• 0x46d52c ReleaseDC

• 0x46d530 ReleaseCapture

• 0x46d534 RegisterWindowMessageA

• 0x46d538 RegisterClipboardFormatA

• 0x46d53c RegisterClassA

• 0x46d540 RedrawWindow

• 0x46d544 PtInRect

• 0x46d548 PostQuitMessage

• 0x46d54c PostMessageA

• 0x46d550 PeekMessageA

• 0x46d554 OffsetRect

• 0x46d558 OemToCharA

• 0x46d55c MsgWaitForMultipleObjects

• 0x46d560 MessageBoxA

• 0x46d564 MapWindowPoints

• 0x46d568 MapVirtualKeyA

• 0x46d56c LoadStringA

• 0x46d570 LoadKeyboardLayoutA

• 0x46d574 LoadIconA

• 0x46d578 LoadCursorA

• 0x46d57c LoadBitmapA

• 0x46d580 KillTimer

• 0x46d584 IsZoomed

• 0x46d588 IsWindowVisible

• 0x46d58c IsWindowEnabled

• 0x46d590 IsWindow

• 0x46d594 IsRectEmpty

• 0x46d598 IsIconic

• 0x46d59c IsDialogMessageA

• 0x46d5a0 IsChild

• 0x46d5a4 InvalidateRect

• 0x46d5a8 IntersectRect

• 0x46d5ac InsertMenuItemA

• 0x46d5b0 InsertMenuA

• 0x46d5b4 InflateRect

• 0x46d5b8 GetWindowThreadProcessId

• 0x46d5bc GetWindowTextA

• 0x46d5c0 GetWindowRect

• 0x46d5c4 GetWindowPlacement

• 0x46d5c8 GetWindowLongA

• 0x46d5cc GetWindowDC

• 0x46d5d0 GetTopWindow

• 0x46d5d4 GetSystemMetrics

• 0x46d5d8 GetSystemMenu

• 0x46d5dc GetSysColorBrush

• 0x46d5e0 GetSysColor

• 0x46d5e4 GetSubMenu

• 0x46d5e8 GetScrollRange

• 0x46d5ec GetScrollPos

• 0x46d5f0 GetScrollInfo

• 0x46d5f4 GetPropA

• 0x46d5f8 GetParent

• 0x46d5fc GetWindow

• 0x46d600 GetMenuStringA

• 0x46d604 GetMenuState

• 0x46d608 GetMenuItemInfoA

• 0x46d60c GetMenuItemID

• 0x46d610 GetMenuItemCount

• 0x46d614 GetMenu

• 0x46d618 GetLastActivePopup

• 0x46d61c GetKeyboardState

• 0x46d620 GetKeyboardLayoutList

• 0x46d624 GetKeyboardLayout

• 0x46d628 GetKeyState

• 0x46d62c GetKeyNameTextA

• 0x46d630 GetIconInfo

• 0x46d634 GetForegroundWindow

• 0x46d638 GetFocus

• 0x46d63c GetDlgItem

• 0x46d640 GetDesktopWindow

• 0x46d644 GetDCEx

• 0x46d648 GetDC

• 0x46d64c GetCursorPos

• 0x46d650 GetCursor

• 0x46d654 GetClipboardData

• 0x46d658 GetClientRect

• 0x46d65c GetClassNameA

• 0x46d660 GetClassInfoA

• 0x46d664 GetCapture

• 0x46d668 GetActiveWindow

• 0x46d66c FrameRect

• 0x46d670 FindWindowA

• 0x46d674 FillRect

• 0x46d678 EqualRect

• 0x46d67c EnumWindows

• 0x46d680 EnumThreadWindows

• 0x46d684 EndPaint

• 0x46d688 EnableWindow

• 0x46d68c EnableScrollBar

• 0x46d690 EnableMenuItem

• 0x46d694 DrawTextA

• 0x46d698 DrawMenuBar

• 0x46d69c DrawIconEx

• 0x46d6a0 DrawIcon

• 0x46d6a4 DrawFrameControl

• 0x46d6a8 DrawEdge

• 0x46d6ac DispatchMessageA

• 0x46d6b0 DestroyWindow

• 0x46d6b4 DestroyMenu

• 0x46d6b8 DestroyIcon

• 0x46d6bc DestroyCursor

• 0x46d6c0 DeleteMenu

• 0x46d6c4 DefWindowProcA

• 0x46d6c8 DefMDIChildProcA

• 0x46d6cc DefFrameProcA

• 0x46d6d0 CreatePopupMenu

• 0x46d6d4 CreateMenu

• 0x46d6d8 CreateIcon

• 0x46d6dc ClientToScreen

• 0x46d6e0 CheckMenuItem

• 0x46d6e4 CallWindowProcA

• 0x46d6e8 CallNextHookEx

• 0x46d6ec BeginPaint

• 0x46d6f0 CharNextA

• 0x46d6f4 CharLowerBuffA

• 0x46d6f8 CharLowerA

• 0x46d6fc CharToOemA

• 0x46d700 AdjustWindowRectEx

• 0x46d704 ActivateKeyboardLayout

Library kernel32.dll:

• 0x46d70c Sleep

Library oleaut32.dll:

• 0x46d714 SafeArrayPtrOfIndex

• 0x46d718 SafeArrayGetUBound

• 0x46d71c SafeArrayGetLBound

• 0x46d720 SafeArrayCreate

• 0x46d724 VariantChangeType

• 0x46d728 VariantCopy

• 0x46d72c VariantClear

• 0x46d730 VariantInit

Library ole32.dll:

• 0x46d738 CoTaskMemFree

• 0x46d73c ProgIDFromCLSID

• 0x46d740 StringFromCLSID

• 0x46d744 CoCreateInstance

• 0x46d748 CoUninitialize

• 0x46d74c CoInitialize

• 0x46d750 IsEqualGUID

Library oleaut32.dll:

• 0x46d758 GetErrorInfo

• 0x46d75c GetActiveObject

• 0x46d760 SysFreeString

Library comctl32.dll:

• 0x46d768 ImageList_SetIconSize

• 0x46d76c ImageList_GetIconSize

• 0x46d770 ImageList_Write

• 0x46d774 ImageList_Read

• 0x46d778 ImageList_GetDragImage

• 0x46d77c ImageList_DragShowNolock

• 0x46d780 ImageList_SetDragCursorImage

• 0x46d784 ImageList_DragMove

• 0x46d788 ImageList_DragLeave

• 0x46d78c ImageList_DragEnter

• 0x46d790 ImageList_EndDrag

• 0x46d794 ImageList_BeginDrag

• 0x46d798 ImageList_Remove

• 0x46d79c ImageList_DrawEx

• 0x46d7a0 ImageList_Draw

• 0x46d7a4 ImageList_GetBkColor

• 0x46d7a8 ImageList_SetBkColor

• 0x46d7ac ImageList_ReplaceIcon

• 0x46d7b0 ImageList_Add

• 0x46d7b4 ImageList_SetImageCount

• 0x46d7b8 ImageList_GetImageCount

• 0x46d7bc ImageList_Destroy

• 0x46d7c0 ImageList_Create

Library comdlg32.dll:

• 0x46d7c8 GetOpenFileNameA

Library advapi32.dll:

• 0x46d7d0 QueryServiceStatus

• 0x46d7d4 OpenServiceA

• 0x46d7d8 OpenSCManagerA

• 0x46d7dc CloseServiceHandle

Library url:

• 0x46d7e4 InetIsOffline

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
www.microsoft.com	CNAME www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net CNAME e13678.ca2.s.tl88.net CNAME www.microsoft.com-c-3.edgekey.net A 27.148.139.88	27.148.139.88
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	216.58.200.238
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51379	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.