SmartHawk

7.2

高危

44 个模型检测该样本为恶意！

重新分析

下载样本

1671a07b049f4198a0a647f42da092efde80a9041de8b7152c593dd2def4a00f

bf8d1765907e8b8d93568da8263d6fb7.exe

分析耗时

91s

最近分析

文件大小

300.0KB

静态报毒动态报毒 100% AI SCORE=89 ARDAMAXNBI ATRAPS CONFIDENCE DOWNLOADER34 ELDORADO EMOTEPMF EMOTET GENERICKDZ HCEJ HIGH CONFIDENCE HRWBUM IWOTEBQAKYE KRYPTIK MALWARE@#2D8T2C93Y7UVL R + TROJ R348787 S15521191 SUSGEN UJ7+94MM78 UNSAFE 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Emotet-FRV!BF8D1765907E	20201024	6.0.6.653
Baidu		20190318	1.0.0.2
Avast		20201024	18.4.3895.0
Alibaba	Trojan:Win32/Emotet.5b7a9e62	20190527	0.3.0.5
Kingsoft		20201024	2013.8.14.323
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619861610.437 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (5 个事件)

Time & API	Arguments	Status	Return
1619861601.781 CryptGenKey	crypto_handle: 0x02b300a0 algorithm_identifier: 0x0000660e () provider_handle: 0x003df710 flags: 1 key: f¹ßVÍ8¤")óA3×Ù	success	1
1619861610.5 CryptExportKey	crypto_handle: 0x02b300a0 crypto_export_handle: 0x02b30060 buffer: f¤[ 1Á"\|j^Å~¡ls¦Ätú¯¥ÿ£?S¿>ÅÛKÆø»-F*¹ap4ÑìS¦k?ÔÞº¸ ¥Çã,â@÷ÀÑ®t8TAYK blob_type: 1 flags: 64	success	1
1619861637.64 CryptExportKey	crypto_handle: 0x02b300a0 crypto_export_handle: 0x02b30060 buffer: f¤3ð·ÆøTtbw#p@^_;É¢×FÐìjC^5$o!Úã'B¾^È³ x´èpþKRûjñüærº"úD^¥6dwlâ2J%åk«ysíàãÊ{e6Pm blob_type: 1 flags: 64	success	1
1619861641.765 CryptExportKey	crypto_handle: 0x02b300a0 crypto_export_handle: 0x02b30060 buffer: f¤Ô¾·E¯`)açç[çtøú_T)`~¿^o;#Íüý #à "ðàó Þ")`ô4ÊÐjé®n²£äzüGo×z(ÛöPu¨}Ð'Ù¬§fqu/9& blob_type: 1 flags: 64	success	1
1619861645.828 CryptExportKey	crypto_handle: 0x02b300a0 crypto_export_handle: 0x02b30060 buffer: f¤XjÔÿ?¨)OÂDÔ²ëä;ÀôHMÏ5AÚÿðÃø²ÂMØY[Âxä¤Ïu¹ÏÔM) ÅÎ!Áãz.±<égÌ-à2;!ÜøG>+ 7_# blob_type: 1 flags: 64	success	1

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

None

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619861601.14 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01d80000	success	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619861610.984 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

bf8d1765907e8b8d93568da8263d6fb7.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619861610.718 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (5 个事件)

host	116.202.234.183
host	172.217.24.14
host	185.94.252.104
host	69.30.203.214
host	70.121.172.89

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619861614.156 RegSetValueExA	key_handle: 0x000003bc value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619861614.156 RegSetValueExA	key_handle: 0x000003bc value: 0éba>× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619861614.156 RegSetValueExA	key_handle: 0x000003bc value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619861614.156 RegSetValueExW	key_handle: 0x000003bc value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619861614.156 RegSetValueExA	key_handle: 0x000003d8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619861614.156 RegSetValueExA	key_handle: 0x000003d8 value: 0éba>× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619861614.156 RegSetValueExA	key_handle: 0x000003d8 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619861614.172 RegSetValueExW	key_handle: 0x000003b8 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Generates some ICMP traffic

File has been identified by 44 AntiVirus engines on VirusTotal as malicious (44 个事件)

Bkav	W32.ArdamaxNBI.Trojan
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.69589
FireEye	Trojan.GenericKDZ.69589
CAT-QuickHeal	Trojan.EmotePMF.S15521191
McAfee	Emotet-FRV!BF8D1765907E
Cylance	Unsafe
AegisLab	Trojan.Win32.Generic.4!c
K7AntiVirus	Trojan ( 0056e06c1 )
BitDefender	Trojan.GenericKDZ.69589
K7GW	Trojan ( 0056e06c1 )
Cyren	W32/Emotet.AQN.gen!Eldorado
Symantec	Trojan.Emotet
APEX	Malicious
ClamAV	Win.Packed.Atraps-9427203-0
Kaspersky	HEUR:Trojan-Banker.Win32.Emotet.vho
Alibaba	Trojan:Win32/Emotet.5b7a9e62
NANO-Antivirus	Trojan.Win32.Emotet.hrwbum
ViRobot	Trojan.Win32.Emotet.307200.D
Ad-Aware	Trojan.GenericKDZ.69589
Comodo	Malware@#2d8t2c93y7uvl
MaxSecure	Trojan.Malware.105704542.susgen
DrWeb	Trojan.DownLoader34.26135
VIPRE	Trojan.Win32.Generic!BT
Invincea	Mal/Generic-R + Troj/Emotet-CLM
McAfee-GW-Edition	Emotet-FRV!BF8D1765907E
Sophos	Troj/Emotet-CLM
Ikarus	Trojan-Banker.Emotet
GData	Trojan.GenericKDZ.69589
Jiangmin	Backdoor.Emotet.sg
Avira	TR/ATRAPS.Gen
MAX	malware (ai score=89)
ZoneAlarm	HEUR:Trojan-Banker.Win32.Emotet.vho
AhnLab-V3	Trojan/Win32.Emotet.R348787
ALYac	Trojan.Agent.Emotet
TACHYON	Backdoor/W32.Emotet.307200.B
VBA32	Trojan.Downloader
Panda	Trj/CI.A
ESET-NOD32	Win32/Emotet.CD
Rising	Trojan.Kryptik!8.8 (TFE:5:iWoteBqaKyE)
Yandex	Trojan.Emotet!/Uj7+94mm78
Fortinet	W32/Kryptik.HCEJ!tr
CrowdStrike	win/malicious_confidence_100% (W)
Qihoo-360	Win32/Backdoor.c2f

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (8 个事件)

dead_host	192.168.56.101:49181
dead_host	185.94.252.104:443
dead_host	172.217.24.14:443
dead_host	70.121.172.89:80
dead_host	116.202.234.183:8080
dead_host	69.30.203.214:8080
dead_host	172.217.160.78:443
dead_host	192.168.56.101:49182

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-20 05:57:16

Imports

Library KERNEL32.dll:

• 0x42a0bc GetCommandLineA

• 0x42a0c0 TerminateProcess

• 0x42a0c4 RaiseException

• 0x42a0c8 HeapReAlloc

• 0x42a0cc HeapSize

• 0x42a0d0 GetACP

• 0x42a0d4 GetTimeZoneInformation

• 0x42a0d8 HeapDestroy

• 0x42a0dc HeapCreate

• 0x42a0e0 VirtualFree

• 0x42a0e4 VirtualAlloc

• 0x42a0e8 IsBadWritePtr

• 0x42a0ec LCMapStringA

• 0x42a0f0 LCMapStringW

• 0x42a0f4 Sleep

• 0x42a0f8 CompareStringA

• 0x42a0fc CompareStringW

• 0x42a100 UnhandledExceptionFilter

• 0x42a104 GetStartupInfoA

• 0x42a108 FreeEnvironmentStringsW

• 0x42a10c GetEnvironmentStrings

• 0x42a110 GetEnvironmentStringsW

• 0x42a114 SetHandleCount

• 0x42a118 GetStdHandle

• 0x42a11c GetFileType

• 0x42a120 SetUnhandledExceptionFilter

• 0x42a124 GetStringTypeA

• 0x42a128 GetStringTypeW

• 0x42a12c IsBadReadPtr

• 0x42a130 IsBadCodePtr

• 0x42a134 SetStdHandle

• 0x42a138 SetEnvironmentVariableA

• 0x42a13c RtlUnwind

• 0x42a140 HeapAlloc

• 0x42a144 HeapFree

• 0x42a148 GetProfileStringA

• 0x42a14c InterlockedExchange

• 0x42a150 GetFileTime

• 0x42a154 GetFileSize

• 0x42a158 GetFileAttributesA

• 0x42a15c GetTickCount

• 0x42a160 FileTimeToLocalFileTime

• 0x42a164 FileTimeToSystemTime

• 0x42a168 GetFullPathNameA

• 0x42a16c GetVolumeInformationA

• 0x42a170 FindFirstFileA

• 0x42a174 FindClose

• 0x42a178 SetEndOfFile

• 0x42a17c UnlockFile

• 0x42a180 LockFile

• 0x42a184 FlushFileBuffers

• 0x42a188 SetFilePointer

• 0x42a18c WriteFile

• 0x42a190 ReadFile

• 0x42a194 CreateFileA

• 0x42a198 GetCurrentProcess

• 0x42a19c DuplicateHandle

• 0x42a1a0 SetErrorMode

• 0x42a1a4 GetOEMCP

• 0x42a1a8 GetCPInfo

• 0x42a1ac GetThreadLocale

• 0x42a1b0 SizeofResource

• 0x42a1b4 GetProcessVersion

• 0x42a1b8 WritePrivateProfileStringA

• 0x42a1bc GlobalFlags

• 0x42a1c0 TlsGetValue

• 0x42a1c4 LocalReAlloc

• 0x42a1c8 TlsSetValue

• 0x42a1cc EnterCriticalSection

• 0x42a1d0 GlobalReAlloc

• 0x42a1d4 LeaveCriticalSection

• 0x42a1d8 TlsFree

• 0x42a1dc GlobalHandle

• 0x42a1e0 DeleteCriticalSection

• 0x42a1e4 TlsAlloc

• 0x42a1e8 InitializeCriticalSection

• 0x42a1ec LocalAlloc

• 0x42a1f0 lstrcpynA

• 0x42a1f4 GetLastError

• 0x42a1f8 FormatMessageA

• 0x42a1fc LocalFree

• 0x42a200 MulDiv

• 0x42a204 MultiByteToWideChar

• 0x42a208 WideCharToMultiByte

• 0x42a20c lstrlenA

• 0x42a210 InterlockedIncrement

• 0x42a214 InterlockedDecrement

• 0x42a218 LoadLibraryA

• 0x42a21c FreeLibrary

• 0x42a220 GetVersion

• 0x42a224 lstrcatA

• 0x42a228 GlobalGetAtomNameA

• 0x42a22c GlobalAddAtomA

• 0x42a230 GlobalFindAtomA

• 0x42a234 lstrcpyA

• 0x42a238 GetModuleHandleA

• 0x42a23c GetProcAddress

• 0x42a240 GlobalUnlock

• 0x42a244 GlobalFree

• 0x42a248 LockResource

• 0x42a24c FindResourceA

• 0x42a250 LoadResource

• 0x42a254 CloseHandle

• 0x42a258 GetModuleFileNameA

• 0x42a25c GlobalLock

• 0x42a260 GlobalAlloc

• 0x42a264 GlobalDeleteAtom

• 0x42a268 lstrcmpA

• 0x42a26c lstrcmpiA

• 0x42a270 GetCurrentThread

• 0x42a274 GetCurrentThreadId

• 0x42a278 ExitProcess

• 0x42a27c FreeEnvironmentStringsA

• 0x42a280 SetLastError

Library USER32.dll:

• 0x42a2b8 GetNextDlgGroupItem

• 0x42a2bc MessageBeep

• 0x42a2c0 InvalidateRect

• 0x42a2c4 CharUpperA

• 0x42a2c8 InflateRect

• 0x42a2cc RegisterClipboardFormatA

• 0x42a2d0 PostThreadMessageA

• 0x42a2d4 GetSysColor

• 0x42a2d8 SetFocus

• 0x42a2dc AdjustWindowRectEx

• 0x42a2e0 ScreenToClient

• 0x42a2e4 CopyRect

• 0x42a2e8 GetTopWindow

• 0x42a2ec IsChild

• 0x42a2f0 GetCapture

• 0x42a2f4 WinHelpA

• 0x42a2f8 wsprintfA

• 0x42a2fc GetClassInfoA

• 0x42a300 RegisterClassA

• 0x42a304 GetMenu

• 0x42a308 GetMenuItemCount

• 0x42a30c GetSubMenu

• 0x42a310 GetMenuItemID

• 0x42a314 GetWindowTextLengthA

• 0x42a318 GetWindowTextA

• 0x42a31c GetDlgCtrlID

• 0x42a320 DefWindowProcA

• 0x42a324 CreateWindowExA

• 0x42a328 GetClassLongA

• 0x42a32c SetPropA

• 0x42a330 UnhookWindowsHookEx

• 0x42a334 GetPropA

• 0x42a338 CallWindowProcA

• 0x42a33c RemovePropA

• 0x42a340 SetRect

• 0x42a344 GetMessagePos

• 0x42a348 GetForegroundWindow

• 0x42a34c PtInRect

• 0x42a350 SetWindowLongA

• 0x42a354 RegisterWindowMessageA

• 0x42a358 OffsetRect

• 0x42a35c IntersectRect

• 0x42a360 SystemParametersInfoA

• 0x42a364 GetWindowPlacement

• 0x42a368 GetWindowRect

• 0x42a36c MapDialogRect

• 0x42a370 SetWindowPos

• 0x42a374 GetWindow

• 0x42a378 SetWindowContextHelpId

• 0x42a37c EndDialog

• 0x42a380 SetActiveWindow

• 0x42a384 IsWindow

• 0x42a388 CreateDialogIndirectParamA

• 0x42a38c GetDlgItem

• 0x42a390 GetMenuCheckMarkDimensions

• 0x42a394 LoadBitmapA

• 0x42a398 GetMenuState

• 0x42a39c ModifyMenuA

• 0x42a3a0 SetMenuItemBitmaps

• 0x42a3a4 CheckMenuItem

• 0x42a3a8 EnableMenuItem

• 0x42a3ac GetFocus

• 0x42a3b0 GetNextDlgTabItem

• 0x42a3b4 GetMessageA

• 0x42a3b8 TranslateMessage

• 0x42a3bc DispatchMessageA

• 0x42a3c0 GetActiveWindow

• 0x42a3c4 GetKeyState

• 0x42a3c8 CallNextHookEx

• 0x42a3cc ValidateRect

• 0x42a3d0 IsWindowVisible

• 0x42a3d4 PeekMessageA

• 0x42a3d8 GetCursorPos

• 0x42a3dc ShowWindow

• 0x42a3e0 GetSystemMetrics

• 0x42a3e4 DrawIcon

• 0x42a3e8 UnregisterClassA

• 0x42a3ec HideCaret

• 0x42a3f0 ShowCaret

• 0x42a3f4 ExcludeUpdateRgn

• 0x42a3f8 DrawFocusRect

• 0x42a3fc SetWindowsHookExA

• 0x42a400 GetParent

• 0x42a404 GetLastActivePopup

• 0x42a408 IsWindowEnabled

• 0x42a40c GetWindowLongA

• 0x42a410 MessageBoxA

• 0x42a414 SetCursor

• 0x42a418 PostQuitMessage

• 0x42a41c PostMessageA

• 0x42a420 LoadIconA

• 0x42a424 EnableWindow

• 0x42a428 GetClientRect

• 0x42a42c CopyAcceleratorTableA

• 0x42a430 CharNextA

• 0x42a434 GetSysColorBrush

• 0x42a438 GetMessageTime

• 0x42a43c IsIconic

• 0x42a440 GetSystemMenu

• 0x42a444 DefDlgProcA

• 0x42a448 IsWindowUnicode

• 0x42a44c AppendMenuA

• 0x42a450 SendMessageA

• 0x42a454 GetClassNameA

• 0x42a458 GetDesktopWindow

• 0x42a45c LoadCursorA

• 0x42a460 DestroyMenu

• 0x42a464 GrayStringA

• 0x42a468 DrawTextA

• 0x42a46c TabbedTextOutA

• 0x42a470 EndPaint

• 0x42a474 BeginPaint

• 0x42a478 GetWindowDC

• 0x42a47c ReleaseDC

• 0x42a480 GetDC

• 0x42a484 ClientToScreen

• 0x42a488 LoadStringA

• 0x42a48c MoveWindow

• 0x42a490 SetWindowTextA

• 0x42a494 IsDialogMessageA

• 0x42a498 IsDlgButtonChecked

• 0x42a49c MapWindowPoints

• 0x42a4a0 DestroyWindow

• 0x42a4a4 CheckRadioButton

• 0x42a4a8 UpdateWindow

• 0x42a4ac SetForegroundWindow

• 0x42a4b0 SendDlgItemMessageA

Library GDI32.dll:

• 0x42a01c SetMapMode

• 0x42a020 SetViewportOrgEx

• 0x42a024 OffsetViewportOrgEx

• 0x42a028 SetViewportExtEx

• 0x42a02c ScaleViewportExtEx

• 0x42a030 SetWindowExtEx

• 0x42a034 ScaleWindowExtEx

• 0x42a038 IntersectClipRect

• 0x42a03c DeleteObject

• 0x42a040 GetDeviceCaps

• 0x42a044 GetViewportExtEx

• 0x42a048 GetWindowExtEx

• 0x42a04c CreateSolidBrush

• 0x42a050 PtVisible

• 0x42a054 RectVisible

• 0x42a058 TextOutA

• 0x42a05c ExtTextOutA

• 0x42a060 Escape

• 0x42a064 GetTextColor

• 0x42a068 GetBkColor

• 0x42a06c DPtoLP

• 0x42a070 LPtoDP

• 0x42a074 GetMapMode

• 0x42a078 PatBlt

• 0x42a07c SetBkMode

• 0x42a080 GetStockObject

• 0x42a084 SelectObject

• 0x42a088 RestoreDC

• 0x42a08c SaveDC

• 0x42a090 DeleteDC

• 0x42a094 GetObjectA

• 0x42a098 SetBkColor

• 0x42a09c SetTextColor

• 0x42a0a0 GetClipBox

• 0x42a0a4 CreateDIBitmap

• 0x42a0a8 GetTextExtentPointA

• 0x42a0ac BitBlt

• 0x42a0b0 CreateCompatibleDC

• 0x42a0b4 CreateBitmap

Library comdlg32.dll:

• 0x42a4c8 GetFileTitleA

Library WINSPOOL.DRV:

• 0x42a4b8 ClosePrinter

• 0x42a4bc DocumentPropertiesA

• 0x42a4c0 OpenPrinterA

Library ADVAPI32.dll:

• 0x42a000 RegCloseKey

• 0x42a004 RegSetValueExA

• 0x42a008 RegOpenKeyExA

• 0x42a00c RegCreateKeyExA

Library COMCTL32.dll:

• 0x42a014

Library oledlg.dll:

• 0x42a510

Library ole32.dll:

• 0x42a4d0 CoFreeUnusedLibraries

• 0x42a4d4 OleInitialize

• 0x42a4d8 CoTaskMemAlloc

• 0x42a4dc CoTaskMemFree

• 0x42a4e0 CreateILockBytesOnHGlobal

• 0x42a4e4 StgCreateDocfileOnILockBytes

• 0x42a4e8 StgOpenStorageOnILockBytes

• 0x42a4ec CoGetClassObject

• 0x42a4f0 CLSIDFromString

• 0x42a4f4 CLSIDFromProgID

• 0x42a4f8 CoRegisterMessageFilter

• 0x42a4fc CoRevokeClassObject

• 0x42a500 OleFlushClipboard

• 0x42a504 OleIsCurrentClipboard

• 0x42a508 OleUninitialize

Library OLEPRO32.DLL:

• 0x42a2b0

Library OLEAUT32.dll:

• 0x42a288 VariantCopy

• 0x42a28c VariantClear

• 0x42a290 SysAllocStringLen

• 0x42a294 SysFreeString

• 0x42a298 VariantChangeType

• 0x42a29c SysAllocString

• 0x42a2a0 SysAllocStringByteLen

• 0x42a2a4 SysStringLen

• 0x42a2a8 VariantTimeToSystemTime

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	62912	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	53210	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.