SmartHawk

9.2

极危

50 个模型检测该样本为恶意！

重新分析

下载样本

18ff84af25bb31c478741616288c35c91c87a21fe757b1fa60e1a5b6f30f6df1

c27f0ab858b64b0edf44f4730d73581e.exe

分析耗时

118s

最近分析

文件大小

617.5KB

静态报毒动态报毒 AI SCORE=87 ATTRIBUTE BZAQ CKGENERIC CLASSIC CONFUSERBG EJVW ELDORADO EMOTET GBYZS GENCIRC GENERICKD GENETIC GENKRYPTIK HFMY HIGH CONFIDENCE HIGHCONFIDENCE HRVURE KRYPTIK QVM41 R011C0DHF20 R347830 UNCLASSIFIEDMALWARE@0 UNSAFE WDBOP 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Emotet-FRW!C27F0AB858B6	20200830	6.0.6.653
Alibaba	Trojan:Win32/Emotet.4534bb76	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Kingsoft		20200830	2013.8.14.323
Tencent	Malware.Win32.Gencirc.10cde815	20200830	1.0.0.1
CrowdStrike		20190702	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619887920.118375 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (5 个事件)

Time & API	Arguments	Status	Return
1619887906.477375 CryptGenKey	crypto_handle: 0x005735f8 algorithm_identifier: 0x0000660e () provider_handle: 0x00575858 flags: 1 key: fûÐ¿MÍF?q^AW	success	1
1619887920.118375 CryptExportKey	crypto_handle: 0x005735f8 crypto_export_handle: 0x00573578 buffer: f¤\Rfx¼nUCÉoùbJ×ÙªÔ"¼+'WòÓû xn Að´l l»ßIt¿WV(4Þí£ô~!Xèö$?¥[kòÖbÂ ëNÒ¸úÃhÈ blob_type: 1 flags: 64	success	1
1619887948.587375 CryptExportKey	crypto_handle: 0x005735f8 crypto_export_handle: 0x00573578 buffer: f¤wZmQ.Æç{nlçëÂ¡4øX2K8i«XÕ_ºÏMðéQ:×i{A6ãà¿ÖÊ+ø2Ø¡£R>Q( 0.f®¨é·O$÷êAaf °Ñ£¬+kª: blob_type: 1 flags: 64	success	1
1619887953.681375 CryptExportKey	crypto_handle: 0x005735f8 crypto_export_handle: 0x00573578 buffer: f¤Ú!2Ïû£!¾»JÈ=³^©ÖEÄ1´JºÂÆÅ+ÄçÒ8ôÀ_åîyq°¥R=²y1åðµTMüÇ¢é·åIqYÝkYAÈ¹oÍs°¯×ÊkÍö!({ blob_type: 1 flags: 64	success	1
1619887978.509375 CryptExportKey	crypto_handle: 0x005735f8 crypto_export_handle: 0x00573578 buffer: f¤söZ ¼¦~úò.ÎàÊûKcpËÛ\¬r1öæhÄXÐí ÿ\K¹½X8%r0=T´Áø*ÄyÆ@,ñ/b,\¬S,Ue§üUrúisk blob_type: 1 flags: 64	success	1

This executable has a PDB path (1 个事件)

pdb_path

c:\Users\Mr.Anderson\Desktop\2008\13.8.20\cgridlistctrlex-master\vs2003\Release\CGridListCtrlEx.pdb

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1619887898.977502 NtAllocateVirtualMemory	process_identifier: 1380 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x005c0000	success
1619887957.665875 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0000000004000000	success
1619887906.149375 NtAllocateVirtualMemory	process_identifier: 2632 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01f40000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619887953.681375 Process32NextW	process_name: GoogleUpdate.exe snapshot_handle: 0x000003c0 process_identifier: 1164	success	1	0
1619887953.681375 Process32NextW	process_name: GoogleUpdate.exe snapshot_handle: 0x000003c0 process_identifier: 800	success	1	0

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619887900.352502 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c27f0ab858b64b0edf44f4730d73581e.exe newfilepath: C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0\rnr20.exe newfilepath_r: C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0\rnr20.exe flags: 3 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c27f0ab858b64b0edf44f4730d73581e.exe	success	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619887921.056375 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

rnr20.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619887920.759375 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (6 个事件)

host	113.108.239.196
host	172.217.24.14
host	192.210.135.126
host	24.233.112.152
host	47.144.21.12
host	69.30.203.214

Installs itself for autorun at Windows startup (1 个事件)

service_name

rnr20

service_path

C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0\rnr20.exe"

Created a service where a service was also not started (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619887905.071502 CreateServiceW	service_start_name: start_type: 2 service_handle: 0x006d8e90 display_name: rnr20 error_control: 0 service_name: rnr20 filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0\rnr20.exe" filepath_r: "C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0\rnr20.exe" service_manager_handle: 0x0374f6c8 desired_access: 2 service_type: 16 password:	success	7179920	0

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619887923.618375 RegSetValueExA	key_handle: 0x000003c0 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619887923.618375 RegSetValueExA	key_handle: 0x000003c0 value: 'H¸>× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619887923.618375 RegSetValueExA	key_handle: 0x000003c0 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619887923.618375 RegSetValueExW	key_handle: 0x000003c0 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619887923.618375 RegSetValueExA	key_handle: 0x000003d8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619887923.618375 RegSetValueExA	key_handle: 0x000003d8 value: 'H¸>× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619887923.618375 RegSetValueExA	key_handle: 0x000003d8 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619887923.649375 RegSetValueExW	key_handle: 0x000003bc value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0\rnr20.exe:Zone.Identifier

File has been identified by 50 AntiVirus engines on VirusTotal as malicious (50 个事件)

Bkav	W32.ConfuserBG.Trojan
Elastic	malicious (high confidence)
DrWeb	Trojan.Emotet.999
MicroWorld-eScan	Trojan.GenericKD.43660693
FireEye	Trojan.GenericKD.43660693
CAT-QuickHeal	Trojan.CKGENERIC
McAfee	Emotet-FRW!C27F0AB858B6
Cylance	Unsafe
Zillya	Backdoor.Emotet.Win32.1001
Sangfor	Malware
K7AntiVirus	Trojan ( 0056c7e01 )
Alibaba	Trojan:Win32/Emotet.4534bb76
K7GW	Trojan ( 0056c7e01 )
Arcabit	Trojan.Generic.D29A3595
Cyren	W32/Emotet.APQ.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Malware.Emotet-9371541-0
Kaspersky	Backdoor.Win32.Emotet.bzaq
BitDefender	Trojan.GenericKD.43660693
NANO-Antivirus	Trojan.Win32.Emotet.hrvure
ViRobot	Trojan.Win32.Emotet.632320
Rising	Trojan.Kryptik!1.CA82 (CLASSIC)
Ad-Aware	Trojan.GenericKD.43660693
TACHYON	Trojan/W32.Emotet.632320
Comodo	.UnclassifiedMalware@0
F-Secure	Trojan.TR/AD.Emotet.wdbop
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R011C0DHF20
Sophos	Troj/Emotet-CLA
Jiangmin	Trojan.Generic.gbyzs
Avira	TR/AD.Emotet.wdbop
Antiy-AVL	Trojan/Win32.Kryptik
Microsoft	Trojan:Win32/Emotet.AER!MTB
AegisLab	Trojan.Win32.Emotet.L!c
ZoneAlarm	Backdoor.Win32.Emotet.bzaq
GData	Trojan.GenericKD.43660693
AhnLab-V3	Trojan/Win32.Emotet.R347830
ALYac	Trojan.Agent.Emotet
MAX	malware (ai score=87)
Malwarebytes	Trojan.Emotet
ESET-NOD32	a variant of Win32/Kryptik.HFMY
TrendMicro-HouseCall	TROJ_GEN.R011C0DHF20
Tencent	Malware.Win32.Gencirc.10cde815
Ikarus	Trojan-Banker.Emotet
Fortinet	W32/GenKryptik.EJVW!tr
AVG	Win32:Malware-gen
Panda	Trj/Genetic.gen
Qihoo-360	Generic/HEUR/QVM41.2.3AEF.Malware.Gen

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (6 个事件)

dead_host	192.210.135.126:8080
dead_host	172.217.24.14:443
dead_host	24.233.112.152:80
dead_host	192.168.56.101:49188
dead_host	69.30.203.214:8080
dead_host	172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-14 04:26:45

Imports

Library KERNEL32.dll:

• 0x4620e8 RtlUnwind

• 0x4620ec TerminateProcess

• 0x4620f0 UnhandledExceptionFilter

• 0x4620f4 SetUnhandledExceptionFilter

• 0x4620f8 IsDebuggerPresent

• 0x4620fc GetTimeFormatA

• 0x462100 GetDateFormatA

• 0x462104 HeapFree

• 0x462108 VirtualProtect

• 0x46210c VirtualAlloc

• 0x462110 GetSystemInfo

• 0x462114 VirtualQuery

• 0x462118 HeapAlloc

• 0x46211c GetSystemTimeAsFileTime

• 0x462120 GetCommandLineA

• 0x462124 GetStartupInfoA

• 0x462128 HeapReAlloc

• 0x46212c HeapSize

• 0x462130 GetACP

• 0x462134 IsValidCodePage

• 0x462138 LCMapStringW

• 0x46213c GetTimeZoneInformation

• 0x462140 HeapCreate

• 0x462144 GetFileTime

• 0x462148 VirtualFree

• 0x46214c GetStdHandle

• 0x462150 LCMapStringA

• 0x462154 GetStringTypeA

• 0x462158 GetStringTypeW

• 0x46215c FreeEnvironmentStringsA

• 0x462160 GetEnvironmentStrings

• 0x462164 FreeEnvironmentStringsW

• 0x462168 GetEnvironmentStringsW

• 0x46216c SetHandleCount

• 0x462170 GetFileType

• 0x462174 QueryPerformanceCounter

• 0x462178 InitializeCriticalSectionAndSpinCount

• 0x46217c GetUserDefaultLCID

• 0x462180 EnumSystemLocalesA

• 0x462184 IsValidLocale

• 0x462188 GetConsoleCP

• 0x46218c GetConsoleMode

• 0x462190 GetLocaleInfoW

• 0x462194 SetStdHandle

• 0x462198 WriteConsoleA

• 0x46219c GetConsoleOutputCP

• 0x4621a0 WriteConsoleW

• 0x4621a4 CompareStringW

• 0x4621a8 SetEnvironmentVariableA

• 0x4621ac GetFileSizeEx

• 0x4621b0 GetFileAttributesA

• 0x4621b4 SetErrorMode

• 0x4621b8 FileTimeToLocalFileTime

• 0x4621bc GetModuleHandleW

• 0x4621c0 GetOEMCP

• 0x4621c4 GetCPInfo

• 0x4621c8 CreateFileA

• 0x4621cc GetFullPathNameA

• 0x4621d0 GetVolumeInformationA

• 0x4621d4 FindFirstFileA

• 0x4621d8 FindClose

• 0x4621dc GetCurrentProcess

• 0x4621e0 DuplicateHandle

• 0x4621e4 GetFileSize

• 0x4621e8 SetEndOfFile

• 0x4621ec UnlockFile

• 0x4621f0 LockFile

• 0x4621f4 FlushFileBuffers

• 0x4621f8 SetFilePointer

• 0x4621fc WriteFile

• 0x462200 ReadFile

• 0x462204 GetThreadLocale

• 0x462208 InterlockedIncrement

• 0x46220c TlsFree

• 0x462210 DeleteCriticalSection

• 0x462214 LocalReAlloc

• 0x462218 TlsSetValue

• 0x46221c TlsAlloc

• 0x462220 InitializeCriticalSection

• 0x462224 GlobalHandle

• 0x462228 GlobalReAlloc

• 0x46222c EnterCriticalSection

• 0x462230 TlsGetValue

• 0x462234 LeaveCriticalSection

• 0x462238 LocalAlloc

• 0x46223c GlobalFlags

• 0x462240 GetProfileIntA

• 0x462244 FileTimeToSystemTime

• 0x462248 InterlockedDecrement

• 0x46224c GetModuleFileNameW

• 0x462250 CopyFileA

• 0x462254 GlobalSize

• 0x462258 FormatMessageA

• 0x46225c LocalFree

• 0x462260 lstrlenW

• 0x462264 MulDiv

• 0x462268 GlobalGetAtomNameA

• 0x46226c GlobalFindAtomA

• 0x462270 lstrcmpW

• 0x462274 GetVersionExA

• 0x462278 GetTickCount

• 0x46227c GetPrivateProfileStringA

• 0x462280 WritePrivateProfileStringA

• 0x462284 FreeResource

• 0x462288 GetCurrentProcessId

• 0x46228c GlobalAddAtomA

• 0x462290 CloseHandle

• 0x462294 GlobalDeleteAtom

• 0x462298 GetCurrentThread

• 0x46229c GetCurrentThreadId

• 0x4622a0 ConvertDefaultLocale

• 0x4622a4 EnumResourceLanguagesA

• 0x4622a8 GetModuleFileNameA

• 0x4622ac GetLocaleInfoA

• 0x4622b0 CompareStringA

• 0x4622b4 InterlockedExchange

• 0x4622b8 lstrcmpA

• 0x4622bc Sleep

• 0x4622c0 GlobalAlloc

• 0x4622c4 GlobalLock

• 0x4622c8 GlobalUnlock

• 0x4622cc GlobalFree

• 0x4622d0 lstrcpynA

• 0x4622d4 FreeLibrary

• 0x4622d8 VerSetConditionMask

• 0x4622dc VerifyVersionInfoA

• 0x4622e0 MultiByteToWideChar

• 0x4622e4 lstrlenA

• 0x4622e8 RaiseException

• 0x4622ec DebugBreak

• 0x4622f0 WideCharToMultiByte

• 0x4622f4 LoadResource

• 0x4622f8 LockResource

• 0x4622fc SizeofResource

• 0x462300 FindResourceA

• 0x462304 GetModuleHandleA

• 0x462308 LoadLibraryA

• 0x46230c GetProcAddress

• 0x462310 GetLastError

• 0x462314 SetLastError

• 0x462318 ExitProcess

Library USER32.dll:

• 0x462380 LoadCursorA

• 0x462384 ReleaseCapture

• 0x462388 SetCapture

• 0x46238c SetRect

• 0x462390 IsRectEmpty

• 0x462394 WindowFromPoint

• 0x462398 DestroyMenu

• 0x46239c EndPaint

• 0x4623a0 BeginPaint

• 0x4623a4 GetWindowDC

• 0x4623a8 ClientToScreen

• 0x4623ac GrayStringA

• 0x4623b0 DrawTextExA

• 0x4623b4 TabbedTextOutA

• 0x4623b8 ShowWindow

• 0x4623bc MoveWindow

• 0x4623c0 SetWindowTextA

• 0x4623c4 IsDialogMessageA

• 0x4623c8 RegisterWindowMessageA

• 0x4623cc SendDlgItemMessageA

• 0x4623d0 WinHelpA

• 0x4623d4 IsChild

• 0x4623d8 GetCapture

• 0x4623dc GetClassLongA

• 0x4623e0 GetClassNameA

• 0x4623e4 GetPropA

• 0x4623e8 RemovePropA

• 0x4623ec SetFocus

• 0x4623f0 GetWindowTextLengthA

• 0x4623f4 GetWindowTextA

• 0x4623f8 GetForegroundWindow

• 0x4623fc GetTopWindow

• 0x462400 UnhookWindowsHookEx

• 0x462404 GetMessageTime

• 0x462408 TrackPopupMenu

• 0x46240c SetMenu

• 0x462410 GetScrollRange

• 0x462414 GetScrollPos

• 0x462418 SetForegroundWindow

• 0x46241c GetSubMenu

• 0x462420 GetMenuItemID

• 0x462424 CreateWindowExA

• 0x462428 GetClassInfoExA

• 0x46242c GetClassInfoA

• 0x462430 RegisterClassA

• 0x462434 AdjustWindowRectEx

• 0x462438 GetDlgCtrlID

• 0x46243c DefWindowProcA

• 0x462440 CallWindowProcA

• 0x462444 GetMenu

• 0x462448 SetWindowLongA

• 0x46244c IntersectRect

• 0x462450 SystemParametersInfoA

• 0x462454 GetWindowPlacement

• 0x462458 SetWindowContextHelpId

• 0x46245c MapDialogRect

• 0x462460 SetWindowPos

• 0x462464 RegisterClipboardFormatA

• 0x462468 SetActiveWindow

• 0x46246c CreateDialogIndirectParamA

• 0x462470 DestroyWindow

• 0x462474 IsWindow

• 0x462478 GetDlgItem

• 0x46247c GetNextDlgTabItem

• 0x462480 EndDialog

• 0x462484 GetWindowThreadProcessId

• 0x462488 GetWindowLongA

• 0x46248c GetSystemMetrics

• 0x462490 DrawIcon

• 0x462494 AppendMenuA

• 0x462498 SendMessageA

• 0x46249c GetLastActivePopup

• 0x4624a0 IsWindowEnabled

• 0x4624a4 MessageBoxA

• 0x4624a8 SetCursor

• 0x4624ac SetWindowsHookExA

• 0x4624b0 CallNextHookEx

• 0x4624b4 GetMessageA

• 0x4624b8 TranslateMessage

• 0x4624bc DispatchMessageA

• 0x4624c0 GetActiveWindow

• 0x4624c4 IsWindowVisible

• 0x4624c8 PeekMessageA

• 0x4624cc GetCursorPos

• 0x4624d0 ValidateRect

• 0x4624d4 UnregisterClassA

• 0x4624d8 MessageBeep

• 0x4624dc GetNextDlgGroupItem

• 0x4624e0 InvalidateRgn

• 0x4624e4 CopyAcceleratorTableA

• 0x4624e8 CharNextA

• 0x4624ec SetMenuItemBitmaps

• 0x4624f0 GetMenuCheckMarkDimensions

• 0x4624f4 PostThreadMessageA

• 0x4624f8 CharUpperA

• 0x4624fc GetSysColorBrush

• 0x462500 MapWindowPoints

• 0x462504 GetSystemMenu

• 0x462508 IsIconic

• 0x46250c GetClientRect

• 0x462510 EnableWindow

• 0x462514 LoadIconA

• 0x462518 GetFocus

• 0x46251c PostMessageA

• 0x462520 GetDC

• 0x462524 ReleaseDC

• 0x462528 UpdateWindow

• 0x46252c InvalidateRect

• 0x462530 GetWindow

• 0x462534 GetParent

• 0x462538 PtInRect

• 0x46253c InflateRect

• 0x462540 OffsetRect

• 0x462544 FillRect

• 0x462548 GetWindowRect

• 0x46254c GetSysColor

• 0x462550 GetDesktopWindow

• 0x462554 GetKeyState

• 0x462558 GetMessagePos

• 0x46255c SetClipboardData

• 0x462560 CloseClipboard

• 0x462564 EmptyClipboard

• 0x462568 DrawTextA

• 0x46256c CreatePopupMenu

• 0x462570 GetMenuItemCount

• 0x462574 ScreenToClient

• 0x462578 OpenClipboard

• 0x46257c CopyRect

• 0x462580 EqualRect

• 0x462584 DrawFocusRect

• 0x462588 PostQuitMessage

• 0x46258c CheckMenuItem

• 0x462590 EnableMenuItem

• 0x462594 GetMenuState

• 0x462598 ModifyMenuA

• 0x46259c LoadBitmapA

• 0x4625a0 SetPropA

Library GDI32.dll:

• 0x46203c ExtSelectClipRgn

• 0x462040 DeleteDC

• 0x462044 GetStockObject

• 0x462048 GetDeviceCaps

• 0x46204c CreatePen

• 0x462050 CreateSolidBrush

• 0x462054 CopyMetaFileA

• 0x462058 GetMapMode

• 0x46205c GetBkColor

• 0x462060 GetTextColor

• 0x462064 GetRgnBox

• 0x462068 ScaleWindowExtEx

• 0x46206c SetWindowExtEx

• 0x462070 ScaleViewportExtEx

• 0x462074 SetViewportExtEx

• 0x462078 OffsetViewportOrgEx

• 0x46207c SetViewportOrgEx

• 0x462080 SelectObject

• 0x462084 Escape

• 0x462088 ExtTextOutA

• 0x46208c TextOutA

• 0x462090 RectVisible

• 0x462094 GetTextExtentPoint32A

• 0x462098 GetWindowExtEx

• 0x46209c GetViewportExtEx

• 0x4620a0 MoveToEx

• 0x4620a4 LineTo

• 0x4620a8 SetMapMode

• 0x4620ac RestoreDC

• 0x4620b0 SaveDC

• 0x4620b4 SetBkColor

• 0x4620b8 SetTextColor

• 0x4620bc GetClipBox

• 0x4620c0 CreateRectRgnIndirect

• 0x4620c4 CreateBitmap

• 0x4620c8 DeleteObject

• 0x4620cc CreateFontIndirectA

• 0x4620d0 CreateCompatibleDC

• 0x4620d4 CreateCompatibleBitmap

• 0x4620d8 GetCurrentObject

• 0x4620dc GetObjectA

• 0x4620e0 PtVisible

Library COMDLG32.dll:

• 0x462034 GetFileTitleA

Library WINSPOOL.DRV:

• 0x4625a8 DocumentPropertiesA

• 0x4625ac ClosePrinter

• 0x4625b0 OpenPrinterA

Library ADVAPI32.dll:

• 0x462000 RegCreateKeyExA

• 0x462004 RegDeleteValueA

• 0x462008 RegSetValueExA

• 0x46200c RegCloseKey

• 0x462010 RegQueryValueA

• 0x462014 RegOpenKeyA

• 0x462018 RegEnumKeyA

• 0x46201c RegDeleteKeyA

• 0x462020 RegOpenKeyExA

• 0x462024 RegQueryValueExA

Library SHELL32.dll:

• 0x462364 ShellExecuteA

Library COMCTL32.dll:

• 0x46202c

Library SHLWAPI.dll:

• 0x46236c PathFindFileNameA

• 0x462370 PathStripToRootA

• 0x462374 PathIsUNCA

• 0x462378 PathFindExtensionA

Library oledlg.dll:

• 0x462614

Library ole32.dll:

• 0x4625b8 CreateStreamOnHGlobal

• 0x4625bc CreateILockBytesOnHGlobal

• 0x4625c0 StgCreateDocfileOnILockBytes

• 0x4625c4 StgOpenStorageOnILockBytes

• 0x4625c8 CoRegisterMessageFilter

• 0x4625cc CoRevokeClassObject

• 0x4625d0 CoGetClassObject

• 0x4625d4 RevokeDragDrop

• 0x4625d8 CoLockObjectExternal

• 0x4625dc RegisterDragDrop

• 0x4625e0 OleFlushClipboard

• 0x4625e4 OleIsCurrentClipboard

• 0x4625e8 OleDuplicateData

• 0x4625ec CoTaskMemAlloc

• 0x4625f0 ReleaseStgMedium

• 0x4625f4 CoTaskMemFree

• 0x4625f8 CLSIDFromString

• 0x4625fc CLSIDFromProgID

• 0x462600 OleInitialize

• 0x462604 CoFreeUnusedLibraries

• 0x462608 OleUninitialize

• 0x46260c DoDragDrop

Library OLEAUT32.dll:

• 0x462320 SystemTimeToVariantTime

• 0x462324 VarBstrFromDate

• 0x462328 SysFreeString

• 0x46232c VarUdateFromDate

• 0x462330 VarDateFromStr

• 0x462334 SysStringLen

• 0x462338 SysAllocStringLen

• 0x46233c VariantClear

• 0x462340 VariantChangeType

• 0x462344 VariantInit

• 0x462348 SysAllocStringByteLen

• 0x46234c OleCreateFontIndirect

• 0x462350 SafeArrayDestroy

• 0x462354 SysAllocString

• 0x462358 VariantCopy

• 0x46235c VariantTimeToSystemTime

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com	172.217.160.78
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	60088	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	62191	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	53210	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	58970	224.0.0.252	5355
192.168.56.101	60221	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.