SmartHawk

4.4

中危

52 个模型检测该样本为恶意！

重新分析

下载样本

467f23ee6a6a4c8a8ae03480b889f9620f2af15b5290e1092b0e85af8718a17d

de3e62b322b195e2cae1f32c03cb33df.exe

分析耗时

82s

最近分析

文件大小

927.7KB

静态报毒动态报毒 100% 5KY@A0UOK8MI AI SCORE=85 AIDETECTVM ATTRIBUTE BSCOPE BT6JTN BYPASSUAC CONFIDENCE DELF EKLE ETSV GDSDA GENCIRC GENERICRXLK GENKRYPTIK HIGH CONFIDENCE HIGHCONFIDENCE HNWRZY IGENT INVALIDSIG MALWARE2 MALWARE@#2VUAEL3UINFBH R007C0DKG20 R346175 REMCOSCRYPT RESCOMS SCORE STATIC AI SUSPICIOUS PE UNSAFE UQVFT WACATAC WRQD ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	GenericRXLK-OW!DE3E62B322B1	20210126	6.0.6.653
Alibaba	Backdoor:Win32/Rescoms.eecb792a	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Malware-gen	20210126	21.1.5827.0
Tencent	Malware.Win32.Gencirc.10cde058	20210126	1.0.0.1
Kingsoft		20210126	2017.9.26.565
CrowdStrike	win/malicious_confidence_100% (W)	20210106	1.0

This executable is signed

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)

section

.itext

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619948481.309176 __exception__	stacktrace: 0x21e9796 0x21e97c9 0x21e96e6 0x219f744 0x21ea3fc 0x21eb472 0x21ae41e gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x775a62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x775a6d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x775a77c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x775a7bca 0x21e6810 0x21eb747 de3e62b322b195e2cae1f32c03cb33df+0x69e7a @ 0x469e7a registers.esp: 1634012 registers.edi: 0 registers.eax: 1634012 registers.ebp: 1634092 registers.edx: 0 registers.ebx: 1635768 registers.esi: 53812132 registers.ecx: 7 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x778eb727	success	0	0

Allocates read-write-execute memory (usually to unpack itself) (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619948415.919176 NtAllocateVirtualMemory	process_identifier: 2760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005c0000	success	0	0
1619948436.528176 NtAllocateVirtualMemory	process_identifier: 2760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01f50000	success	0	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Disables proxy possibly for traffic interception (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619948451.872176 RegSetValueExA	key_handle: 0x000002c4 value: 0 regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	success	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

108.160.167.147:443

File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Agent.ETSV
FireEye	Generic.mg.de3e62b322b195e2
McAfee	GenericRXLK-OW!DE3E62B322B1
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Trojan ( 0053ba121 )
Alibaba	Backdoor:Win32/Rescoms.eecb792a
K7GW	Trojan ( 0053ba121 )
Cybereason	malicious.322b19
Arcabit	Trojan.Agent.ETSV
BitDefenderTheta	Gen:NN.ZelphiF.34780.5KY@a0uOK8mi
Cyren	W32/Delf.WRQD-3477
Symantec	ML.Attribute.HighConfidence
TrendMicro-HouseCall	TROJ_GEN.R007C0DKG20
Avast	Win32:Malware-gen
Kaspersky	HEUR:Exploit.Win32.BypassUAC.gen
BitDefender	Trojan.Agent.ETSV
NANO-Antivirus	Exploit.Win32.BypassUAC.hnwrzy
Paloalto	generic.ml
Tencent	Malware.Win32.Gencirc.10cde058
Ad-Aware	Trojan.Agent.ETSV
Sophos	Mal/Generic-S
Comodo	Malware@#2vuael3uinfbh
F-Secure	Trojan.TR/Rescoms.uqvft
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R007C0DKG20
McAfee-GW-Edition	GenericRXLK-OW!DE3E62B322B1
SentinelOne	Static AI - Suspicious PE
Emsisoft	Trojan.Agent.ETSV (B)
APEX	Malicious
Jiangmin	Exploit.BypassUAC.bvf
eGambit	PE.Heur.InvalidSig
Avira	TR/Rescoms.uqvft
MAX	malware (ai score=85)
Antiy-AVL	Trojan[Exploit]/Win32.BypassUAC
Microsoft	Trojan:Win32/RemcosCrypt.ACH!MTB
ZoneAlarm	HEUR:Exploit.Win32.BypassUAC.gen
GData	Trojan.Agent.ETSV
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.BypassUAC.R346175
VBA32	BScope.Trojan.Wacatac
Malwarebytes	Trojan.MalPack.SMY
ESET-NOD32	Win32/Rescoms.B
Yandex	Trojan.Igent.bT6jtN.247
Ikarus	Trojan.Inject
Fortinet	W32/GenKryptik.EKLE!tr
AVG	Win32:Malware-gen
Panda	Trj/GdSda.A

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library oleaut32.dll:

• 0x4d9780 SysFreeString

• 0x4d9784 SysReAllocStringLen

• 0x4d9788 SysAllocStringLen

Library advapi32.dll:

• 0x4d9790 RegQueryValueExA

• 0x4d9794 RegOpenKeyExA

• 0x4d9798 RegCloseKey

Library user32.dll:

• 0x4d97a0 GetKeyboardType

• 0x4d97a4 DestroyWindow

• 0x4d97a8 LoadStringA

• 0x4d97ac MessageBoxA

• 0x4d97b0 CharNextA

Library kernel32.dll:

• 0x4d97b8 GetACP

• 0x4d97bc Sleep

• 0x4d97c0 VirtualFree

• 0x4d97c4 VirtualAlloc

• 0x4d97c8 GetTickCount

• 0x4d97cc QueryPerformanceCounter

• 0x4d97d0 GetCurrentThreadId

• 0x4d97d4 InterlockedDecrement

• 0x4d97d8 InterlockedIncrement

• 0x4d97dc VirtualQuery

• 0x4d97e0 WideCharToMultiByte

• 0x4d97e4 MultiByteToWideChar

• 0x4d97e8 lstrlenA

• 0x4d97ec lstrcpynA

• 0x4d97f0 LoadLibraryExA

• 0x4d97f4 GetThreadLocale

• 0x4d97f8 GetStartupInfoA

• 0x4d97fc GetProcAddress

• 0x4d9800 GetModuleHandleA

• 0x4d9804 GetModuleFileNameA

• 0x4d9808 GetLocaleInfoA

• 0x4d980c GetCommandLineA

• 0x4d9810 FreeLibrary

• 0x4d9814 FindFirstFileA

• 0x4d9818 FindClose

• 0x4d981c ExitProcess

• 0x4d9820 CompareStringA

• 0x4d9824 WriteFile

• 0x4d9828 UnhandledExceptionFilter

• 0x4d982c RtlUnwind

• 0x4d9830 RaiseException

• 0x4d9834 GetStdHandle

Library kernel32.dll:

• 0x4d983c TlsSetValue

• 0x4d9840 TlsGetValue

• 0x4d9844 LocalAlloc

• 0x4d9848 GetModuleHandleA

Library user32.dll:

• 0x4d9850 CreateWindowExA

• 0x4d9854 WindowFromPoint

• 0x4d9858 WaitMessage

• 0x4d985c UpdateWindow

• 0x4d9860 UnregisterClassA

• 0x4d9864 UnhookWindowsHookEx

• 0x4d9868 TranslateMessage

• 0x4d986c TranslateMDISysAccel

• 0x4d9870 TrackPopupMenu

• 0x4d9874 SystemParametersInfoA

• 0x4d9878 ShowWindow

• 0x4d987c ShowScrollBar

• 0x4d9880 ShowOwnedPopups

• 0x4d9884 SetWindowsHookExA

• 0x4d9888 SetWindowTextA

• 0x4d988c SetWindowPos

• 0x4d9890 SetWindowPlacement

• 0x4d9894 SetWindowLongW

• 0x4d9898 SetWindowLongA

• 0x4d989c SetTimer

• 0x4d98a0 SetScrollRange

• 0x4d98a4 SetScrollPos

• 0x4d98a8 SetScrollInfo

• 0x4d98ac SetRect

• 0x4d98b0 SetPropA

• 0x4d98b4 SetParent

• 0x4d98b8 SetMenuItemInfoA

• 0x4d98bc SetMenu

• 0x4d98c0 SetForegroundWindow

• 0x4d98c4 SetFocus

• 0x4d98c8 SetCursor

• 0x4d98cc SetClassLongA

• 0x4d98d0 SetCapture

• 0x4d98d4 SetActiveWindow

• 0x4d98d8 SendMessageW

• 0x4d98dc SendMessageA

• 0x4d98e0 ScrollWindow

• 0x4d98e4 ScreenToClient

• 0x4d98e8 RemovePropA

• 0x4d98ec RemoveMenu

• 0x4d98f0 ReleaseDC

• 0x4d98f4 ReleaseCapture

• 0x4d98f8 RegisterWindowMessageA

• 0x4d98fc RegisterClipboardFormatA

• 0x4d9900 RegisterClassA

• 0x4d9904 RedrawWindow

• 0x4d9908 PtInRect

• 0x4d990c PostQuitMessage

• 0x4d9910 PostMessageA

• 0x4d9914 PeekMessageW

• 0x4d9918 PeekMessageA

• 0x4d991c OffsetRect

• 0x4d9920 OemToCharA

• 0x4d9924 MessageBoxA

• 0x4d9928 MapWindowPoints

• 0x4d992c MapVirtualKeyA

• 0x4d9930 LoadStringA

• 0x4d9934 LoadKeyboardLayoutA

• 0x4d9938 LoadIconA

• 0x4d993c LoadCursorA

• 0x4d9940 LoadBitmapA

• 0x4d9944 KillTimer

• 0x4d9948 IsZoomed

• 0x4d994c IsWindowVisible

• 0x4d9950 IsWindowUnicode

• 0x4d9954 IsWindowEnabled

• 0x4d9958 IsWindow

• 0x4d995c IsRectEmpty

• 0x4d9960 IsIconic

• 0x4d9964 IsDialogMessageW

• 0x4d9968 IsDialogMessageA

• 0x4d996c IsChild

• 0x4d9970 InvalidateRect

• 0x4d9974 IntersectRect

• 0x4d9978 InsertMenuItemA

• 0x4d997c InsertMenuA

• 0x4d9980 InflateRect

• 0x4d9984 GetWindowThreadProcessId

• 0x4d9988 GetWindowTextA

• 0x4d998c GetWindowRect

• 0x4d9990 GetWindowPlacement

• 0x4d9994 GetWindowLongW

• 0x4d9998 GetWindowLongA

• 0x4d999c GetWindowDC

• 0x4d99a0 GetTopWindow

• 0x4d99a4 GetSystemMetrics

• 0x4d99a8 GetSystemMenu

• 0x4d99ac GetSysColorBrush

• 0x4d99b0 GetSysColor

• 0x4d99b4 GetSubMenu

• 0x4d99b8 GetScrollRange

• 0x4d99bc GetScrollPos

• 0x4d99c0 GetScrollInfo

• 0x4d99c4 GetPropA

• 0x4d99c8 GetParent

• 0x4d99cc GetWindow

• 0x4d99d0 GetMessagePos

• 0x4d99d4 GetMenuStringA

• 0x4d99d8 GetMenuState

• 0x4d99dc GetMenuItemInfoA

• 0x4d99e0 GetMenuItemID

• 0x4d99e4 GetMenuItemCount

• 0x4d99e8 GetMenu

• 0x4d99ec GetLastActivePopup

• 0x4d99f0 GetKeyboardState

• 0x4d99f4 GetKeyboardLayoutNameA

• 0x4d99f8 GetKeyboardLayoutList

• 0x4d99fc GetKeyboardLayout

• 0x4d9a00 GetKeyState

• 0x4d9a04 GetKeyNameTextA

• 0x4d9a08 GetIconInfo

• 0x4d9a0c GetForegroundWindow

• 0x4d9a10 GetFocus

• 0x4d9a14 GetDesktopWindow

• 0x4d9a18 GetDCEx

• 0x4d9a1c GetDC

• 0x4d9a20 GetCursorPos

• 0x4d9a24 GetCursor

• 0x4d9a28 GetClientRect

• 0x4d9a2c GetClassLongA

• 0x4d9a30 GetClassInfoA

• 0x4d9a34 GetCapture

• 0x4d9a38 GetActiveWindow

• 0x4d9a3c FrameRect

• 0x4d9a40 FindWindowExA

• 0x4d9a44 FindWindowA

• 0x4d9a48 FillRect

• 0x4d9a4c EqualRect

• 0x4d9a50 EnumWindows

• 0x4d9a54 EnumThreadWindows

• 0x4d9a58 EnumChildWindows

• 0x4d9a5c EndPaint

• 0x4d9a60 EnableWindow

• 0x4d9a64 EnableScrollBar

• 0x4d9a68 EnableMenuItem

• 0x4d9a6c DrawTextA

• 0x4d9a70 DrawMenuBar

• 0x4d9a74 DrawIconEx

• 0x4d9a78 DrawIcon

• 0x4d9a7c DrawFrameControl

• 0x4d9a80 DrawEdge

• 0x4d9a84 DispatchMessageW

• 0x4d9a88 DispatchMessageA

• 0x4d9a8c DestroyWindow

• 0x4d9a90 DestroyMenu

• 0x4d9a94 DestroyIcon

• 0x4d9a98 DestroyCursor

• 0x4d9a9c DeleteMenu

• 0x4d9aa0 DefWindowProcA

• 0x4d9aa4 DefMDIChildProcA

• 0x4d9aa8 DefFrameProcA

• 0x4d9aac CreatePopupMenu

• 0x4d9ab0 CreateMenu

• 0x4d9ab4 CreateIcon

• 0x4d9ab8 ClientToScreen

• 0x4d9abc CheckMenuItem

• 0x4d9ac0 CharNextW

• 0x4d9ac4 CallWindowProcA

• 0x4d9ac8 CallNextHookEx

• 0x4d9acc BeginPaint

• 0x4d9ad0 CharNextA

• 0x4d9ad4 CharLowerA

• 0x4d9ad8 CharUpperBuffA

• 0x4d9adc CharToOemA

• 0x4d9ae0 AdjustWindowRectEx

• 0x4d9ae4 ActivateKeyboardLayout

Library gdi32.dll:

• 0x4d9aec UnrealizeObject

• 0x4d9af0 StretchBlt

• 0x4d9af4 SetWindowOrgEx

• 0x4d9af8 SetViewportOrgEx

• 0x4d9afc SetTextColor

• 0x4d9b00 SetStretchBltMode

• 0x4d9b04 SetROP2

• 0x4d9b08 SetPixel

• 0x4d9b0c SetDIBColorTable

• 0x4d9b10 SetBrushOrgEx

• 0x4d9b14 SetBkMode

• 0x4d9b18 SetBkColor

• 0x4d9b1c SelectPalette

• 0x4d9b20 SelectObject

• 0x4d9b24 SelectClipRgn

• 0x4d9b28 SaveDC

• 0x4d9b2c RestoreDC

• 0x4d9b30 Rectangle

• 0x4d9b34 RectVisible

• 0x4d9b38 RealizePalette

• 0x4d9b3c Polyline

• 0x4d9b40 PatBlt

• 0x4d9b44 MoveToEx

• 0x4d9b48 MaskBlt

• 0x4d9b4c LineTo

• 0x4d9b50 IntersectClipRect

• 0x4d9b54 GetWindowOrgEx

• 0x4d9b58 GetTextMetricsA

• 0x4d9b5c GetTextExtentPoint32A

• 0x4d9b60 GetSystemPaletteEntries

• 0x4d9b64 GetStockObject

• 0x4d9b68 GetRgnBox

• 0x4d9b6c GetROP2

• 0x4d9b70 GetPixel

• 0x4d9b74 GetPaletteEntries

• 0x4d9b78 GetObjectA

• 0x4d9b7c GetDeviceCaps

• 0x4d9b80 GetDIBits

• 0x4d9b84 GetDIBColorTable

• 0x4d9b88 GetDCOrgEx

• 0x4d9b8c GetDCPenColor

• 0x4d9b90 GetCurrentPositionEx

• 0x4d9b94 GetClipBox

• 0x4d9b98 GetBrushOrgEx

• 0x4d9b9c GetBkMode

• 0x4d9ba0 GetBitmapBits

• 0x4d9ba4 ExcludeClipRect

• 0x4d9ba8 DeleteObject

• 0x4d9bac DeleteDC

• 0x4d9bb0 CreateSolidBrush

• 0x4d9bb4 CreatePenIndirect

• 0x4d9bb8 CreatePalette

• 0x4d9bbc CreateHalftonePalette

• 0x4d9bc0 CreateFontIndirectA

• 0x4d9bc4 CreateDIBitmap

• 0x4d9bc8 CreateDIBSection

• 0x4d9bcc CreateCompatibleDC

• 0x4d9bd0 CreateCompatibleBitmap

• 0x4d9bd4 CreateBrushIndirect

• 0x4d9bd8 CreateBitmap

• 0x4d9bdc BitBlt

Library version.dll:

• 0x4d9be4 VerQueryValueA

• 0x4d9be8 GetFileVersionInfoSizeA

• 0x4d9bec GetFileVersionInfoA

Library kernel32.dll:

• 0x4d9bf4 lstrcpyA

• 0x4d9bf8 WriteFile

• 0x4d9bfc WaitForSingleObject

• 0x4d9c00 VirtualQuery

• 0x4d9c04 VirtualProtect

• 0x4d9c08 VirtualAlloc

• 0x4d9c0c SizeofResource

• 0x4d9c10 SetThreadLocale

• 0x4d9c14 SetFilePointer

• 0x4d9c18 SetEvent

• 0x4d9c1c SetErrorMode

• 0x4d9c20 SetEndOfFile

• 0x4d9c24 ResetEvent

• 0x4d9c28 ReadFile

• 0x4d9c2c MultiByteToWideChar

• 0x4d9c30 MulDiv

• 0x4d9c34 LockResource

• 0x4d9c38 LoadResource

• 0x4d9c3c LoadLibraryA

• 0x4d9c40 LeaveCriticalSection

• 0x4d9c44 InitializeCriticalSection

• 0x4d9c48 GlobalFindAtomA

• 0x4d9c4c GlobalDeleteAtom

• 0x4d9c50 GlobalAddAtomA

• 0x4d9c54 GetVersionExA

• 0x4d9c58 GetVersion

• 0x4d9c5c GetTickCount

• 0x4d9c60 GetThreadLocale

• 0x4d9c64 GetStdHandle

• 0x4d9c68 GetProcAddress

• 0x4d9c6c GetModuleHandleA

• 0x4d9c70 GetModuleFileNameA

• 0x4d9c74 GetLocaleInfoA

• 0x4d9c78 GetLocalTime

• 0x4d9c7c GetLastError

• 0x4d9c80 GetFullPathNameA

• 0x4d9c84 GetDiskFreeSpaceA

• 0x4d9c88 GetDateFormatA

• 0x4d9c8c GetCurrentThreadId

• 0x4d9c90 GetCurrentProcessId

• 0x4d9c94 GetCPInfo

• 0x4d9c98 FreeResource

• 0x4d9c9c InterlockedExchange

• 0x4d9ca0 FreeLibrary

• 0x4d9ca4 FormatMessageA

• 0x4d9ca8 FindResourceA

• 0x4d9cac EnumCalendarInfoA

• 0x4d9cb0 EnterCriticalSection

• 0x4d9cb4 DeleteCriticalSection

• 0x4d9cb8 CreateThread

• 0x4d9cbc CreateFileA

• 0x4d9cc0 CreateEventA

• 0x4d9cc4 CompareStringA

• 0x4d9cc8 CloseHandle

Library advapi32.dll:

• 0x4d9cd0 RegQueryValueExA

• 0x4d9cd4 RegOpenKeyExA

• 0x4d9cd8 RegFlushKey

• 0x4d9cdc RegCloseKey

Library oleaut32.dll:

• 0x4d9ce4 GetErrorInfo

• 0x4d9ce8 SysFreeString

Library ole32.dll:

• 0x4d9cf0 CoUninitialize

• 0x4d9cf4 CoInitialize

Library kernel32.dll:

• 0x4d9cfc Sleep

Library oleaut32.dll:

• 0x4d9d04 SafeArrayPtrOfIndex

• 0x4d9d08 SafeArrayPutElement

• 0x4d9d0c SafeArrayGetElement

• 0x4d9d10 SafeArrayUnaccessData

• 0x4d9d14 SafeArrayAccessData

• 0x4d9d18 SafeArrayGetUBound

• 0x4d9d1c SafeArrayGetLBound

• 0x4d9d20 SafeArrayCreate

• 0x4d9d24 VariantChangeType

• 0x4d9d28 VariantCopyInd

• 0x4d9d2c VariantCopy

• 0x4d9d30 VariantClear

• 0x4d9d34 VariantInit

Library comctl32.dll:

• 0x4d9d3c _TrackMouseEvent

• 0x4d9d40 ImageList_SetIconSize

• 0x4d9d44 ImageList_GetIconSize

• 0x4d9d48 ImageList_Write

• 0x4d9d4c ImageList_Read

• 0x4d9d50 ImageList_GetDragImage

• 0x4d9d54 ImageList_DragShowNolock

• 0x4d9d58 ImageList_DragMove

• 0x4d9d5c ImageList_DragLeave

• 0x4d9d60 ImageList_DragEnter

• 0x4d9d64 ImageList_EndDrag

• 0x4d9d68 ImageList_BeginDrag

• 0x4d9d6c ImageList_Remove

• 0x4d9d70 ImageList_DrawEx

• 0x4d9d74 ImageList_Replace

• 0x4d9d78 ImageList_Draw

• 0x4d9d7c ImageList_GetBkColor

• 0x4d9d80 ImageList_SetBkColor

• 0x4d9d84 ImageList_Add

• 0x4d9d88 ImageList_GetImageCount

• 0x4d9d8c ImageList_Destroy

• 0x4d9d90 ImageList_Create

Library advapi32.dll:

• 0x4d9d98 QueryServiceStatus

• 0x4d9d9c OpenServiceA

• 0x4d9da0 OpenSCManagerA

• 0x4d9da4 CloseServiceHandle

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
www.microsoft.com	CNAME www.microsoft.com-c-3.edgekey.net CNAME www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net CNAME e13678.ca2.s.tl88.net A 183.61.93.182	183.61.93.182
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
cdn.discordapp.com	A 108.160.167.147	108.160.167.147
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58370	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	62192	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.