SmartHawk

6.2

高危

51 个模型检测该样本为恶意！

重新分析

下载样本

f4e432f1f19d2b3b6c9aa8c1011adbf4785a44dfccc32720a2130edfd29b31b7

e0f2fe594579d9de402a534275727105.exe

分析耗时

88s

最近分析

文件大小

1.7MB

静态报毒动态报毒 AGEN AI SCORE=89 AIDETECTVM BSCOPE BUDMXZ CLASSIC DELF DPIE FAREIT GDSDA GENERICKDZ GENKRYPTIK HIGH CONFIDENCE HQWCFH IGENT KCLOUD KRYPTIK MALICIOUS PE MALWARE2 MALWARE@#92W0ZEAO0R9C NWHZ R347077 REMCOS REMCOSCRYPT S + TROJ SCORE STATIC AI TH3@AYVBEKMI UNSAFE ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FZO!E0F2FE594579	20210127	6.0.6.653
Alibaba	TrojanDownloader:Win32/Remcos.cd028a25	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Malware-gen	20210127	21.1.5827.0
Kingsoft	Win32.Hack.Undef.(kcloud)	20210127	2017.9.26.565

This executable is signed

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620832029.853374 __exception__	stacktrace: 0x3069c00 0x306a5e3 0x306a768 DriverCallback+0x4e waveOutOpen-0xa2e winmm+0x3af0 @ 0x750d3af0 timeEndPeriod+0x54a timeKillEvent-0x57 winmm+0xa535 @ 0x750da535 timeEndPeriod+0x449 timeKillEvent-0x158 winmm+0xa434 @ 0x750da434 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 57473944 registers.edi: 0 registers.eax: 0 registers.ebp: 57474012 registers.edx: 12 registers.ebx: 0 registers.esi: 1144 registers.ecx: 0 exception.instruction_r: 8b 47 3c 03 c7 89 45 f4 bb 00 00 00 10 81 c3 00 exception.instruction: mov eax, dword ptr [edi + 0x3c] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x3069ab5	success	0	0

Time & API

Arguments

Status

Return

Repeated

1620832029.853374
__exception__

stacktrace:

0x3069c00
0x306a5e3
0x306a768
DriverCallback+0x4e waveOutOpen-0xa2e winmm+0x3af0 @ 0x750d3af0
timeEndPeriod+0x54a timeKillEvent-0x57 winmm+0xa535 @ 0x750da535
timeEndPeriod+0x449 timeKillEvent-0x158 winmm+0xa434 @ 0x750da434
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 57473944
registers.edi: 0
registers.eax: 0
registers.ebp: 57474012
registers.edx: 12
registers.ebx: 0
registers.esi: 1144
registers.ecx: 0
exception.instruction_r: 8b 47 3c 03 c7 89 45 f4 bb 00 00 00 10 81 c3 00
exception.instruction: mov eax, dword ptr [edi + 0x3c]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x3069ab5

success

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620831961.150374 NtAllocateVirtualMemory	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003e0000	success	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620831997.806374 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Disables proxy possibly for traffic interception (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620831997.119374 RegSetValueExA	key_handle: 0x000002cc value: 0 regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	success	0	0

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1620832000.431374 RegSetValueExA	key_handle: 0x000003c0 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1620832000.431374 RegSetValueExA	key_handle: 0x000003c0 value: ûKG× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1620832000.431374 RegSetValueExA	key_handle: 0x000003c0 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1620832000.447374 RegSetValueExW	key_handle: 0x000003c0 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1620832000.447374 RegSetValueExA	key_handle: 0x000003dc value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1620832000.447374 RegSetValueExA	key_handle: 0x000003dc value: ûKG× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1620832000.447374 RegSetValueExA	key_handle: 0x000003dc value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1620832000.556374 RegSetValueExW	key_handle: 0x000003bc value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Network activity contains more than one unique useragent (2 个事件)

process	e0f2fe594579d9de402a534275727105.exe				useragent	Internal
process	e0f2fe594579d9de402a534275727105.exe				useragent	WWWWWWWE

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

108.160.163.108:443

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.69279
FireEye	Generic.mg.e0f2fe594579d9de
Qihoo-360	Generic/Trojan.072
McAfee	Fareit-FZO!E0F2FE594579
Cylance	Unsafe
K7AntiVirus	Unwanted-Program ( 005412441 )
Alibaba	TrojanDownloader:Win32/Remcos.cd028a25
K7GW	Unwanted-Program ( 005412441 )
Cybereason	malicious.94579d
Arcabit	Trojan.Generic.D10E9F
Cyren	W32/Trojan.NWHZ-1477
Symantec	Trojan Horse
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	HEUR:Backdoor.Win32.Remcos.gen
BitDefender	Trojan.GenericKDZ.69279
NANO-Antivirus	Trojan.Win32.Remcos.hqwcfh
Paloalto	generic.ml
Ad-Aware	Trojan.GenericKDZ.69279
Sophos	Mal/Generic-S + Troj/Spy-BBP
Comodo	Malware@#92w0zeao0r9c
F-Secure	Heuristic.HEUR/AGEN.1139675
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	Fareit-FZO!E0F2FE594579
Emsisoft	Trojan.GenericKDZ.69279 (B)
Ikarus	Trojan.Inject
Jiangmin	Backdoor.Remcos.ccj
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1139675
Antiy-AVL	Trojan/Win32.Generic
Kingsoft	Win32.Hack.Undef.(kcloud)
Gridinsoft	Trojan.Win32.Packed.oa
Microsoft	Trojan:Win32/RemcosCrypt.ACH!MTB
ZoneAlarm	HEUR:Backdoor.Win32.Remcos.gen
GData	Trojan.GenericKDZ.69279
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.RL_Generic.R347077
BitDefenderTheta	Gen:NN.ZelphiF.34780.TH3@ayVBekmi
ALYac	Trojan.GenericKDZ.69279
MAX	malware (ai score=89)
VBA32	BScope.Trojan.Downloader
Malwarebytes	Trojan.MalPack.SMY
ESET-NOD32	Win32/TrojanDownloader.Delf.CZG
Rising	Trojan.Kryptik!1.C56D (CLASSIC)
Yandex	Trojan.Igent.bUdMxz.4
SentinelOne	Static AI - Malicious PE
Fortinet	W32/GenKryptik.DPIE!tr
AVG	Win32:Malware-gen

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x478154 DeleteCriticalSection

• 0x478158 LeaveCriticalSection

• 0x47815c EnterCriticalSection

• 0x478160 InitializeCriticalSection

• 0x478164 VirtualFree

• 0x478168 VirtualAlloc

• 0x47816c LocalFree

• 0x478170 LocalAlloc

• 0x478174 GetTickCount

• 0x478178 QueryPerformanceCounter

• 0x47817c GetVersion

• 0x478180 GetCurrentThreadId

• 0x478184 InterlockedDecrement

• 0x478188 InterlockedIncrement

• 0x47818c VirtualQuery

• 0x478190 WideCharToMultiByte

• 0x478194 MultiByteToWideChar

• 0x478198 lstrlenA

• 0x47819c lstrcpynA

• 0x4781a0 LoadLibraryExA

• 0x4781a4 GetThreadLocale

• 0x4781a8 GetStartupInfoA

• 0x4781ac GetProcAddress

• 0x4781b0 GetModuleHandleA

• 0x4781b4 GetModuleFileNameA

• 0x4781b8 GetLocaleInfoA

• 0x4781bc GetCommandLineA

• 0x4781c0 FreeLibrary

• 0x4781c4 FindFirstFileA

• 0x4781c8 FindClose

• 0x4781cc ExitProcess

• 0x4781d0 WriteFile

• 0x4781d4 UnhandledExceptionFilter

• 0x4781d8 RtlUnwind

• 0x4781dc RaiseException

• 0x4781e0 GetStdHandle

Library user32.dll:

• 0x4781e8 GetKeyboardType

• 0x4781ec LoadStringA

• 0x4781f0 MessageBoxA

• 0x4781f4 CharNextA

Library advapi32.dll:

• 0x4781fc RegQueryValueExA

• 0x478200 RegOpenKeyExA

• 0x478204 RegCloseKey

Library oleaut32.dll:

• 0x47820c SysFreeString

• 0x478210 SysReAllocStringLen

• 0x478214 SysAllocStringLen

Library kernel32.dll:

• 0x47821c TlsSetValue

• 0x478220 TlsGetValue

• 0x478224 LocalAlloc

• 0x478228 GetModuleHandleA

Library advapi32.dll:

• 0x478230 RegQueryValueExA

• 0x478234 RegOpenKeyExA

• 0x478238 RegCloseKey

Library kernel32.dll:

• 0x478240 lstrcpyA

• 0x478244 WriteFile

• 0x478248 WaitForSingleObject

• 0x47824c VirtualQuery

• 0x478250 VirtualProtect

• 0x478254 VirtualAlloc

• 0x478258 Sleep

• 0x47825c SizeofResource

• 0x478260 SetThreadLocale

• 0x478264 SetFilePointer

• 0x478268 SetEvent

• 0x47826c SetErrorMode

• 0x478270 SetEndOfFile

• 0x478274 ResetEvent

• 0x478278 ReadFile

• 0x47827c MultiByteToWideChar

• 0x478280 MulDiv

• 0x478284 LockResource

• 0x478288 LoadResource

• 0x47828c LoadLibraryA

• 0x478290 LeaveCriticalSection

• 0x478294 InitializeCriticalSection

• 0x478298 GlobalUnlock

• 0x47829c GlobalReAlloc

• 0x4782a0 GlobalHandle

• 0x4782a4 GlobalLock

• 0x4782a8 GlobalFree

• 0x4782ac GlobalFindAtomA

• 0x4782b0 GlobalDeleteAtom

• 0x4782b4 GlobalAlloc

• 0x4782b8 GlobalAddAtomA

• 0x4782bc GetVersionExA

• 0x4782c0 GetVersion

• 0x4782c4 GetTickCount

• 0x4782c8 GetThreadLocale

• 0x4782cc GetSystemInfo

• 0x4782d0 GetStringTypeExA

• 0x4782d4 GetStdHandle

• 0x4782d8 GetProcAddress

• 0x4782dc GetModuleHandleA

• 0x4782e0 GetModuleFileNameA

• 0x4782e4 GetLocaleInfoA

• 0x4782e8 GetLocalTime

• 0x4782ec GetLastError

• 0x4782f0 GetFullPathNameA

• 0x4782f4 GetDiskFreeSpaceA

• 0x4782f8 GetDateFormatA

• 0x4782fc GetCurrentThreadId

• 0x478300 GetCurrentProcessId

• 0x478304 GetCPInfo

• 0x478308 GetACP

• 0x47830c FreeResource

• 0x478310 InterlockedExchange

• 0x478314 FreeLibrary

• 0x478318 FormatMessageA

• 0x47831c FindResourceA

• 0x478320 EnumCalendarInfoA

• 0x478324 EnterCriticalSection

• 0x478328 DeleteCriticalSection

• 0x47832c CreateThread

• 0x478330 CreateFileA

• 0x478334 CreateEventA

• 0x478338 CompareStringA

• 0x47833c CloseHandle

Library version.dll:

• 0x478344 VerQueryValueA

• 0x478348 GetFileVersionInfoSizeA

• 0x47834c GetFileVersionInfoA

Library gdi32.dll:

• 0x478354 UnrealizeObject

• 0x478358 StretchBlt

• 0x47835c SetWindowOrgEx

• 0x478360 SetWinMetaFileBits

• 0x478364 SetViewportOrgEx

• 0x478368 SetTextColor

• 0x47836c SetStretchBltMode

• 0x478370 SetROP2

• 0x478374 SetPixel

• 0x478378 SetEnhMetaFileBits

• 0x47837c SetDIBColorTable

• 0x478380 SetBrushOrgEx

• 0x478384 SetBkMode

• 0x478388 SetBkColor

• 0x47838c SelectPalette

• 0x478390 SelectObject

• 0x478394 SaveDC

• 0x478398 RestoreDC

• 0x47839c Rectangle

• 0x4783a0 RectVisible

• 0x4783a4 RealizePalette

• 0x4783a8 PlayEnhMetaFile

• 0x4783ac PatBlt

• 0x4783b0 MoveToEx

• 0x4783b4 MaskBlt

• 0x4783b8 LineTo

• 0x4783bc IntersectClipRect

• 0x4783c0 GetWindowOrgEx

• 0x4783c4 GetWinMetaFileBits

• 0x4783c8 GetTextMetricsA

• 0x4783cc GetTextExtentPoint32A

• 0x4783d0 GetSystemPaletteEntries

• 0x4783d4 GetStockObject

• 0x4783d8 GetPixel

• 0x4783dc GetPaletteEntries

• 0x4783e0 GetObjectA

• 0x4783e4 GetEnhMetaFilePaletteEntries

• 0x4783e8 GetEnhMetaFileHeader

• 0x4783ec GetEnhMetaFileBits

• 0x4783f0 GetDeviceCaps

• 0x4783f4 GetDIBits

• 0x4783f8 GetDIBColorTable

• 0x4783fc GetDCOrgEx

• 0x478400 GetDCPenColor

• 0x478404 GetCurrentPositionEx

• 0x478408 GetClipBox

• 0x47840c GetBrushOrgEx

• 0x478410 GetBkMode

• 0x478414 GetBitmapBits

• 0x478418 GdiFlush

• 0x47841c ExcludeClipRect

• 0x478420 DeleteObject

• 0x478424 DeleteEnhMetaFile

• 0x478428 DeleteDC

• 0x47842c CreateSolidBrush

• 0x478430 CreatePenIndirect

• 0x478434 CreatePalette

• 0x478438 CreateHalftonePalette

• 0x47843c CreateFontIndirectA

• 0x478440 CreateDIBitmap

• 0x478444 CreateDIBSection

• 0x478448 CreateCompatibleDC

• 0x47844c CreateCompatibleBitmap

• 0x478450 CreateBrushIndirect

• 0x478454 CreateBitmap

• 0x478458 CopyEnhMetaFileA

• 0x47845c BitBlt

Library user32.dll:

• 0x478464 CreateWindowExA

• 0x478468 WindowFromPoint

• 0x47846c WinHelpA

• 0x478470 WaitMessage

• 0x478474 UpdateWindow

• 0x478478 UnregisterClassA

• 0x47847c UnhookWindowsHookEx

• 0x478480 TranslateMessage

• 0x478484 TranslateMDISysAccel

• 0x478488 TrackPopupMenu

• 0x47848c SystemParametersInfoA

• 0x478490 AnimateWindow

• 0x478494 ShowWindow

• 0x478498 ShowScrollBar

• 0x47849c ShowOwnedPopups

• 0x4784a0 ShowCursor

• 0x4784a4 SetWindowsHookExA

• 0x4784a8 SetWindowPos

• 0x4784ac SetWindowPlacement

• 0x4784b0 SetWindowLongA

• 0x4784b4 SetTimer

• 0x4784b8 SetScrollRange

• 0x4784bc SetScrollPos

• 0x4784c0 SetScrollInfo

• 0x4784c4 SetRect

• 0x4784c8 SetPropA

• 0x4784cc SetParent

• 0x4784d0 SetMenuItemInfoA

• 0x4784d4 SetMenu

• 0x4784d8 SetForegroundWindow

• 0x4784dc SetFocus

• 0x4784e0 SetCursor

• 0x4784e4 SetClassLongA

• 0x4784e8 SetCapture

• 0x4784ec SetActiveWindow

• 0x4784f0 SendMessageA

• 0x4784f4 ScrollWindow

• 0x4784f8 ScreenToClient

• 0x4784fc RemovePropA

• 0x478500 RemoveMenu

• 0x478504 ReleaseDC

• 0x478508 ReleaseCapture

• 0x47850c RegisterWindowMessageA

• 0x478510 RegisterClipboardFormatA

• 0x478514 RegisterClassA

• 0x478518 RedrawWindow

• 0x47851c PtInRect

• 0x478520 PostQuitMessage

• 0x478524 PostMessageA

• 0x478528 PeekMessageA

• 0x47852c OffsetRect

• 0x478530 OemToCharA

• 0x478534 MessageBoxA

• 0x478538 MapWindowPoints

• 0x47853c MapVirtualKeyA

• 0x478540 LoadStringA

• 0x478544 LoadKeyboardLayoutA

• 0x478548 LoadIconA

• 0x47854c LoadCursorA

• 0x478550 LoadBitmapA

• 0x478554 KillTimer

• 0x478558 IsZoomed

• 0x47855c IsWindowVisible

• 0x478560 IsWindowEnabled

• 0x478564 IsWindow

• 0x478568 IsRectEmpty

• 0x47856c IsIconic

• 0x478570 IsDialogMessageA

• 0x478574 IsChild

• 0x478578 InvalidateRect

• 0x47857c IntersectRect

• 0x478580 InsertMenuItemA

• 0x478584 InsertMenuA

• 0x478588 InflateRect

• 0x47858c GetWindowThreadProcessId

• 0x478590 GetWindowTextA

• 0x478594 GetWindowRect

• 0x478598 GetWindowPlacement

• 0x47859c GetWindowLongA

• 0x4785a0 GetWindowDC

• 0x4785a4 GetTopWindow

• 0x4785a8 GetSystemMetrics

• 0x4785ac GetSystemMenu

• 0x4785b0 GetSysColorBrush

• 0x4785b4 GetSysColor

• 0x4785b8 GetSubMenu

• 0x4785bc GetScrollRange

• 0x4785c0 GetScrollPos

• 0x4785c4 GetScrollInfo

• 0x4785c8 GetPropA

• 0x4785cc GetParent

• 0x4785d0 GetWindow

• 0x4785d4 GetMenuStringA

• 0x4785d8 GetMenuState

• 0x4785dc GetMenuItemInfoA

• 0x4785e0 GetMenuItemID

• 0x4785e4 GetMenuItemCount

• 0x4785e8 GetMenu

• 0x4785ec GetLastActivePopup

• 0x4785f0 GetKeyboardState

• 0x4785f4 GetKeyboardLayoutList

• 0x4785f8 GetKeyboardLayout

• 0x4785fc GetKeyState

• 0x478600 GetKeyNameTextA

• 0x478604 GetIconInfo

• 0x478608 GetForegroundWindow

• 0x47860c GetFocus

• 0x478610 GetDesktopWindow

• 0x478614 GetDCEx

• 0x478618 GetDC

• 0x47861c GetCursorPos

• 0x478620 GetCursor

• 0x478624 GetClipboardData

• 0x478628 GetClientRect

• 0x47862c GetClassNameA

• 0x478630 GetClassInfoA

• 0x478634 GetCapture

• 0x478638 GetActiveWindow

• 0x47863c FrameRect

• 0x478640 FindWindowA

• 0x478644 FillRect

• 0x478648 EqualRect

• 0x47864c EnumWindows

• 0x478650 EnumThreadWindows

• 0x478654 EndPaint

• 0x478658 EnableWindow

• 0x47865c EnableScrollBar

• 0x478660 EnableMenuItem

• 0x478664 DrawTextA

• 0x478668 DrawMenuBar

• 0x47866c DrawIconEx

• 0x478670 DrawIcon

• 0x478674 DrawFrameControl

• 0x478678 DrawEdge

• 0x47867c DispatchMessageA

• 0x478680 DestroyWindow

• 0x478684 DestroyMenu

• 0x478688 DestroyIcon

• 0x47868c DestroyCursor

• 0x478690 DeleteMenu

• 0x478694 DefWindowProcA

• 0x478698 DefMDIChildProcA

• 0x47869c DefFrameProcA

• 0x4786a0 CreatePopupMenu

• 0x4786a4 CreateMenu

• 0x4786a8 CreateIcon

• 0x4786ac ClientToScreen

• 0x4786b0 CheckMenuItem

• 0x4786b4 CallWindowProcA

• 0x4786b8 CallNextHookEx

• 0x4786bc BeginPaint

• 0x4786c0 CharNextA

• 0x4786c4 CharLowerBuffA

• 0x4786c8 CharLowerA

• 0x4786cc CharToOemA

• 0x4786d0 AdjustWindowRectEx

• 0x4786d4 ActivateKeyboardLayout

Library kernel32.dll:

• 0x4786dc Sleep

Library oleaut32.dll:

• 0x4786e4 SafeArrayPtrOfIndex

• 0x4786e8 SafeArrayGetUBound

• 0x4786ec SafeArrayGetLBound

• 0x4786f0 SafeArrayCreate

• 0x4786f4 VariantChangeType

• 0x4786f8 VariantCopy

• 0x4786fc VariantClear

• 0x478700 VariantInit

Library ole32.dll:

• 0x478708 CoUninitialize

• 0x47870c CoInitialize

Library oleaut32.dll:

• 0x478714 GetErrorInfo

• 0x478718 SysFreeString

Library comctl32.dll:

• 0x478720 ImageList_SetIconSize

• 0x478724 ImageList_GetIconSize

• 0x478728 ImageList_Write

• 0x47872c ImageList_Read

• 0x478730 ImageList_GetDragImage

• 0x478734 ImageList_DragShowNolock

• 0x478738 ImageList_SetDragCursorImage

• 0x47873c ImageList_DragMove

• 0x478740 ImageList_DragLeave

• 0x478744 ImageList_DragEnter

• 0x478748 ImageList_EndDrag

• 0x47874c ImageList_BeginDrag

• 0x478750 ImageList_Remove

• 0x478754 ImageList_DrawEx

• 0x478758 ImageList_Draw

• 0x47875c ImageList_GetBkColor

• 0x478760 ImageList_SetBkColor

• 0x478764 ImageList_ReplaceIcon

• 0x478768 ImageList_Add

• 0x47876c ImageList_SetImageCount

• 0x478770 ImageList_GetImageCount

• 0x478774 ImageList_Destroy

• 0x478778 ImageList_Create

Library UrL:

• 0x478780 InetIsOffline

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
www.microsoft.com	CNAME www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net CNAME e13678.ca2.s.tl88.net CNAME www.microsoft.com-c-3.edgekey.net A 27.148.139.88	27.148.139.88
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
cdn.discordapp.com	A 108.160.163.108	108.160.163.108
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49713	114.114.114.114	53
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	53237	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	61680	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	50568	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.