SmartHawk

11.4

0-day

55 个模型检测该样本为恶意！

重新分析

下载样本

0305ff9e28ecda4996390905abd594649e7ae6b874761f3341e492357af87d0d

e5d41cde76aec1ffcd1b4a294663c163.exe

分析耗时

88s

最近分析

文件大小

673.0KB

静态报毒动态报毒 100% 2TL3VD1ENPE AGENTTESLA AI SCORE=86 AIDETECTVM AMCA CLASSIC CONFIDENCE DELF DELPHI DELPHILESS DZDBF ENAR EQGR FAREIT GENERICKDZ GENETIC GENKRYPTIK HIGH CONFIDENCE HSFJLL LOKI LOKIBOT MALWARE1 MALWARE@#3IJDGYCF2A5CX NOON NOONIH PUTTY QGW@AOV@ZTHI RATNET S15481576 SCORE SMAT SUSPICIOUS PE TSCOPE UNSAFE X2094 ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FPQ!E5D41CDE76AE	20201024	6.0.6.653
Alibaba	TrojanSpy:Win32/Fareit.d31bf759	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20201024	18.4.3895.0
Tencent	Win32.Trojan-spy.Noon.Amca	20201024	1.0.0.1
Kingsoft		20201024	2013.8.14.323
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Queries for the computername (3 个事件)

Time & API	Arguments	Status	Return
1619979599.921875 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619979601.280875 GetComputerNameW	computer_name: OSKAR-PC	success	1
1619979601.342875 GetComputerNameW	computer_name: OSKAR-PC	success	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619979593.827875 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1619979592.74925 NtAllocateVirtualMemory	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f0000	success
1619979592.82725 NtProtectVirtualMemory	process_identifier: 1632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 77824 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00467000	success
1619979592.82725 NtAllocateVirtualMemory	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x007e0000	success

Steals private information from local Internet browsers (19 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Chromium\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Web Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\RockMelt\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619979601.327875 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\e5d41cde76aec1ffcd1b4a294663c163.exe newfilepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\6ED2B0\0019EA.exe newfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Roaming\6ED2B0\0019EA.exe flags: 1 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\e5d41cde76aec1ffcd1b4a294663c163.exe	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.407363367269403

section

{'size_of_data': '0x00023800', 'virtual_address': '0x0008b000', 'entropy': 7.407363367269403, 'name': '.rsrc', 'virtual_size': '0x00023718'}

description

A section with a high entropy has been found

entropy

0.2113095238095238

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619979601.233875 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Harvests credentials from local FTP client softwares (22 个事件)

file	C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FTPGetter\servers.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\wcx_ftp.ini
file	C:\Windows\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\GHISLER\wcx_ftp.ini
file	C:\Users\Administrator.Oskar-PC\wcx_ftp.ini
file	C:\Windows\32BitFtp.ini
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\sitemanager.xml
file	C:\Program Files (x86)\FileZilla\Filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\filezilla.xml
file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\FileZilla\recentservers.xml
registry	HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
registry	HKEY_CURRENT_USER\Software\Ghisler\Total Commander
registry	HKEY_CURRENT_USER\Software\VanDyke\SecureFX
registry	HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
registry	HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
registry	HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
registry	HKEY_CURRENT_USER\Software\Martin Prikryl
registry	HKEY_LOCAL_MACHINE\Software\Martin Prikryl

Harvests information related to installed instant messenger clients (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Roaming\.purple\accounts.xml

Harvests credentials from local email clients (3 个事件)

registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1632 called NtSetContextThread to modify thread in remote process 1376
1619979592.90525 NtSetContextThread	thread_handle: 0x00000120 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1376	success	0	0

Putty Files, Registry Keys and/or Mutexes Detected

Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1632 resumed a thread in remote process 1376
1619979593.01425 NtResumeThread	thread_handle: 0x00000120 suspend_count: 1 process_identifier: 1376	success	0	0

Executed a process and injected code into it, probably while unpacking (7 个事件)

Time & API	Arguments	Status	Return
1619979592.87425 CreateProcessInternalW	thread_identifier: 1380 thread_handle: 0x00000120 process_identifier: 1376 current_directory: filepath: track: 1 command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\e5d41cde76aec1ffcd1b4a294663c163.exe" filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) process_handle: 0x00000124 inherit_handles: 0	success	1
1619979592.87425 NtUnmapViewOfSection	process_identifier: 1376 region_size: 4096 process_handle: 0x00000124 base_address: 0x00400000	success	0
1619979592.87425 NtMapViewOfSection	section_handle: 0x0000012c process_identifier: 1376 commit_size: 663552 win32_protect: 64 (PAGE_EXECUTE_READWRITE) buffer: process_handle: 0x00000124 allocation_type: 0 () section_offset: 0 view_size: 663552 base_address: 0x00400000	success	0
1619979592.90525 NtGetContextThread	thread_handle: 0x00000120	success	0
1619979592.90525 NtSetContextThread	thread_handle: 0x00000120 registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4274654 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 process_identifier: 1376	success	0
1619979593.01425 NtResumeThread	thread_handle: 0x00000120 suspend_count: 1 process_identifier: 1376	success	0
1619979598.936875 NtResumeThread	thread_handle: 0x00000110 suspend_count: 1 process_identifier: 1376	success	0

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.69532
FireEye	Generic.mg.e5d41cde76aec1ff
CAT-QuickHeal	Trojan.NoonIH.S15481576
McAfee	Fareit-FPQ!E5D41CDE76AE
Cylance	Unsafe
SUPERAntiSpyware	Trojan.Agent/Gen-Loki
Sangfor	Malware
K7AntiVirus	Trojan ( 0056c99c1 )
Alibaba	TrojanSpy:Win32/Fareit.d31bf759
K7GW	Trojan ( 0056c99c1 )
Cybereason	malicious.e76aec
Arcabit	Trojan.Generic.D10F9C
Cyren	W32/Trojan.SMAT-1563
Symantec	Infostealer.Lokibot!43
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Dropper.AgentTesla-9375297-1
Kaspersky	HEUR:Trojan-Spy.Win32.Noon.gen
BitDefender	Trojan.GenericKDZ.69532
NANO-Antivirus	Trojan.Win32.Noon.hsfjll
Avast	Win32:Trojan-gen
Tencent	Win32.Trojan-spy.Noon.Amca
Ad-Aware	Trojan.GenericKDZ.69532
Comodo	Malware@#3ijdgycf2a5cx
DrWeb	BackDoor.RatNET.2
VIPRE	Trojan.Win32.Generic!BT
Invincea	Mal/Generic-S
McAfee-GW-Edition	BehavesLike.Win32.Fareit.jh
Sophos	Mal/Generic-S
Ikarus	Trojan.Inject
Jiangmin	TrojanSpy.Noon.qcb
Avira	DR/Delphi.dzdbf
Microsoft	Trojan:Win32/Fareit.VD!MTB
AegisLab	Trojan.Win32.Noon.l!c
ZoneAlarm	HEUR:Trojan-Spy.Win32.Noon.gen
GData	Trojan.GenericKDZ.69532
TACHYON	Trojan/W32.DP-Agent.689152.J
AhnLab-V3	Suspicious/Win.Delphiless.X2094
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZelphiF.34590.QGW@aOV@ZThi
ALYac	Trojan.GenericKDZ.69532
MAX	malware (ai score=86)
VBA32	TScope.Trojan.Delf
ESET-NOD32	a variant of Win32/Injector.ENAR
Rising	Trojan.Injector!1.CA8A (CLASSIC)
Yandex	Trojan.Injector!2TL3vD1ENPE
SentinelOne	DFI - Suspicious PE
eGambit	Unsafe.AI_Score_95%

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x47e168 DeleteCriticalSection

• 0x47e16c LeaveCriticalSection

• 0x47e170 EnterCriticalSection

• 0x47e174 InitializeCriticalSection

• 0x47e178 VirtualFree

• 0x47e17c VirtualAlloc

• 0x47e180 LocalFree

• 0x47e184 LocalAlloc

• 0x47e188 GetVersion

• 0x47e18c GetCurrentThreadId

• 0x47e190 InterlockedDecrement

• 0x47e194 InterlockedIncrement

• 0x47e198 VirtualQuery

• 0x47e19c WideCharToMultiByte

• 0x47e1a0 SetCurrentDirectoryA

• 0x47e1a4 MultiByteToWideChar

• 0x47e1a8 lstrlenA

• 0x47e1ac lstrcpynA

• 0x47e1b0 LoadLibraryExA

• 0x47e1b4 GetThreadLocale

• 0x47e1b8 GetStartupInfoA

• 0x47e1bc GetProcAddress

• 0x47e1c0 GetModuleHandleA

• 0x47e1c4 GetModuleFileNameA

• 0x47e1c8 GetLocaleInfoA

• 0x47e1cc GetLastError

• 0x47e1d0 GetCurrentDirectoryA

• 0x47e1d4 GetCommandLineA

• 0x47e1d8 FreeLibrary

• 0x47e1dc FindFirstFileA

• 0x47e1e0 FindClose

• 0x47e1e4 ExitProcess

• 0x47e1e8 WriteFile

• 0x47e1ec UnhandledExceptionFilter

• 0x47e1f0 RtlUnwind

• 0x47e1f4 RaiseException

• 0x47e1f8 GetStdHandle

Library user32.dll:

• 0x47e200 GetKeyboardType

• 0x47e204 LoadStringA

• 0x47e208 MessageBoxA

• 0x47e20c CharNextA

Library advapi32.dll:

• 0x47e214 RegQueryValueExA

• 0x47e218 RegOpenKeyExA

• 0x47e21c RegCloseKey

Library oleaut32.dll:

• 0x47e224 SysFreeString

• 0x47e228 SysReAllocStringLen

• 0x47e22c SysAllocStringLen

Library kernel32.dll:

• 0x47e234 TlsSetValue

• 0x47e238 TlsGetValue

• 0x47e23c LocalAlloc

• 0x47e240 GetModuleHandleA

Library advapi32.dll:

• 0x47e248 RegQueryValueExA

• 0x47e24c RegOpenKeyExA

• 0x47e250 RegCloseKey

Library kernel32.dll:

• 0x47e258 lstrcpyA

• 0x47e25c WriteFile

• 0x47e260 WinExec

• 0x47e264 WaitForSingleObject

• 0x47e268 VirtualQuery

• 0x47e26c VirtualProtect

• 0x47e270 VirtualAlloc

• 0x47e274 Sleep

• 0x47e278 SizeofResource

• 0x47e27c SetThreadLocale

• 0x47e280 SetFilePointer

• 0x47e284 SetEvent

• 0x47e288 SetErrorMode

• 0x47e28c SetEndOfFile

• 0x47e290 ResetEvent

• 0x47e294 ReadFile

• 0x47e298 MulDiv

• 0x47e29c LockResource

• 0x47e2a0 LoadResource

• 0x47e2a4 LoadLibraryA

• 0x47e2a8 LeaveCriticalSection

• 0x47e2ac InitializeCriticalSection

• 0x47e2b0 GlobalUnlock

• 0x47e2b4 GlobalReAlloc

• 0x47e2b8 GlobalHandle

• 0x47e2bc GlobalLock

• 0x47e2c0 GlobalFree

• 0x47e2c4 GlobalFindAtomA

• 0x47e2c8 GlobalDeleteAtom

• 0x47e2cc GlobalAlloc

• 0x47e2d0 GlobalAddAtomA

• 0x47e2d4 GetVolumeInformationA

• 0x47e2d8 GetVersionExA

• 0x47e2dc GetVersion

• 0x47e2e0 GetTickCount

• 0x47e2e4 GetThreadLocale

• 0x47e2e8 GetSystemTimeAsFileTime

• 0x47e2ec GetSystemInfo

• 0x47e2f0 GetStringTypeExA

• 0x47e2f4 GetStdHandle

• 0x47e2f8 GetProcAddress

• 0x47e2fc GetModuleHandleA

• 0x47e300 GetModuleFileNameA

• 0x47e304 GetLogicalDrives

• 0x47e308 GetLocaleInfoA

• 0x47e30c GetLocalTime

• 0x47e310 GetLastError

• 0x47e314 GetFullPathNameA

• 0x47e318 GetFileAttributesA

• 0x47e31c GetDriveTypeA

• 0x47e320 GetDiskFreeSpaceA

• 0x47e324 GetDateFormatA

• 0x47e328 GetCurrentThreadId

• 0x47e32c GetCurrentProcessId

• 0x47e330 GetCPInfo

• 0x47e334 GetACP

• 0x47e338 FreeResource

• 0x47e33c InterlockedExchange

• 0x47e340 FreeLibrary

• 0x47e344 FormatMessageA

• 0x47e348 FindResourceA

• 0x47e34c FindNextFileA

• 0x47e350 FindFirstFileA

• 0x47e354 FindClose

• 0x47e358 FileTimeToSystemTime

• 0x47e35c FileTimeToLocalFileTime

• 0x47e360 FileTimeToDosDateTime

• 0x47e364 EnumCalendarInfoA

• 0x47e368 EnterCriticalSection

• 0x47e36c DeleteCriticalSection

• 0x47e370 CreateThread

• 0x47e374 CreateFileA

• 0x47e378 CreateEventA

• 0x47e37c CompareStringA

• 0x47e380 CloseHandle

Library mpr.dll:

• 0x47e388 WNetGetConnectionA

Library version.dll:

• 0x47e390 VerQueryValueA

• 0x47e394 GetFileVersionInfoSizeA

• 0x47e398 GetFileVersionInfoA

Library gdi32.dll:

• 0x47e3a0 UnrealizeObject

• 0x47e3a4 StretchBlt

• 0x47e3a8 SetWindowOrgEx

• 0x47e3ac SetWinMetaFileBits

• 0x47e3b0 SetViewportOrgEx

• 0x47e3b4 SetTextColor

• 0x47e3b8 SetStretchBltMode

• 0x47e3bc SetROP2

• 0x47e3c0 SetPixel

• 0x47e3c4 SetEnhMetaFileBits

• 0x47e3c8 SetDIBColorTable

• 0x47e3cc SetBrushOrgEx

• 0x47e3d0 SetBkMode

• 0x47e3d4 SetBkColor

• 0x47e3d8 SelectPalette

• 0x47e3dc SelectObject

• 0x47e3e0 SaveDC

• 0x47e3e4 RestoreDC

• 0x47e3e8 Rectangle

• 0x47e3ec RectVisible

• 0x47e3f0 RealizePalette

• 0x47e3f4 Polyline

• 0x47e3f8 PlayEnhMetaFile

• 0x47e3fc PatBlt

• 0x47e400 MoveToEx

• 0x47e404 MaskBlt

• 0x47e408 LineTo

• 0x47e40c IntersectClipRect

• 0x47e410 GetWindowOrgEx

• 0x47e414 GetWinMetaFileBits

• 0x47e418 GetTextMetricsA

• 0x47e41c GetTextExtentPoint32A

• 0x47e420 GetSystemPaletteEntries

• 0x47e424 GetStockObject

• 0x47e428 GetPixel

• 0x47e42c GetPaletteEntries

• 0x47e430 GetObjectA

• 0x47e434 GetEnhMetaFilePaletteEntries

• 0x47e438 GetEnhMetaFileHeader

• 0x47e43c GetEnhMetaFileBits

• 0x47e440 GetDeviceCaps

• 0x47e444 GetDIBits

• 0x47e448 GetDIBColorTable

• 0x47e44c GetDCOrgEx

• 0x47e450 GetCurrentPositionEx

• 0x47e454 GetClipBox

• 0x47e458 GetBrushOrgEx

• 0x47e45c GetBitmapBits

• 0x47e460 ExtTextOutA

• 0x47e464 ExcludeClipRect

• 0x47e468 DeleteObject

• 0x47e46c DeleteEnhMetaFile

• 0x47e470 DeleteDC

• 0x47e474 CreateSolidBrush

• 0x47e478 CreatePenIndirect

• 0x47e47c CreatePalette

• 0x47e480 CreateHalftonePalette

• 0x47e484 CreateFontIndirectA

• 0x47e488 CreateDIBitmap

• 0x47e48c CreateDIBSection

• 0x47e490 CreateCompatibleDC

• 0x47e494 CreateCompatibleBitmap

• 0x47e498 CreateBrushIndirect

• 0x47e49c CreateBitmap

• 0x47e4a0 CopyEnhMetaFileA

• 0x47e4a4 BitBlt

Library opengl32.dll:

• 0x47e4ac wglCreateContext

Library user32.dll:

• 0x47e4b4 CreateWindowExA

• 0x47e4b8 WindowFromPoint

• 0x47e4bc WinHelpA

• 0x47e4c0 WaitMessage

• 0x47e4c4 UpdateWindow

• 0x47e4c8 UnregisterClassA

• 0x47e4cc UnhookWindowsHookEx

• 0x47e4d0 TranslateMessage

• 0x47e4d4 TranslateMDISysAccel

• 0x47e4d8 TrackPopupMenu

• 0x47e4dc SystemParametersInfoA

• 0x47e4e0 ShowWindow

• 0x47e4e4 ShowScrollBar

• 0x47e4e8 ShowOwnedPopups

• 0x47e4ec ShowCursor

• 0x47e4f0 SetWindowsHookExA

• 0x47e4f4 SetWindowTextA

• 0x47e4f8 SetWindowPos

• 0x47e4fc SetWindowPlacement

• 0x47e500 SetWindowLongA

• 0x47e504 SetTimer

• 0x47e508 SetScrollRange

• 0x47e50c SetScrollPos

• 0x47e510 SetScrollInfo

• 0x47e514 SetRect

• 0x47e518 SetPropA

• 0x47e51c SetParent

• 0x47e520 SetMenuItemInfoA

• 0x47e524 SetMenu

• 0x47e528 SetForegroundWindow

• 0x47e52c SetFocus

• 0x47e530 SetCursor

• 0x47e534 SetClassLongA

• 0x47e538 SetCapture

• 0x47e53c SetActiveWindow

• 0x47e540 SendMessageA

• 0x47e544 ScrollWindow

• 0x47e548 ScreenToClient

• 0x47e54c RemovePropA

• 0x47e550 RemoveMenu

• 0x47e554 ReleaseDC

• 0x47e558 ReleaseCapture

• 0x47e55c RegisterWindowMessageA

• 0x47e560 RegisterClipboardFormatA

• 0x47e564 RegisterClassA

• 0x47e568 RedrawWindow

• 0x47e56c PtInRect

• 0x47e570 PostQuitMessage

• 0x47e574 PostMessageA

• 0x47e578 PeekMessageA

• 0x47e57c OffsetRect

• 0x47e580 OemToCharA

• 0x47e584 MessageBoxA

• 0x47e588 MapWindowPoints

• 0x47e58c MapVirtualKeyA

• 0x47e590 LoadStringA

• 0x47e594 LoadKeyboardLayoutA

• 0x47e598 LoadIconA

• 0x47e59c LoadCursorA

• 0x47e5a0 LoadBitmapA

• 0x47e5a4 KillTimer

• 0x47e5a8 IsZoomed

• 0x47e5ac IsWindowVisible

• 0x47e5b0 IsWindowEnabled

• 0x47e5b4 IsWindow

• 0x47e5b8 IsRectEmpty

• 0x47e5bc IsIconic

• 0x47e5c0 IsDialogMessageA

• 0x47e5c4 IsChild

• 0x47e5c8 InvalidateRect

• 0x47e5cc IntersectRect

• 0x47e5d0 InsertMenuItemA

• 0x47e5d4 InsertMenuA

• 0x47e5d8 InflateRect

• 0x47e5dc GetWindowThreadProcessId

• 0x47e5e0 GetWindowTextA

• 0x47e5e4 GetWindowRect

• 0x47e5e8 GetWindowPlacement

• 0x47e5ec GetWindowLongA

• 0x47e5f0 GetWindowDC

• 0x47e5f4 GetTopWindow

• 0x47e5f8 GetSystemMetrics

• 0x47e5fc GetSystemMenu

• 0x47e600 GetSysColorBrush

• 0x47e604 GetSysColor

• 0x47e608 GetSubMenu

• 0x47e60c GetScrollRange

• 0x47e610 GetScrollPos

• 0x47e614 GetScrollInfo

• 0x47e618 GetPropA

• 0x47e61c GetParent

• 0x47e620 GetWindow

• 0x47e624 GetMenuStringA

• 0x47e628 GetMenuState

• 0x47e62c GetMenuItemInfoA

• 0x47e630 GetMenuItemID

• 0x47e634 GetMenuItemCount

• 0x47e638 GetMenu

• 0x47e63c GetLastActivePopup

• 0x47e640 GetKeyboardState

• 0x47e644 GetKeyboardLayoutList

• 0x47e648 GetKeyboardLayout

• 0x47e64c GetKeyState

• 0x47e650 GetKeyNameTextA

• 0x47e654 GetIconInfo

• 0x47e658 GetForegroundWindow

• 0x47e65c GetFocus

• 0x47e660 GetDlgItem

• 0x47e664 GetDesktopWindow

• 0x47e668 GetDCEx

• 0x47e66c GetDC

• 0x47e670 GetCursorPos

• 0x47e674 GetCursor

• 0x47e678 GetClipboardData

• 0x47e67c GetClientRect

• 0x47e680 GetClassNameA

• 0x47e684 GetClassInfoA

• 0x47e688 GetCapture

• 0x47e68c GetActiveWindow

• 0x47e690 FrameRect

• 0x47e694 FindWindowA

• 0x47e698 FillRect

• 0x47e69c EqualRect

• 0x47e6a0 EnumWindows

• 0x47e6a4 EnumThreadWindows

• 0x47e6a8 EndPaint

• 0x47e6ac EnableWindow

• 0x47e6b0 EnableScrollBar

• 0x47e6b4 EnableMenuItem

• 0x47e6b8 DrawTextA

• 0x47e6bc DrawMenuBar

• 0x47e6c0 DrawIconEx

• 0x47e6c4 DrawIcon

• 0x47e6c8 DrawFrameControl

• 0x47e6cc DrawFocusRect

• 0x47e6d0 DrawEdge

• 0x47e6d4 DispatchMessageA

• 0x47e6d8 DestroyWindow

• 0x47e6dc DestroyMenu

• 0x47e6e0 DestroyIcon

• 0x47e6e4 DestroyCursor

• 0x47e6e8 DeleteMenu

• 0x47e6ec DefWindowProcA

• 0x47e6f0 DefMDIChildProcA

• 0x47e6f4 DefFrameProcA

• 0x47e6f8 CreatePopupMenu

• 0x47e6fc CreateMenu

• 0x47e700 CreateIcon

• 0x47e704 ClientToScreen

• 0x47e708 CheckMenuItem

• 0x47e70c CallWindowProcA

• 0x47e710 CallNextHookEx

• 0x47e714 BeginPaint

• 0x47e718 CharNextA

• 0x47e71c CharLowerBuffA

• 0x47e720 CharLowerA

• 0x47e724 CharUpperBuffA

• 0x47e728 CharToOemA

• 0x47e72c AdjustWindowRectEx

• 0x47e730 ActivateKeyboardLayout

Library kernel32.dll:

• 0x47e738 Sleep

Library oleaut32.dll:

• 0x47e740 SafeArrayPtrOfIndex

• 0x47e744 SafeArrayGetUBound

• 0x47e748 SafeArrayGetLBound

• 0x47e74c SafeArrayCreate

• 0x47e750 VariantChangeType

• 0x47e754 VariantCopy

• 0x47e758 VariantClear

• 0x47e75c VariantInit

Library comctl32.dll:

• 0x47e764 ImageList_SetIconSize

• 0x47e768 ImageList_GetIconSize

• 0x47e76c ImageList_Write

• 0x47e770 ImageList_Read

• 0x47e774 ImageList_GetDragImage

• 0x47e778 ImageList_DragShowNolock

• 0x47e77c ImageList_SetDragCursorImage

• 0x47e780 ImageList_DragMove

• 0x47e784 ImageList_DragLeave

• 0x47e788 ImageList_DragEnter

• 0x47e78c ImageList_EndDrag

• 0x47e790 ImageList_BeginDrag

• 0x47e794 ImageList_Remove

• 0x47e798 ImageList_DrawEx

• 0x47e79c ImageList_Replace

• 0x47e7a0 ImageList_Draw

• 0x47e7a4 ImageList_GetBkColor

• 0x47e7a8 ImageList_SetBkColor

• 0x47e7ac ImageList_ReplaceIcon

• 0x47e7b0 ImageList_Add

• 0x47e7b4 ImageList_GetImageCount

• 0x47e7b8 ImageList_Destroy

• 0x47e7bc ImageList_Create

Library comdlg32.dll:

• 0x47e7c4 GetOpenFileNameA

Library user32.dll:

• 0x47e7cc DdeCmpStringHandles

• 0x47e7d0 DdeFreeStringHandle

• 0x47e7d4 DdeQueryStringA

• 0x47e7d8 DdeCreateStringHandleA

• 0x47e7dc DdeGetLastError

• 0x47e7e0 DdeFreeDataHandle

• 0x47e7e4 DdeUnaccessData

• 0x47e7e8 DdeAccessData

• 0x47e7ec DdeCreateDataHandle

• 0x47e7f0 DdeClientTransaction

• 0x47e7f4 DdeNameService

• 0x47e7f8 DdePostAdvise

• 0x47e7fc DdeSetUserHandle

• 0x47e800 DdeQueryConvInfo

• 0x47e804 DdeDisconnect

• 0x47e808 DdeConnect

• 0x47e80c DdeUninitialize

• 0x47e810 DdeInitializeA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
totosieqwarteg.com
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	62912	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.