SmartHawk

8.8

极危

46 个模型检测该样本为恶意！

重新分析

下载样本

7aba1804c8bccf9746f58c4a60ef410eba465816c6e7d51add5aca48e53f16ce

e71cb629f9ee78015ad89e860650668a.exe

分析耗时

106s

最近分析

文件大小

464.0KB

静态报毒动态报毒 AI SCORE=86 AIDETECTVM ATTRIBUTE CKGENERICPMF CLASSIC CXWIM DOWNLOADER34 ELDORADO EMOTET GENCIRC GENERICKDZ GENETIC HFMY HIGH CONFIDENCE HIGHCONFIDENCE HRTUGS INJUKE KRYPTIK MALWARE1 MALWARE@#3NR84HBMLKVUS R + TROJ S15430279 UNSAFE 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Trojan:Win32/Injuke.d92940cb	20190527	0.3.0.5
Avast	Win32:Malware-gen	20201023	18.4.3895.0
Tencent	Malware.Win32.Gencirc.10cde818	20201023	1.0.0.1
Kingsoft		20201023	2013.8.14.323
McAfee	Emotet-FRV!E71CB629F9EE	20201023	6.0.6.653
CrowdStrike		20190702	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619987472.984 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (3 个事件)

Time & API	Arguments	Status	Return
1619987458.453 CryptGenKey	crypto_handle: 0x008e51c0 algorithm_identifier: 0x0000660e () provider_handle: 0x008e7438 flags: 1 key: f³ü](³h~ZGÑú^	success	1
1619987472.999 CryptExportKey	crypto_handle: 0x008e51c0 crypto_export_handle: 0x008e5140 buffer: f¤#\|`þOÊÇÑCÆòt}súÓþe§F$ã¤§´Bi:Ó0-Ê mî½:Bç6 ÓT%îÇUâ~æl2% >8WÃ ¶HPó`Q)rCN blob_type: 1 flags: 64	success	1
1619987501.921 CryptExportKey	crypto_handle: 0x008e51c0 crypto_export_handle: 0x008e5140 buffer: f¤~ß;{ÄðqÂ*5ÇöBÀé¨Ø·\HÊ}¡ @ð+\dBÏÄm¥D4 Û²?fýúbg¤ÅåèõÉae£=cB¬nß>"1Î³ìWd%ªàRq+ blob_type: 1 flags: 64	success	1

This executable has a PDB path (1 个事件)

pdb_path

c:\Users\Mr.Anderson\Desktop\Vc++ 6.0\13.8.20\cgridlistctrlex-master\cgridlistctrlex-master\vs2003\Release\CGridListCtrlEx.pdb

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1619987449.26525 NtAllocateVirtualMemory	process_identifier: 2420 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x003f0000	success
1619987080.314897 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0000000004280000	success
1619987458.203 NtAllocateVirtualMemory	process_identifier: 284 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00610000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619987453.39025 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\e71cb629f9ee78015ad89e860650668a.exe newfilepath: C:\Windows\SysWOW64\nci\ExplorerFrame.exe newfilepath_r: C:\Windows\SysWOW64\nci\ExplorerFrame.exe flags: 3 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\e71cb629f9ee78015ad89e860650668a.exe	success	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619987474.171 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

explorerframe.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619987473.89 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (5 个事件)

host	172.217.24.14
host	201.171.150.41
host	94.76.247.61
host	203.208.40.98
host	203.208.41.33

Installs itself for autorun at Windows startup (1 个事件)

service_name

ExplorerFrame

service_path

C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\nci\ExplorerFrame.exe"

Created a service where a service was also not started (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619987456.60925 CreateServiceW	service_start_name: start_type: 2 service_handle: 0x009275d8 display_name: ExplorerFrame error_control: 0 service_name: ExplorerFrame filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\nci\ExplorerFrame.exe" filepath_r: "C:\Windows\SysWOW64\nci\ExplorerFrame.exe" service_manager_handle: 0x037b8c90 desired_access: 2 service_type: 16 password:	success	9598424	0

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619987476.781 RegSetValueExA	key_handle: 0x000003c8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619987476.781 RegSetValueExA	key_handle: 0x000003c8 value: À&5G?× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619987476.781 RegSetValueExA	key_handle: 0x000003c8 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619987476.781 RegSetValueExW	key_handle: 0x000003c8 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619987476.796 RegSetValueExA	key_handle: 0x000003e0 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619987476.796 RegSetValueExA	key_handle: 0x000003e0 value: À&5G?× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619987476.796 RegSetValueExA	key_handle: 0x000003e0 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619987476.796 RegSetValueExW	key_handle: 0x000003c4 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Windows\SysWOW64\nci\ExplorerFrame.exe:Zone.Identifier

File has been identified by 46 AntiVirus engines on VirusTotal as malicious (46 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.69431
FireEye	Trojan.GenericKDZ.69431
CAT-QuickHeal	Trojan.CkgenericPMF.S15430279
ALYac	Trojan.Agent.Emotet
Cylance	Unsafe
SUPERAntiSpyware	Trojan.Agent/Gen-Emotet
K7AntiVirus	Trojan ( 0056c7a21 )
Alibaba	Trojan:Win32/Injuke.d92940cb
K7GW	Trojan ( 0056c7a21 )
Arcabit	Trojan.Generic.D10F37
Cyren	W32/Emotet.APQ.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Malware-gen
ClamAV	Win.Trojan.Generickdz-9753092-0
Kaspersky	HEUR:Trojan-Banker.Win32.Emotet.pef
BitDefender	Trojan.GenericKDZ.69431
NANO-Antivirus	Trojan.Win32.Injuke.hrtugs
Paloalto	generic.ml
AegisLab	Trojan.Win32.Injuke.4!c
Tencent	Malware.Win32.Gencirc.10cde818
Ad-Aware	Trojan.GenericKDZ.69431
Comodo	Malware@#3nr84hbmlkvus
DrWeb	Trojan.DownLoader34.22507
VIPRE	Trojan.Win32.Generic!BT
Invincea	Mal/Generic-R + Troj/Emotet-CLA
McAfee-GW-Edition	BehavesLike.Win32.Emotet.gh
Sophos	Troj/Emotet-CLA
Ikarus	Trojan-Banker.Emotet
Jiangmin	Trojan.Banker.Emotet.odi
Avira	TR/AD.Emotet.cxwim
MAX	malware (ai score=86)
Microsoft	Trojan:Win32/Emotet.ARJ!MTB
ZoneAlarm	HEUR:Trojan-Banker.Win32.Emotet.pef
GData	Trojan.GenericKDZ.69431
AhnLab-V3	Malware/Win32.Generic.C4180461
McAfee	Emotet-FRV!E71CB629F9EE
TACHYON	Backdoor/W32.Emotet.475136
ESET-NOD32	a variant of Win32/Kryptik.HFMY
Rising	Trojan.Kryptik!1.CA5D (CLASSIC)
Fortinet	W32/Emotet.E88D!tr
AVG	Win32:Malware-gen
Panda	Trj/Genetic.gen
Qihoo-360	Win32/Trojan.94f

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (4 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.78:443
dead_host	201.171.150.41:443
dead_host	94.76.247.61:8080

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-13 17:23:00

Imports

Library KERNEL32.dll:

• 0x448104 GetSystemInfo

• 0x448108 VirtualQuery

• 0x44810c HeapReAlloc

• 0x448110 GetSystemTimeAsFileTime

• 0x448114 GetStartupInfoA

• 0x448118 GetCommandLineA

• 0x44811c TerminateProcess

• 0x448120 HeapSize

• 0x448124 QueryPerformanceCounter

• 0x448128 GetCurrentProcessId

• 0x44812c LCMapStringA

• 0x448130 LCMapStringW

• 0x448134 SetUnhandledExceptionFilter

• 0x448138 GetTimeZoneInformation

• 0x44813c HeapDestroy

• 0x448140 HeapCreate

• 0x448144 VirtualFree

• 0x448148 IsBadWritePtr

• 0x44814c VirtualAlloc

• 0x448150 GetStringTypeW

• 0x448154 GetStdHandle

• 0x448158 UnhandledExceptionFilter

• 0x44815c FreeEnvironmentStringsA

• 0x448160 GetEnvironmentStrings

• 0x448164 FreeEnvironmentStringsW

• 0x448168 GetEnvironmentStringsW

• 0x44816c SetHandleCount

• 0x448170 GetFileType

• 0x448174 IsBadReadPtr

• 0x448178 IsBadCodePtr

• 0x44817c GetUserDefaultLCID

• 0x448180 EnumSystemLocalesA

• 0x448184 IsValidLocale

• 0x448188 IsValidCodePage

• 0x44818c SetStdHandle

• 0x448190 GetLocaleInfoW

• 0x448194 SetEnvironmentVariableA

• 0x448198 InterlockedExchange

• 0x44819c VirtualProtect

• 0x4481a0 HeapFree

• 0x4481a4 HeapAlloc

• 0x4481a8 GetDateFormatA

• 0x4481ac GetTimeFormatA

• 0x4481b0 RtlUnwind

• 0x4481b4 GetFileTime

• 0x4481b8 GetFileAttributesA

• 0x4481bc SetErrorMode

• 0x4481c0 FileTimeToLocalFileTime

• 0x4481c4 GetOEMCP

• 0x4481c8 GetCPInfo

• 0x4481cc CreateFileA

• 0x4481d0 GetFullPathNameA

• 0x4481d4 GetVolumeInformationA

• 0x4481d8 FindFirstFileA

• 0x4481dc FindClose

• 0x4481e0 GetCurrentProcess

• 0x4481e4 DuplicateHandle

• 0x4481e8 GetFileSize

• 0x4481ec SetEndOfFile

• 0x4481f0 UnlockFile

• 0x4481f4 LockFile

• 0x4481f8 FlushFileBuffers

• 0x4481fc SetFilePointer

• 0x448200 WriteFile

• 0x448204 ReadFile

• 0x448208 TlsFree

• 0x44820c LocalReAlloc

• 0x448210 TlsSetValue

• 0x448214 TlsAlloc

• 0x448218 TlsGetValue

• 0x44821c EnterCriticalSection

• 0x448220 GlobalHandle

• 0x448224 GlobalReAlloc

• 0x448228 LeaveCriticalSection

• 0x44822c LocalAlloc

• 0x448230 GlobalFlags

• 0x448234 InterlockedIncrement

• 0x448238 GetProfileIntA

• 0x44823c FileTimeToSystemTime

• 0x448240 InterlockedDecrement

• 0x448244 SetLastError

• 0x448248 CopyFileA

• 0x44824c MulDiv

• 0x448250 GlobalSize

• 0x448254 FormatMessageA

• 0x448258 LocalFree

• 0x44825c GlobalGetAtomNameA

• 0x448260 GlobalFindAtomA

• 0x448264 lstrcatA

• 0x448268 lstrcmpW

• 0x44826c GetTickCount

• 0x448270 GetPrivateProfileStringA

• 0x448274 WritePrivateProfileStringA

• 0x448278 FreeResource

• 0x44827c CloseHandle

• 0x448280 GlobalAddAtomA

• 0x448284 GetCurrentThread

• 0x448288 GetCurrentThreadId

• 0x44828c GlobalDeleteAtom

• 0x448290 lstrcmpA

• 0x448294 GetModuleFileNameA

• 0x448298 GetModuleHandleA

• 0x44829c ConvertDefaultLocale

• 0x4482a0 EnumResourceLanguagesA

• 0x4482a4 lstrcpyA

• 0x4482a8 GlobalAlloc

• 0x4482ac GlobalLock

• 0x4482b0 GlobalUnlock

• 0x4482b4 GlobalFree

• 0x4482b8 lstrcpynA

• 0x4482bc Sleep

• 0x4482c0 LoadLibraryA

• 0x4482c4 GetProcAddress

• 0x4482c8 FreeLibrary

• 0x4482cc VerSetConditionMask

• 0x4482d0 VerifyVersionInfoA

• 0x4482d4 DebugBreak

• 0x4482d8 CompareStringW

• 0x4482dc CompareStringA

• 0x4482e0 lstrlenA

• 0x4482e4 lstrlenW

• 0x4482e8 lstrcmpiA

• 0x4482ec GetVersion

• 0x4482f0 DeleteCriticalSection

• 0x4482f4 InitializeCriticalSection

• 0x4482f8 GetLastError

• 0x4482fc RaiseException

• 0x448300 MultiByteToWideChar

• 0x448304 ExitProcess

• 0x448308 WideCharToMultiByte

• 0x44830c FindResourceA

• 0x448310 LoadResource

• 0x448314 LockResource

• 0x448318 SizeofResource

• 0x44831c GetVersionExA

• 0x448320 GetThreadLocale

• 0x448324 GetLocaleInfoA

• 0x448328 GetACP

• 0x44832c GetStringTypeA

Library USER32.dll:

• 0x448394 InvalidateRgn

• 0x448398 CopyAcceleratorTableA

• 0x44839c CharNextA

• 0x4483a0 PostThreadMessageA

• 0x4483a4 GetSysColorBrush

• 0x4483a8 LoadCursorA

• 0x4483ac WindowFromPoint

• 0x4483b0 ReleaseCapture

• 0x4483b4 SetCapture

• 0x4483b8 SetRect

• 0x4483bc IsRectEmpty

• 0x4483c0 EndPaint

• 0x4483c4 BeginPaint

• 0x4483c8 GetWindowDC

• 0x4483cc ClientToScreen

• 0x4483d0 GrayStringA

• 0x4483d4 DrawTextExA

• 0x4483d8 TabbedTextOutA

• 0x4483dc DestroyMenu

• 0x4483e0 ShowWindow

• 0x4483e4 MoveWindow

• 0x4483e8 SetWindowTextA

• 0x4483ec IsDialogMessageA

• 0x4483f0 WinHelpA

• 0x4483f4 GetCapture

• 0x4483f8 CreateWindowExA

• 0x4483fc GetClassLongA

• 0x448400 GetClassInfoExA

• 0x448404 GetClassNameA

• 0x448408 SetPropA

• 0x44840c GetPropA

• 0x448410 RemovePropA

• 0x448414 SendDlgItemMessageA

• 0x448418 SetFocus

• 0x44841c IsChild

• 0x448420 GetWindowTextLengthA

• 0x448424 GetWindowTextA

• 0x448428 GetForegroundWindow

• 0x44842c GetTopWindow

• 0x448430 UnhookWindowsHookEx

• 0x448434 GetMessageTime

• 0x448438 MapWindowPoints

• 0x44843c TrackPopupMenu

• 0x448440 GetScrollPos

• 0x448444 SetForegroundWindow

• 0x448448 GetMenu

• 0x44844c GetSubMenu

• 0x448450 GetMenuItemID

• 0x448454 AdjustWindowRectEx

• 0x448458 GetClassInfoA

• 0x44845c RegisterClassA

• 0x448460 GetDlgCtrlID

• 0x448464 DefWindowProcA

• 0x448468 CallWindowProcA

• 0x44846c SetWindowLongA

• 0x448470 IntersectRect

• 0x448474 SystemParametersInfoA

• 0x448478 GetWindowPlacement

• 0x44847c SetWindowContextHelpId

• 0x448480 MapDialogRect

• 0x448484 SetWindowPos

• 0x448488 RegisterClipboardFormatA

• 0x44848c wsprintfA

• 0x448490 DrawIcon

• 0x448494 AppendMenuA

• 0x448498 SendMessageA

• 0x44849c GetSystemMenu

• 0x4484a0 IsIconic

• 0x4484a4 GetClientRect

• 0x4484a8 EnableWindow

• 0x4484ac LoadIconA

• 0x4484b0 GetSystemMetrics

• 0x4484b4 CharUpperA

• 0x4484b8 RegisterWindowMessageA

• 0x4484bc SetActiveWindow

• 0x4484c0 CreateDialogIndirectParamA

• 0x4484c4 DestroyWindow

• 0x4484c8 IsWindow

• 0x4484cc GetDlgItem

• 0x4484d0 GetNextDlgTabItem

• 0x4484d4 EndDialog

• 0x4484d8 SetMenuItemBitmaps

• 0x4484dc ModifyMenuA

• 0x4484e0 GetMenuState

• 0x4484e4 EnableMenuItem

• 0x4484e8 CheckMenuItem

• 0x4484ec GetMenuCheckMarkDimensions

• 0x4484f0 LoadBitmapA

• 0x4484f4 SetWindowsHookExA

• 0x4484f8 CallNextHookEx

• 0x4484fc GetMessageA

• 0x448500 TranslateMessage

• 0x448504 DispatchMessageA

• 0x448508 GetActiveWindow

• 0x44850c IsWindowVisible

• 0x448510 PeekMessageA

• 0x448514 GetCursorPos

• 0x448518 ValidateRect

• 0x44851c MessageBoxA

• 0x448520 GetWindowLongA

• 0x448524 GetLastActivePopup

• 0x448528 IsWindowEnabled

• 0x44852c SetCursor

• 0x448530 PostQuitMessage

• 0x448534 DrawFocusRect

• 0x448538 MessageBeep

• 0x44853c GetScrollRange

• 0x448540 GetNextDlgGroupItem

• 0x448544 UnregisterClassA

• 0x448548 PostMessageA

• 0x44854c GetDC

• 0x448550 ReleaseDC

• 0x448554 UpdateWindow

• 0x448558 InvalidateRect

• 0x44855c GetWindow

• 0x448560 GetParent

• 0x448564 GetFocus

• 0x448568 PtInRect

• 0x44856c InflateRect

• 0x448570 OffsetRect

• 0x448574 FillRect

• 0x448578 GetWindowRect

• 0x44857c GetKeyState

• 0x448580 DrawTextA

• 0x448584 CreatePopupMenu

• 0x448588 GetMenuItemCount

• 0x44858c ScreenToClient

• 0x448590 OpenClipboard

• 0x448594 GetSysColor

• 0x448598 GetDesktopWindow

• 0x44859c GetMessagePos

• 0x4485a0 CloseClipboard

• 0x4485a4 SetClipboardData

• 0x4485a8 EmptyClipboard

• 0x4485ac CopyRect

• 0x4485b0 EqualRect

Library GDI32.dll:

• 0x448058 CreatePen

• 0x44805c CreateSolidBrush

• 0x448060 GetMapMode

• 0x448064 GetBkColor

• 0x448068 GetRgnBox

• 0x44806c GetStockObject

• 0x448070 DeleteDC

• 0x448074 ExtSelectClipRgn

• 0x448078 ScaleWindowExtEx

• 0x44807c SetWindowExtEx

• 0x448080 ScaleViewportExtEx

• 0x448084 SetViewportExtEx

• 0x448088 OffsetViewportOrgEx

• 0x44808c SetViewportOrgEx

• 0x448090 SelectObject

• 0x448094 Escape

• 0x448098 TextOutA

• 0x44809c RectVisible

• 0x4480a0 PtVisible

• 0x4480a4 GetWindowExtEx

• 0x4480a8 GetTextColor

• 0x4480ac GetTextExtentPoint32A

• 0x4480b0 MoveToEx

• 0x4480b4 LineTo

• 0x4480b8 SetMapMode

• 0x4480bc RestoreDC

• 0x4480c0 SaveDC

• 0x4480c4 ExtTextOutA

• 0x4480c8 CopyMetaFileA

• 0x4480cc GetDeviceCaps

• 0x4480d0 SetBkColor

• 0x4480d4 SetTextColor

• 0x4480d8 GetClipBox

• 0x4480dc CreateRectRgnIndirect

• 0x4480e0 CreateBitmap

• 0x4480e4 DeleteObject

• 0x4480e8 CreateFontIndirectA

• 0x4480ec CreateCompatibleDC

• 0x4480f0 CreateCompatibleBitmap

• 0x4480f4 GetCurrentObject

• 0x4480f8 GetObjectA

• 0x4480fc GetViewportExtEx

Library comdlg32.dll:

• 0x4485c8 GetFileTitleA

Library WINSPOOL.DRV:

• 0x4485b8 OpenPrinterA

• 0x4485bc DocumentPropertiesA

• 0x4485c0 ClosePrinter

Library ADVAPI32.dll:

• 0x448000 RegCloseKey

• 0x448004 RegOpenKeyExA

• 0x448008 RegDeleteKeyA

• 0x44800c RegEnumKeyA

• 0x448010 RegOpenKeyA

• 0x448014 RegQueryValueA

• 0x448018 RegCreateKeyExA

• 0x44801c RegSetValueExA

• 0x448020 RegDeleteValueA

• 0x448024 RegQueryValueExA

Library SHELL32.dll:

• 0x448378 ShellExecuteA

Library COMCTL32.dll:

• 0x44802c ImageList_ReplaceIcon

• 0x448030 ImageList_GetImageCount

• 0x448034 ImageList_AddMasked

• 0x448038 ImageList_Draw

• 0x44803c ImageList_SetBkColor

• 0x448040 ImageList_GetBkColor

• 0x448044 ImageList_GetImageInfo

• 0x448048 ImageList_Destroy

• 0x44804c ImageList_Create

• 0x448050

Library SHLWAPI.dll:

• 0x448380 PathFindFileNameA

• 0x448384 PathStripToRootA

• 0x448388 PathFindExtensionA

• 0x44838c PathIsUNCA

Library oledlg.dll:

• 0x44862c

Library ole32.dll:

• 0x4485d0 OleFlushClipboard

• 0x4485d4 OleIsCurrentClipboard

• 0x4485d8 DoDragDrop

• 0x4485dc RevokeDragDrop

• 0x4485e0 CoLockObjectExternal

• 0x4485e4 RegisterDragDrop

• 0x4485e8 OleDuplicateData

• 0x4485ec ReleaseStgMedium

• 0x4485f0 CoTaskMemAlloc

• 0x4485f4 CoGetClassObject

• 0x4485f8 CoTaskMemFree

• 0x4485fc CLSIDFromString

• 0x448600 CLSIDFromProgID

• 0x448604 OleInitialize

• 0x448608 CoFreeUnusedLibraries

• 0x44860c OleUninitialize

• 0x448610 CreateStreamOnHGlobal

• 0x448614 CreateILockBytesOnHGlobal

• 0x448618 StgCreateDocfileOnILockBytes

• 0x44861c StgOpenStorageOnILockBytes

• 0x448620 CoRegisterMessageFilter

• 0x448624 CoRevokeClassObject

Library OLEAUT32.dll:

• 0x448334 SysFreeString

• 0x448338 SystemTimeToVariantTime

• 0x44833c VarBstrFromDate

• 0x448340 VarUdateFromDate

• 0x448344 VariantTimeToSystemTime

• 0x448348 VarDateFromStr

• 0x44834c SysStringLen

• 0x448350 SysAllocStringLen

• 0x448354 VariantClear

• 0x448358 VariantChangeType

• 0x44835c VariantInit

• 0x448360 SysAllocStringByteLen

• 0x448364 OleCreateFontIndirect

• 0x448368 SafeArrayDestroy

• 0x44836c SysAllocString

• 0x448370 VariantCopy

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
teredo.ipv6.microsoft.com		127.0.0.1
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com	216.58.200.238

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57236	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.