SmartHawk

4.2

中危

55 个模型检测该样本为恶意！

重新分析

下载样本

fd4e2f9a772d8d1f532b2f924fda838d553a5bcb0d5ccc5b6972969e8eec4002

ed9ccf10785209ca018603573ece4d8b.exe

分析耗时

79s

最近分析

文件大小

1.2MB

静态报毒动态报毒 100% ADWAREDEALPLY AI SCORE=82 AIDETECTVM ATTRIBUTE BHH2HHDSULR BOPL51MK9KY CONFIDENCE CRYPTINJECT DOWNLOADER33 ELPX ELRO ERHQ GDSDA GENCIRC GENERICRXAA GENKRYPTIK GULOADER HIGH CONFIDENCE HIGHCONFIDENCE HKLSTE MALWARE2 MALWARE@#3B01SA7HDKPG7 MLX@AKJFSSJI PSGV R06EC0DIA20 REMCOS SCORE SFAHL SONBOKLI STATIC AI SUSPICIOUS PE UNSAFE ZELPHIF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20201228	21.1.5827.0
Alibaba	Backdoor:Win32/CryptInject.61f1b950	20190527	0.3.0.5
Tencent	Malware.Win32.Gencirc.10cdcdfa	20201228	1.0.0.1
Kingsoft		20201228	2017.9.26.565
McAfee	GenericRXAA-AA!ED9CCF107852	20201228	6.0.6.653
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)

section

.itext

The executable uses a known packer (1 个事件)

packer

BobSoft Mini Delphi -> BoB / BobSoft

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619999733.300915 __exception__	stacktrace: 0x33e691f 0x33e6959 0x33e6855 0x339fa8c 0x33e7842 0x33e7d12 0x33aea32 gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x775a62fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x775a6d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x775a77c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x775a7bca 0x33e4229 registers.esp: 1633972 registers.edi: 0 registers.eax: 1633972 registers.ebp: 1634052 registers.edx: 0 registers.ebx: 1635776 registers.esi: 56732112 registers.ecx: 7 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x778eb727	success	0	0

Allocates read-write-execute memory (usually to unpack itself) (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619999683.191915 NtAllocateVirtualMemory	process_identifier: 2760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006b0000	success	0	0
1619999688.566915 NtAllocateVirtualMemory	process_identifier: 2760 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02100000	success	0	0

Downloads a file or document from Google Drive (1 个事件)

domain

drive.google.com

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

31.13.67.33:443

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Agent.ERHQ
FireEye	Trojan.Agent.ERHQ
CAT-QuickHeal	Backdoor.Remcos
Qihoo-360	Win32/Backdoor.a07
ALYac	Backdoor.Remcos.A
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 7000000f1 )
BitDefender	Trojan.Agent.ERHQ
K7GW	Trojan ( 7000000f1 )
Cybereason	malicious.078520
BitDefenderTheta	Gen:NN.ZelphiF.34700.mLX@aKjFSSji
Cyren	W32/Trojan.PSGV-8662
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	HEUR:Backdoor.Win32.Remcos.gen
Alibaba	Backdoor:Win32/CryptInject.61f1b950
NANO-Antivirus	Trojan.Win32.GenKryptik.hklste
Tencent	Malware.Win32.Gencirc.10cdcdfa
Ad-Aware	Trojan.Agent.ERHQ
Emsisoft	Trojan.Agent.ERHQ (B)
Comodo	Malware@#3b01sa7hdkpg7
F-Secure	Trojan.TR/Crypt.Agent.sfahl
DrWeb	Trojan.DownLoader33.44281
TrendMicro	TROJ_GEN.R06EC0DIA20
McAfee-GW-Edition	BehavesLike.Win32.AdwareDealPly.th
Sophos	Mal/Generic-S
Ikarus	Trojan.Inject
GData	Trojan.Agent.ERHQ
Jiangmin	Backdoor.Remcos.bnd
Webroot	W32.Trojan.Gen
Avira	TR/Crypt.Agent.sfahl
MAX	malware (ai score=82)
Antiy-AVL	Trojan/Win32.Sonbokli
Arcabit	Trojan.Agent.ERHQ
ZoneAlarm	HEUR:Backdoor.Win32.Remcos.gen
Microsoft	Trojan:Win32/CryptInject.AJ!MTB
Cynet	Malicious (score: 85)
McAfee	GenericRXAA-AA!ED9CCF107852
VBA32	Backdoor.Remcos
Malwarebytes	Trojan.GuLoader
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Win32/GenKryptik.ELPX
TrendMicro-HouseCall	TROJ_GEN.R06EC0DIA20
Rising	Backdoor.Remcos!8.B89E (TFE:4:bHh2HHDsULR)
Yandex	Trojan.GenKryptik!BopL51MK9KY

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library oleaut32.dll:

• 0x4e27a4 SysFreeString

• 0x4e27a8 SysReAllocStringLen

• 0x4e27ac SysAllocStringLen

Library advapi32.dll:

• 0x4e27b4 RegQueryValueExA

• 0x4e27b8 RegOpenKeyExA

• 0x4e27bc RegCloseKey

Library user32.dll:

• 0x4e27c4 GetKeyboardType

• 0x4e27c8 DestroyWindow

• 0x4e27cc LoadStringA

• 0x4e27d0 MessageBoxA

• 0x4e27d4 CharNextA

Library kernel32.dll:

• 0x4e27dc GetACP

• 0x4e27e0 Sleep

• 0x4e27e4 VirtualFree

• 0x4e27e8 VirtualAlloc

• 0x4e27ec GetCurrentThreadId

• 0x4e27f0 InterlockedDecrement

• 0x4e27f4 InterlockedIncrement

• 0x4e27f8 VirtualQuery

• 0x4e27fc WideCharToMultiByte

• 0x4e2800 MultiByteToWideChar

• 0x4e2804 lstrlenA

• 0x4e2808 lstrcpynA

• 0x4e280c LoadLibraryExA

• 0x4e2810 GetThreadLocale

• 0x4e2814 GetStartupInfoA

• 0x4e2818 GetProcAddress

• 0x4e281c GetModuleHandleA

• 0x4e2820 GetModuleFileNameA

• 0x4e2824 GetLocaleInfoA

• 0x4e2828 GetCommandLineA

• 0x4e282c FreeLibrary

• 0x4e2830 FindFirstFileA

• 0x4e2834 FindClose

• 0x4e2838 ExitProcess

• 0x4e283c CompareStringA

• 0x4e2840 WriteFile

• 0x4e2844 UnhandledExceptionFilter

• 0x4e2848 RtlUnwind

• 0x4e284c RaiseException

• 0x4e2850 GetStdHandle

Library kernel32.dll:

• 0x4e2858 TlsSetValue

• 0x4e285c TlsGetValue

• 0x4e2860 LocalAlloc

• 0x4e2864 GetModuleHandleA

Library user32.dll:

• 0x4e286c CreateWindowExA

• 0x4e2870 WindowFromPoint

• 0x4e2874 WaitMessage

• 0x4e2878 UpdateWindow

• 0x4e287c UnregisterClassA

• 0x4e2880 UnhookWindowsHookEx

• 0x4e2884 TranslateMessage

• 0x4e2888 TranslateMDISysAccel

• 0x4e288c TrackPopupMenu

• 0x4e2890 SystemParametersInfoA

• 0x4e2894 ShowWindow

• 0x4e2898 ShowScrollBar

• 0x4e289c ShowOwnedPopups

• 0x4e28a0 SetWindowsHookExA

• 0x4e28a4 SetWindowTextA

• 0x4e28a8 SetWindowPos

• 0x4e28ac SetWindowPlacement

• 0x4e28b0 SetWindowLongW

• 0x4e28b4 SetWindowLongA

• 0x4e28b8 SetTimer

• 0x4e28bc SetScrollRange

• 0x4e28c0 SetScrollPos

• 0x4e28c4 SetScrollInfo

• 0x4e28c8 SetRect

• 0x4e28cc SetPropA

• 0x4e28d0 SetParent

• 0x4e28d4 SetMenuItemInfoA

• 0x4e28d8 SetMenu

• 0x4e28dc SetForegroundWindow

• 0x4e28e0 SetFocus

• 0x4e28e4 SetCursor

• 0x4e28e8 SetClipboardData

• 0x4e28ec SetClassLongA

• 0x4e28f0 SetCapture

• 0x4e28f4 SetActiveWindow

• 0x4e28f8 SendMessageW

• 0x4e28fc SendMessageA

• 0x4e2900 ScrollWindow

• 0x4e2904 ScreenToClient

• 0x4e2908 RemovePropA

• 0x4e290c RemoveMenu

• 0x4e2910 ReleaseDC

• 0x4e2914 ReleaseCapture

• 0x4e2918 RegisterWindowMessageA

• 0x4e291c RegisterClipboardFormatA

• 0x4e2920 RegisterClassA

• 0x4e2924 RedrawWindow

• 0x4e2928 PtInRect

• 0x4e292c PostQuitMessage

• 0x4e2930 PostMessageA

• 0x4e2934 PeekMessageW

• 0x4e2938 PeekMessageA

• 0x4e293c OpenClipboard

• 0x4e2940 OffsetRect

• 0x4e2944 OemToCharA

• 0x4e2948 MessageBoxA

• 0x4e294c MessageBeep

• 0x4e2950 MapWindowPoints

• 0x4e2954 MapVirtualKeyA

• 0x4e2958 LoadStringA

• 0x4e295c LoadKeyboardLayoutA

• 0x4e2960 LoadIconA

• 0x4e2964 LoadCursorA

• 0x4e2968 LoadBitmapA

• 0x4e296c KillTimer

• 0x4e2970 IsZoomed

• 0x4e2974 IsWindowVisible

• 0x4e2978 IsWindowUnicode

• 0x4e297c IsWindowEnabled

• 0x4e2980 IsWindow

• 0x4e2984 IsRectEmpty

• 0x4e2988 IsIconic

• 0x4e298c IsDialogMessageW

• 0x4e2990 IsDialogMessageA

• 0x4e2994 IsChild

• 0x4e2998 InvalidateRect

• 0x4e299c IntersectRect

• 0x4e29a0 InsertMenuItemA

• 0x4e29a4 InsertMenuA

• 0x4e29a8 InflateRect

• 0x4e29ac GetWindowThreadProcessId

• 0x4e29b0 GetWindowTextA

• 0x4e29b4 GetWindowRect

• 0x4e29b8 GetWindowPlacement

• 0x4e29bc GetWindowLongW

• 0x4e29c0 GetWindowLongA

• 0x4e29c4 GetWindowDC

• 0x4e29c8 GetUpdateRect

• 0x4e29cc GetTopWindow

• 0x4e29d0 GetSystemMetrics

• 0x4e29d4 GetSystemMenu

• 0x4e29d8 GetSysColorBrush

• 0x4e29dc GetSysColor

• 0x4e29e0 GetSubMenu

• 0x4e29e4 GetScrollRange

• 0x4e29e8 GetScrollPos

• 0x4e29ec GetScrollInfo

• 0x4e29f0 GetPropA

• 0x4e29f4 GetParent

• 0x4e29f8 GetWindow

• 0x4e29fc GetMessagePos

• 0x4e2a00 GetMenuStringA

• 0x4e2a04 GetMenuState

• 0x4e2a08 GetMenuItemInfoA

• 0x4e2a0c GetMenuItemID

• 0x4e2a10 GetMenuItemCount

• 0x4e2a14 GetMenu

• 0x4e2a18 GetLastActivePopup

• 0x4e2a1c GetKeyboardState

• 0x4e2a20 GetKeyboardLayoutNameA

• 0x4e2a24 GetKeyboardLayoutList

• 0x4e2a28 GetKeyboardLayout

• 0x4e2a2c GetKeyState

• 0x4e2a30 GetKeyNameTextA

• 0x4e2a34 GetIconInfo

• 0x4e2a38 GetForegroundWindow

• 0x4e2a3c GetFocus

• 0x4e2a40 GetDesktopWindow

• 0x4e2a44 GetDCEx

• 0x4e2a48 GetDC

• 0x4e2a4c GetCursorPos

• 0x4e2a50 GetCursor

• 0x4e2a54 GetClipboardData

• 0x4e2a58 GetClientRect

• 0x4e2a5c GetClassLongA

• 0x4e2a60 GetClassInfoA

• 0x4e2a64 GetCapture

• 0x4e2a68 GetActiveWindow

• 0x4e2a6c FrameRect

• 0x4e2a70 FindWindowA

• 0x4e2a74 FillRect

• 0x4e2a78 EqualRect

• 0x4e2a7c EnumWindows

• 0x4e2a80 EnumThreadWindows

• 0x4e2a84 EnumChildWindows

• 0x4e2a88 EndPaint

• 0x4e2a8c EnableWindow

• 0x4e2a90 EnableScrollBar

• 0x4e2a94 EnableMenuItem

• 0x4e2a98 EmptyClipboard

• 0x4e2a9c DrawTextA

• 0x4e2aa0 DrawMenuBar

• 0x4e2aa4 DrawIconEx

• 0x4e2aa8 DrawIcon

• 0x4e2aac DrawFrameControl

• 0x4e2ab0 DrawEdge

• 0x4e2ab4 DispatchMessageW

• 0x4e2ab8 DispatchMessageA

• 0x4e2abc DestroyWindow

• 0x4e2ac0 DestroyMenu

• 0x4e2ac4 DestroyIcon

• 0x4e2ac8 DestroyCursor

• 0x4e2acc DeleteMenu

• 0x4e2ad0 DefWindowProcA

• 0x4e2ad4 DefMDIChildProcA

• 0x4e2ad8 DefFrameProcA

• 0x4e2adc CreatePopupMenu

• 0x4e2ae0 CreateMenu

• 0x4e2ae4 CreateIcon

• 0x4e2ae8 CloseClipboard

• 0x4e2aec ClientToScreen

• 0x4e2af0 CheckMenuItem

• 0x4e2af4 CallWindowProcA

• 0x4e2af8 CallNextHookEx

• 0x4e2afc BeginPaint

• 0x4e2b00 CharNextA

• 0x4e2b04 CharLowerBuffA

• 0x4e2b08 CharLowerA

• 0x4e2b0c CharUpperBuffA

• 0x4e2b10 CharToOemA

• 0x4e2b14 AdjustWindowRectEx

• 0x4e2b18 ActivateKeyboardLayout

Library gdi32.dll:

• 0x4e2b20 UnrealizeObject

• 0x4e2b24 StretchBlt

• 0x4e2b28 StartPage

• 0x4e2b2c StartDocA

• 0x4e2b30 SetWindowOrgEx

• 0x4e2b34 SetWinMetaFileBits

• 0x4e2b38 SetViewportOrgEx

• 0x4e2b3c SetTextColor

• 0x4e2b40 SetStretchBltMode

• 0x4e2b44 SetROP2

• 0x4e2b48 SetPixel

• 0x4e2b4c SetMapMode

• 0x4e2b50 SetEnhMetaFileBits

• 0x4e2b54 SetDIBColorTable

• 0x4e2b58 SetBrushOrgEx

• 0x4e2b5c SetBkMode

• 0x4e2b60 SetBkColor

• 0x4e2b64 SetAbortProc

• 0x4e2b68 SelectPalette

• 0x4e2b6c SelectObject

• 0x4e2b70 SaveDC

• 0x4e2b74 RestoreDC

• 0x4e2b78 Rectangle

• 0x4e2b7c RectVisible

• 0x4e2b80 RealizePalette

• 0x4e2b84 PlayEnhMetaFile

• 0x4e2b88 PatBlt

• 0x4e2b8c MoveToEx

• 0x4e2b90 MaskBlt

• 0x4e2b94 LineTo

• 0x4e2b98 IntersectClipRect

• 0x4e2b9c GetWindowOrgEx

• 0x4e2ba0 GetWinMetaFileBits

• 0x4e2ba4 GetTextMetricsA

• 0x4e2ba8 GetTextExtentPointA

• 0x4e2bac GetTextExtentPoint32A

• 0x4e2bb0 GetSystemPaletteEntries

• 0x4e2bb4 GetStockObject

• 0x4e2bb8 GetRgnBox

• 0x4e2bbc GetPixel

• 0x4e2bc0 GetPaletteEntries

• 0x4e2bc4 GetObjectA

• 0x4e2bc8 GetEnhMetaFilePaletteEntries

• 0x4e2bcc GetEnhMetaFileHeader

• 0x4e2bd0 GetEnhMetaFileBits

• 0x4e2bd4 GetDeviceCaps

• 0x4e2bd8 GetDIBits

• 0x4e2bdc GetDIBColorTable

• 0x4e2be0 GetDCOrgEx

• 0x4e2be4 GetCurrentPositionEx

• 0x4e2be8 GetClipBox

• 0x4e2bec GetBrushOrgEx

• 0x4e2bf0 GetBitmapBits

• 0x4e2bf4 GdiFlush

• 0x4e2bf8 ExcludeClipRect

• 0x4e2bfc EndPage

• 0x4e2c00 EndDoc

• 0x4e2c04 DeleteObject

• 0x4e2c08 DeleteEnhMetaFile

• 0x4e2c0c DeleteDC

• 0x4e2c10 CreateSolidBrush

• 0x4e2c14 CreatePenIndirect

• 0x4e2c18 CreatePalette

• 0x4e2c1c CreateICA

• 0x4e2c20 CreateHalftonePalette

• 0x4e2c24 CreateFontIndirectA

• 0x4e2c28 CreateDIBitmap

• 0x4e2c2c CreateDIBSection

• 0x4e2c30 CreateDCA

• 0x4e2c34 CreateCompatibleDC

• 0x4e2c38 CreateCompatibleBitmap

• 0x4e2c3c CreateBrushIndirect

• 0x4e2c40 CreateBitmap

• 0x4e2c44 CopyEnhMetaFileA

• 0x4e2c48 BitBlt

Library version.dll:

• 0x4e2c50 VerQueryValueA

• 0x4e2c54 GetFileVersionInfoSizeA

• 0x4e2c58 GetFileVersionInfoA

Library kernel32.dll:

• 0x4e2c60 lstrcpyA

• 0x4e2c64 WriteFile

• 0x4e2c68 WaitForSingleObject

• 0x4e2c6c VirtualQuery

• 0x4e2c70 VirtualProtect

• 0x4e2c74 VirtualAlloc

• 0x4e2c78 SizeofResource

• 0x4e2c7c SetThreadLocale

• 0x4e2c80 SetFilePointer

• 0x4e2c84 SetEvent

• 0x4e2c88 SetErrorMode

• 0x4e2c8c SetEndOfFile

• 0x4e2c90 ResetEvent

• 0x4e2c94 ReadFile

• 0x4e2c98 MulDiv

• 0x4e2c9c LockResource

• 0x4e2ca0 LoadResource

• 0x4e2ca4 LoadLibraryA

• 0x4e2ca8 LeaveCriticalSection

• 0x4e2cac InitializeCriticalSection

• 0x4e2cb0 GlobalUnlock

• 0x4e2cb4 GlobalLock

• 0x4e2cb8 GlobalFree

• 0x4e2cbc GlobalFindAtomA

• 0x4e2cc0 GlobalDeleteAtom

• 0x4e2cc4 GlobalAlloc

• 0x4e2cc8 GlobalAddAtomA

• 0x4e2ccc GetVersionExA

• 0x4e2cd0 GetVersion

• 0x4e2cd4 GetTickCount

• 0x4e2cd8 GetThreadLocale

• 0x4e2cdc GetStdHandle

• 0x4e2ce0 GetProfileStringA

• 0x4e2ce4 GetProcAddress

• 0x4e2ce8 GetModuleHandleA

• 0x4e2cec GetModuleFileNameA

• 0x4e2cf0 GetLocaleInfoA

• 0x4e2cf4 GetLocalTime

• 0x4e2cf8 GetLastError

• 0x4e2cfc GetFullPathNameA

• 0x4e2d00 GetDiskFreeSpaceA

• 0x4e2d04 GetDateFormatA

• 0x4e2d08 GetCurrentThreadId

• 0x4e2d0c GetCurrentProcessId

• 0x4e2d10 GetCPInfo

• 0x4e2d14 FreeResource

• 0x4e2d18 InterlockedExchange

• 0x4e2d1c FreeLibrary

• 0x4e2d20 FormatMessageA

• 0x4e2d24 FindResourceA

• 0x4e2d28 EnumCalendarInfoA

• 0x4e2d2c EnterCriticalSection

• 0x4e2d30 DeleteCriticalSection

• 0x4e2d34 CreateThread

• 0x4e2d38 CreateFileA

• 0x4e2d3c CreateEventA

• 0x4e2d40 CompareStringA

• 0x4e2d44 CloseHandle

Library advapi32.dll:

• 0x4e2d4c RegQueryValueExA

• 0x4e2d50 RegOpenKeyExA

• 0x4e2d54 RegFlushKey

• 0x4e2d58 RegCloseKey

Library kernel32.dll:

• 0x4e2d60 Sleep

Library oleaut32.dll:

• 0x4e2d68 SafeArrayPtrOfIndex

• 0x4e2d6c SafeArrayGetUBound

• 0x4e2d70 SafeArrayGetLBound

• 0x4e2d74 SafeArrayCreate

• 0x4e2d78 VariantChangeType

• 0x4e2d7c VariantCopy

• 0x4e2d80 VariantClear

• 0x4e2d84 VariantInit

Library comctl32.dll:

• 0x4e2d8c _TrackMouseEvent

• 0x4e2d90 ImageList_SetIconSize

• 0x4e2d94 ImageList_GetIconSize

• 0x4e2d98 ImageList_Write

• 0x4e2d9c ImageList_Read

• 0x4e2da0 ImageList_GetDragImage

• 0x4e2da4 ImageList_DragShowNolock

• 0x4e2da8 ImageList_DragMove

• 0x4e2dac ImageList_DragLeave

• 0x4e2db0 ImageList_DragEnter

• 0x4e2db4 ImageList_EndDrag

• 0x4e2db8 ImageList_BeginDrag

• 0x4e2dbc ImageList_Remove

• 0x4e2dc0 ImageList_DrawEx

• 0x4e2dc4 ImageList_Replace

• 0x4e2dc8 ImageList_Draw

• 0x4e2dcc ImageList_GetBkColor

• 0x4e2dd0 ImageList_SetBkColor

• 0x4e2dd4 ImageList_Add

• 0x4e2dd8 ImageList_GetImageCount

• 0x4e2ddc ImageList_Destroy

• 0x4e2de0 ImageList_Create

• 0x4e2de4 InitCommonControls

Library winspool.drv:

• 0x4e2dec OpenPrinterA

• 0x4e2df0 EnumPrintersA

• 0x4e2df4 DocumentPropertiesA

• 0x4e2df8 ClosePrinter

Library URL.DLL:

• 0x4e2e00 InetIsOffline

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
drive.google.com	A 31.13.67.33	108.160.166.61
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	59704	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.