1.0
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.80
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Dropper-GHV [Drp] | 20200325 | 18.4.3895.0 |
| Baidu | Win32.Trojan.Agent.dc | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200325 | 2013.8.14.323 |
| McAfee | W32/Generic.worm.ag | 20200324 | 6.0.6.653 |
| Tencent | Trojan.Win32.FakeFolder.uu | 20200325 | 1.0.0.1 |
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(1 个事件)
| section | .drdata |
动态指标
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 63 个反病毒引擎识别为恶意
(50 out of 63 个事件)
| ALYac | Gen:Variant.Ulise.92466 |
| APEX | Malicious |
| AVG | Win32:Dropper-GHV [Drp] |
| Acronis | suspicious |
| Ad-Aware | Gen:Variant.Ulise.92466 |
| AhnLab-V3 | Worm/Win32.Palevo.R25886 |
| Antiy-AVL | Worm/Win32.Juched |
| Arcabit | Trojan.Ulise.D16932 |
| Avast | Win32:Dropper-GHV [Drp] |
| Avira | TR/Spy.Agent.586689 |
| Baidu | Win32.Trojan.Agent.dc |
| BitDefender | Gen:Variant.Ulise.92466 |
| BitDefenderTheta | Gen:NN.ZexaF.34100.rCY@aKTN0Yni |
| Bkav | W32.GorolandV.Trojan |
| CAT-QuickHeal | Trojan.Mauvaise.SL1 |
| ClamAV | Win.Worm.Ganelp-6776766-0 |
| Comodo | Worm.Win32.Jushed.KA@4cysvx |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.8b9f5a |
| Cylance | Unsafe |
| Cyren | W32/A-96e92a7a!Eldorado |
| DrWeb | Trojan.Proxy.19144 |
| ESET-NOD32 | a variant of Win32/Agent.TNE |
| Emsisoft | Gen:Variant.Ulise.92466 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/A-96e92a7a!Eldorado |
| F-Secure | Trojan.TR/Spy.Agent.586689 |
| FireEye | Generic.mg.26f88688b9f5ac87 |
| Fortinet | W32/Agent.TNE!tr |
| GData | Gen:Variant.Ulise.92466 |
| Ikarus | Trojan.Agent3 |
| Invincea | heuristic |
| Jiangmin | Worm/Juched.ag |
| K7AntiVirus | Trojan ( 0053af151 ) |
| K7GW | Trojan ( 0028aba91 ) |
| Kaspersky | Worm.Win32.Juched.fja |
| MAX | malware (ai score=83) |
| Malwarebytes | Worm.Jesched |
| MaxSecure | Worm.Juched.buz |
| McAfee | W32/Generic.worm.ag |
| McAfee-GW-Edition | BehavesLike.Win32.Generic.dz |
| MicroWorld-eScan | Gen:Variant.Ulise.92466 |
| Microsoft | Worm:Win32/Ganelp.E |
| NANO-Antivirus | Trojan.Win32.Juched.fiiyae |
| Panda | Generic Malware |
| Qihoo-360 | HEUR/QVM02.0.1D81.Malware.Gen |
| Rising | Trojan.Agent!1.C135 (RDMK:cmRtazq2ZCQyEiAs5jLhy7FkbSZL) |
| SUPERAntiSpyware | Trojan.Agent/Gen-FoldKrypt |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Agent-BAYX |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2011-04-16 06:03:11
PE Imphash
cf6478dd315d96e90d4e24bcf02940d3
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00025c90 | 0x00026000 | 3.885258036500126 |
| .rdata | 0x00027000 | 0x00001a84 | 0x00002000 | 4.371285008747218 |
| .data | 0x00029000 | 0x00015684 | 0x00004000 | 0.43640242823477116 |
| .idata | 0x0003f000 | 0x00000954 | 0x00001000 | 2.844224709149127 |
| .rsrc | 0x00040000 | 0x0000300c | 0x00004000 | 2.247910968831343 |
| .reloc | 0x00044000 | 0x0000135b | 0x00002000 | 4.116233472712689 |
| .drdata | 0x00046000 | 0x00011000 | 0x00011000 | 0.0 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x000401c0 | 0x000025a8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x00042768 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library KERNEL32.dll:
• 0x43f224 GetLastError
• 0x43f228 GetSystemTime
• 0x43f22c MultiByteToWideChar
• 0x43f230 GetModuleHandleA
• 0x43f234 FindClose
• 0x43f238 FindNextFileA
• 0x43f23c FindFirstFileA
• 0x43f240 GetLocaleInfoA
• 0x43f244 Sleep
• 0x43f248 FlushFileBuffers
• 0x43f24c SetStdHandle
• 0x43f250 SetFilePointer
• 0x43f254 LCMapStringW
• 0x43f258 ExitProcess
• 0x43f25c TerminateProcess
• 0x43f260 GetCurrentProcess
• 0x43f264 GetStartupInfoA
• 0x43f268 GetCommandLineA
• 0x43f26c GetVersion
• 0x43f270 DebugBreak
• 0x43f274 GetStdHandle
• 0x43f278 WriteFile
• 0x43f27c InterlockedDecrement
• 0x43f280 OutputDebugStringA
• 0x43f284 GetProcAddress
• 0x43f288 LoadLibraryA
• 0x43f28c InterlockedIncrement
• 0x43f290 GetModuleFileNameA
• 0x43f294 IsBadWritePtr
• 0x43f298 IsBadReadPtr
• 0x43f29c HeapValidate
• 0x43f2a0 UnhandledExceptionFilter
• 0x43f2a4 FreeEnvironmentStringsA
• 0x43f2a8 FreeEnvironmentStringsW
• 0x43f2ac WideCharToMultiByte
• 0x43f2b0 GetEnvironmentStrings
• 0x43f2b4 GetEnvironmentStringsW
• 0x43f2b8 SetHandleCount
• 0x43f2bc GetFileType
• 0x43f2c0 GetEnvironmentVariableA
• 0x43f2c4 GetVersionExA
• 0x43f2c8 HeapDestroy
• 0x43f2cc HeapCreate
• 0x43f2d0 HeapFree
• 0x43f2d4 VirtualFree
• 0x43f2d8 RtlUnwind
• 0x43f2dc SetConsoleCtrlHandler
• 0x43f2e0 HeapAlloc
• 0x43f2e4 HeapReAlloc
• 0x43f2e8 VirtualAlloc
• 0x43f2ec GetCPInfo
• 0x43f2f0 GetACP
• 0x43f2f4 GetOEMCP
• 0x43f2f8 GetStringTypeA
• 0x43f2fc GetStringTypeW
• 0x43f300 LCMapStringA
• 0x43f304 CloseHandle
Library ADVAPI32.dll:
• 0x43f1f4 GetUserNameW
L!This program cannot be run in DOS mode.
.rdata
@.data
.idata
@.reloc
B.drdata
UDSVW}
E_^[]UPSVW}
_^[P;Q
]UTSVW}
_^[]ULSVW}
MU;U}gE
E}^}7M
_^[L;rN
]U@SVW}
_^[@;M
]UDSVW}
_^[]UPSVW}
>E<4QC
_^[]UDSVW}
_^[]UlSVW}
u,U;Uu
t\U;Uu
E_^[l;E
]UpSVW}
EMMU3f
Q<UE8PE
MQxUEH|MU
M;M}-U
_^[p;C
]U`SVW}
EMMU3f
Q<UE8PE
3_MQxUEH|MU
ME_^[]UtSVW}
_^[t;1@
]UtSVW}
_^[t;;
]U@SVW}
_^[@;:
]U|SVW}
_^[|;0
]UHSVW}
_^[H;&
]UHSVW}
E_^[H;%
]UHSVW}
9Us)E3
3EEEfE
jdTQhDB
MQh`pB
URh@pB
EPR ;J"
MQPp;!
MQPx;!
fUfUfEfEfMfMfE
-oje`[VQLG_^[
;}}PRcP
wu,hHuB
E}tEEP
9UtOEi
9UtVEi
9MtVUi
9EtVMi
tAt2t$
PRSVWhvB
_^[ZX]
DDDDDDDDDDDDDD
GIt%t)
Gt/KuD$
GKu[^D$
[^_U=C
]UjhwB
MQUR)G
EMQUR'
eEPJMd
_^[]U=,C
E]UQLC
@v)URc
RPQRPQRPQREPM
EE]UQE
t&h<zB
E _^[]UQj
EE]UQj
EE]UQj
3u&hX|B
t&h<zB
;t!h{B
$REPw:
M;Mt!hL{B
;Et!h0{B
E_^[]UQj
EE]UQj
]UQSVWB
uCE PMQ
uCE PMQ
;Mt!h|B
;Mt!h|B
_^[]Uj
EE_^[]UQB
E]UQSVWE
_^[]UQ
E]UQSVWE
E_^[]U
3uNh~B
u:U REH
QURhp}B
u:E PMQ
REPhD}B
u/M Qhh~B
QURhH~B
RE PMQh
REPn5
ucMQURE
E]UQ@C
H0_^[]U
A,+B,M
J0+H0U
E_^[]U
PM Qh@B
u_^[]U\SVWE
UB E=LB
EPMQhB
u_^[]U4SVWEP
3_^[]UQSVW}
3u_^[]U
E]UQ=tC
UjmhDB
=tGjyhDB
EMMUREPj
UREPMU
PMQUR#
EPMQUREPj
3%MQUREPO
MU;U}eE8tXM
E}tXMQ
E}@}2M<
]USVWUj
t.;t$$t(4v
VC20XC00U
]_^[]UL$
_^[]UQE
]U0SVWEE
E_^[]U,SVWEE
E_^[]Q=
EE]UQ}
PMQUREPB/
EE]U0E
REPMQURR,
MQUREP
UREPMQ$
uKUREPM
UREPMQ?#
]UQE=C
EE]Uh]U=C
3]UQ=C
UE;Es%MU
MU;Us$EM#
MU;UuIC
U#TDU}
E}?} MU
UE;Ew]MA
UUE+EE
M;t U;u
tn} }2
,3]U<B
u3]UQE
MU;UsiE
MU;UsiE
EM;M}4U
s3E;Eu
3{UU[E
UE]U(E
3]U0SVWEE
E_^[]U
MQUREPj
s{Uk0EpB
Mk0UEfAdB
Ar;Zw2C
Qar;zw2C
3]U=tC
M0M_=LB
B8t6t8t't
8t3^[_G^[_
^[_UWVSM
[^_SVD$
ddIdd.wld3
``C``5
fEfMQRa
U tHE@t
RPRPu0RPQR9~
ERM+MM
fZfZPxQ
QtRxP)
fA]UWVu
DDDDDDDDDDDDDD
SVWe=C
3CMQURE
PMQURE
_^[]Ujh
SVWe=C
REPMQU
EPMQUREPM
EPMQh
QUREPh
UREPMQh
QU+RQU
E+]UQSVW}
_^[]UE
M}-s#UE
~VUREH
;Eu!MQ
E_^[]UQE
EE]UQVE
3^]USVW}
_^[]%XC
Oe !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_abcdefghijklmnopqrstuvwxyz{|}~
VmfantunmoelIriGoeotA
WoitAtdDcyenserGiwro
yeploiCFA
EreabtimVaAevntieGnonrl
MllmtuiaedFNAGoeee
aitAeDcyreerCtro
FAieterteltuASitbs
erebyrirFLa
drAabyoirLLa
MlnAtuaeedHlGoed
PAetcreodsGrds
n2lr3leldke.
broFlleGae
bloAclloGal
FSteeelzGii
dealeiRF
tliirFWee
aieFAreeCtl
snoaelHlCed
c3xosersNPe2t
c3rosirsFtPe2s
CerstrPedertcIGunos
aoe2pteTh3aorelpnhCtolSs
LcrSntiDeiAeglvrsGoaitg
DeetvpeiyGrTA
eilFAeeeDtl
oitAmDcyeeerRvro
dsnoilFCe
dtenxlieiFNFA
dslnriiiFAFFte
etsnteoaennlHlIrCed
GipFAtteFel
etnAtentnnocIrCe
etnteennpIrOA
i.ntlielwnd
PipFAtteFul
leeexthEuSlcA
l.e2lh3lsld
$*$%u}-sEBB5>Ds?>DB?<$5D-$5BF935C-$81B54q335CC-!1B1=5D5BC-v9B5G1<<!?<93I-$D1>41B4!B?69<5-qED8?B9J54q@@<931D9?>C-|9CD
bd:ael*nE::
CegsyeoeRlK
SaEgVeetuARelx
OKxgnEeeyRpeA
a2lv3ldidap.
DtlgeaAelVeReeu
CtygaeAeeKxRreE
\Java\jre-
gFsomeralPri
$?6DG1B5]aaaaaaaaaaaaaaaaa]sEBB5>D'5BC9?>]#E>
e.gteeixrde
/Downs/HelpVer.hlp
/Downs/Help.hlp
Help.hlp
/Private/
Pfile.hlp
\VirtualDevice.vxd
ProgramFiles
?>D85<9>EH
6D@]DB9@?4]3?=
gdaheb
eedeia
7B9@D?<?:9]8?CD\54]>5D
gdaheb123
5<571>0ghfddd
5<571>0ghfddd]5<]6E>@93]?B7
jusched.
!B?7B1=v9<5C
Fi386\chkesp.c
The value of ESP was not properly saved across a function call. This is usually a result of calling a function declared with one calling convention with a function pointer declared with a different calling convention.
Assertion Failed
Warning
%s(%d) : %s
Assertion failed!
Assertion failed:
_CrtDbgReport: String too long or IO Error
Second Chance Assertion Failed: File %s, Line %d
wsprintfA
user32.dll
Microsoft Visual C++ Debug Library
Debug %s!
Program: %s%s%s%s%s%s%s%s%s%s%s
(Press Retry to debug the application)
Module:
File:
Line:
Expression:
For information on how your program can cause an assertion
failure, see the Visual C++ documentation on asserts.
<program name unknown>
dbgrpt.c
szUserMessage != NULL
Client
Ignore
Normal
Error: memory allocation: bad memory block type.
Invalid allocation size: %u bytes.
Client hook allocation failure.
Client hook allocation failure at file %hs line %d.
dbgheap.c
_CrtCheckMemory()
_pFirstBlock == pOldBlock
_pLastBlock == pOldBlock
fRealloc || (!fRealloc && pNewBlock == pOldBlock)
_BLOCK_TYPE(pOldBlock->nBlockUse)==_BLOCK_TYPE(nBlockUse)
pOldBlock->nLine == IGNORE_LINE && pOldBlock->lRequest == IGNORE_REQ
_CrtIsValidHeapPointer(pUserData)
Allocation too large or negative: %u bytes.
Client hook re-allocation failure.
Client hook re-allocation failure at file %hs line %d.
_pFirstBlock == pHead
_pLastBlock == pHead
pHead->nBlockUse == nBlockUse
pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ
DAMAGE: after %hs block (#%d) at 0x%08X.
DAMAGE: before %hs block (#%d) at 0x%08X.
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)
Client hook free failure.
memory check error at 0x%08X = 0x%02X, should be 0x%02X.
%hs located at 0x%08X is %u bytes long.
%hs allocated at file %hs(%d).
DAMAGE: on top of Free block at 0x%08X.
DAMAGED
_heapchk fails with unknown return value!
_heapchk fails with _HEAPBADPTR.
_heapchk fails with _HEAPBADEND.
_heapchk fails with _HEAPBADNODE.
_heapchk fails with _HEAPBADBEGIN.
Bad memory block found at 0x%08X.
_CrtMemCheckPoint: NULL state pointer.
_CrtMemDifference: NULL state pointer.
Object dump complete.
crt block at 0x%08X, subtype %x, %u bytes long.
normal block at 0x%08X, %u bytes long.
client block at 0x%08X, subtype %x, %u bytes long.
{%ld}
%hs(%d) :
#File Error#(%d) :
Dumping objects ->
Data: <%s> %s
Detected memory leaks!
Total allocations: %ld bytes.
Largest number used: %ld bytes.
%ld bytes in %ld %hs Blocks.
stdenvp.c
stdargv.c
a_env.c
ioinit.c
__GLOBAL_HEAP_SELECTED
__MSVCRT_HEAP_SELECT
runtime error
TLOSS error
SING error
DOMAIN error
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
abnormal program termination
- not enough space for environment
- not enough space for arguments
- floating point not loaded
Microsoft Visual C++ Runtime Library
Runtime Error!
Program:
format != NULL
sprintf.c
string != NULL
vsprintf.c
GetLastActivePopup
GetActiveWindow
MessageBoxA
("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)
_flsbuf.c
str != NULL
`h````
ppxxxx
(null)
output.c
ch != _T('\0')
_getbuf.c
_file.c
osfinfo.c
fclose.c
_freebuf.c
stream != NULL
aa3vd2apeJUt
a3d2peUt
GetModuleHandleA
GetLastError
GetSystemTime
MultiByteToWideChar
GetLocaleInfoA
FindClose
FindNextFileA
FindFirstFileA
KERNEL32.dll
GetUserNameW
ADVAPI32.dll
CoUninitialize
CoCreateInstance
CoInitialize
ole32.dll
ExitProcess
TerminateProcess
GetCurrentProcess
GetStartupInfoA
GetCommandLineA
GetVersion
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
GetProcAddress
LoadLibraryA
InterlockedIncrement
GetModuleFileNameA
IsBadWritePtr
IsBadReadPtr
HeapValidate
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
HeapFree
VirtualFree
RtlUnwind
SetConsoleCtrlHandler
HeapAlloc
HeapReAlloc
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetFilePointer
SetStdHandle
FlushFileBuffers
CloseHandle
ICONMD5.71d2c87e
-kkeJ/
.nnnnnnnS8
/qqqqqqqqqqq\@$
tttttttttttttttfI3
wwwwwwwwwwwwwwwwwwwpS<
zzzzzzzzzzzzzzzzzzzzzzzz\E&
}}}}}}}}}}}}}}}}}}}}}}}}}}M
H((wf,
I33lfZ
KUUmfh
6666666i777
8(8<8L8^8k8|888888
9)909=9D9Q9X9b9l9v999999999~::::::::
;";,;6;=;J;Q;[;e;r;y;;;;;;;;;;;;<<c=
>2>V>]>n>>>>>>>
232?2F2\2l2z22222222222
3/363B3I3a3h3t3{33333333333
4)404<4C4[4b4n4K5c5j5v5}5555555555
6+626>6E6]6d6p6w66666666666
7%7,787?7W7^7j7q77777777777
8 8&82898Q8X8d8k8888888899:::%;;;;;
<@<d<<<|=======
> >;>G>M>V>_>{>>>
?1?=?C?R?e?~?
l00000000
1+171=1F1O1k1111
2)2/2>2Q2j2I3a3}333334444
5$5I5U5\555555
6F6{666777
878C8J8o8{88888888
9/9S9^9|9999::(;;<<<<
=&=,=<=[=u=|======z>>>>>>o?{????????
010g0o0x0w11111
2#2C2H22E33q45 6+6=6Q6`6g666
788899w::@;;;
<A<p<<~====
>/>A>S>d>i>x>>>>>>>>
X00000011
2 2,2@2}222
383D3X3x333333
4]4y444
5*5>5R5f5z555555
6'6.687L7`77778
9 939G9w99::::
;$<*<6<J<^<<<<<<<
='=.=G=[=~=>>>>>>
? ?Z?a?r??????
333333
4$444455555555
6%6,6064686<6@6D6H666666
70777<7@7D7a77777777777*8084888<8
;#;(;5;:;;;;;;
<'<=<B<O<T<b<|<<<<<
= =%=1=7=@=F=K=X======E>d>u>>>>>>3???P?Z?j?t????
1070E0M0S0g0t0y0
0000000 1+1g1s11111
2'2-2B2S222222
3/353T3`333354T4`4
44444444
5'535T5g5s5555
6[66Q7f7r777777748\8888
9U9^9c9k9q9w9
99999999
:2:;;;;;
<-<P<U<<<<
=b=n===>>G>U>]>c>l>t>|>>>>>>>>>7?C????????
0%050>0S00
1R1^1c1111
2"252j2p2222
3!3I33333333
4&4D4N4Z4{444
5 5+5V5b555
6U6a666
8:8?8b8g888888P9\9c9999$:D::::::
;';E;T;;;#<\<~<<<<<<
>0>5>_>>2?\?h???
U0000O1111/2Q2h222)3.333 4M444405L5v555<6G6Z6n6t6666666
717;7L7n77777777888
9#959q99999
:!:.:8:c:::=;!<
? ?.?:?I?\?o???
0/0R0`0s000
1,1V1\1q11
2:2L2R2[2p22
4#4R4a4t44
5K5Q55567;7A7R7X7r7y77777777
8$858=8D8L8V8s888888N9h9q9u:~:::::
;6;?;H;[;o;x;
<2<K<e<<<<??
112;2A2L2X2]22222222222.373K3Z3^3b3f3j333"4)404A4R4c444444
5 5<5k5z555555555555/676=6K6U6Z6`6l6v6{66666666666
7E7777 8J8Q8w8~888.959C9999
:^::R;Y;;;;
=%=====
>S>>>>>>>>
?8?T?[?e?p?z???????
020I000000
1#1)1/191C1g1p1{1666666666
7"737>7G7]7g7m7y77777777777777
8c8888
=E=K=S=`=h=o=========
>0>8>>
66B6K6g6r6y666666666666
7!7,767E7N7T7j7t7{77778======
>.>=>E>N>R>X>a>e>p>y>>x?
????????
0'0000c11
2Y2a2g22$33
44/555p:u:z<<<<<==??
1]1c1l1~1111111
2)2/222222222 323U3e3o3}333333
4T4]4g4q4444{55555
6X6g666666.7=7R7r77777777V88999
?c?o???
1<1Q111H2O2j3q3
4455/7Q7s7<<<<<<<<<<<<<<<<<<<0=4=8=<=@=D=H=L=P=T=X=\=`=d=h=X?p?w?
????????
0b0h0l0p0t000
111[11111111111
2f2k2222222222
3*3Q33
4&4+4H4V4c4m4~444444
6666777
8v88888#9@9O9999999+:Z:2;<;i;;;;;;
<.<8<n<w<<<<8=Q=f=o={===========
>M>f>x>>>>
?%?:?X?}??????
040h000000
121>1g1u1111111
242@2L2_2p2z222222>3M3333
454`4u455
6*6U6k66677777
8"8(8J8_8q8{888
9=9F999999999
: :&:,:2:8:>:D:J:P:V:\:b:h:n:t:z::::::::::::::::::::
555555
3 6:::::::::;;;;;;;;;;;;;;;;
8<@<D<P?T?`?h?
111111
E:\Yeni\MSoft\mtro\user\jre23\Debug\p2.pdb
59g399g8=Ao;AAo@EIwCIIwHMQ
PUYSYYX]a[aa`eici59g399j?=Ao;AArGEIwCIIzOMQ
KQQWUYSYY_]a[aageici39f86>:@;An@>FBHCIvHFNJPKQ~PNVRXSYXV^Z`[a`^fbhcif58f9jj<n=@nArrDvEHvIzzL~MP~QTUXY\]`adehilmpqtuxy|}
fd;eefg;nlCmmnoCvtKuuvwK~|S}}~
S[[cckkss{{
b1gi=59lj9oqE=AtrAwyMEI|zI
UMQQ]UYYe]aameiiumqq}uyy}
f1h;86j9n9pC@>rAvAxKHFzI~ISPNQQ[XVYYc`^aakhfiispnqq{xvyy~
6f2;8=>m>n:C@EFuFvBKHMN}N~JSPUVVR[X]^^Zc`effbkhm35e3g8ji;=m;o@rqCEuCwHzyKM}K
PSUSX[][`ce75;58:h;?=C=@BpCGEKEHJxKOMSMPRSWU[UXZ[_]c]`bcgekehj35e3g8ji;=m;o@rqCEuCwHzyKM}K
PSUSX[][`ce35e3g8ji;=m;o@rqCEuCwHzyKM}K
PSUSX[][`ce89749j;?@A?<ArCGHIGDIzKOPQOLQSWXYWTY[_`a_\acghigdikof1h;86j9n9pC@>rAvAxKHFzI~ISPNQQ[XVYYc`^aakhfiispnqq{xvyy~
fd;eefg;nlCmmnoCvtKuuvwK~|S}}~
S[[cckkss{{
35d9h677;=lAp>??CEtIxFGGKM|QNOOSUYVWW[]a^__ced9:<45;mlABD<=CutIJLDEK}|QRTLMSYZ\TU[abd\]cijldekqrtlmsyz|tu{|}
b54<9==7j=<DAEE?rEDLIMMGzMLTQUUOUT\Y]]W]\daee_edlimmgmltquuout|y}}w}|
b54<9==7j=<DAEE?rEDLIMMGzMLTQUUOUT\Y]]W]\daee_edlimmgmltquuout|y}}w}|
b54<9==7j=<DAEE?rEDLIMMGzMLTQUUOUT\Y]]W]\daee_edlimmgmltquuout|y}}w}|
c596:hi
k=A>Bpq
sEIFJxy
{MQNR UYVZ']a^b/eifj7mqnr?uyvzG}~OW_
e7;ge8ikm?Com@qsuGKwuHy{}OS
}PW[X_c`gkhospw{x
358;;hl<;=@CCptDCEHKKx|LKMPSSTSUX[[\[]`ccdcehe7c<h>?lm?kDpFGtuGsLxNO|}O{TVWW\^__dfgglnootvww|~
6b:3i9hk>jB;qApsFrJCyIx{NzRKQVZSY^b[afjci6b:3i9hk>jB;qApsFrJCyIx{NzRKQVZSY^b[afjci6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffiknddd47kiklll<?sqstttDG{y{|||LOTW\_dglotw|
1:e:7h7@9BmB?p?HAJuJGxGPIR}ROOXQZZWW`Ybb__ha582:e7l@=@:Bm?tHEHBJuG|PMPJR}OXUXRZW`]`Zb_hehbj9884j=kiA@@<rEsqIHHDzM{yQPPLUYXXT]a``\eihhdmqa37::768i;?BB?>@qCGJJGFHyKORRONPSWZZWVX[_bb_^`cgjjgfhkorronpswzzwvx{
~4:e45j;><Bm<=rCFDJuDEzKNLR}LMSVTZTU[^\b\]cfdjd6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikndc:5jflklkB=rntstsJEzv|{|{RM~ZUb]jermzu}
c7:i4g>>k?Bq<oFFsGJyDwNN{ORL
VVWZT^^_b\ffgjdnnorlvvwzt~~
62h5e6=8>:p=m>E@FBxEuFMHNJM}NUPVRUV]X^Z]^e`fbef372gi=;m;?:oqECuCGBwyMK}KOJ
USSWR][[_Zeccgb6e4g6jim>m<o>rquFuDwFzy}N}L
NVTV^\^fdfa74ef8<>i?<mn@DFqGDuvHLNyOL}~PTVWTX\^_\`dfgdhlnolptvwtx|~
|cd6;=f:mkl>CEnBustFKMvJ}{|NSU~RV[]Z^cebfkmjnsurv{}z~
822hihgk@::pqposHBBxyxw{PJJ
XRR`ZZhbbf1969h6jn9A>Ap>rvAIFIxFz~IQNQNQYVYVYa^a^aififiqnqnqyvyvy~~
7f88=8;i?n@@E@CqGvHHMHKyO~PPUPSWXX]X[_``e`cghhmhk599g4i<<=AAo<qDDEIIwDyLLMQQ
LTTUYYT\\]aa\ddeiid99e:5kg;AAmB=soCIIuJE{wKQQ}RM
SYYZU[aab]ciijekq776gh99m??>opAAuGGFwxII}OON
QQWWVYY__^aaggfii85h8f<j=@=p@nDrEHExHvLzMPMP~TUXUX\]`]`dehehlmf1969h6jn9A>Ap>rvAIFIxFz~IQNQNQYVYVYa^a^aififiqnqnqyvyvy~~
bd76:7;8jl?>B?C@rtGFJGKHz|ONROSPWVZW[X_^b_c`gfjgkhonrospwvzw{x
2743:9j
:?<;BAr
BGDCJIz
JOLKRQ RWTSZY'Z_\[ba/bgb957757:jA=??=?BrIEGGEGJzQMOOMORYUWWUWZa]__]_bieggegjqmoomoryuwwuwz}
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffiknfc3d:gh=nk;lBopEvsCtJwxM~{K|R
USZ][becjmkrusz}{
8f5<7gi8@n=D?oq@HvELGwyHP~MTO
PXU\WX`]d_`helgh27e977;@:?mA??CHBGuIGGKPJO}QOOSXRWYWW[`Z_a__chbgc48::jkkk<@BBrsssDHJJz{{{LPRRTXZZ\`bbdhjjlprrtxzz|
6139j>?k>9;ArFGsFACIzNO{NIKQVWVQSY^_^Y[afgfacinb:egi><8jBmoqFD@rJuwyNLHzR}
VTPZ^\Xbfd`jnlhrvtpz~|x
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn99:h7k>mAABp?sFuIIJxG{N}QQROVYYZW^aab_fiijgnq32:;i7;:;:BCq?CBCBJKyGKJKJRSOSRSRZ[W[Z[Zbc_cbcbjd:68=69>lB>@E>AFtJFHMFIN|RNPUNQVZVX]VY^b^`e^afjfhmfinrnpunqvzvx}vy~~~
13f9f<l@9;nAnDtHACvIvL|PIK~Q~TXQSY\`Y[adhabg:ih96kjoBqpA>srwJyxIF{z
RQNZYVba^jifrqnzyv~76c88<?<?>k@@DGDGFsHHLOLON{PPTWTWVXX\_\_^``dgdgfhhlo3d6h459>;l>p<=AFCtFxDEINK|NLMQVSVTUY^[^\]afcf5c34j9:k=k;<rABsEsCDzIJ{M{KLQRUSTYZ][\abecd3d6h459>;l>p<=AFCtFxDEINK|NLMQVSVTUY^[^\]afcf554<gk8m==<Dos@uEEDLw{H}MMLT
PUUT\X]]\d`eedl162h=>:;9>:pEFBCAFBxMNJKINJUVRSQVR]^Z[Y^Zefbca6ffe8877>nnm@@??FvvuHHGGN~~}PPOOVXXWW^``__fhhade6<8;=ilm>D@CEqtuFLHKMy|}NTPSUV\X[]^d`ceflhkmntpsuv|x{}~add3e767ill;m?>?qttCuGFGy||K}ONOSWVW[_^_cgfgkonoswvw{
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn52gf6gjk=:on>orsEBwvFwz{MJ
URV]Z^ebf2697ejg>:>A?mroFBFIGuzwNJNQO}
VRVYW^Z^a_fbf6e44i56>>m<<q=>FFuDDyEFNN}LLMNVVTTUV^^\\]^ffdde3d6h459>;l>p<=AFCtFxDEINK|NLMQVSVTUY^[^\]afcf7ec7gi6k?mk?oq>sGusGwyF{O}{O
NWWV__^ggf21e;<<9>:9mCDDAFBAuKLLINJI}STTQVRQ[\\Y^ZYcddafba6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffiknab7hffi>ij?pnnqFqrGxvvyNyzO~~VW^_fgnovw~
43h:=i88<;pBEq@@DCxJMyHHLKRUPPTSZ]XX\[be``dcje74f=:g@m?<nEBoHuGDvMJwP}OL~UR
XWT]Z`_\ebhgdmjpolurxwt}z
ce5d9>;:km=lAFCBsuEtINKJ{}M|QVSRUY^[Z]afcbeinkjmqvsruy~{z}
c3chfil:k;kpnqtBsCsxvy|J{K{~RSZ[bcjkrsz{
3d6h459>;l>p<=AFCtFxDEINK|NLMQVSVTUY^[^\]afcfd7h9g57<l?pAo=?DtGxIwEGL|OQ
MOTWYUW\_a]_dgiegloqmotwyuw|
7ef;<=<<?mnCDEDDGuvKLMLLO}~STUTTW[\]\\_cdeddgklmlad976>i8ilA?>Fq@qtIGFNyHy|QONVPYWV^Xa_^f`igfnhqonvpywv~x
~6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn1ddg4;k79llo<Cs?AttwDK{GI||
LSOQT[WY\c_a8b4i;=km@j<qCEsuHrDyKM{}PzLSUXT[]`\cehdkme1hdg5k:m9plo=sBuAxtwE{J}I|
MRQUZY]baejimrquzy}
12c:4gjm9:kB<oruABsJDwz}IJ{RL
QRZTYZb\ae1gi=<j8m9oqEDr@uAwyMLzH}I
UTPQ]\XYed`amlhiutpq}|xy
fb:4h>68njB<pF>@vrJDxNFH~zRLVNPZT^VXb\f^`jdnfhrlvnpzt~vx|~
behh:=:mjmppBEBuruxxJMJ}z}RURZ]Zbebjmjrurz}ze575hhhjm=?=pppruEGExxxz}MOMUWU]_]egemomuwu}
8feff6l:@nmnn>tBHvuvvF|JP~}~~NRXVZ`^bhfj72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn2chdg<k::kploDsBBsxtwL{JJ{|
TRR\ZZdbb72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm35d;g9lm;=lCoAtuCEtKwI|}KM|S
QSU[Y[]cace72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm1dhi56:@9lpq=>BHAtxyEFJPI|MNRXQUVZ`Y]^bha6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffiknd53e<<;:l=;mDDCBtECuLLKJ|MK}TTSRUS\\[Z][ddcbecllkjmkttsrus||{z}{
72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemmd53e<<;:l=;mDDCBtECuLLKJ|MK}TTSRUS\\[Z][ddcbecllkjmkttsrus||{z}{
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffiknd53e<<;:l=;mDDCBtECuLLKJ|MK}TTSRUS\\[Z][ddcbecllkjmkttsrus||{z}{
72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm
h B j j j j
( n u l l )
( ( ( ( ( H
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.