1.1
低危

24c12d7710d768483ee8fdea8a5fddeb40336636c2358adfcb64021b28f8a3f4

24c12d7710d768483ee8fdea8a5fddeb40336636c2358adfcb64021b28f8a3f4.exe

分析耗时

195s

最近分析

373天前

文件大小

120.0KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN LUNAM
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.75
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/Lunam.243f8b61 20190527 0.3.0.5
Avast Win32:Malware-gen 20200912 18.4.3895.0
Baidu None 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Kingsoft None 20200913 2013.8.14.323
McAfee GenericRXIE-NA!5F5BF05C43E4 20200912 6.0.6.653
Tencent Trojan.Win32.FakeFolder.pb 20200913 1.0.0.1
静态指标
行为判定
动态指标
该二进制文件可能包含加密或压缩数据,表明使用了打包工具 (3 个事件)
section {'name': '.text', 'virtual_address': '0x00001000', 'virtual_size': '0x00022000', 'size_of_data': '0x00005c00', 'entropy': 7.9720032517446535} entropy 7.9720032517446535 description 发现高熵的节
section {'name': '.rsrc', 'virtual_address': '0x00023000', 'virtual_size': '0x00002000', 'size_of_data': '0x00002000', 'entropy': 7.641001215802067} entropy 7.641001215802067 description 发现高熵的节
entropy 1.0 description 此PE文件的整体熵值较高
网络通信
与未执行 DNS 查询的主机进行通信 (1 个事件)
host 114.114.114.114
文件已被 VirusTotal 上 59 个反病毒引擎识别为恶意 (50 out of 59 个事件)
ALYac Trojan.GenericKD.34473039
APEX Malicious
AVG Win32:Malware-gen
Acronis suspicious
Ad-Aware Trojan.GenericKD.34473039
AhnLab-V3 Trojan/Win32.Lunam.R261674
Alibaba Trojan:Win32/Lunam.243f8b61
Antiy-AVL Trojan/Win32.Lunam
Arcabit Trojan.Generic.D20E044F
Avast Win32:Malware-gen
Avira TR/Crypt.PEPM.Gen
BitDefender Trojan.GenericKD.34473039
BitDefenderTheta AI:Packer.88CDE1121E
Bkav W32.AIDetectVM.malware1
CAT-QuickHeal Trojan.Lunam
ClamAV Win.Malware.Lunam-6911425-0
Comodo TrojWare.Win32.Spy.Agent.1396070@1qn3u3
CrowdStrike win/malicious_confidence_100% (W)
Cybereason malicious.c43e4a
Cylance Unsafe
Cynet Malicious (score: 100)
Cyren W32/Hupigon.CB.gen!Eldorado
DrWeb Trojan.PWS.Banker1.30100
ESET-NOD32 Win32/Otfrem.A
Elastic malicious (high confidence)
F-Secure Trojan.TR/Crypt.PEPM.Gen
FireEye Generic.mg.5f5bf05c43e4a885
Fortinet W32/Agent.4FE0!tr
GData Trojan.GenericKD.34473039
Ikarus Trojan.Win32.Lunam
Invincea ML/PE-A + Mal/SillyFDC-K
Jiangmin Trojan/PSW.Lmir.dah
K7AntiVirus Trojan ( 0029f2001 )
K7GW Trojan ( 0029f2001 )
Kaspersky Trojan.Win32.Lunam.a
MAX malware (ai score=83)
Malwarebytes Spyware.PasswordStealer
MaxSecure Win.MxResIcn.Heur.Gen
McAfee GenericRXIE-NA!5F5BF05C43E4
MicroWorld-eScan Trojan.GenericKD.34473039
Microsoft Trojan:Win32/Lunam
NANO-Antivirus Trojan.Win32.Lunam.foufld
Paloalto generic.ml
Panda Trj/Genetic.gen
Qihoo-360 Win32/Worm.FakeFolder.CU
Rising Trojan.Lunam!1.B819 (CLASSIC)
Sangfor Malware
SentinelOne DFI - Malicious PE
Sophos Mal/SillyFDC-K
Symantec W32.SillyFDC.BCR
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2008-11-16 11:29:47

PE Imphash

09d0478591d4f788cb3e5ea416c25237

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00022000 0x00005c00 7.9720032517446535
.rsrc 0x00023000 0x00002000 0x00002000 7.641001215802067

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00022308 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_ICON 0x00022308 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_ICON 0x00022308 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_ICON 0x00022308 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_ICON 0x00022308 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_ICON 0x00022308 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_GROUP_ICON 0x00022770 0x0000005a LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_VERSION 0x000227d0 0x00000264 LANG_ENGLISH SUBLANG_ENGLISH_US None

Imports

Library kernel32.dll:
0x4231e0 LoadLibraryA
0x4231e4 GetProcAddress
0x4231e8 VirtualAlloc
0x4231ec VirtualFree

L!This program cannot be run in DOS mode.
PEC2^O
mbTpEN
:EWB(CO!
P\_!"%
hDB;e@~o
u|KrA/
b^UbUA
#Dzsb2dp&d
I81,xN6`
@Kk\;>d_y
%WzztE+`i[gV[bf1=9
D;kbr7?WY|
Z(PQ.KWUd
IWa+VW
t_%f]l.k+
b7/+Kv=Qg
E\!yP^U,agOPB`
ie}>u!
{xzGG3v0c\>AtUVY
q|^pXK
#il;C2
ktbQo!TZ
.,.Mh!Y!h'.*
q'e1_?m("
Xd'Ziay
n-C/T
0#ZWT|@KJ
eDtlk1
Vh0y&]!
?j|829J
xT+8v(
$J}ji0
fU^ma2yUf
pnxv=k
CK?K~9f\(%{
H<nO0.g
(b$a,kz"`Hn#[<ms&Q%
A^1.Q>-b
5#IK3&X!%V\q
ixz"SYOY
J^MfzNun
Ik^-tHS*
[9h?vnqd
J7Vng0
J#H#{]`$RXBPJ
N$Le=F
=8wv-3
s#*Za&DZ9
v?L$4P
v|jhXQ]N'
mGd/VD)=1B
3|P)ST
atgZCU+g
+d0J1I
18pO^l>p3
m'@e'05
LgThHL
D#f{O(J`d"rF
J7urt`Rj
3$+cC9W
yywWm;
Jjex|s
X!#uoK12#
"s@K\}C
?R{,hUUu ikHc
PECompact2
\ugWPw
H%caAp
6m8Nme!6
VR^]RIK5
vdQ_w\|H
y9e!w)n
]oRln uJ
=%8T"mXgbslcoF
$E,+hu
s@B?hqa`
#^|G(!8
x`T"@h
Ozi FzR7
zL)cOx
ba&tqa
J`/O`0
.E]=NQjKnw
1.19_p
vS}pT<*bgN_
WGc.5mIr@`^
/M8@tCL=ge
H:aP%w9iWPs0.,q
2\.vghK>-(au
"hA=1M-
r9W;>-
gigov
0~P<!Az$
#]_E{3o
4{h.6DsN!
+QRKK?t
^**5!<Vg
NZ_Rt
s0BRK3.[q#I
gKO3lToa
wW-E&@&A^t&
HEC+X[:
?EXN\GO(?
%OIpMEG
e+.;:?
Y;zVpN
Z'K20Vxq
?%Mh2^G
lXV!QOA,ex
pS@hv;
i'h8Q]g
tM;k/&i
bKz5Bg3
c14=pxh
Y,9}'r=[39dUM{RZ_
QN.KEnB[r
.nyULT6
xl$T&0C6
q]}N:)
Ag7F%TQf|U`
#h7HlV/M
PG3ilpeGA~oLIC,
}r/h{bG~
MCPTl+mj
oD u{VuLR.%
9iXS7b
^#w0N8
QqKrx[1T|>*
+NW{(h
I~+aXHt
uTpNMC
XC6mD.g
a`v\.$J,s[
u<-@pc}]
phusCJH]
o!w-BTy&
i*V&S9
Jtt]{JQ
E*wmc3e(jbtgh(
v-9q[3$uZU
HdOM1x&
8WiNW@
e87@46]
}D~+eLuOf
nAr8ei#v
~K(rAN
(rU)E'
TU?Ho9oJ
b'c4;|
p~>\\c@WCG{
t[1It/Tl"x
mNP_nw_WUZ
Q;G9%2|v13
;Li[@cc+
bYV/LT
DU=m?M!]
+@@L4~Ru4
ycr1FJP
/d._]aUIU>2|
/wQ)bAvRw;
*cV!^vgFcu*o
8.t__g
_P}`\nJ
))_c,dQ
'/ZMtQ
krgkLpf
'WC,oj /9
0psHW
'"[<VGs`
,G^`h,x
Gyp.`[
Ilv6Lgqm`x~Z
}oo\sRapWTz
'uwTH"
X8`,fw-
Zj{I# AJ
3G>51D8GvkR
<1V\%H
b.l} 2#,cczg%V
Y_eza^.\/CVj8tg
UsKjSS
nB^ur8E k
.QTcR
w!T4)9tZBlc<,
x,aajYE
[*V^|B)u?
XycA )%
4R5w1g
%!'Y'(
:pBjSqP
PJ2%b6
t6w6Gux
38pq" E
hJVulHWsL<-l_
ht=+?l}3@rrP
}3;+9
HtU*pM<(
Z\YLGA
t9*YKw
yGMa.%
%J=i:
O"os7?
1xtD/g
j:<^$V%e
mh>iFMk/[o
{CQ0*1w9
4Wr7%x{
<)~@mWV
`Z_IDJAtY<i-i
6t<rzt5<`[5L
E;7]A7JKd|JI
li3@kg
WeN)bJ
>3gJF%Lj
B^L<J#%G*6=lf
Tn#qn)r.0
wX8OZm?
CWsi0>
2NbXy4Ro71!6E
'QXqE6
Tmd7 E!
3q4.p=[);"r
H,u"[
ZPv,@J5!-
?zw!.RrM+<
wQkMS&P'P1
YR|7^RVM0iqC
\bw>_|{
WwbfwBL_m
~(N'5&/q{'9
\~c!{MFz|@m!Qk>C&
L83C^(%=
rN4RE^5wH]
z:wy@NaW:c5Si2h
<9Aj?Q)d77(+
^qyc;03Zet
$nggb
9i'eZU$!w
M!@/ce8
zr:S;2__Qx9p=`
a"DJe&dS3$)*
f%o9q\
hm1\GY
WO4O0k
)f/q0fP=
e7NhV7xU
+5C9&I
@sEuQr
+w5kV%5
0dV+ghQl0^/
>fBX&D
C.V7zyic,
8/5$DJ~A{D=:D
gb@U+-
TC2F-a=GP
v%ezB&j1Li
!-Ci~0
)ttg=y|
_ATRPx2
y&Fyuv~^r
bk'+$#*7^'Lz
!rZaz&
^Hmyqk
Ipx&(
4Pxt.$
FHg^BL8YoR
l)"]%l#
/x*_UL'2
NLy`dsf2GK*a,
|i_w<Y[
_H#|Dc
s2xy{`
w"g]P<
0;mfh})b
7CUq]CMC
jV9z)]Jl?
C@EP7$1
f@U2|*lc
Gm18xu
]yJT_}
{pY."h=U
`ZHL~`
1w.7BgpY
Zdp/Rn>
>?i/Ow
apHgV1+PrLd
!i6d@G[
#>BOIr1:%
r>r+HE
wsIAwh<e
/Gn6g1.gUij4H^m2
nITgLTmnvt:9
Y0Kb.Pp/8XiQF>+lp
O0jw%#-
Kl$;.jB%
9`R#IA,n
Texk`%
P#qd\lKB
<*sfk;k
.v^Z[$
qz{W(g8i!D7;uM
tVxNg\
Cb(3>
HVpag]Sn?lQ
YEB~0sqq[
:t_]BJ
skX#r[yzum&wL
p5v{9Fo
Yc>#~^q9?
bkGV-}:
r#hKgb\;
<|Kr9%|
m:Cs^W?+6g{EA23!
aEP0oh3QzLY
H/0\.]
6R]qW>EK
#0 1XiY
@?j&Y($/
0i2nyK\bF
L@8|V,
f.%tS-
iLOls;:
+A'QZ`
wxG]Aa
3yXOq6q;?91q
AVrLMq[+zMOy#w`
vSA'?T
\IT`mN[Q
~,b#*2r
|syW)wH8
A(dXS|
bsl(&o
PmeCv7KjZ:`\}OX
XmO+4V3UNXko,z0dU*D
IU+NdafDum
S"y"Zh
w{5pLy
&/LbxVnE{b4
]<l)$E
(j.LF1
'r;W8}
~T$ivBr
:2&<*&Qe,wj7
;@p"Wy)
d?[xn-#|7m0
kd#a`/
ngN`\DO
h2PswM
/}'_$T
O3|yRG
6%6EDSD
f8'F~=8J6=
GvE2Hl+*@A3O'
80sNSor
vda{& f
cjk_T}+j
q#Kc#i^?,
N#>f\xZ-b
rI2"T?m.FS
~![V&8
tvVEUa7d
{M}Ueg
Pv\o(a8E/,3Ky
9ulAnG)n}
s4jCT?!1|
[KLm1&QOkOq
fU8D8*
!1o?|j7*+`5
0=_l,G_L
^dmI^yp`lP%#%
1puvv\
G-QJD@
FAt_;$<o
`dyv'8
S+#NXV
z~E<z/
!1Na>Jq}
~z\qyE
FE8UZ1&&
@+7cs`
E?x]='
ZaOrF~
gYUFwbZlr
q[%FQx
eIS}<[g!
(2,u73
7oFNLqd
g5UVuZ~
:Ig{8m
QD(QI%C'P
-BT=Cg~\
Eh(qB
%&;FX%
2dE~4^9
{BQd!,r
uVKc1hg
~R0h[b
+Roj?k3eZ
fU,;j}k~
Qx0d.'
3qwIDblZ%
Nm-Z w
p,tUVv
d2:@nPmD036[l
:12DT*p,Wdyv$e
Jsieoc_
c\Ru~=
=!W+BP
+}eDR.Ml:'X
F={P4{a
:D\r8yA
70L92AoU
$\{gI{
_>/~07
Cu"$i{xE~9P@km7"
chcYp+/'
VvS]D!@.8o5V4+
nU#6~
uHO>M?C
8N9t=,7
>zLC9[uO
92V'>h1BuZ/%j
bS. *KDg)t0
O7B[(N
U(l'?XsS\/u$Ii
J__B@y
+TWH,2
kernel32.dll
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
m2_ KW7n
OQ?*CT!
8!5@|K
9w}iX=~L<,
Hq]C<.+
?C&i"p
;==$?K@]
v!pc}nw"J
d"qPw,
{ia0dVD
>z%voql
3hKt2?}
8 JQY'
-Y,'/>owL
!DV,8Jb
F3_Jg6
y$O=Vb
2qia_?upw
T\>FND
ModulqHan8
Virtopc>ken*32+
ZPY[z]8@
+>(/P"
H+SlM8!
{BtpyL(+
P/(#vjE#hM!"xV4
!J*YO*AW$^@f;M
D$4HSUVPg
6A|$ l
\8T<>#
v0`Zf#
9hD-*
9$$ ?|
;0xUeN
:@97oJ
+Pz%}T`oe<~Wq
405=QtL
vB*(3H%Iw]
Dd"B7\
(1XdS!a
N~0SvJQ
~}U?_(
90sk$M
sFpRph
cN,4+KQ07!'
A,R?B-
%# |"!
uD3Z~X0
fdb;u}
'nPPCN1tMs
!Z`;h2=2
dT)}&nAH+6J^|
@tKwFQ
B_^/b2
XY^WVi
PO:M9W
,QAj@Rw3:
]F:9Fu
g!{PWQSL}@
i7Xt|H,!
A|Q@,:Zha]oM9%
Nr'`Q6
vq"d4n
9l@L04+
pUWmsvb
{ u.Th}e<cdc
%sy5|lntba6id|SDqLG5d,al
uj'XGvMagB
wP=tfNfExitPL
}~ActNCO;b2!
n$zH[QY9
<$J0dkX2
`t$$|$(3
r+|$(|$
USQWVRW
ZPR3C
Z^_Y[]
[Content_Types].xml
l"%33V
=^i7+-
&0A6l4
dsXgL`
tt4Q+"wa|T\y,N
_rels/.rels
i")c$qU~31jH[{
?6!Y_o
word/_rels/document.xml.rels
E}-;}PBlJ!
`[^^ljNKD8R1d:
4e>K/4V
m^urw2N
:>S!?p8JX
0KDEVKc2P,
word/document.xml\r6
Te9$@v
:lZwN., $.
L<E,`@
evh.S5Y
n/UX:9`<R
Qp`_4uK@&
d4tjK8*
Eq@#CDGs,W;`lIgx2=
pK}m$g)Q
)5 8XqIEOvL6?
lZm>'Z}bp$V
hS[[+F={n:O|f}
r,0`%Rp
T]%U-%#+<
g99V[H"
8_aI7FA
naa9"3
O|$CO 1
+]S pK{%
H=+dBtq
l8]xbDM5
Nv&@o2
R8Vnsl
z_s=5W
%f-@Lc,
YI-%>|A=
R ^O/n`2P
}d$/x&$
;&cb4;B-d[B]2
/|)Y^6
G0??]U
~Q3QP%J
]n8].Hi,iob
word/theme/theme1.xmlYM
c7c;i&%GyFQ
Yl`)YZJ4WN
KtR7,BVYT
w/FDloa0
"6q1h,)
z^[`5P^77]/
~8W1@y
@yoV}i
(&8l+^
c o^sp_N?>}
L#_S^?
SJzYt=
[CrGjZ
!B DlnA
`5w12}
D8'c'8=Sd{.
xkw[Hn
tto/+V
; dykZ<J
(V|)i$Fs
d6In!,
\o0Sn_d3-k3iL
zY(6i4["
'ri [xA
Q /wb}KpV3I
C2!f^EqM
[lE!pqbUyIGb>+(
;5V+7X
8zC<C7/}KR\/
UjT}6*
word/settings.xmlVn8
}_`:dII:D
vQ@IM
{d"/&W&|
RV-m:j
0C$}_B(!|K^
?8HwP_
[v@je)
eB8/O!*
N%"kI#UW
L!CcKaiNeS
_5S0&Xhp
N6eE,vx%N-
DjaSi!
l8_MW7M@/M^
word/fontTable.xml
h@Qd[T
W^zP41J
_vpAmV
-QBpbg
2D9!28
2GouMY
QnQpTaP
"o2?),*"q49"qNklL,'e$r
$J#&3(
.!/>iL
word/webSettings.xmln0
6jVj>LZcy
-{ 'eF3
8Yc25,S+
0LDG+Hk5
nE}5'`t
*ib#3ir]
G?tMmm
1z}:~;
docProps/app.xml
d*57|bUL68
dPRuhs
kB`sGA6(
@4PL)<
X `-=\D
w(Pi}D\Ic
QdH{=,J
laZ)Cu:/-
#>xeNfa5/_d`GQlhL
docProps/core.xml
JQ0is;#;DS
v0RAi?
SPPFOqJO,
Q1BO24v
E+=:/=S/:b(C
%)$,N*
word/styles.xml]s
(Y02~6zO
<e{>8WyJ2
b.Y)fBew<j0yE?JyVq
&Xe==<Y*EO:5/e"[c&
ea^wyye\,SVBZhT*4<+H(
l'Yzg~L
8o4lws
A{6>_U
lY7wP6-S9
I3B$g?
lvXUdb{,/1_
VID[33D
Y %6",
Pwq<nDs<fCs<^Bs<VAs<N@s<
0;{sVtm]6WT
C|hyK%G,I4
%{ c,!n
dPXwh?/I
ANYUSl|*me E%%'b}b5<7
,fxbhFD
Q54v'U54vkhD
Tf[|p=!cz
0|iL;-
z75rR|Z
5VG%5HZJ
/Kq0JIxBGk}+I/
g/Dg{N=da`I*!"e
y<|"??
zz0dpOv
W@&TJ--|
lY?raaTJX
p`Tt'Q3
I7d%O*g
Thom3{v'9
WN/Lx9'
okxXtw1{;#W
x<K[-OD*
8>l{VJb+g$,xwf
gVd>#tu|']h
ZlWGZGu^e<
N?qW~D_A
uSVs(o
V0>dj*
6*DZ?j
"F\f?zz
"fR(Er-
}#aWw#AwH<
) tuGp'tuKj8+W=?~
QRCTp`J
`!Kj%5Ja'
Pzz1xa(~T
Wj\)5.[
g?!Hj\)5.[
'd/&\j\)5.[K
Wj\)5.[
%7<0A\
I?dMM'm
/tYqIoA]?c
Y4yG$mT
xj~ij>~
eQe}tg
[Content_Types].xmlPK
_rels/.relsPK
word/_rels/document.xml.relsPK
word/document.xmlPK
word/theme/theme1.xmlPK
word/settings.xmlPK
word/fontTable.xmlPK
word/webSettings.xmlPK
docProps/app.xmlPK
docProps/core.xmlPK
word/styles.xmlPK4/17/2019 BM6
**//..,,))$$
,,77==<<99
""88CCHHEEBB!!
,,BBKKOOLLFF@@
55KKRRSSNNIIAA88
??SS
EEZZ%%
OOccaaYYQQHH??66&&**!~!3
SSllhh^^TTLLBB))++--#~#3
^^zzppccZZRR330000//#}#3
oogg``
LLIIAA::00
yyppjjeebb]]VVNNAA//
vvgg[[TTOOJJKKFF??;;11##3
4/20/2019 4/20/2019 4/23/2019 1
&Adobe
71"0p68`A2#$5
BR#br3C$
0@Sst%uvw`c45
PAQq"2
BRb#3$
!1AQaq
Re3l{eUf5S%
cP.PdK&
WZaw*~*
u*PSnR
0U;By:
/TalDv
LbRqv6L
lLy>k,1[SRU~:y!
R65P6D56
yT$3Y~"9
0Zd-e2+
9Sv`#Q7
Kx1fe\
WZ~k{G
jIv7,46657;5a2dknpjte
(]<_<Pe
0*LI"d,'
GW~_Ln
%$CN"(
>ODHq;A
2iFX(w
z2BTI-
s@bbpT]l
8):{;M(
. H^s#
RvgmsZ
^qZ^afO 5Jol9
$'S#\\1
Cr3i1)
ek%\pZO
0}J{eYvd3c
% V,%y
2T<,uuT62Zjv1YVrWN91_@3v
>K{^b]
(20QH<9
kdnnw7
"|6$e3\e^3J
!#jJr,RD/
N%5=m1
Oe3bV}H
f)U'i'F
1]E@Is
(Hdjqj8Rh
#r?2+\K!,d6
JL!wB.
[gFAKzbv>#HN
g&FfG\BY{e
`epqn{j
tM%r_R
k]vO|W
}v2Ip!
NDADtI'
:%6B<}
hzH:ra^Ye
I:`0>[
eq;30*
P~AV:7+^
DkfD.g'7
( c<1z
[>gt[l$
uF3\hHCSzc<
6>&\fq
1lvoI}
,k:|V/}vu
X:&Gs^>6
(#9g'.
N{4B!pi3:7;:J
(5BvLN1?j
8NPLDa&=
3Y%E]y^uw
&(<Qbzy(uE%-Brs
QV}K\z
#ki,+m5k
>zbbc-\<%
(J\5p[p
Uqx4e4'Plh_z8'
LlO'*%n#
S"q(i6G*&xR45q,Ok
9~;7Git
^Ts> N
(}yt(.t
R<9K@?
}^]r`~
JTNSF<q
d66m(3UXOL)~R
23yeKFI
yxRl9MdV!C
j9l*.R#
:TE9q@
&,qnC/4qZ
d<~L0:JlUqq
F2#hCi0tHja}rU|3N8 CHdn(
kD?\+$7
t*2?iD
=x;|\J{*J+h7L
F9%W9n1pz0jsF
CyA^.^X
gnL{NoS81(LY
JlFpM{qsm
_-Zw*zuN
~J{R-g
loI7+[
rL{a2n
Khm;VIrmHshl
Sg]C%u]^<{>
qQ;&S
M}iDTZzMnS
CBH^0d.psU\+A
/l{S*\
IY26;O
#\V{#uEu
8e,znf
$L@gr2MeZY0I
7[NIOv
CYV3w{
.t]mbrA^m
LX`9lE
3]%i=}p
6Noq_e7?
/A[/#`
i5>{nH
[Di#~0M
="nk`&
.#['2LlDk
EqhpQx
ux==i^
3-sbDr
['Iq<-T
1w 6>DCZQ'*
)qsZtr
jp}}gE
4TN)tp
qY5S*EN{"
.yWt})Fo^8
F>r$CL*#5A
E""Z UUz
WC1U9S\
8z6<..
*U~Dyh
mINU]=
/wI:rV_
UZg(US}lU1(RV<QJm
(U{|:b_.
G%Sg|]
OZjr./Y
`%:?y&v
otuR&c8
#mFomDiY$a
#QParS
H1m;q"\w=
s6^0p!
[aDIrW
HmF)1^%E
bgATJwP
+tW#&J
ZSXeY@"l?
@&2=2+2`
I{eO!Xi$d%
sK|-$n
cM!xy^K
FyU1snq+
6yf~f]xz2X6MuFP6
IZ/Bk:
sx+y}D,m|
UWSV|`
uZ}QwHzm
TduMH'#\
R"p\ubvu
n<VtbH
]\ CBmUh
XSi[jcm
OPf^`1_f[MG9r/n+ueCB[}A
??U]J7
{wrc)C[m
PG%EC$7
kAjL|exEjM{i[e'6
a]}e-}
s%<^Q;y
$:_xxQ
- Ndh-
^T^+~c
&ncjou
l6qMDt|
Y,L\ Mo
&S_ PuX
`XU9Wwh
4HD~uS
-VAF.lG&RLIQ
,m{YB@?
;x|,-TS'~D
)AL~<?u
w5H$>zL!'N
el*ZAc_
@Uy`kJt,$
lh.B.;i
~#V|AK|
eNHn*6
6hPRd@rNC
w<(M[Q$%
"kuDtU
PW-J#w
SHIWc@%O9ogJ$O
mR\Jq[
T.L"_S
n -R^h..
%;f~["\;-
a-pKIe
aCi+7+d;y
\ckbCbj
6Ndo<
qZF{|pG(X-*
dzvUG]^)
5lSv;.2f
6Zb=D)P.znpt.4
1wDtb[.
cwQ,m:)\F
ds,pZ 5pX;*tUQ54r*
jL:Hi\
[+S-e
hX'3qJl
\%!9-/kd
w;gItRQ,;
9FldZ~Lv7e>rXI6&Vm/
\%iE<k^LnNm<[
"SB3@o6h4
/:.r'[
)Qd.KS
4OUV\9/Q1
fE1_0h UU
UqR\z;
sl)A0B
W :URP
k`s<(@Zd
y7^1g[eL'
}%~'G|VZ
Vx[:qm5O${fVuT
EwFqq(
A9k27;KS
@q/u{z
1nHlie2
'gNdz)|
M8ZHci
)nS?z(U
=6kNunX&cR1
TG,1;lmn%$L
*-wX7Kow
wUP+]Ya@
eNeEjXtQ
4kCi44
;(jW+k
Ghh=R'
=UKFIUjuc.
&Ej2K_16NYZl/
i/0_Eu
hKXqhtO
JEQ"*`:*NJW?/
_j_0kR%DL
QjMU:)%
.*+4U(>
}$D_:p
?4LQzqY
+Nu|pu||i^:)`W+
kU>=8P
\e\!|r
vz<~)Ns
CS\71@b
f7g>-r-?x
5aqkCpd\s3Q
Rbf`H
CxaXWX
yai`B:
&5s6^U
HoV"#H%s7v9e1J
ne\i',D
;`$/\|
A])&o=
7$/1$,A7
\XxFG@4-_
l$}Q!\gH{m
em+zaNp@r
8_y]<ZE
25X/sQ4
q~vV3W4_3*5x
ANe]P(yOK
{:b7[l
#RPTE35U+[6
Y^bv`h
*cO1-e%
n;&0&Q]
jSe@YNp
2 ,uPJ
b% Q9;
ob7yK*
}~+]ws
L8qLYt
p\sbha
vqU(3DX<
r}H)7g
,7cx;#
hp~v`ZW
j3L:P&
HTRqye
B"mx&]A
py[Q`$
tcJ"1x9
(m@3')0o=
Ttxs+HO4
$}:b_&X{
-:`HG<U>N
8:m!qDC
zm"Ha9#
)%=LV_0
v"Q0uz
v`NgBQ,Xa
=+aKj
@&ZJAn
R'\dOqkt@0<vOR=X;P
Kr^'^`?za,^
f]X}5\
]qZ9\'
X)K9A"
Dqy8p;2S=q}D<}`!=t
\4M}>v{
&mh(}sx
xby)r<>8
%M#p(<
\JE?>qzW98
z}`h):]8,5)?1
?6}kb]9
"|5y/8
Bmt~-O
'z'jU%?p>
?G8!G_
w4Q|~GY
ry?j0i
bI.6G3
*B%~ap
Q9&NMj
<++}e|ds
P?L6&R:
>17=K1,
?!yp|\$d
)<9]U~
]PsFl>
=r N>Jc>
C{m zw=a
"|`pU4W
%6_9pO
eZ<}pIc
X__^q+
.oa=9_<
~v][`r#xy
1TE5fUIJ*(*
lt:U!%Lf 3/w
:%*>TbHY
N;`P5Aqvd
!!,EZ+QsRD}
hXm8%b
Dn ;4EQx-
GZ jLg1!C
Gfl|1N
{L 09Ye2
J\`HHT
`H',9\{
9.CsitmZZ6
XR[~XRK44woZ
!M4$<~B
744=^RUW%
yb*b0K["'
.UpmV\
-L. ({X
mMThANzpc9A
pbTJJ_8
tNQE+R
&:Yt**%q
YVKq4~
fzU_1xl
a|-'M `TLZ3*-
J-8I# g
{/zCQ1i
-<w18\o7w
B0t,A4i
!B=TT@
JZ&!R*u
PYzK`%zgg
"1\$cL9;#1ZCi
5"dQrW/KB
$O@my<vc
afVS56
N:Dc%8B^WAV
Y7j@:<
U~0Y/vNU
:\_"#A
1],&]C
R)ve(6A2
4iGtnBA_@X@Fb
d"gT^3
IE&9%b$*Em
3j`*t(
!xb.Y3Z`
v&`tI,2e.@
XNAh#)
9_T#iRG
lyTQI-ks
aaK73olW
o4+Bl`
"@x8NI
4+89T) !wt6
DE_Xtb%Auz#
l0Y$K v[Je
lJ4Qmx
<U>jA(o$e"k
"3|=[z
"Q"=F|
`MOw}V@
M+-TKC.
]tJ,#q
i?Orku
#jt~9J
Mn'sx{
UYyQ]M
}!4kg|
cD-{\M0
N:HE/s:{|
M{j^(q
HR\ rv1A@
@w`81hAbh
o.Bm)m
oLt.vP
'12g0i'
(b9MG:
A,8CJB%
gn\rb'b
O//k@vAT
5nz(u hCS
rl*='z
TPBgr&
6a:%jb
rv%MN?{i:T$
)QM%M aLjo
=\#V''I
[(}e]5P
E@_8CG1
9- ]\g
.$sA@x
OVp_RU&50=.4
r4++oJ
*yW1j,
o|+SG%qr
?rnGFV
&9dP;0O5
o.qgd)
6DV`{?qD1
7|26!.[*HDb
)L,J44@R)b!V
<6*'|]u M
Xi1~r?
4do9?
CNNN!'B4q'_
4/26/2019 4/30/2019 4/30/2019 BM:
#///////////////#
#kpppppppppppppppppppppppppppppppppppppppppppppk#
xcppp/
5/2/2019 5/3/2019
&Adobe


A #02B
Pq2R@Bbr
1QAa q0@P
.qqx4EP64v64eDh4
:q*6[*Z\
>Sy__<
F~FILoGt=_#nZ.ZiKQ
~w<\y}
l\lj-4n65t
^7McJMcM6*Z
-EKqtn
-EKQr\T
V6cT\T\lj-65@
njnv.6[^LB
-EKQr\T
En6.ZTTj
uj*[RTl
0mEEQR
0JTJTRJ*TbJ
eM:fW:*.%
1Q*0J1Q*TbF*Tb
+"Gk<:Xf
S65{EF
Hc$,>?b8o_2Lq|'f
6l$XST
*1Q*Tb
XM9>42
3}.?bY6rRs
EskfpLR1&<DR
7 a*Ta
*UJNQQe9h
I9t.dxVJvBN^bdv
Fq(H'oF)T^E
EQE,cHdry"U
TNcO2zAF+
\S@}lHO
32XDx&
<TVH4+
{@5UZ&R2
3(kTNm_=VP
Uld@}A
%?v>+2$
1Z}AfH`b\ .(
("fM#X
ZYexH<
t4<NWq+n
tZ|NU=D(l.Qi3rMeV>
}</T+6+5
`|\+Ney 9xt
$iATWe{
#su1J0
,&ml&n_S
,~,I4V8QOfzdMp`
>F*;d<!aWG0<>/;
Ty0,4gy<
E|Y/EiA
%DQEei
$e)JR)JR)JR)JR)JR
9+6r6aK!R)JR)JR)JR)JR)I
8;3%qC&y
.KyF7]B}DS,
&^6h'u3
1VKR)JR)JR)JQ
damVJ&C
B)JR)JR)JRD?
GC^=E2
JR)JR)JR)JRw!
ER)JR)JR)JR)JR
)JR)JR)JR)JR)JR)JR)JR)J_)JR)JR)JR)JRR)JR
)JR)~JR)J_RJR2}
'!ZSAQf
C|#T(s
CHa1p6
E#Qb$4S
4I'mVxTQ|W$
zvJULi
wJjDpL
Ia"Xl3
E\j\f$CVR
I$I77Xg
Xe$I$I$$
I$I$I$
o2$I$I$I$HuO]$I$I$I$I
EI$I$I$I$I$
/I$I$I$I$I$XDI$I$I$I$I$CI$I$I$I$I$I?
ZU7Yn(hF6
es37|qe%Vx%
yV=E*URAN
Px'xT*r]
=j(MgDnu
mT*R*4<
:{Im7>
nN6I:+{
Z("CqN
G&D4?"lmu
vHUT.v
Cf5#)O
Pz$avx?XUKhv=
OrV)}Ke0gXkW
<fN?p9
$_OUI/_
?"FShk"B
n.&Yz%IFz`
<"no84Nv
4&T.hM\
u4(*M0.
Av--.hC*P\
v<q 6p7]ZP\
I)'`E%~dTp
`Ule S
k(OI(RaX"
{OP:VK
&xg_4F
Ofn+P'fj%
V#j)dn~aK
^:_DR7R
'Q\2~m
6?kUt<sg
? V9qOaW
f\NaYS;Y@$
rnX$l-D{?
z&)J_z
l F$Cf%7<t?DTk6kxB
(>a+!SE<
XQACHMZIHUUJLLWDLKIHTZXFIMTIEGGWQWOGPGDGJCNURBVCJQXVBNPVTOPMNNTTDEGSATMWQVJQFPBRZYSWXFZBRDRTMIPXGPYOBPTBGBRCLKOBPWEQYKSWMRZSUVOUZYXPUNQRYSGIJQYNGSQRYHHJZJUMQJPTACXNBIEDZCTCZFJIXKCYCKIPZNVTFBQBHVQPDZQRVSUVURMXHKEGKOEZEKIBLMVJZUDECREOCIPGSFUCTSCEFBGUVOCNDBATVZGWMVPTZJSFZRHXIRJRCNKGELIWDNZGAMKSBWMWHLFEXGQBOUETVJFOOQXUHVLHCLNPXVMMJAJTHMWAYJLTYJTFGFKQFLSVQPPDXBZGMDPNMFIPCUAIECDYSLACFWPJBZLRMHWQJDDODGYBNCMNPZVZEFOUOYYYZSTZKLXVCNXWPBLBCHTQQEFOILBEJPKRUZJWWDNKGUNAADWZHCOURFFZEJCPBGILFFCNVTANFXLWXQDYJULHEUQGOBNUZUCFIYEITTPKEZQIHPOKWZDMMSUBIQXHUWBBEGGRGQPCKRFMAFMCKBLNPXUXCCXQDHQXPKHVYQWHXEGHICDOZJUCLTBKKZKRKOQAZWXHKAHVKDOFGKTIQHEGCMPYHKLGIDESWNAVASFUCOGCYQQRLWQIWDFFCQYHYHKKPIBOGOKXWOZWCVHKMGTXFXAKYYBZQGZWSMFICJRXGDLJAHPSTMPIAXRZNMJBHJFVZOWDKOKPDQRKIRARJEJMNPCSEWUFHKLELPZWCMWLZTZBFWJTIBXAZBTTJOEGHCLXUZYBYGYULFGJPLUNVJCTDKVUHKFCMCESWXMDLZQKDUWTAECRDBWECXPCHPBCERDAJOGFCHMDGSJLSJJKMJCXPTLKLLKNTYGOHAERGCOCIKXTKCONSVANKBZLAAXCSYEMOBEEWLNTVTKLAAWZXJHAKYJHSMBMGKGYCJVIXFXKLBIIILIGERUIRCZLATCAWQPZDBSCIHXZEAKRVW5/14/2019 5/14/2019 BM6$
9=n =
$]0$> @
&(_6(G%J A
33774411,,&&
p! ,X9,N)S%K ?
JJOOKKGGCC>>9933--&&
+7/0M-[)T%I ?
(0PX/N
UU\\VVTTOOKKEE@@::33,,%%
0J81Z.^)R%H>
3Iq[!6
A7&(ii``]]YYTTOOHHBB;;44,,$$
1P:1^.^)R$H
05RiPw
STooffbb\\WWQQIIBB::22++
5K:1]-](P"F
ssrrkkff__XXQQIIAA9922
}gNz`U8yB*^$M!E%Daxg
LK=>GB/+56
ttnngg__XXPPGG>>77
Ge7&R4E
]]#$}u
uunnff^^UULLEE55
u0x3Q\
ttllddZZQQKK
mXhB=X4!m!A@barrxx
||qqhh__ZZ88
1z7'LK
>@ffiiqq{{
BDvvllhhJJ
(qI*7^#s
UUppvv
{?OD,
)f]4,w:
MMyybd6)wQGW
7CZum]Z.
D+YxG,I
X>C`_zmoD7
~)6MWgntT0
%$$$$$##"
*7HZh_E
*)*+++*)(''
)=GU'Rg
x//1122221/.,+
f,6566777766421+
z989::;;;;:98766
['><=>????>>=<;994
f7@@@BBCCCCBA@?=;<
r?CCEFFGGGGFEDBA??0
|EFGIJKKKKKJIHFDBA=
JJKMNOOOOONMKJHECC
NMOQRSSTSSRQONKIFH"
XrQQSTVWWWWWVUSQOMJK+
SUVY[]^]\\ZXWURPMO&
vTY_^VQU]^[]^]ZWTTD
}2AGNPOMI:
n%3=HYnoT1
d <BIR^rpY<!}
p>KVajukH3'
b*nseXI#
k=tlI"~
Joe Cage B
""#,##0;""\-#,##0
""#,##0;[Red]""\-#,##0
""#,##0.00;""\-#,##0.00
""#,##0.00;[Red]""\-#,##0.00
_ ""* #,##0_ ;_ ""* \-#,##0_ ;_ ""* "-"_ ;_ @_
_ * #,##0_ ;_ * \-#,##0_ ;_ * "-"_ ;_ @_
_ ""* #,##0.00_ ;_ ""* \-#,##0.00_ ;_ ""* "-"??_ ;_ @_
_ * #,##0.00_ ;_ * \-#,##0.00_ ;_ * "-"??_ ;_ @_
\$#,##0_);\(\$#,##0\)
\$#,##0_);[Red]\(\$#,##0\)
\$#,##0.00_);\(\$#,##0.00\)
\$#,##0.00_);[Red]\(\$#,##0.00\)
#,##0.00_
#,##0_
"Yes";"Yes";"No"
"True";"True";"False"
"On";"On";"Off"
0.00_
0_);[Red]\(0\)
0.00_);\(0.00\)
???
???
???
6ReN!j
hgUSCQ<h
hgUSCQ<h
fJTe,g
fJTe,g
cUSCQ<h
cUSCQ<h
0]hVwQ9
vQN9(u
]KQkSu
]KQkSu
^yv;`{h
gPlQSQS
,{hQu
M&d2?'
M&d2?(
M&d2?)
M&d2?M
jZ?\.?
Microsoft Excel
!Print_Titles
Microsoft Office Excel 2003
Excel.Sheet.8
5/24/2019 5/24/2019 BM8
Xea8I>v
BOD`jatuky
3@68F8@J;\f^qwu~y
at{y{4A3#/
qIQDjrh
6B5Sb^
wDG>4?3+=2tr^
lqkswn_eY
x0<@%5'3?/
grqZaYw|w
Zl@JtOYN"3%|
pusq{}
->>.;9
;I?GZT^mn
#-:HQ{p|{;LGauz
c: j>#pC&wJ*}L)xbUa`(7Vtehf\]s0AAHZTvcv}k
$.;IfvDHD8MTd{g~m~TfaUgbK`\]rw}aS?c8
"&K\\|RgrezXmuzJ]fsbqo@PKCTOD]d~'$
(6,.C<Uikt
iyA[hk~Zn
4JZ*:8
!+#*=5@WVObd
Z{e}3Qw;Vl
VY\^dl<BF=FH
+=55JF;PNIar
i|TewA[ob}Tfr
#'ZaiVajdq~!+''805MNZs
lZw(K,Z);K
x*=Ej|
$'-.98?QW7EJ
+-]v@R`q~Xtj)Bj&>m+FdK_te|4LVrBHI
15<jwu<J>JZYRfnPl+E\
*.buzb-Hq+M@Ts0E\
Vm~-7U7A;_eb7=C
4;C_lp
3DP3CJRdv3Ka@Zs
;]w;KXRn
;@D~6O`
/<I\i<qD|evv<Xjbu~DVX,;?
{NhyVn
'F^sl{;QX"-'
'! )!&
4Ro.D[%4D
CHPSmLi;N`
2OlUt
k$M4aKx/Mu
!*+:L}
,H%Ab6^!2G
'?]&Ef*Im
*2-6/=GB
'-1;;/80!&"
CRk1Gi
6BG_lw]gn
@b=cSx>Vw
AJW%(-
"*7;EahrCf Bf-T{?b^~|6AQ1:IfrIOX
AVg(FcSt
QdrH[sGf
g|>Vlatz
+Yesz{py
"*7FQa|bn
zxmv@FP
NZk?[}fvNV`
~`{d|ESf
)7n~T]m
hp}IP[
6/1/2019 6/1/2019 1:03:14 PM
Root Entry
Workbook
SummaryInformation
DocumentSummaryInformation
Arial1
Arial1
Arial1
Arial1
-2]\ #,##0.00_);[Red]\([$
-2]\ #,##0.00\)
20% -
20% -
20% -
20% -
20% -
20% -
20% -
20% -
20% -
20% -
20% -
20% -
40% -
40% -
40% -
40% -
40% -
40% -
40% -
40% -
40% -
40% -
40% -
40% -
60% -
60% -
60% -
60% -
60% -
60% -
60% -
60% -
60% -
60% -
60% -
60% -
TableStyleMedium9PivotStyleLight16
&L&"Arial"&10
&R&"Arial"&10
-DX
&L&"Arial"&10
&C&"Arial"&10
&R&"Arial"&10
pdfFactory Pro
?@@@@@@@@@@@
BCCCCCCCCCCD
FGHIIJJJIIIF
KLLLLLLLLLLL
Kbde_``f__]^Z
STTUVVVVVVVVW
STTUVVVVVVVVW
STTUVVVVVVVVW
STTUVVVVVVVVW
STTUVVVVVVVVW
STTUVVVVVVVVW
STTUVVVVVVVVW
STTUVVVVVVVVW
STTUVVVVVVVVW
STTUVVVVVVVVW
STTUVVVVVVVVW
STTUVVVVVVVVW
STTUVVVVVVVVW
STTUVVVVVVVVW
STTUVVVVVVVVW
STTUVVVVVVVVW
STTUVVVVVVVVW
STTUVVVVVVVVW
STTUVVVVVVVVW
STTUVVVVVVVVW
STTUVVVVVVVVW
$$$$$$$$$$$$$$$$$$$$
STTUVVVVVVVVW
STTUVVVVVVVVW
FXXXXXXXXXXX
CompObj

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255 131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.