15c6f4587ed57bface0e0fcaeadd3e76be9234a75ee2db96d02e2cfd40102f14
15c6f4587ed57bface0e0fcaeadd3e76be9234a75ee2db96d02e2cfd40102f14.exe
静态报毒
动态报毒
CVE
FAMILY
METATYPE
PLATFORM
TYPE
UNKNOWN
WIN32
TROJAN
DEEPSCAN
DACN
0.12
FACILE
1.00
IMCLNet
0.86
MFGraph
0.00
| 引擎 |
描述 |
特征 |
威胁分数 |
可能家族 |
检测耗时 |
|
DACN
|
基于动态分析和胶囊网络的可视化恶意软件检测
|
API调用、DLL以及注册表的修改情况
|
0.12
|
Unknown
|
0.07s
|
|
FACILE
|
利用改进的层次胶囊网络对二进制恶意软件图像进行识别分类
|
二进制图像映射为的灰度图像
|
1.00
|
Unknown
|
0.03s
|
|
IMCLNet
|
轻量化深度卷积网络模型实现恶意软件家族检测
|
原始二进制映射而成的可视化图像
|
0.86
|
Unknown
|
0.24s
|
|
MFGraph
|
利用静态特征构建图网络以检测恶意软件
|
原始二进制PE文件的静态特征节点
|
0.00
|
Unknown
|
0.00s
|
| 查杀引擎 |
查杀结果 |
查杀时间 |
查杀版本 |
|
Alibaba
|
None
|
20190527
|
0.3.0.5
|
|
Avast
|
Win32:PWSX-gen [Trj]
|
20200320
|
18.4.3895.0
|
|
Baidu
|
None
|
20190318
|
1.0.0.2
|
|
CrowdStrike
|
win/malicious_confidence_100% (D)
|
20190702
|
1.0
|
|
Kingsoft
|
None
|
20200320
|
2013.8.14.323
|
|
McAfee
|
GenericRXEP-HY!8EF8CEEBA3B4
|
20200319
|
6.0.6.653
|
|
Tencent
|
Malware.Win32.Gencirc.10b0cbdf
|
20200320
|
1.0.0.1
|
该二进制文件可能包含加密或压缩数据,表明使用了打包工具
(2 个事件)
| section |
{'name': '', 'virtual_address': '0x00001000', 'virtual_size': '0x00066000', 'size_of_data': '0x00014c00', 'entropy': 7.976928395822499} |
entropy |
7.976928395822499 |
description |
发现高熵的节 |
| entropy |
0.9903634393316165 |
description |
此PE文件的整体熵值较高 |
与未执行 DNS 查询的主机进行通信
(1 个事件)
文件已被 VirusTotal 上 57 个反病毒引擎识别为恶意
(50 out of 57 个事件)
| ALYac |
DeepScan:Generic.PWStealer.6BE8E1A0 |
| APEX |
Malicious |
| AVG |
Win32:PWSX-gen [Trj] |
| Acronis |
suspicious |
| Ad-Aware |
DeepScan:Generic.PWStealer.6BE8E1A0 |
| AhnLab-V3 |
Malware/RL.Generic.R256475 |
| Antiy-AVL |
Trojan[PSW]/Win32.QQPass |
| Arcabit |
DeepScan:Generic.PWStealer.6BE8E1A0 |
| Avast |
Win32:PWSX-gen [Trj] |
| Avira |
TR/Vundo.Gen |
| BitDefender |
DeepScan:Generic.PWStealer.6BE8E1A0 |
| BitDefenderTheta |
AI:Packer.709B383223 |
| Bkav |
HW32.Packed. |
| CAT-QuickHeal |
Trojan.ScarCS.S9432402 |
| Comodo |
TrojWare.Win32.PSW.QQpass.DFS@8njimh |
| CrowdStrike |
win/malicious_confidence_100% (D) |
| Cybereason |
malicious.a9f74b |
| Cylance |
Unsafe |
| Cyren |
W32/S-7ef0bbbd!Eldorado |
| DrWeb |
BackDoor.Bifrost.29297 |
| ESET-NOD32 |
a variant of Win32/PSW.QQPass.OUO |
| Emsisoft |
DeepScan:Generic.PWStealer.6BE8E1A0 (B) |
| Endgame |
malicious (high confidence) |
| F-Prot |
W32/S-7ef0bbbd!Eldorado |
| F-Secure |
Trojan.TR/Vundo.Gen |
| FireEye |
Generic.mg.6cb1305a9f74b10f |
| Fortinet |
W32/GameHack.AX!tr |
| GData |
DeepScan:Generic.PWStealer.6BE8E1A0 |
| Ikarus |
Trojan.Win32.Dynamer |
| Invincea |
heuristic |
| Jiangmin |
Trojan.Scar.niq |
| K7AntiVirus |
Password-Stealer ( 004b38871 ) |
| K7GW |
Password-Stealer ( 004b38871 ) |
| Kaspersky |
Trojan.Win32.Scar.ievr |
| MAX |
malware (ai score=86) |
| Malwarebytes |
Spyware.PasswordStealer |
| MaxSecure |
Trojan.Malware.300983.susgen |
| McAfee |
GenericRXEP-HY!8EF8CEEBA3B4 |
| McAfee-GW-Edition |
BehavesLike.Win32.Generic.mc |
| MicroWorld-eScan |
DeepScan:Generic.PWStealer.6BE8E1A0 |
| Microsoft |
PWS:Win32/QQpass.B!MTB |
| NANO-Antivirus |
Trojan.Win32.Scar.epyqop |
| Panda |
Trj/Genetic.gen |
| Qihoo-360 |
HEUR/QVM19.1.015F.Malware.Gen |
| Rising |
Stealer.QQPass!8.F7 (RDMK:cmRtazpl9gOpTz/738a61IdTsEkI) |
| Sangfor |
Malware |
| SentinelOne |
DFI - Malicious PE |
| Sophos |
Troj/Agent-BBAC |
| Tencent |
Malware.Win32.Gencirc.10b0cbdf |
| Trapmine |
malicious.high.ml.score |
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
👋 欢迎使用 ChatHawk
我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!
🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
PE Compile Time
2014-12-08 13:58:29
PE Imphash
352063077f27a851dc2b08e15f08105e
Sections
| Name |
Virtual Address |
Virtual Size |
Size of Raw Data |
Entropy |
|
0x00001000 |
0x00066000 |
0x00014c00 |
7.976928395822499 |
| petite |
0x00067000 |
0x0000033b |
0x0000033b |
3.997365146900804 |
L!This program cannot be run in DOS mode.
RA3A3A3:/C3
<E3/C3.,C3w
C3A3y2
<V3A3@3
3RichA3
`petite
Y|^)GM0QC
2vmz,P?
`>Ev447
FTUmpj8
z0<)-tdA6
lh<[`6c
}`AV(Z3Ng
cy-)),
6dV0$5
~tz"x(MECYw
Y<.Ox
y)`dr/
{O$)`tf
&)VMM@
A0DQhBJ
TJP<71JlVhpR
A<*$d#^$
a16F|w
3M5}
$usjN<
yk/q8L
O$"diPi
;JgmlL
nfcf&X
4B=>@m"Mc
^d=!x@
f-%_~qL
((3|bh7
/pI"']/U{
g^#H~/
%(ZK4p$M}
yVkM=Y?
<WuQhT7D
UXRT4eV<B'2
HThu{|}ccw=:!
GAL"><`
w`h{_3h
7pZtXe<r`
K[_4>
d6O)~)L
B1B(/f@
w`O]xSS@Q
#]n ]&
IW1bvX\
H(FB/&;
5s[\ 1
'`fWp*t1>*|mGI%"
".6TCb
))y041={
Fu2R&4tL
xZe\So
YA":W!!i
$Um*an
4SKIh"
JBJG0P~
+e!R -lo
n&V+=rYZ
ty|ADtuo
6XV]kt(
HX(C}K
%a!SYc:
Bx`n$!B
E[.dG`D(*
DEm! &*J
,+E!jIk
=x_i+,
#>5IJ!
*uPn_v1V1
h}|!b/
[:5[\[
%IOs1Q~
q'U?$Da`;+
3Y}=2H
c Zdq% :"tC~
b"uMDCAs
S&[Eu+w:>5
#_c\G8
<Mt-EWu6)
4p!APU
|;Tn|sqNa
5FV?CsM
7c.k3d
GP[ZQ4k
[?H7C>
=UF0#$
$oa2soYt)
NO)J'D
lgb
(;6*
xz0ozI
NE`ld_~
44$3pNC~z8
d#hD^
j\dd{+\S;E
0x?=v^0
W!Jd|om;
@vA/sB
T jnEhM5k3
P3abcg
10sX/
t&uNk_:
NJ> 2$$!]zsS[
+=Pl j
x$aL7Ocngt
cI[07(
6|xpm*
FS.tiEE
lVnha RdC
5SGzb<XUp
uU*@xYfR
XWSYOCYhE
IsjY0q
v#lk}]M
TOAg;18a
JU}f_/SAHu
R%Z|1aow
=?AKMA
<X,&`e
$$I,:;
cCC'7DCi@
,a`KIJqCxb#Z
)gzyiL#3lD
fu'k!J@CLbvR
6v$BzTfu
WV*jv51|TE
mo|_.Pm@D
q`xR=0
Cg..5t
<gi:a Fs%
dc0JftE
3 &C-
)nAl@(!t
71do2(.;or6`^'
6>$GW8
w- N~T
v,*#m8
Y^"tjWA4)Y"
?,lA.y\
/m~P=nE"X$)
m`I$Ik6W%?
M7di_'-
sd~v@H
$^,~/tM
kE]uY.l
Vy`oU,$
EEJz";6
:"CF-[@?/
]O](pth
e.F=YxXS}
$YCI!&
L"F*}e>vLF~
5dX+5DY|RP._6
AVY-K ?(^X(sn
WjAW3m
V[Bw)F?:KQU0L(D
nn_BLQ
LK1AK2
>&b*G%
RSe^WK5J
Lbj-.VP
P6!Ko{_
qA25|!
ldS}i{
X__C1<
T0DM[[k^_+
rhFx:N63LOu|2+Wwgg|mr
xj@EJz8<VFZf
yWautJomO
!o{b}):
tWh>@gj=!msZT"
B)&DDlM
mkCAVz
$$++*4-a{C*
{YSy2V
UjH=!Q
"!~((lH
u.IjNRp
7(=70Ia
]+]QHx
;pD)JL<
#!eWiG5/
%Ht)ksCw|H
^wEV0qj|YIWjOf(hP
W*vpZ\#
Tp1c \
6y!lJ-
[W&jw$
=]BXQ=^w2
WRqoy]
qbB[x!|6!
6c@=4A
_Dc9OIw
B]S_]D
dYyy&U
_Dp57{s
?Y)k/~@
11Pa@yCW8
iB+"9L$\c!Op
F3LsMX$
oT>jOXNI%/[
k6/A!j>
wP:OM 1H:
<<I([.
7H oz
{4WC&x
75W:XP
u%V[_(H
G8$+hmvskpD[kG
+]/3O'i
A4hU?ar
yXu1$faId2
%(hZ}=
,ogtP'^`)
f[B<u:NN0S
t@Q=$|
R}=\t]vj=
C!D;{W
zi\n(`+sC-7!
;wMUxWP
ZUjprau
1>}%( x3z;(
2m|c~?RDY
n#bXjL8
y3"?Uyb2@CCj
Qx!/nL
XqsPMBb2S_k$dpoU
G.I1GX
^_'Z*?
wWZ%]P
Mwn1z$l
pnY.a+X
IC?E}*
`G{/<sEA@wm
%2w e>rI6)|h"2o
Gq:#*X*
_0\Q}C|h`89&VP?|
?Vu,>85F,
!c#\Q7v
3mg!JOS
+;*[_]=;
5Tj^]*
l Q|+
U;@Xl#BNU
EGP0DB
k7&>D.>
:P-qp
G)P-HC&
Hr1h}pS+
oNk%-]+
)|TYb9X3$I}{
}!5UVdyq_R,[
rccu;j
N}nvN~S(;aY{xs
!>F@Kqd
}HxP{/
'/Ckms
obh{CB6>
?"8Uj!V
J8C+j:<rR
A[ub!h
x9K^g<
`W?!sQ
~Krp"V/
C@.#+QqT%
DQ_M@Fu>2
i[gUUx1?(
5/`4[c
2_[FB*BAbC
-s_7}Cb4S
_(7UA`GW'r\2qxU
5vUZC:wvk]
h>_i__*:
C0NFUWO^
u0[AD *r]n_%+
G2sc_P519nn}p~m )H/
%9}yud^
YOSEZBq".~vW:
@wJe]'{cFWgA@`
<_'1x_Z[A
a{Ab/)V
sPr%!
7|?$\f?d}#JxV
G:[ [U
-/h^mD~0,+
\w.wWD3vx!
wpuKIFV
-t_A<`+
y.NUV5
lPWqK4
$1_~At
,H!}u]@tM
b &yg3Z&7
e(Hf
Wa]WC+v]|S
]KOyWJ
8`FrpGf
g@cF)a8(
1%$9Jb
dpT?:G*
!{ !7d
'-aUtK
UddfgddhdddMFdd
ddUBddDEddVw
Z$@02MXB
=&j\dP
!C.`Ba$d
<svXOU!J
IV64j'A]c[u}0J
n!KaG+
PkbP.OA2
lEM;c;tSeb
9. C*L@4
C!R|y!
@0WDzX
#}}]-+
QJ]PAT
*p`9,X/|
y4`K1|J
!UHW0l<
GO4l+RL
W-+Zv]
j~S8)4O? G
CK7V&wz >B
qS(~q#cd~#
gFA^bc7cQ#L
rd}|A@z
KD/c
EnvIF=v
3Q %G-}UY+j
A<+4dd
x0^]ewLy
tfa~B$"
<W? D{!
h{}P4
Tex[+z-$Wtu
UTA@Cn#
t;)D7S_!7b
)5m5Zr%
M4|!fG\CC7Ws
SsM{l@L
^71J&[J
ZSBgAK
Zixz'Ws'st
s(BfU]
U#2FmX1P
$A8a`l
10)&st
{(HA"g_
J.OT=6=
NM#Um@
age_!E|~
J}[luPVju"@} c
A Fn\@7
V?fgK!cH
z7Z?]"LuQ,IZc9
+< {/c
!|'HZI4L3
GZYSSKuk
F9-^S_i`
igMAs
B_AQy4#
+1Be=P0Yw^
NvCJrz37)8\K
IlNm;w
S?o\n#f^A
7MWyJL{.an=
dAfaXL
4t\~6_|Vu!>,
Q5GxUATn@
+;W]iA
9p)_ow
:k&u^DE
_!s:EWU8
x<QCARD6$
i5O9-$
3k?q?V
W!m2;l
OTC(@8k
<yCdYY\u
f/l+Wzl20k
C}Wf}WD+>
h|RU(f*U
ZpWT+HAh
+r$W!BC
+kqHvZ
#V}"y}S
/RsF}gb<=M
5[\3tHmz
1LI+A2
7sgJ*{GmVQ<` ;
%u\%TA
r@^$7 x
cw=0X3]-Y~/D
rA\`'%%..
r5SSB^
_A+WP^W
9p;=\AcK+z
urCfk1W4qr
7Wu':7
SEXzV!hU?=Y];t5+
w_/zuglm)'
a-6Q\CD3Po
o+G2FA
/V-c0G
NPs'Hv
dU_Qi$
x.$_>l
qPnfhfd]oq3
zHx>TQ'
V] E_i2
W%+ !X0hR4XY
[+ov"gTW>e
t@\? jh
S<m=M"k
];gc`adE
$YQ8cqw Ypz
!KTmD3{ZWU2c
FtlC|,.*z"+M|?C
!* 'xlr
#;u!S!
t:ZU;OPC
!KSi":10Q
UCpHZU
+(H:dw
+-?hp bxY
F+!KHQB-
cM+fau#NUzfuXTT|
O.{PQ4
1kOXo<J
)asm^os
Sj#m#
`z/N|~MCAC
XS@>SC
BS6qx
Sk@B%@8D,]V'&
MF|U;]\@ku`N|
s0W}nUi
B3~d0/ >+
O}J8s A#
kC{lC+
BxsZLCz$1=
Vz!`%fIp$$I
!A{1SgkA
7{GSaC>
Y\X+(BU
'K TE%~
s+LsE+
msA(DcP!#
:!"{BRtS7
r5<6{o
y,!Ac\#X=3\{DA&
K' A{W
pqc(C+Zu
- .#%n
?dnWdDpw
H08X_ +LP
{/T/{=b
wc{8&
CPT{#a
}bQ{:x"ZB{
>X!Wz0aQ u
v|}'PO7
!bJT!
PxGQ3+
!)tANx6*+
O]K)w<]
'~,~)|1&CCb
h.H~xZ<
}(nseR7@JSsu
-WsSAkY
%R9G.:,WY3&q+s;]
fCtl{H
5VUe>wPZXFWU*+wSD7
1~x}!fx
":?F!AC
4=RwS"\[{ ^cP
#~A<Fa=$
j% j.<
I"qyF*YG>~(@C
o- Z?_Q
4LIhB z{
!As VACUfBW
bb&Gu+CS
!AsuLp
<zO<,Av
+s9[]\1kA
*\zz+UT?tB
AtC~ve FK
%>m1]t
~])J($WdP
*AV!U/@[u*OS
,+Unsw%J'^V0:U
~V\`aq.R&k:QM'
07e#]`xKM
YUZo$fd!<Rdo1@hO}
nXRX7x
?|(uAm
DX^O >6
D^QA W(dzZ
)]fNRka
1R|AAKeB0
aIDxKr4,
C"#aBdRJh19
vuUT=Y
X A`*V
^qd<8@|Q!
BK!A]J1OK
X@*-rHh}?]
m/qR\y
U*rvtxqxDw>0
:y7bX~*.= k
~K2?R!d
$YU^|!4
v]"'Y:A
\*3FXMAON
&`uXJA15
Z !lJb,JDBWU
NOZePx!
EA>OQVyBNU
(|9#6J7G
.7JCh4
,EY-#U_
jq]qL,UB
1|Oo;]C:<0X
OcE7/_U
y:\gCV!Fm
rtpLxZ
S8[QO]{
Q>~|m !?H7)
H`G$}*p
j!eXE}F
]}!DWlVS8CUgq|4
LU([g V
wvM ]x-aa(,FB>
A!h|:M8 l 5(FZj)
]sO;%Uokz
<dcT.@Q&Cm
uxwI6
dsW*Z&
swvwSAxXLR/l/9
]FaqH^"
l<H@6N6c)W/c
'WL#BAaEg
92+._8r
aW,Ks
]=@%{vl
:KC'U#
6fR[X_
h#xwC9G3!M]Y`
l2&BoLn81
WxTs]>vut
Q:}_+6LS8c
FfYkWZ*
viqYl}d(g* <A
r{x(Q
.Dspp_
>]Y(>,E?8a
Y_,h2
&_lib}
vYwKW4i
=^emN*N*
Pp!:bdY
MQ;AP(~r5S
J\u`xU"e
oGx;:`!_Jh$
zZW3&C
gl`'-![Tt
Bef;|A
`d;*]G36
HcU D6
_"S,t|
C2}GWw)I4#4hX.
P{uA&>#
t"RXAY[+3VP
)Pnc3@
).[zVA
>0J_}+
G|=Efx
p\e vz>
HXj[Bj
= dY?W)
qV(gzeMWQx0Q4~Qd&<
Q_+UFnsawW#
_&*LXR
PuPyxi*
JuqFk_{!
lhpUVU_s
fis]RG
ox:8H~
aez<"JA
B3kNG5w|@ESl[]QC"0
!u_xGan
?J<ae`]5$
BR<&hY`7!uhj
0Q JQgXqu
RA8X"X
g[%]P]
|*Yr~? g[
B|CWK1kC
0FVc{foHRa!l
obZV]DTA6
bIHp+0Nv)5
b&|<qgB\
RJC> 7ds
9rhb0(xU /
9}4=^u+`
PSCSu7#
.#tC`Gw
{]W3AS
m_v.)Wzra_Wx2$+fA6a
d3_.?wF
dK'(]w.x
i!Vzdc)h
.!J1\+!(9
h)!ZV&8
=S;Ilv
YfUZNq_
)]ujCl8Ub
MeKE"
!q6{ 4)zUy
(h X%L$(%'$)
w=/@S1
T[Qf"n]la
4I[Xkuh|&
Cr4T4a
3[5MiAE
Ae0WsI"
;[> om
K/z'a;j
~a|!w=
"`FWgT
(8c>AA
}j"Bb<0
@3Um?jL|!
z <
n-!dW
hi+F+$
er 1XdSGic #?@5rT
wY{Ud|
QX!:$a
9zW[&1C;
IFKFKC=\
[3@_ANYBF#_
x{ :l/
Dw=+GV>s
6eG9<@5x*#w=X/
Jaag4&e6Jf
bF|!C)
QwK_\/1w
E/A#>vO
TYSL)@v4cnWk
\|r|5
J"gSD;EDN&\
>U`ijUSm)
WBG]B9c_(k=
SeaTA!B
r*P fI[5]
w>%&t]
dx!!iKXmYN,QA
+9_F]*856
*0h.Fluc1|D~Lq:
xHMC5b
E<$],'5bF
$;8Q5zUZyTHRV
O}KT`l9=4W(
[\Lu`Y
m^dyUH
_c]ac_(p&
TC$Sw+?5
NVk?96[
}xVh6$%W4NAZ
r!XO7KE<
OK;K~TMU6/B
>Ml!;/yw7D
wzclB1n
%,lRFu
mBQN;G!ujp
.xn&}yX
[ug@\w:
:W,~s+S
UySnA<8pH/A
/pc>H}
CcSZ[!Jc{
1`o%3aC4t#A"yb>
-YJ2{WWL
4IYX(U
J0N^YS
Q,Y4(u
(2ig4?gXY
`{\}>4+0!a
TR]}@Or
\Bd}p~?I
*Ftf=A-
#*q<d8m
9u|j[S
H#woKQQP
"dQlOrzBC
u>rCoU
m?+b!#&C
|O}mgk
},Q\NS
#v`b4VG{t~2
G-k[b"`P+UU
uK1LWb
5Z}cY,}gZb0R
:KrS3]::(h`j(J
@~j4 N
.}Ntu/
eZ@!2PU
@De0PkI{:N&
pUTXEY
icJeNi
u\WX&`
%V2QM,uy"
RS)][E~
Jckh46!.
tZbFmudJ
!CZ>( 8Y
e}&(ADY"X
y_q]pM
mX!=kz
,2Pheh
4FdFKQ
>|o$8_W.7V0
na/%O}TCA
w`Um<H
dCqNW8
9zC43]@t
{B!a&*
I6^n77
5)2xy_E]W
Do%(k]A
E0A?w '
_U~kYUE
U&a1Ub:dvYd
SOq2P#
qWmEb)W"-E
m/?7H\]
r(,Ww
j?|$/cdc]_
/MtLBO
F~G Xq
d *C6F
zOw7|!
xbCc=4}olC
UvAH5M[?
zbWq~$R
Mh,wG&W0
LT(+(`(QH|Yu=/5d
l~!Mnux
[AUHA<dY
s;Auw]-vg
vV;]w&>
F*}DH,l
%<~_ Ar5,Y
,z?M?VTW
SO+w]A\
o;\EvA$
^5 HkH: v~
Pc|C%m)o
!jC<dwd
s#T#! \
J H9D!Fc[]
EH){eHd N
EK.n<m
:X&? <t}KC
6}&Z9G
X|S4yC
xsGU9Y
x{Ou7Z8
_X78{O7
q0] 0\A
Vd7uY#
mG]xD
IxIjBIS
g7?;'
@:Clp,:J("K
SoYuU}b
6wlGx\w
{X,A\`D]~o
0_57"O
Y,Z n}
h{]%&`w_~/
dQZ8<rc
R w-^0$
2uVkP|S
up 4b
.=r .41|!
JH1U]p,7
1u B"^YAZWgaBmV
_<y]^dA(
=OZ]cjwd
uDQnu<+]
} w\z\p?C
1&`W.yS]C(
V'4Y]'c=U4B *.
)xoWw}RAx
tC >sS
VdA^A^
HGqR_Q~}7y?
v{z].djE}i#h^7
0TAk{:.
M3wjw0
<[+w':XC
)*uR?ErZ"1)o
+}rWWZ}_w,
c2ClYu
3ed#ffDA4\x
Au!|exst8
i>IS!4/
1^2W>'kvB
s:zijsQ%t
;7U>@[%.
ozb>d04
i{Ab#^_
Wg.Y:(
@DL*~J
3:g<b|3
lyO=h
SlH*TUA<
GQ9liN
j}$*C@
_@+aSe
rQqdb5
2%Bv73#
9O..]D
9w` [ju
}l,UQ2;
{ky 0,TxeNM#v[Y\R^AV
qdkydSUZ_& \wak
_\T-CyX!
B|OmZi2+
G_oDsIkn
BjMPCD
R3BJGE
$ey@aUh
T_d0=!1i"j:zV
d@8tS3
*f+vZ9
L2U~v(
*+?Fa~
yGB*cA
KFDA +c
daNllA+TZ
xHQI ),~_F
C<FY$,&>
',DNY/C
_1c,F?.*7MT_
4&th>%
-OaFU?k
0m"HXWi
8Vn,]H6s)KiSF
U!LG=]}
wW(6NC
yMX=l*L<,
c.y$~9A
^Ust\UQ
!!5krln
<3!k={W>Ja.]k
1bF4Dt%*
M-U3.r]-
*WXLO
BCfGK+
,Y-\mW@
5,:|~k
)`GAb.hUem&wL.;N]a
=VoU_*p
S*=T2Ei~V)X^^
KpG}YU+?:\_
P-4<V_f
&E,2S !;eiu
VcF<p_1
U]KjXM
]8fL1+F
tU4yK@34OW
Q\CQJX_!
oB9u*Wd
BAqWuAd
P]W:&\/
3CDD9w
7f4@j_l
NXs:b4B)o
|\N{3+1D)MTQ"z
?!Rc9~U/]
s|A/p2a
@Ap2bM
)dYWS;
38,PwrAD
-FC$(F
.}CfKVH4
_1g?"S
Lha+UhO7ukHD]
<N*(*^
?+j2{G
HS~5qv(
n &&KG
32YG+
{YK;Je
/C+\zK
kXu~TxV~
.] TFG9B
)F VC
Oxt#jG.
7AX]g!
`SNsJ:U
5UVWaj
x& V6q
7T0ra/
=WIUgl8%.
>uh:]@}f)jam
oUacN(qu
2|(no,ASq~?9i
V]\yMv2
?()thU
h:!ixT!,
L?CUv
q2vD(
sCWCbC
g 8i+=AWuA>
?a[#w/
1"N;5h[BOB
fWo?SV
Db@%_C@6
=]a6aIT
C@C@<=
Y.lhAl
T1'\xE
! ITgZ!
! =O!
C@6C@<
C@C@<7C@<
iGyhz"R!{-nx8X
b,|&(0
bN"yUc13(@E[:7*uUS^$-7-
I:0K&L
lwe@K
D(LE1I
B7N}qF6Q(
7Gj5g`
D0sNd!Cu4N4xh
j- dte
["g4{{
Q[/}O5o
w6e`h#Pq&
UcmHKl*
(%dgh\~Q[qsAai
G71sT_
)~Sef`j<nv
AZ08M";/@
&R~<,0
C@f)*)1DL+/t$7QS
z,qz u3
;6)a-%OC9m
C4<;c}Q
H[G"&Y @,5.+:b'
(VZ1D'(x/rwYX*
@3I$M/X('y
3r;5w2
6hj/^(-
&\+$fkzVL
\Z<s^=
)@T}P# v
9JhQ->.=
HgQ8R|
Y8,htR
*9yTH&*-?
Aa<l$<,(es
THzk!.j,
2Ga0y_O
W0twG.M
8Zb"w
V<d 7#HLg
[L*'EB
d5vKX}
F#xSRW
(P)vva}~kIn70 6
]K6Wdz27
nexx1WP
U]a}he+
+:X]vj
T[Bjgt6
R|3m&F
.=e00
LQNv*r
I0|YT$Y
iTM%U}do8P<
E$51yU<fC_jV
a`q/eII)
[g9j><VE"
HVBV11/
M'o(s__I@
XhkMP^3Q+@xv_$f-
*QJ|,uUcL
q!U&H.
sl)`cy9En+$e1C'MV
dxuN%&7yA.BA/L
4=iG')
X9LEh
6XV5`0mLrjxv)rMH-[*k0b
J8[c3t
A/injNa&<g
L1Dj*$(e
'LQ@5d
}ygKAG
k"6)\S
-R.2*g
xEu:Z\
:*9TmlQs5}
k%(4,=L3rW
4}wXl-cz
`AN*[P
p#&yqm
5IEH`Jr
iS3Miy0
g;M&#Q
7T!}@rH[jU(
w<."5Z
4[A,$BC
nNDz\\.BDkXRPBW
@tA>Q:
2eH6|
t9v,d_cW
]+o[>Nw
F1EY'-mo
PV|)%C^
6J_)BK]
i<4@.*
UmK*uPO(W)
g@X;6p
V->dTz4peUe0V>H
B(vUiB1
DQ`j"M,[i
/mF* B
VRw`cd
]U<~{?hi7
W_I>!9{,
7[xPY5
EEV#-
n,grur
#_0\8
M[At7w
gJbE-
eB41<*
4$_lfGa
<Pk7hA
RHC^ZfT G
?e3P0e"
Kr`y&y
?1(4A]aXFN\
(tR;1:Bg
)|{Ar.{?\YY26
AQWDGD--
& *Bh%nHr
ZJW yn
D(xpMOEB
uT>#+r
uu _J
w7~2s50`b
*2nr}!fC@
zy)b9+U
]++[wG[c5
BB $&2d
HThdQH
8e$ *0r
J[j}1}
Np2FJS+`f@Q
-'gen'
6/m~I+*kcIr
~IRF_*
oQFd:`-
=&2Z;??
bLG1{_.qY_
jLO`Eu
yRER'MGAd>`J">K
"6'GZC9uSu%
b(jzKB
)sr8A]
|aW%-7]
O6 OC7
uUD|t|= :
+]JA"%
-w0@uMO[N
5C(@F48
Ljk>^5
x+42U1x`
9Ac1XE
Tc<C/JY
7QMjOO
2644D:AA@$8#}
d&+|*j4M
p[QOnIU*q
ON*EDeDX
"fL:;%0/
EB[]!$)oriP
hAuPEc
6e]W<(
#%cG2\r
ptdo+DxTO
2T@EU$D$93+MU
PhMpi)4+c4
C"CV1'Q7
/vkV>FS#B=
NMtkCEH(}yE
~H\\Yp3 _
6MvYm3UUkuCC
6CAT!"
%WM^#uep&?
xt6>R^!
h~w7bc
;]D6(/f
:5e{~F
0NM=0~!JXl
Y"'^OT
CaQ$$i
"Q-TDt
?>~LLHHL
wZk::=cR0E
+0K;JDS$
<~2XSt
P #vL/
x{D;b10j*
=z5+cU}W}`@w
4RW/\LIR;
R]Cy28
Le. L~[Y
WBhAov"I
TPz@Q/Hx
HQQ[=bj2
R8#h4ab_
A{p"`Pt%O
Ez#Ij]|MDt>6
o? gi$'?2&
vEL.,UN&O
iNpMdS
ry={V$"CLQx*Nh
X|zA#8/2
A_KQFLK2
^dbZiTMZ(X
c+5Y\>v3
(ipw(a
oMTO!6Tv
=Kuju;
,#g-uM
h dI@0%*S
0K'K!hL
&vGR"z@
"<cVIJv{x
`w$|u[
18wPmpC]j}"q
kR{"{ftG)
F/|;g`c59
T0i-Rw%a
"9.`KP|D
||;WjP
z!T#>Lyf8PYMA
zs#S$~
`W%AJh]Lw
F"M)=&
'!\(B4M$'pv8H
YB~AB_]0KhpHP
8Hh:tb
/n:Pst,
k>YAWv::E
d.0s82h+q>[
;|ZfU<eD0$`
.s080icq
o%mD]@&&
TUZ:J^K
!M>xCqs0
4)b&~%M
VW>}B1
DuGO?E
+}]Chlw
~kemMq,
d!s_(]S[I`:(
&v3I"66
&WhE^&_c
dCMdmYad
mF8rXfw
@{L9xx2
S2GA%CU
G-42t061
_+EI'r)W4k4P
]C%m%8lo+AW$
yUwbs`
HXCtL;TG
LIfXBWd'cBk
R-D#}D$b(%&)
3^,Y|@w
VYQh0a
(Xs"M\@
9/RDJ}#S' f=
{-i_I&
HY`S|`ds
a1eb"j
om,7\(
`[NuZu
P{#"6n
>bRlJz8x
VLDWFe8r/
KzlQ`q|T
}^m[Ty1}\IS
>0*P,x
gNK} )i
5fd'Ua
g3H'%EI
+H[GV
b!OG_gb!ow
VHiq>|OS
nz WH~Xl32#
u'^[:U
Pj`b3x)?!f2Hf(Pa)J
7?F5,P
`J855l
H#S pkm%VV+
g0XD8G
J"EwwL[oJ%
z|C1^n
j4P(j}5x1]j9
I;o;{O!x,LV
YsidSG
ST"p=)~s)]E3G
nV6ty@hxT
]8P3ykL@B
!1M`V
o9gGg!
mMVKgOz0h
;s~]rZ/<1]`ZMU
Xw?0p2U;
m((NcG%H
t^XpW5
!jakDu;
L:M=`@<
DS/A[|*rh2(
LSYJ-O*
p"Ay#'|7
tYR^hN<
h{4v~V}YL
78 .EXT
,HsN]/OAu
"'@V,
rx+"4U*
y_h)hJv
[zAu@\)L_=
p5>E2k+M
d*kTY[
hZV(P4*>
|"2mFbUC5T
Rbm;IB{x_j
j(Sc,P
{>pU[C?^
om^t0Cvy^+ev
DOEl`W
?]&V%C
EcO@a$@u9MR
")VftP O[
KdViV
'E~[?b,A~4$
G0:|KL#Cl
(J1WDFL*"t>(d
HBBBB~tRPBBBBV,:8BBBB.$.BBBB
3\`P*C
GenaTA?49L
)iqqDMi
94M4QymA
aMi}U2M4
=eiIY1)
Hji$4M=Msei}eEi
_42[-iir}]UiI!
Yiayqa~i1Ld=
WiykU5srD
t.Y5i!SL
mM4MmH
I2-l=U|di
I4M}m\I2M9
)4MiA!I2M
1YMdh5]1
d5{-M4MyE
@MiydiH!
AIimy]4M4)
Qir9QM4I`e!
I2my%4Md%
<M$]u'
y8`=AI}
Sl0cLe9J
p6Z b/&
u=4M4e-K4M
M4MS;s4M4+c
K7_M4M
4M4o74MC{
M4MK3K4M4#{4M
WM4Mw?4M4g/H4M
M4MP8p4M4(`
H4\M4M
4M4l44M@x
M4MH0H4M4 x4M
t<4M4d,Z&IRNE
vi:&iiJv:i&Z&
>i2NBii>2i^R
ri>"iiNr>i"^"
"n0Wr4M
a-I5M4MA
4M4eY-a
3XY*M4Mb:rY;
j?d?\V\
4Mgekqas:MIAqiey}
5nRH9VE:2ii:
:>"i6JVbziV2
nHi&b$
_i*r]_
4%LI2uN*64M^]
e=&8co9`
zP^KBw
MNLw{l((Jvvff||f_54bonyz\*3vpgFQ
Q-0&lWGY
BvJyDHe
BiAIUZ
zU=#x#N
i=Z!GX`
OtVA'5
W9z+i>&
~sV/cNq}
3^ /CH
1qE0j={&s
[r8Zcog
}O2dx>
j1,MWd
k*Y,fud>{OB*,uK
C\%1zPf
2#|Jz{N
bxV"xg%
v_X^Z"X/aFEb5U
j[dC'T
iY+T8=1_V^yK
JAYh\CJ[4E$@?4viO|kgv4&[<K}Y{~t
r)PEwid
t'TZ)
NKgrl%|JEjK
%/-eM|V
W[Ew*rYBU,nM[?
UYJw+L
="RV(%W@S{Yp
9_]pB-Iqj
aOjdDUdiWJ
Bm=m~@
Dr$V< +FZa,
NUvnYW[Rxm%i
|R>1*+hJ~
>guFU\
~|xW]pv
iem]gg
+3sR(*&
^ixVhtX-#2d|e:uOGti
#W~X%>#
KXUmEx\"Y
F[cw"I
=iwoI^:wS][
QN=?S_)iL
&% Rb8=FtFN?R
BT<GFHW)R,
ewi$mzc4
]tSk^3
DR4'}X1^sX/S<< B
XS}TXZLip
iii/"58;i0%(KFQibrA$e
iMdR{G\_4M4b
a{^UQAN"}<
hvb}:z|x
Ami$T%/2X2Cr
q=21t>?jc41l0kiex.zd
3b~c{.ji^Pp@|[BT
$<vb~u<&? /&
l^ndia8"LSJ
"k"(0]
@${pvr}
f4oD<`
pZRW+p/o}|jj,z,w
@Ig#Uc@[Ah
)S_*T%$!Ns
gslmita
qQyRzDsXwZq_mTiXk@kIcShNhtc)`g
~hQjCoKaIw~
\F9]FAjG?
k0CyQzO~+_t
G(2758<b
fQH"$&*!
-OD2I$
lI$986:
k;{>D"$
2'\$Hd$,z
t$L`3V$L
V-A\^L
ts\z$i4Z$
a"T$HY
ROLf[_#$
I2MVL&4I
4o4I$KKAx\2I$
lI$I0Awvryj3C~udrX
Y \SD"VID
#H&$l:34x
&H$pI29|$I"L]
R"$&pi
$H2F8&3$H&@%
j/$&W
%#s2I&zs}pt2MI
OeGB2MI
]<0Wg{
FyHUgT\O1^D
(RptlBd|
(Eu`a,n
v:E`0O
JXc/ZrPkXK
F33YXk$2*oh%!^/
1Z x!O
q3SL]FcV
lan7X/QM
>]fU Xd:7_
Z4cojc8s
q;tEs5LrWURbs.*N$ukztUj
\rTpQtjr]r
HVO_<#6C
gIU(pl
h?T3_o!C `B0@;?
~Ruquna
%K)WYj
"(4*]"~
FU<23
'd(\Y_X].S;&Ra
Q'<6L!U
H>*1C039~
D"lqwH&+k
I4x$&e
dL )>2
$$NL4M
z=YL56$
Dpr"H&|%b<x
PD"dLK
(0ww4Md
D"~rD"$
$dHlzgKY4e
WwdrYBx
_xh1IXKc
*4IiEr
qguFx5*>M
_PyjP5
Dk>z<}:G
Mi0~4II2N_&4
`cD"|XUROH$
LAF{"$
fdc["HhNm
q|EBW,BPxH z4
LD2S><f
i~$ir<
AS8Cc/&W>D"
\I"q}-D2M
L#U@D2I$
9z>W'ujl
$lV~77C61
a4X \`M
w\6"+C&>=$f!
Z:;$s-;,7Z
J\4dH&$Fd$Y
By9t)Ac;^H
I2I&w)1D2I%
0$I2#HQ
G/iifWE2UZTt~^
;p9w I2Im
.<r4I&54x[uu$
*W`pg8
U||u*2
cIk`!6
d6'h5
vDzBGSEY
DW|=tPc
G(int%(b
y2A:[<J4CRPWmzJ
+* +Q\
$I%uVQT/K}]VqD`L5_9ZDZk[
cY_&,:{
z^b)Mu5?uEa4"0iNTZ
uSwoP#A
-Ye#LWi"m| p"1Bb
7OY^Ko=<
VXRzw]FX}eK
Na.sX)
7F%WW8
mAhmnq3/
z%;Lojn
6|(eZFsj
IeXvJBR
v4@TcV
yW]j-'za^X5v]T
(uXu#\
z:|?NTVwS
U9q]6p@XCMNhN@uuuN
uv' t*
z*}q Op_
}.VA#1x!
W4*L{b:r|
/8o_,*2+
.4oO8N
#L,0/S E6
wWR?e0
9(5?H\
AsfV:j9?O};-WV
u#^TT}
Zmqm[A0u
Bb"[;Ua
380,:7%E65
\W.44H?
N6}~s])
K`ZH5:`uodF5
L2&FVX
?GgMcGXCm
Wj,wYmW:-[
vw^=27hF|#
hLRNyfMvtu
4;jhm&W-4T
Pa#G#$c
).KW8p
b?Uum"O
aop]L3EjL]
8K4UqU.`V7D
F<GKpG
Nq4")*
HwLBVBT
hOU28K
~@+>4>6_e
_ORCYS
Mw5ywebVrdU'
W!{7pz}
#Ncs}#)|V
hcb#4N
+E.@ffupV
J.KPsND:
jyYAZ6
M5>/wR}Z
|NDK5pP
UnwB5g
i[6g^OPW
iUHP~W
TG^]-U+u
TAV.v]
4M4l~`
f7HiR,> i.`4M$
8B\ipjD&
Xb|&4MnPJ
:$iTVx4MN0*
"<ii4M(J2
^@M4Mz
iil~`d
L4hrLii
HR,> 4M4i$
8B4M4\pjDI2M&
iXbi|nPJ4M$
:TVxi$N0*
4MiZ8tv
4M"<I2M(E2
^i@z$i
lL4M~`
rt4ane|3o
*>"Qdiqz
i.PE#;F?BIS`
I*1VD
$U^%f' F_;Ir
yYp1lL
<0^)=1|NEu$JO3r"[
y\/.De
x}rstyydgfeh7@
ksc}f|j|h`pjts
GZS@JV~fJw|gMh|ald-
aynpgqijsb\ AC61**
1hk--.
3s:q<1-o40
bE=Ex9
G<6:?Mrc
r_Lll*r
7nY&e?[X
[AeEt7H
?4,kl;.xe"q[Xv;^.
L(D2;M
jX8377_N?nXCEScHEM~
6aZXkvaye}r
wicZcyX6uz+`s4
Eza;fa@~X6dP
Kcek8m
KZ/ry9c
\l2h"EUCC9"<&&f>~mUp
d6 Vo3
8F<V>G|3
2 NR>G|3.
s=dA2<
dAJPdA
dA@PsA
!TG *
!z$$c;
@3U\E| !
yGC='7=d
CO/?C=_
CK+=d;[
AC!1Q=d
DmI?q5sM
CSYj/P
d#=1:#`A
$BE.43
TXS[U&B
@@i}M#tg8
:N9h{TS,@
$tl`l!
H/m+0*h
NB<=tC$\$K
t7s.CE
u*+\Hh$<.4
<*435`y
}$v}{h"t[WWV
U]\B^c
%dxnXe
V48^XXXX]
MessageBoxA
wsprintfA
ExitProcess
GetModuleHandleA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
LoadLibraryA
RegCloseKey
BitBlt
GdipDrawLine
AlphaBlend
OleRun
DragFinish
PathFileExistsA
InternetOpenA
user32.dll
kernel32.dll
ADVAPI32.dll
ATL.DLL
GDI32.dll
gdiplus.dll
MSIMG32.dll
MSVCRT.dll
ole32.dll
OLEAUT32.dll
SHELL32.dll
SHLWAPI.dll
WININET.dll
SystemkhkmzSystemdoeavSystamdcmxlSystemgpuzwSystemntqxvSystemotcykSystamjphlqSystemlsqkgSystemltjyaSystamxrvexSystemveeobSystemjrmvxSystemmwrdsSystemfncezSystamynvmdSystamgbbsvSystamxriplSystamdivsaSystameklbbSystemrimhtSystemkasviSystamppjujSystemwvhvwSystemomuuuSystemtdpfjSystamdgzpySystemlhmniSystemaoxqvSystamnriukSystemiyvtbSystamahdmbSystempacqhSystemiqywzSystamfhdwlSystemkhighSystampaemfSystammknlgSystemqkichSystamcynyxSystemqzwncSystamfkhjnSystemfdepaSystamsxyyt
TCP
No TCP connections recorded.
UDP
| Source |
Source Port |
Destination |
Destination Port |
| 192.168.56.101 |
53179 |
224.0.0.252 |
5355 |
| 192.168.56.101 |
49642 |
224.0.0.252 |
5355 |
| 192.168.56.101 |
137 |
192.168.56.255 |
137 |
| 192.168.56.101 |
61714 |
114.114.114.114 |
53 |
| 192.168.56.101 |
56933 |
114.114.114.114 |
53 |
| 192.168.56.101 |
138 |
192.168.56.255 |
138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped buffers.