0.9
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.75
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Dropper-NGS [Drp] | 20200523 | 18.4.3895.0 |
| Baidu | Win32.Trojan.Urelas.a | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200523 | 2013.8.14.323 |
| McAfee | GenericRXAA-AA!8AD6C4A6BF29 | 20200523 | 6.0.6.653 |
| Tencent | None | 20200523 | 1.0.0.1 |
静态指标
动态指标
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 41 个反病毒引擎识别为恶意
(41 个事件)
| ALYac | Gen:Variant.Mikey.91414 |
| APEX | Malicious |
| AVG | Win32:Dropper-NGS [Drp] |
| Acronis | suspicious |
| Ad-Aware | Gen:Variant.Mikey.91414 |
| Antiy-AVL | Trojan[Downloader]/Win32.Urelas.ab |
| Arcabit | Trojan.Mikey.D16516 |
| Avast | Win32:Dropper-NGS [Drp] |
| Avira | TR/Urelas.szlbt |
| Baidu | Win32.Trojan.Urelas.a |
| BitDefender | Gen:Variant.Mikey.91414 |
| BitDefenderTheta | Gen:NN.ZexaF.34122.omY@aiUF2Qo |
| CAT-QuickHeal | Trojan.Gupboot.G.mue |
| Comodo | TrojWare.Win32.Urelas.AB@56u91z |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cylance | Unsafe |
| Emsisoft | Gen:Variant.Mikey.91414 (B) |
| Endgame | malicious (high confidence) |
| F-Secure | Trojan.TR/Urelas.szlbt |
| FireEye | Generic.mg.8ad6c4a6bf29376d |
| Fortinet | W32/Agent.NGS!tr |
| GData | Gen:Variant.Mikey.91414 |
| Ikarus | Trojan.Win32.Gupboot |
| Invincea | heuristic |
| Kaspersky | HEUR:Backdoor.Win32.Generic |
| MAX | malware (ai score=82) |
| MaxSecure | Trojan.Malware.121218.susgen |
| McAfee | GenericRXAA-AA!8AD6C4A6BF29 |
| McAfee-GW-Edition | BehavesLike.Win32.Gupboot.dm |
| MicroWorld-eScan | Gen:Variant.Mikey.91414 |
| Microsoft | Trojan:Win32/Urelas.AA |
| Qihoo-360 | Win32/Backdoor.d55 |
| Rising | Trojan.Gupboot!1.9CEA (C64:YzY0Ot6zTn1B+Qze) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Symantec | ML.Attribute.HighConfidence |
| TrendMicro-HouseCall | TROJ_GEN.R007C0DEN20 |
| VIPRE | Trojan.Win32.Urelas.ab (v) |
| Zillya | Trojan.Generic.Win32.1052057 |
| ZoneAlarm | HEUR:Backdoor.Win32.Generic |
| eGambit | Unsafe.AI_Score_99% |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2013-10-01 10:25:09
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00035000 | 0x00034000 | 5.659513816360966 |
| .rsrc | 0x00036000 | 0x00002000 | 0x00001200 | 5.173346186810857 |
| .reloc | 0x00038000 | 0x00001000 | 0x00000200 | 0.0 |
L!This program cannot be run in DOS mode.
$]bw]bw]bwTwobwTwKbwTwbwz4
wPbw]cwbwTw[bwCw\bwTw\bwRich]bw
PEC2NO
.reloc
SUVW3h
3SQ\$(f$,
3SPf$T
3SRf$L
3SRf$l
3SQf$,
3SRf$<
3SQf$D
fu+t!$
fu+t_$
fu=l0B
RD$0j@P
MSMPuh
3WQfD$
f;u+tyT$
3WQfD$
PL$6Q3fD$8"
D$"D$&D$*D$.D$2D$6fD$:D$
PL$0Qm
tl_GBP9{
fu+u0Sj
SUVWjd
3VWfL$
D$"D$&D$*D$.D$2D$6fD$:$D
L$HQWWh
T$HD$DWh
L$@ 3n
D$$D$4D$LD$dD$tWD$
D$ D$$D$,D$0D$4D$<D$@D$DD$HD$LD$TD$XD$\D$`D$dD$lD$pD$tD$|\$x\$h\$P\$8\$(\$
;|_^][p
8MSMPuh
3VQfD$
$SUVWj
QT$LRx
_^]3[Y
[YVWVj
@u+VW$
D$ P$,
j@htIB
]3[YWh
D$DSV3Wh
D$ D$$D$(D$,D$0D$4D$8D$<D$@D$
S'3j>QT$
RGPfL$ @
[L$D3^s
H_^3[L$D3Js
L$P_^[36s
D$8D$@SUVD$
t$$L$ D$
fT$(D$*D$.D$2D$6D$:D$>D$BfD$F3
3ftD(f
ftD(@;~D$(Pi
D$ D$$D$(D$,D$0D$4D$
fu+tWtSD$
u34SUVD$
GWVjPj
L$0 3n
WPhP0B
3_^[L$
_^[3jm
QT$2RfL$4
D$!fD$%D$'X@B
tmD$(P$4
_^][3k
L$&3VQD$(
T$ Rt$
T$ RD$ PL$
_^][3i
u#u T$
tJ;~8+
D$ SPF
_^][3.g
RD$2P|$0L$ fT$4
\$(\$ t
t$ 33f
D$(ST$
~yT$ L$$RD$
_^][3d
_^]3>c
3VQD$,
D$.3VPt$$t$ t$(fT$4
RPt$ 4
PL$$QT$$R
uTh(PB
T$,RD$
_^][3`
PL$RQfD$Tb
3D$"D$&D$*D$.D$2D$6D$:D$>D$BfD$FJB
fT$ D$
T$$RD$
T$ RPh
fu+u/hl
fu.hJB
uFD$ P
PL$$Qj
^][33k]
SUVWQP|$
_^][3[
3tAST$
u3@;rL$
T$(U2c
jgVjdhEB
v&f=tLB
jlPD$0
^8ULD B
^L$H3$U
^L$H3T
3^L$H3T
3^L$H3T
3^L$H3
L$L^33cT
yZ3#3L$
>yZ3#3
T$ 3#3
yZHPT$
3H<#3H$3
3#3l$
|$ L$ L$
yZ#3L$
)yZH@3HT
3H(33H #3T$
yZHX3HD
3H,|$ 3H$3
9yZHH3H0l$ 3H
3H(3#H(\$
)yZHL3H4l$
HP3H833H0
3H$+n\$
nHT3H<
3H(3\$
nHX3H@
3H83H,H8
)nH03HD
)nHH3H@l$
nHP3HH
3H(3\$
nH@3HT
3HL3H,HL
)nHX3HP
)nHH3HTl$
nHP3H<
3H$3\$
nH@3HT
3H(3H H
)nHX3HD
)nHH3H0l$
3H *n\$
nHP3H8
)nHT|$ 3H<33H433H(T$
3H,:n|$ 33H8
9nH03HD
l$ H<HH3H@3H4
H@H83HL3HD
3H<3l$
H@3HTt$
3HL33H,#|$ |$
HLHX3HP3H0
T$ HPHH3HT3H4
HX3H83HL33H #\$
3H$3l$
H@3HTt$
3H(33H #T$ T$
H HX3HD+
3H,3H$
|$ H$HH3H03H
H(HL3H43H,
HP3H8|$
#H0#T$
HT3H<T$
3H433H(#t$ t$
H4HX3H@+
3H83H,
|$ H03HD
H<HH3H@7
3H43H
H@H83HL|$
HP3HHT$
3H<33H(#
HHH@3HT*
l$ HX3HP
3HL3H 33l$
HXHP3H<
H@3HTl$
H HX3HD3H,
HH3H0*b3H
3H,3H 33l$
H,HP3H83H0
HT3H<l$
3H43l$
H4HX3H@
3H83H,
H8H03HD3H<
3H43H 33l$
H@H83HL3b3HD3H$
3H(3l$
HHH@3HT
3HL3H,
HX3HP.b3H03HD
HTHX3H8;b3HL3H
;r_VD;
_^]SUl$
SSRD$,8O
Q\$D\$@D$H
#EgD$LD$P
D$TvT2
,;v5T$pVR\$
Un0W~4D$
F,;uen(9F4u
SUVV N
L$0N0T$(V4
D$ ;s9
D$ ;s1|$
D$ ;s0|$
D$ ;s0|$
N(D$$;s
F,+L$$D$(
;N(rL$$L$
F0N(;t
u[V4T$0RV4D$4F0
;u N(F0;t
L$$AHBD$0
N(L$$L$
F0N(;t
u[V4T$0R
V4D$4F0
;u N(F0;t
+V4T$0R4
MV4T$0RV4
G(O$RP
G(O$RP
F(F4F0F8
G0VWG(O j@j
t'W(G h
O(W$VQ
G(O Sj
F(u V$G(O$RP
W(G$VR
(SUVN4
T$ $<w@
u%F0N(;t
T$ ulL$<D$
QF4DN0D$@F4
D$()D$$
D$ )D$,
L$(;s9
QT$8RL$8QT$,RV
L$$T$ H
K(S$PQ
C(K$RPD$D
_^][(jD$
F D$<~
V T$<~
K(S$PQ
S(C$QR
C(K$RP
_^][(P
O(W$PQ
O(W$PQ
F4F0F8
G0F(O(W$PQ
F$O(W$PQ
G(O$VP
t$Lt$Pt$Tt$Xt$\t$`t$dt$ht$lt$pt$tt$xt$|$
u9l$Lu
073_^][
uT$,;v
T$ ;t
T$ G;$
t$4HTLL$<T$
L$@T$,
E;v.l$
A+;r|$
t<t$(T$
L$0L$@
+T$1T$0
(L$8D$
l$ T$0
rL$<T$(
T$(H#;
D$<@;D$,D$
C(K Ul$
D$$L$ VT$
RPQL$(j
S(C$VR
C(K Ul$
D$4L$,VT$
RPD$0QL$0hA
L$4T$0VD$
PD$$QL$,Rh
E u&T$(9
wdC(K$VP
S(C$VRC
u"S(C$VRC
S(C$VR
K(S$VQ
T$(D$,J0SU(@
Vr Wz4D$
L$,T$4#
l$8](+
T$()T$
;sim,l$(+
;rl$(+;v-+
uL$8i($
\$8s 4
{4_^]3[
] tMT$<J
\$8s 4
T$(\$8s 4
{4_^][
O(W$PQ
O(W$PQ
F(F4F0F8
O(W$PQ
_VW3;u
w(9w$u
_^y_3^QSUVW
_^][Y3
_^][Y_^][Y
U,1;]v
D$ PUSQ
uHE|,H<
t$$D$0L$@$
\SUVW3l$
E_^][\
JD$dT$`
\$,T$TL$P t
T$8(l$$;
uXT$xt/D$8L$|;s
_^][\Qu
NxQV(F
NDVH^L;u
^@O<39_4NT^PW4
^$^(^,u
G@FXODN\W0
FqgE#FuxV4;t
w|^_]3[
SUVt$ 3WT$
h|;t9U
]<)]X}l
t%3v um
G;rt$$EyM
W)E\+)EyM
E]Vw|u
F^]9n\u
FP;FTt
3RfD$&
}V3t@~
VxRF(P
Q;T$(RD$0PL$LQ
fuD$lt$8
L$PD$HT$T(
D$,D$$PL$0QT$8
D$$L$(\$
}N3t@~
VxRF(Pn
3_^]L$
3D$$L$ PQD$ K4RB
SVW3;t
^0WWWWW
AAKu;t
AAFFf;t
Ku3;uf
SVW3;t
^0WWWWWx
AAFFf;t
Ku3;uf
DDDDDDDDDDDDDD
VVVVV]
;t3f97
uf93u ~
jEPhD B
_VVVVV8
VW3M]9}
E+)E(Vj)
3PPPPPEN
VVVVV$
Y}V*YEE
@@fu3_[]
SVW39}
}O;]rOt
u+WuV,
M+;rP})E
YYt)EF
E3B;r9]u
S3VW;t
^0SSSSSJ
3_^[]UW}
@@fufM
7GGEPj
RPjjEU
M]EUVOX
Yu)jAXf;w
E;ErCE9Eu
3;Er/w
Quuu Z
u>9ur9w
`p33_^[
GGBBft
tu=\RB
^0WWWWW$
U S39]
;t$;u
;tU;|BMx
YYt"Mx
39]fD~
VVVVV[
UQSV3;u
^SSSSS0
^SSSSS0
IGG;r3_^[
S3VW;t
^0SSSSS
U S39]
;t4;|"Mx
SSSSST
YY]jXh
,ffffffE
eYV5!B
YYt:V5!B
PkYF,t
P]YF4t
POYF<t
PAYF@t
P3YFDt
P%YFHt
~lt#WF
YYt4V5!B
Iuu}]U
+EPRQL
3SEEESX5
PZ+t Q3
1 B8"B
;r"($B
;r =($B
W3E}}}
FFf> t
at8rt+wt WWWWW
E}9}urE
E9}u:eE
FFf> tj
FFf> tf9>
Y]3u;5cB
4V<YYSB
+SVWD B
1E3PeuEEEEd
Y__^[]Q
:E_^[]E
9csmu)=
URPQQh@
t;T$4t
;v.4v\
UVWS33333[_^]
33333USVWj
_^[]Ul$
jXEU;u
SSSSSh
PYME;E
Y]\3_[^j
VVVVVa
W>+~,WPVYP
Y/V|Yt
Y}3u;5cB
YY3BUSB
FVwYYG
Wt1t'Pg
UQSVW5PRB
;r@PuWQ
P4YPRB
V34809u
;u'0sVVVVV
P4UM`8
<PVEP(
r3VVhU
QH++PPVh
,P+P5P(
\D+48;E
8+0_[M3^j
DDDDDDDDDDDDDD
Ej@j ^VmA
[j@j @
;rE9=xRB
F$|3@_^
MOI;|9 M
SI VW}
HD9#U#
MLD3#u
]#\D\D
]3@\RB
YYuBh'4A
tx5LRB
VW33};
3PPPPPi
@Y<v8V%D
3VVVVV&
;t$t j
Yu =@ B
WPWPWv
M_3[)j
whu;5+B
8]tEMap<u
Zf1Af0A@@JuL
@;vFF~
XM_^3[$j
PY^hS=$A
PY%u 'B
3W;to=.B
uVxY_^[]
USV5$A
t7t3V0;t(W8Yt
VYY^3j
Fpt"~l
Pf;r]*
P~CC>Yu
3PPPPP
t4+t$+t
ItQht@lt
3F tBP
itmnt$o
aYYYfgu
;YYY>-u
jj0XfQfE
t-RPSW09~
`pM_^3[
3PPPPP
t4+t$HHt
ItUhtDlt
HHtYHHt
2itmnt$o
YYY;-u
t-RPSW`09~
0@?If8
@@u+(u
u(9t M
`pM_^3[gx
3;v.jX3;E
WWWWW:
]wi=\RB
;uL9=<B
8csmu*x
EYF`[_^
Gf>=Yt1j
tPVWP<u
3PPPPP
3Y[_^5p9B
UQV3W}
@@ft<uf t
@@HHf9
@@Bf8\tf8"u8
ft$9Uu
UQQSVWh
V33Sf>B
`]YY?sJM
EHY\9B
u+@S@WS
_[^SVW
E3E3;u
YYu,9E
_};=cB
SSSSSE
tGHt.Ht&
^SSSSS0
Y+t7+t*+t
;t0;t,;t =
uEPuuu
SuEuPuuu
$ MeHM
tSSS6
E+PD=P6
_8VVVVVj
9ut(9ut
SV33W9u
;u"VVVVV
CCGGM
tBft=f;t6EP
Map_^[
UV3W95<B
GGBBM
B(;r3_^[]
SVWD B
1E3PEd
Y_^[]USVWUj
P(RP$R
UPjh BA
t:|$,t
;t$,v-4v
UQPXY]Y[
EU_^j
WWWWW}
u5=@ B
S3;VW|[;
t58t0=@ B
]V3;|";
u}uyG+j@j YYEta
SSSSSz
tAt2t$
WWWWWx
Y}SYE;t
SW5T9B
3]V3;|
cxVVVVV
EV395-B
tO=$/B
tVURPEPQ
M:iE9X
eMapYv
E`p:39]
YY]QL$
atx@|t
eE}hOA
quYj h
Y+t"+t
+td+uD
3PPPPPs
PtEY3}
u@OdMGd
u wdSUY
PrY@?B
WP{rY<?B
tGPr5@?B
rYYt,t(
;t0PrYt%
3_^[];t
^0SSSSSp
pVVVVV
^SSSSS0o
f;v6;t
Map_^[;t2;w,oj"^SSSSS0'o
ESV3W9
u8SS3GWhA
39]$SSu
;~Ej3X
P=]Y;t
3;tAuVWuu
t"SS9]
EVYuEYY
P'\Y;t
3;tuSW
u`YE;t
e_^[M3zK
]u(Mu$u u
UQQD B
SV3W;u:EP3FVhA
39] SSu
PCZY;t
ESEYu39]
e_^[M3{I
[u$Mu u
G^6@^v 8^v$0^v((^v, ^v0
^v<]@v@]vD]vH]vL]vP]vT]vX]v\]v`]vd]vh]vl]vp]vt]vx}]v|u]@
PH\YF ;
P6\Yv$;5
V$\Y^]UV3PPPPPPPPU
$s ^UV3PPPPPPPPU
VC~Yp%B
t.V2~Yt"V&~
V}Yt.V}Yt"V}
V}Yt.V}Yt"V}
]39}~0N
D=VP'YYtG;}|fE
YYM_^3[sD
0;u,cWWWWW
u+9uv&<bE
E`p3[_^
@@fu+E
Y}S@YE;
wIVSP"
]5VYE;t'CH;r
PSu=SESP
9}uH;u
VW5T9B
E;t CH;r
!`9}ul
L1$!_^[u
\VVVVV
^s)EPj
QPREPx
Map[3PPj
ffffffu
uYF;~[
-WWuuj
PgIY;t
WWWWVuWu
&YYE;t+WWVPVuWu
usYEe_^[M38QL$
u,x_ ;t
EPQEPEj
AAu+Hu u
RQMQVp
YY]UWVSM
B:t6t:t't
WVS3D$
$UQQSVWd5
SVWE3PPPuu
E_^[E]
UQSVW}
Fu^8Mt
MM=3;u+9Kj
_VVVVV8J
SSSSSH
F80t.G
E`p3_^[
^VMQMQp
ISSSSS0:I
M_^3[)
^WWWWW0MH
E`p3[_^
MNu7u-cEj
^03PPPPPD
E`p3_^[
^VMQMQp
TDSSSSS0C
M_^3[B$
_WMQMQp
CSSSSS8%C
EHE3}-
M_^3[H#
et_EtZfu
VVVVV}@
]EuMm]]
VY,Y^]
QRfYYt
t3@_^]
=csmu+C
8csmu8x
t*9csmu"A
E8M38E
>csmuB~
YYtaSV
_YYPV&
YYt)SV
Ht Hu4j
t+>MOCt#u$u u
EPEPVu W
;Es[S;7|G;w
@u"u$u
;Er[_^
9>u&~
YuO39 ~
EPEPuu W
(u$]u E
)u$u uSu
tR99u2y
u$Vu u
Q 3@_^[]U
m9VW_^]M
Mu&EP3SSSSWEPEPa
E`p3M_^3[T
M%EP3SSSSWEPEP
E`p3M_^3[
^0SSSSS2
3PPPPP/
WVU33D$
%#Vt1W}
_VVVVV8/
YY3^]Pd5
SVW(D B
3PeuEEd
u'339\u
JB|j 3Y+@M
JBj Y+3B\M
3+BL1<
}3^j Y+
u'339\u
JB|j 3Y+@M
JBj Y+3B\M
3+BL1<
}3^j Y+
S3V3EE
F3WE}]u]]]]]]]9]$u $SSSSS
<+t(<-t$:t<C
]<+t<-t`}
+t HHt
B:t,1<
+JMtHHt
B:}OMEO?
tEPuEP,
3f;u BE
f;u!BC
u4}u+e
f;r#33f9EE
]EEEEEEEEEEEE?E
u}fu/u+u'3f;
;u0u,h8
VVVVV>
`EfUu}M
MMMMM3
3f;u GE
90t!uuE
EFFEM}
EMuUm
HuMu9Et
u4}u+e
33f9EE
f;wK3EE9
}fEEEEEf}V33f9u
E\3f;u
f~7}x+EMe
EM}Um
H}Mu9Et
u4}u+e
f;r#33f9EE
ufEEEEEfu
~(E]Mm
0K;]sE;]s
EM_^3[~
K;sE;s3f
SVW}]3
SV3WEN@
M_^3[6j
"w'w w8#w
,|'|4]|L`|
|>|<|^|i||
||J|||i|Tm|/|,
|lm|t/|&|
|0|\k|$a|la|O|,P|N|
|m|l^|i|
||+|\V|_|D
B|Dw||i|t|l[|
|d|$|$|$|$|
|u|s|l.|a|$m|a|\|d!|!|l||W|<y|R|e||
xCA~5A~nA~xA~
BA~HCA~9A~
A~bA~PwA~iA~PhA~
bad allocation
EncodePointer
DecodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
Unknown exception
CorExitProcess
runtime error
TLOSS error
SING error
DOMAIN error
An application has made an attempt to load the C runtime library incorrectly.
Please contact the application's support team for more information.
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
- not enough space for locale information
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
- CRT not initialized
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
- not enough space for environment
- not enough space for arguments
- floating point support not loaded
Microsoft Visual C++ Runtime Library
<program name unknown>
Runtime Error!
Program:
(null)
`h````
xpxxxx
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
`h`hhh
xppwpp
GetProcessWindowStation
GetUserObjectInformationA
GetLastActivePopup
GetActiveWindow
MessageBoxA
USER32.DLL
!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
Complete Object Locator'
Class Hierarchy Descriptor'
Base Class Array'
Base Class Descriptor at (
Type Descriptor'
`local static thread guard'
`managed vector copy constructor iterator'
`vector vbase copy constructor iterator'
`vector copy constructor iterator'
`dynamic atexit destructor for '
`dynamic initializer for '
`eh vector vbase copy constructor iterator'
`eh vector copy constructor iterator'
`managed vector destructor iterator'
`managed vector constructor iterator'
`placement delete[] closure'
`placement delete closure'
`omni callsig'
delete[]
new[]
`local vftable constructor closure'
`local vftable'
`udt returning'
`copy constructor closure'
`eh vector vbase constructor iterator'
`eh vector destructor iterator'
`eh vector constructor iterator'
`virtual displacement map'
`vector vbase constructor iterator'
`vector destructor iterator'
`vector constructor iterator'
`scalar deleting destructor'
`default constructor closure'
`vector deleting destructor'
`vbase destructor'
`string'
`local static guard'
`typeof'
`vcall'
`vbtable'
`vftable'
operator
delete
__unaligned
__restrict
__ptr64
__clrcall
__fastcall
__thiscall
__stdcall
__pascal
__cdecl
__based(
CONOUT$
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
need dictionary
stream end
file error
stream error
data error
insufficient memory
buffer error
incompatible version
invalid literal/length code
invalid distance code
invalid block type
invalid stored block lengths
too many length or distance symbols
invalid bit length repeat
inflate 1.1.3 Copyright 1995-1998 Mark Adler
incomplete dynamic bit lengths tree
oversubscribed literal/length tree
oversubscribed dynamic bit lengths tree
incomplete literal/length tree
oversubscribed distance tree
incomplete distance tree
empty distance tree with lengths
invalid distance code
invalid literal/length code
unknown compression method
jHqA}
kdzbeO\
iLA`rqg
@l2u\E
a=-fAv
\cQkkbal
eLXaMQ:t
jiCn4Fg
c;d>jm
i]Wbgeq6l
8ROggW
A`Ugn1yiFa
fo%6hRw
[&wowG
eibkaEl
`MGiIwn>Jj
)WTg#.zfJa
h]+o*7
-1.1.3
invalid window size
incorrect header check
need dictionary
incorrect data check
unzip 0.15 Copyright 1998 Gilles Vollant
%d.%d.%d.%d
1.234.83.146
1.234.83.146
133.242.129.155
<Embed File Info>
DBG :
_uinsey.bat
GAIsProcessorFeaturePresent
KERNEL32
bad exception
1#QNAN
1#SNAN
GetVersionExW
GetModuleFileNameW
GetTempPathW
GetFileAttributesW
DeleteFileW
OpenEventW
CloseHandle
CreateEventW
GetTickCount
GetSystemDirectoryW
DeviceIoControl
ReadFile
CreateFileW
GetTempPathA
GetModuleFileNameA
CreateFileA
WriteFile
CreateThread
MultiByteToWideChar
ExitProcess
GetModuleHandleW
GetFileSizeEx
SetFileAttributesW
GetLastError
GetFileSize
SetFilePointer
SystemTimeToFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
WideCharToMultiByte
KERNEL32.dll
wsprintfW
LoadStringW
LoadIconW
LoadCursorW
RegisterClassExW
CreateWindowExW
DialogBoxParamW
DestroyWindow
DefWindowProcW
BeginPaint
EndPaint
PostQuitMessage
EndDialog
USER32.dll
RegOpenKeyExW
RegSetValueExW
RegCloseKey
RegQueryValueExW
ADVAPI32.dll
ShellExecuteW
ShellExecuteA
SHELL32.dll
WS2_32.dll
GetAdaptersInfo
IPHLPAPI.DLL
HeapAlloc
HeapFree
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
RaiseException
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
SetStdHandle
FlushFileBuffers
HeapSize
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LoadLibraryA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetEndOfFile
GetProcessHeap
GetModuleHandleA
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVtype_info@@
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
218.54.31.226
:Repeat
del "%s"
if exist "%s" goto Repeat
rmdir "%s"
del "%s"
.?AVbad_exception@std@@
I x@oGAkU'9p|B
~QCv)/&D(
uuvHMXB
9;5SM]=];Z] T7aZ%]g']
?Zd;On
7?3=Bz
;1az?aUY~S|
D?$?9'
*?}d|FU>c{
zc%C1<!8G
u7.:3q
#2IZ9W
,%I-64OSk%Y
wwwwwwwwwwwwwwwpxpx
pxwwwwwwwwwwwwwxpxpxDDDDDDDDD@
pxDDDDDDDDDH
pxDDDDDDDDDH
pxDDDDDDDDDDDDDDpxpwwwwwwwwwwwwwwwp
wwwwwwwpxpxpxpxpxpxpxpxwwwwwwpxDDDpxDDDDDDpxpwwwwwwww
%%$$"#"#"#*+()''&&??<=9;7A63[4]5mm]5\]m]mm5\mm5555555\\\5\\\5m\55\\5ed:cOXY/P.Z0.0.QR00/ZPP0000000/0PPZR.BI@/DE0,
CWkV21TSav^8{
}>qooggggggg1`_fhsnHK{JLp
Gl-FjNw~ytMMMMMMUbbrrrrrxxxxxxxxrriUMMMMMMMMMUuzt
.#%-0%:?%9>%8=%7;
EG@DF@MO@LN2Kh2\g2]f2[I3')+*+)))*))()*+++,6J!54 CBAjYPQTVTSkllZTTXRTUiHceWda/
iu`_<bmt^}zy|yx~
{|yvrrwsqpon
PPPPPPPPPPPPPPPPPKMNNNNNNNNNNOLO
JHHGGGGGGGGHI
JEEEEEEEEEEFC
JEEEEEEEEEEFC
JEEEEEEEEEEFD
JEFEEEEEEEEEB
O%JEEEEEEEEEFFB
JJIIIIJIIIIJJ
O(@>=77A779?<8;$O'
)O6530./21+*-,4#4PPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP
Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'H#P'Q'Q'Q'Q'
R&R&R'R&R&R&R&R&Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'R'
e)qjiPt
{rFpcq
S^EDIID:BI638?@=>>=======8,00-.(',0-0178
S(O$N!N!N!N!N"M"M"M"M"M"M"M"M"M"M"M"M"M"M"M"M"N"M"M"O$S)O"
QDf>.j~ro
*V=;?73?//87566-&*'!+3$357_
OO&F#C!C!C!C!C!C!C!C!C!C!
A E$R(
x(s o7|WRzW
wwwwwwwwwwwwwwwpxpx
pxwwwwwwwwwwwwwxpxpxDDDDDDDDD@
pxDDDDDDDDDH
pxDDDDDDDDDH
pxDDDDDDDDDDDDDDpxpwwwwwwwwwwwwwwwp
wwwwwwwpxpxpxpxpxpxpxpxwwwwwwpxDDDpxDDDDDDpxpwwwwwwww
%%$$"#"#"#*+()''&&??<=9;7A63[4]5mm]5\]m]mm5\mm5555555\\\5\\\5m\55\\5ed:cOXY/P.Z0.0.QR00/ZPP0000000/0PPZR.BI@/DE0,
CWkV21TSav^8{
}>qooggggggg1`_fhsnHK{JLp
Gl-FjNw~ytMMMMMMUbbrrrrrxxxxxxxxrriUMMMMMMMMMUuzt
.#%-0%:?%9>%8=%7;
EG@DF@MO@LN2Kh2\g2]f2[I3')+*+)))*))()*+++,6J!54 CBAjYPQTVTSkllZTTXRTUiHceWda/
iu`_<bmt^}zy|yx~
{|yvrrwsqpon
PPPPPPPPPPPPPPPPPKMNNNNNNNNNNOLO
JHHGGGGGGGGHI
JEEEEEEEEEEFC
JEEEEEEEEEEFC
JEEEEEEEEEEFD
JEFEEEEEEEEEB
O%JEEEEEEEEEFFB
JJIIIIJIIIIJJ
O(@>=77A779?<8;$O'
)O6530./21+*-,4#4PPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP
Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'H#P'Q'Q'Q'Q'
R&R&R'R&R&R&R&R&Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'Q'R'
e)qjiPt
{rFpcq
S^EDIID:BI638?@=>>=======8,00-.(',0-0178
S(O$N!N!N!N!N"M"M"M"M"M"M"M"M"M"M"M"M"M"M"M"M"N"M"M"O$S)O"
QDf>.j~ro
*V=;?73?//87566-&*'!+3$357_
OO&F#C!C!C!C!C!C!C!C!C!C!
A E$R(
x(s o7|WRzW
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
3*3k3~333)4L44444
5255 6C7Y7|7777738c88K9T;g;;;;;;;<<
>(>->A>>>>>
?&?-?W???
031112-3G3U3\3333(4T4f444
5`5.646V6\6b66W7777777R88?9w9999
:%::::::
;Q;X;;;;;;;;;
<(<><E<Q<{<<<<<<<<<<<
='=]==========
>3>:>S>Z>??
171B1M1q112
5(555#6N6T6[6c6k6666677R777777
828l8r88
9J9P999
:-:g::;;;
<E<w<<<<<
=+=@=n==
2 2[22<33
6o6666666
7:7?7X7s7777777
8#8b8i8888
9K99999
:.:=:::::::
;6;g;;;;;;&<.<G<T<x<
=A=[=a=
>1>8>D>X>v>>>>>>>
?"?.?8?>?[?`?x???????
080[0l0000
1(1/191Y1e111
88829;
< <$<(<,<0<4<8<=)>L>Q>
06112445
6<7@7D7H7L7P7T7X7\7`7d7h7l7p7<<n=s===
>,>K>r>>>>^???
60Z11A2X2o222222
333^333K6Z66
7U7u77
:<:@:D:H:L:P:T:X:\:`:d:h:l:p::
593<]<<<
0$11D34
5f55Z777777777
81888<8@8D8H8L8P8T888888
9!9<9C9H9L9P9q99999999999::@:D:H:L::
;=>????
0Q0W0_0l001
44,5555
6"6Y6j67777::J;\;;;;=
0@1e1y1111111
3!3(3/363=3D3L3T3\3h3q3v3|3333333333333
5-5Y5u5555555
6,636Z6`6k6w66666666666
7"7.747A7K7R7j7y777777+818[8a8}88859X9b99999
:!:(:.:5:;:C:J:O:W:`:l:q:v:|:::::::::::::::
;9;?;[;<=========
>%>I>[>i>~>>>>>>
1R1q111
2+262l2|2222222A3^334444
5A5M5Y6>7T77 89a:k: ;.;;;<<2=o===>1?n?x????
0g1111
323]33394R4{44444/5b5n6u66C77
???X?_?g?l?p?t??????????
0N0T0X0\0`0000000
1!1K1}11111111111111v22222 33333
4]4e4444415a5s55555
6,6:6@6c6j6666666r7777999
:*:3:@:K:]:p:{::::::::::::::
;";+;8;>;X;i;o;;;????
0e082C2K2t2y22222222
3$333333333333
4*424B4W4444444
6+666Z6c6j6s6666
7*7=7U7g77
8H8_899
:*:4:B:K:U::::::::/;d;w;;
<L<<<L=X=k=}========
> >G>p>>>i???
*0y00'1>1O113566695;<<
1!1%1)1-11151911222>3R3x367?9o99t;=========
>'>m>s>
?<?????
3#333333
4+404V4y444444444
5Q5Z5f5555555!6.636A67z888
9&999K999<<<
=.=9=P=u==A>j?
E0N0c00H1M1_1}111
2q2}22
3>3333
4F4u4.5A5R5w55555S6d666
7!7O7]7f777
8'8O88889
:::q:{:^;~;;[<<<< =M=h=v=~==========
>>-???
;0F0q0|00000000-121w1|11111
22222222
3#32383F3O3^3c3m3{3333444
5&5Q6o666
7 7*7Z77!888r9C::::::
;J;;X<e>w>>>>>>>
0(0J000333/4g444)5/5S5v5555
7d777899999999
:::8;D;h;;;;;<<>>
0A12222222222222222
3/3B3^34555)8I8
11333333
7P78k:===?
1135677@8"999c:i:y:
;0;;<<=f>>
]0t0011
4c7g7k7o7s7w7{7
777777w8888*9N9
X34666
7]7x7777
2$2(2l2p2t2x2|2 3$3(3@3D3
x:|:::::::::::::::::::::::::::::::::
; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;d;h;l;p;t;x;|;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;<<<<<<<<<<
5 585<5T5d5h5|55555555555555
6h66666666666
787X7x77777777
8,808P8p888888
94989X9x99999
:8:T:X:t:x:::::
; ;@;\;`;|;;;;;;
<,<0<@<d<p<x<<<<<<<<<
=(=D=H=
0 011P5T5X5666666
7$7,747<7D7L7T7\7d7l7t7|77777;< =0=@=P=`==============
> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>d>h>l>p>t>x>|>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
kernel32.dll
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
_SWVUP
PjRQA!
&}{pHwBD#
V6gr !
*Du c"
$P(u&H
R?!!S@
Origna;l mvezbus|:?%X}NVw
loctin(8AdrT!|
chyksum58
)Q]V`mtH^
1A`=C\ry
<sRQ44
RP(zYM
tLHX$C|'#btM,s
Z`;2=2H
Q&RV nS3
)},NnF
]i91\GP
!{PWQS
smsvbY
sNhNcD
MAPayfQq@dHIZ
fA+6kmhD E@<
Ap%li4
The3<cdl
%os5/l]ntPb[&v6idSDLBG5ed;%3*V
wtcxtf7
k8ll?E
xitPMLChHanxdOp
|Virt4A
cSn@*d
H^?39J
@@PEC2
DbgMs;k,y
Dexb=gSn)B
FV D\me(h#
`t$$|$(3
r+|$(|$
u]CUSQWVR;
ZPR3C
Z^_Y[]
@ I @ @ @ @ @ @ @ @
K E R N E L 3 2 . D L L
U T F - 1 6 L E
U N I C O D E
m s c o r e e . d l l
( n u l l )
( ( ( ( ( H
h ( ( ( ( H
H
A A A A A A A A A A A A A A A A A A A A A A A A A A A A
% s % s % s
u n k n o w n z i p r e s u l t c o d e
S u c c e s s
C u l d n ' t d u p l i c a t e h a n d l e
C o u l d n ' t c r e a t e / o p e n f i l e
F a i l e d t o a l l o c a t e m e m o r y
E r r o r w r i t i n g t o f i l e
F i l e n o t f o u n d i n t h e z i p f i l e
S t i l l m o r e d a t a t o u n z i p
Z i p f i l e i s c o r r u p t o r n o t a z i p f i l e
E r r o r r e a d i n g f i l e
C o r r e c t p a s s w o r d r e q u i r e d
C a l l e r : f a u l t y a r g u m e n t s
C a l l e r : t h e f i l e h a d a l r e a d y b e e n p a r t i a l l y u n z i p p e d
C a l l e r : c a n o n l y g e t m e m o r y o f a m e m o r y z i p f i l e
C a l l e r : n o t e n o u g h s p a c e a l l o c a t e d f o r m e m o r y z i p f i l e
C a l l e r : t h e r e w a s a p r e v i o u s e r r o r
C a l l e r : a d d i t i o n s t o t h e z i p h a v e a l r e a d y b e e n e n d e d
C a l l e r : m i x i n g c r e a t i o n a n d o p e n i n g o f z i p
Z i p - b u g : i n t e r n a l i n i t i a l i s a t i o n n o t c o m p l e t e d
Z i p - b u g : t r y i n g t o s e e k t h e u n s e e k a b l e
Z i p - b u g : t h e a n t i c i p a t e d s i z e t u r n e d o u t w r o n g
Z i p - b u g : t r i e d t o c h a n g e m i n d , b u t n o t a l l o w e d
Z i p - b u g : a n i n t e r n a l e r r o r d u r i n g f l a t i o n
t m p 8 % X . e x e
H G D r a w . d l l
2 1 8 . 5 4 . 3 1 . 2 2 6
g o l f s e t . i n i
2 1 8 . 5 4 . 3 1 . 1 6 5
2 1 8 . 5 4 . 3 1 . 2 2 6
S o f t w a r e \ M i c r o s o f t \ W i n d o w s N T \ C u r r e n t V e r s i o n \ W i n d o w s
g o l f i n f o . i n i
g o l f s e t . i n i
% s % s . e x e
\ \ . \ % s
\ \ . \ P H Y S I C A L D R I V E
% d . % d . % d . % d
g o l f i n f o . i n i
2 1 8 . 5 4 . 3 1 . 1 6 5
2 1 8 . 5 4 . 3 1 . 2 2 6
S o f t w a r e \ M i c r o s o f t \ W i n d o w s N T \ C u r r e n t V e r s i o n \ W i n d o w s
T r a y K e y
S o f t w a r e \ M i c r o s o f t \ W i n d o w s N T \ C u r r e n t V e r s i o n \ W i n d o w s
T r a y K e y
f i l e s i z e % d
R e a d I m a g e C o d e :
< E m b e d F i l e I n f o >
R e a d I m a g e C o d e :
R e a d I m a g e C o d e E x f a i l e d
D B G :
D B G :
A A A A A A A A A A A A A A A A
A A A A A A A A A
U n K m o w n O S
W i n 2 0 0 3
W i n V i s t a
W i n S e v e n
' ( , , - - . 0 0 0 0 1 3
1 6 7 8 8 8 : = > = @ ? B D E I I I S ^
; @ Q b c b b o
! & ' * + -
* / / 3 3 5 6 5 7 7 8 ; = ?
x $ & * + + , - - / 0 4 6 I
s s s s s s
s s s s s s s s s
Y L F C E D E C C C D C C E C C D E E E C I S @ J I B
f k m k n n n m
n n m m l n o o i
' ( , , - - . 0 0 0 0 1 3
1 6 7 8 8 8 : = > = @ ? B D E I I I S ^
; @ Q b c b b o
! & ' * + -
* / / 3 3 5 6 5 7 7 8 ; = ?
x $ & * + + , - - / 0 4 6 I
s s s s s s
s s s s s s s s s
Y L F C E D E C C C D C C E C C D E E E C I S @ J I B
f k m k n n n m
n n m m l n o o i
i E & x i t
h & A b o u t . . .
I o g d r e t
M S S h e l l D l g
S y s T r e e V i e w 3 2
S y s T r e e V i e w 3 2
S y s T r e e V i e w 3 2
S y s I P A d d r e s s 3 2
S y s I P A d d r e s s 3 2
S y s I P A d d r e s s 3 2
m s c t l s _ p r o g r e s s 3 2
m s c t l s _ p r o g r e s s 3 2
m s c t l s _ p r o g r e s s 3 2
U H F D R T Y E Y R I O E R E
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.