1.1
低危

1a75d9babc3237dd4cdf940c4a04c00c84f485f20b402adccd8e8422f2b9e9eb

1a75d9babc3237dd4cdf940c4a04c00c84f485f20b402adccd8e8422f2b9e9eb.exe

分析耗时

193s

最近分析

380天前

文件大小

181.1KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN RANSOM MINGGY
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.72
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/Gepys.06eba7d0 20190527 0.3.0.5
Avast Win32:Kryptik-LRH [Trj] 20200902 18.4.3895.0
Baidu Win32.Trojan.Kryptik.eg 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Kingsoft None 20200902 2013.8.14.323
McAfee Dropper-FFK!8ED524A7D4C9 20200902 6.0.6.653
Tencent Malware.Win32.Gencirc.10b8a66f 20200902 1.0.0.1
静态指标
行为判定
动态指标
该二进制文件可能包含加密或压缩数据,表明使用了打包工具 (1 个事件)
section {'name': '.xdata', 'virtual_address': '0x00031000', 'virtual_size': '0x000001eb', 'size_of_data': '0x000001eb', 'entropy': 7.536481260518361} entropy 7.536481260518361 description 发现高熵的节
网络通信
与未执行 DNS 查询的主机进行通信 (1 个事件)
host 114.114.114.114
文件已被 VirusTotal 上 58 个反病毒引擎识别为恶意 (50 out of 58 个事件)
ALYac Gen:Variant.Minggy.10
APEX Malicious
AVG Win32:Kryptik-LRH [Trj]
Acronis suspicious
Ad-Aware Gen:Variant.Minggy.10
AhnLab-V3 Trojan/Win32.Shipup.R65212
Alibaba Trojan:Win32/Gepys.06eba7d0
Antiy-AVL Trojan/Win32.ShipUp
Arcabit Trojan.Minggy.10
Avast Win32:Kryptik-LRH [Trj]
Avira TR/Crypt.XPACK.Gen7
Baidu Win32.Trojan.Kryptik.eg
BitDefender Gen:Variant.Minggy.10
BitDefenderTheta Gen:NN.ZexaF.34216.luX@aGuXhmj
Bkav W32.AIDetectVM.malware1
CAT-QuickHeal TrojanDropper.Gepys.A
ClamAV Win.Packed.Minggy-6993948-0
Comodo TrojWare.Win32.Kryptik.BANN@4xjerl
CrowdStrike win/malicious_confidence_100% (W)
Cybereason malicious.7d4c99
Cylance Unsafe
Cynet Malicious (score: 100)
Cyren W32/Gepys.AR.gen!Eldorado
DrWeb Trojan.Redirect.157
ESET-NOD32 a variant of Win32/Injector.AGHP
Elastic malicious (high confidence)
F-Secure Trojan.TR/Crypt.XPACK.Gen7
FireEye Generic.mg.8ed524a7d4c99cc7
Fortinet W32/Injector.AFZG!tr
GData Gen:Variant.Minggy.10
Ikarus Trojan-Downloader.Win32.Dofoil
Invincea ML/PE-A + Mal/EncPk-ACW
Jiangmin Trojan/Generic.awbzv
K7AntiVirus Trojan ( 0053507e1 )
K7GW Trojan ( 0053507e1 )
Kaspersky HEUR:Trojan.Win32.Generic
MAX malware (ai score=80)
Malwarebytes Trojan.Injector
MaxSecure Trojan.Malware.300983.susgen
McAfee Dropper-FFK!8ED524A7D4C9
MicroWorld-eScan Gen:Variant.Minggy.10
Microsoft Trojan:Win32/Gepys.VDSK!MTB
NANO-Antivirus Trojan.Win32.Redirect.craqyo
Paloalto generic.ml
Panda Trj/Genetic.gen
Qihoo-360 Generic/HEUR/QVM20.1.A593.Malware.Gen
Rising Dropper.Win32.Gepys.c (CLASSIC)
SUPERAntiSpyware Trojan.Agent/Gen-Injector
Sangfor Malware
SentinelOne DFI - Malicious PE
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2013-05-09 02:26:20

PE Imphash

0fc2e0fe86c492f53419b1bb5c85f1a5

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x000038fc 0x000038fc 5.619194212957892
.bss 0x00005000 0x00001f40 0x00000000 0.0
.data 0x00007000 0x000285c0 0x000285c0 6.712303968264178
.idata 0x00030000 0x00000688 0x00000688 4.4787997790194725
.xdata 0x00031000 0x000001eb 0x000001eb 7.536481260518361

Imports

Library CRYPT32.DLL:
Library KERNEL32.dll:
0x430200 GetProcAddress
0x430204 LoadLibraryA
0x430208 RtlUnwind
0x43020c VirtualProtect
0x430210 GetModuleHandleW
0x430214 GetStartupInfoW
0x430218 lstrlenW
0x43021c GetVersionExW
0x430220 LoadLibraryW
0x430224 DefineDosDeviceW
0x430228 GetModuleHandleA
0x43022c GetLastError
0x430230 QueryDosDeviceW
Library USER32.DLL:
0x43023c GetDlgItem
0x430240 GetDlgItemInt
0x430244 GetWindowLongA
0x430248 ShowWindow
0x43024c LoadStringW
0x430250 SendMessageW
0x430254 MessageBoxW
0x430258 DefWindowProcW
0x43025c PostMessageW
Library CRTDLL.DLL:
0x430268 __GetMainArgs
0x43026c exit
0x430270 raise
0x430274 signal
Library COMCTL32.dll:
Library ADVAPI32.dll:
0x43028c RegOpenKeyExW
0x430290 RegSetValueExW
0x430294 RegQueryValueExW
0x430298 RegCloseKey
Library ulib.dll:
0x4302a8 ??0DSTRING@@QAE@XZ
0x4302ac ??0PATH@@QAE@XZ
Library ntdll.dll:
0x4302b8 RtlFreeHeap
0x4302bc RtlAllocateHeap

L!This program cannot be run in DOS mode.
.idata
@.xdata
t ;t$$t
_^[USVWUj
]_^[]U
v4b1qUk
SVWeP<$f
x|PxV5p@
1_^[UpSVWu
A1EE}eEB
_^[U(SVWu
}E9Eu(U
EE9E|E})9}
L_^[UQU
UQPSVWu
}_^[U SVWu
]EE9E|M9u
SuVVESuVI
X_^[UVW}
$_^]U SVW]
|_^[U,
WVp)iilz
`ro%edhd
EEcPahdhRt
LEdV8XD
%!zTa+
)PLnu}
ftd|tp
urchF)P
@xdEpG
pEoL|!
|dxisfft
peEEd%Ls<`L
lFrodE6
hR{sVhe
iuPPEx|e
<Vl\i+fhVpEPX
p0cXEF
fSx|l?
dlxQ dp#x+d
pfjKX|ppEeF
\itdtt
ph|8Emadlhye
.PrXEPd
+de+xdsAM?P
ElEHta)
lPE)|P%lr
EJ|die
EtxV+8
LT%\||@X
p|tiFNYhu
d|||tl
Dh)i1x
`\|tit%f
[Pl)h<
;#X+)l
)|y))!.
xxS#hx
+pHtkitei
x#Tvpp/h
|xlhpi
L|d|WWl'
pD|Xp`
6|D\mpi2`%
Dftliq)?tipV+`
)t%mxTr)l
dtx\x+
`p6l|p;
#|.ytj)x
++cTptDr
S|f|%tp|h)#
in)dxXp
%gHFLl
Y!\ptl
`|titR
)!#-|y
P`%fxx
+ll+XG%
i\)%+t|
ilhip Ld
xD+>et
||ilxX
xxpo++
i`/p.ce
%%C#h;
]imZ[lT%`+
N+t$L|
fu9M1EuV
wE1EE@
a$}=Et"
EEtEE]Vk[
E@U]SuEEE
eEPEuE
e4jVWp
_PT4UGEeXE
WP[}EE@V
jEPuSU
jjE4j<_
WWRlVb
PEuhSSE
SWhu_[
tjS>|SS
mZimZn
!mSmmmmO
ummrZZZZ
MTfOmm.
t mcZZ
! E!ED"
j@<jj0VV
Ed=0g=ut
qfhSjP
0V@RMt
E@0EquE
kaOffN
q+qqkOA
N_Okfyka
+3+N+Na
j@h2VBj
,,+W,+,
++++++,,+,F+,,+,+,+,
+,,,+W,++d,+U,+dV++W`
+F@++`,
,W+++,+d,,+,V,+++,
+M,`+,@,,
hhR+hh
UppBhlh
hhhq hhhSh
jQR|hG
WRA+h+h h
EPP0t_P
RqPhht
U33UQ[t
FGWhPP@8
j|A+WF
F|UP+RR
Q!@RAW
G@R|\PQR
+\0+RW
@QPAMRV
44@PP4PP
PP4j4Q
44P4h4:0h4PlPPPP
hq44D P
DP@4PQ444PPPPPp4
444PPP
4hHlllHlHlHHHhD
lAlHYlml
WHpHHlpH
HHllHHDHHHjHqHlA
lHllHl
QlYllHHlHHl
hHHRljll
lH1QHP
j222]2q
j02Ejjj@j3322
3pjPjq
222[j@2j
jj22[PBpjj
22jj2^jjU2_h
pPjDpWQ@@jp
MjDujj@
0000fS@@
3j0f0j[Dp0f
000jf000M
LhpPQ!
VVPVV_DE
V3<V]3SV
SV@VVVVV
!SVVjVJV
VVp(MpV
h\3\Dp
@$\\\;
\ff+\\\\9@\I
>\\uf\f\\;
S@Wf$W
,:P+S0
jj.@pQ
hj@x=@jjM
t`0jjj\hjt
Djjj8`L
HEhhHj
3RfD01
dhRDPd
QfduC@
&hH@fPMp
LHhaTw
DfftPf
9@LtuI
QWu$V]
@&PVDtDP
D@D@Dt
MDDH$Dg^"DHu^D^]H3qD@LDL
DHh$hD$
hLh@hh3]hh
qEh@$M
fuhhhh@hh
hhQhqL
htEhhD3h
th@-]hhf^'hh
T@jhPh
hhhth^Vhh
hhh3q]hht]_t
]Cttttt
f+tutEf9ftttt
@u9uZ<<<
@@E<P<<
fEDf=2
4(0uD5h
<<@ED4H<D<
E<<D<f
@D@r@@uDu
^@@hD@
@@@@@Ehj;@@@@@
}@j@@@
@]h@D9
5]@3D@
}Esjjjj
jjjjjjjj
jUjjjuj
jUjjU}
P3PVVY
SSrrrS
S9rr@r@S
W@PS{rh]rrSSpPFS
?@uStj
SrSGhrr=P3SS
SSSr_(t
rrrrSrrSSS3
Yt3uj3
duu9juS`u`
uuNu~d@
ududuuN
vu^ Quf=
~d@^F@
t=@Yu"
=$D5GY
tYYYSYVY5Y
f8G9tu
tttttYtSV
uftftt
fWVV3SWV
[;@V;YE3V
VS VVV
^VV_u9VVVXupu
tD@@PW
Ef3DP@
>>Pt>ujW
>>tqF3>
jj^P5j
}~jfvG\@
YYYYYYjj|
jNh@p_YY5
h=_$WDWW_
@_5@WWWt_pWDp__
h@DDWVW_W__W@_3W_W
__WDWW
WDh=W___pW
W|__uWWW
5_W_@W
__u_@__W_|
PpD@@tY5
$Djj@hhD
__FSV__
E___8_
u]lN__S
__U_d@8
E[__EE__E_3+@{
W3eWuO3
;WuPWp
W=@===
<=0j@====
@===V=
[==D00q0
0=@=h0==
e==@=?@==bW0_@3
;0@>0F
00u~``|
0Y@^q$0[0$q
^@0@00W@WES
_004U00
`|0`|3
>p(>p@>E)YDp@
>6ppD>
>>_>pu>j0PUp>
]E>p>pPppE
VEUp>j
pp>p`p
>>pD>4>p^>
pp>>>pp>Y>
pEppY@|9
>p>]p>>
Y]jDDM
D]}Dt0tt}@DDDtD
CD@DD5
DDDD;QDP
D9}YD\p"TDDu
DDhDD!
EED]uxu2\u9@t`
DDEtMD
MDD|DDM
DD}duYE|
GD}jGODGSdD
>DD,DD
UU@]Wf
UPU5U@@U
pUDUtUU
@j_UUU
P@UjupUVU
;Yt;UP
P;H;V;;
3SU-]]
;tEj;@D;
D;;5;tA;H;;3
Y5uYDD
sP@uDDW
;DYYYDYY
YYDDDDD
DS;DGPDt
D5YpYY
DYYY@YD>
YDCr+Yr
hhDhh@[&
hu3hhuh
uqhh9hV^@g
_hhhhe
tMMf(9
3BA*1@
[M[[$[t]_
t$[Y[[[[[@
$UEV=AtDE
u$Lhtp
PPPPP@=
@@@XPM
@PhPX@
P@@Ph@}P
;PPP@@PqL@}(P
@PSGP5S
PPPp|@@5D@@
P@h@@@D@PpP@PP@h
PSPt@@D
D\}\[[
[t[ u5[
[[[P[t[
[E[t[Pu^t[tP[tu[DD
Dt(PM\E[[[E[[Q[L5
3^tuWV9
["uf]U
tt3Oj0
u00ff0Oj0
K'+Puu0330
00^0"fJt000f0
VuvvDuD
DDDDT@
NN@LD@
F@F@$OF+FFPF@E
O |FFG
hY;0_tYhYh
Yhh]hhY^h[PYu
hYWYEYYYh3YYhh3hhVh]YY
Y@u0j'hYVY
(h_thhthUYtY
tYYuV}t;YhYjhh
8YhhAhhh@W
YVYhYs
j5QjYJF
jWtEEl
j@DWPP
wvjv+3
pFM@aHu
p93`@=
CZZ>Z{
GCJZuv
RR3[WRR
RRj@jV
t[RR3R_
3tV^R3
Uu@hdwQE39
Q9u29t9F]p9XQs0Q
Q9=Q99
QtQ99QD5Y
uQ3S9VQ^9M9jt=
Q"9D996Q93
QQQVV99j]YQ
^tQuVQuu
QQQuQuF9Q3]
ffvfuGFt
vtvjvRvvva
vVvvqDuvvvp
vvvvYvJB
vYiuvHvv
vP\lv"@vvv`vvv0Dvh*
d,X@pvtvLv8vvvHv<4vv
X@XXXX
XXXXXXXX
XvXXXX
B!ynyy
VYYVYt
ttP;;;;;
YVF@;;;YbV;F@
t;;tY;;@F
;V 8P;P;;;
tt;P$;;;;;
t;tY;;@U;+t;;Fu
EY@3;vVF;Y;
FHPP@;;;H
;Y@;5;I;t;;@;U@];
upS39u
]=$SpS
t???@S
uu?_?U?S;??uP??"??;;??^E
3 uM?h
???uu?
?tu u?
L2jDu@
V$D$u$W$M
P$$d|$v_H
$5$$hP
$3|u$($$^
DI,3,$
fuuSKPh
YuQ$Qu
fAuLYu
ApAutA
SrNoNrs
rDAu6
zislotb
sotiy
yy inda
sydy an
lle fMp
lm rol
t a n
tcsnh
lmltti
t0stit
3tttAi
etttst
eean0s0
gnrnn
ratogt
- up6x
6R666
nt moRn
o0 Rnr
p0 0anu
e0 c 0
fa2 enott
0rm0a0
000 g
@@RRRRuR
.WPMggtgeAgsge
toxslcagwWgogbg
ognuienoGgw2
srDLua
RPgVctg
ggtoalWi
rtguglt
ltWeesegglsIa
tgtFgUF
rSadfmigGeeogScinepLGtgSEn
djUelgo
AeGFiL
eaVOse3se
rFyybaea
iuaoaa
bubbbAauub
mtyJFSMabb
cAAbvgD
bbegbNb
JJMlburb
nbJsrupy
ratirnnbu
bbcSea
ubeSNryM
rearece
bbtabbO
yWMeMMMyMMy
uyMMFd
yiyMMy
yMyeMdya
Myruynyy
MdsSaM
im{63v
f@}t/h 0
`p>1ou
4*!)55
/5J5AHNNGE\5YNXNINN^5NVN
NR5<:5DV
ANXNNNONQ`5{H5B586NP5
LFN_[N@5Z5S;}5]NNTC9TN7ONWG~M
MZEN5NNB?N5WNKRND5>I5Q555N5YNPN5|NNLNFCNUJSNUKN5=GeA
GG4G#GGGGvGM`
TKGG+GG1UUG~ G
G)LhWG[
GvGG>\7
GGGUGGGN7kGG+ \
@ts(ZI
@E|wIEaF
ptpyTp
leltaCoRoolilo
Norooule
dnloolod
oetCeelloVo
eooFool
Welllei
oGollo
eeGWlteeHe
rAeenilzCl
GisetTtttttet
GtrMsFsiotho
mttttFttce
preJxtttiFectanteltlp
Slekclo
ptEHttiteP
tteTte
eGtSyi
Wttdv`
eymHpe
TSoltF
aeVtF3a
mSCiWWGPasWltWWCr
tiPeeoWWWn
tGEddWWLaeeWdaeWeoeNWIrrnWt
WWhGioEenttWmeeth
mRaWWWrG
oLCtotr.TeaDieWWerWrW
IW2nutK
NWWercWWippsWWulWceeapalWpW
ssaerWaoaWTrhaWarWLG
pWnEa]pMprsaMpg
AadoaC
eptplptlodcsnc
nsttergppceLappg
ispgReAs
Mtopgpesa
UnnCrpp
pCetTopoLpwpiDsrrx
treEnaPinnnnnnauS
tnWiaEeRoened
noSigPEeeotwW3p
mePiOlQnx
iyWEontndwi7eno
pnnemx
snPngd
nnntanaW
sDte~n
ioDrin
KEnln2noBppgnrglsMB
nrgnnrtwndf
NEiGUeg
a3hesRieEEo
rDeer!eeS
exueCzEeHet
e2eegeu
eceeLxt3uoe.
aelelonxee
eRCeWeeenWyL
nInlezWirnzo
inenCcC
tlndiioprd
SPn3Htn
nnEnAss
eyleee
nSoslUutniInou
2fnnalentT
ptnsnnem2re
etiiaun
GtnUon
intSfonnr
nannnODl
tlxlet
SlneMl
lteodthrctteleallGedttedtslttDtdi
eorlir
olltPttdtleFtctsee
btltAd
tstlnEnlldlFlx
lIngnlPtcreotttEistt
neletigtletlllsUatEttlt
rxhitllcctltHEelll
ttuuttltdPpeaplloenolllsGltty
ntentlitDAteoeDitttDtt
SnnDtSrtpntme
ndDSgCnetE
tnFteDttd
eCsatDncoDttoWSdGoein
traGettnSteSltDrl
HTtvDttamPGe
ivtttitsDtEap
dnDcreetlgtunoittDoarFe
dDIttnieti
neCiWuiiottz
ooLsorcDLsue
lssltoDilcsrssDnnclsnSrasI
sTDeensaIsdet
stDeseasGme
srdssAe
FlDtDe
ecDsDeTs
SrstDsDaGtsDEtlilr
Dellts
sssnittDrtDsCsrEeskTTsrlsoeDtDcSsDVa
ndraPucPcPtbteEpCeLr
ec?oat
tCvPPCLuPPPP
lrsePeCLlt
PPltrPSPoc
GdneAPiHWaaPCt
efmtec
nkPSPIoPreGeCeICPaPaetPeePt
eretooPPPn
QrPieOne
DiycarPrerMin
ecP-CeMHrndoH
eaWayeRg
ilhdMu
@X(@@@~~~
@@~~@@l
F#OOO!g {
^&OOQO8lM
OOOL_JO
OOO5<O
OUOtOOsO~"[MEaPFObOO
OOUO1OO1JO
NtVrMhbFb]<Y
{x4F&a
Mk8[T3
W&b8Dq1
Y*vOOOOOOgOgRgphOOOk_(O
OZ=gO`Ma6O
5gBOU[ZO
}%pPggx
>9g<sg
gEkggF
PPz?>PAw
PPP8Pxe)Pf
hPPmP ozBPZ&V5P>E
PAuPjPo
{UWkqP
?Z+1PP
PPPPl#
O1JP+````
`m`x]_B
`5``0m```Q`S
`GKf```"P$&
``hY`If
X```+)
T%[J=s```ww
wQwQwwo2Pw
gwdw&%(nUwC
go{Nw>
wIwuw,0
i\wuwJiewX
_w"#2w-w
d,,s'|,
!!nt!{
Oe!C!o*y.!z;!
=<oIkY!!"!
e@n=!!
tvuG~!YJ
<!!o"=mB
)uRX6s
$b YM!
u9Q@@M@
@e@@M.
@Bx@,Y
(GG=(Gsc"
xGGoGGG06X6SCGGE'q#yv=;
GGG6:GG
GzG:GY
G+Y-$G
GGAG(*7ve^GGG
(?<l*W
LvcKfYZ
[j>vrl{
Ypii&H
(V$2GSU{
#nq9`!
}&N%:|||
j|3t3|p|M|a|S'|S
|+_s||[|~Q"
:|/|=||#
GS}MZ2||u|
Vd7~{0i0]
uuVD;g
cY{%oJ
`eyWxF
]#~7eQ
4Hjryo<3p+@
fjF{QQ
;QQQA2*Q&
QQQsZ_QQ
QEQQQFkQ QQ>ssMq7}sqIN/m.Q
5`QQu:ZuO'QQQQQQRs;g
xlQss7
sa)QPsQ{sQTZ0
;SQXP3
rXsw,5nUBD3T
Uh$sse)
(,s|s90%
cOss%ssL
e.(y8.s
!+l9s!;
94!!!T!9
jM9{N$!qm!9?99!99!!G!9XkW.9!r9!
m!9i6@EE9!9-!!!!Q99uC9|999!
!!r.[!W9!9!~
9YaWY999&99.)!9!<B9
^!F9!9!!9V
=5RQg8
aiH5J5
p/5.h5X55g5rfgOj55!~#
55vWei
5}q$KW55U5
555T}555W5
^\:LnlPL49
KF aMD1
hc B%s
XTIX9<ji
X+XXNXX\X)BBX
XXX1XX+NX
y2XX{7
S7XX:X
~@XXaLX
yy_5w@yyy)yW3l0W(2_I
HF-;Cy
scyy`y
1='sy(yh&y
2j<jjj=
|6oj-jtJ^)
jj5!j~jjjQjejljjjHi
j#j5jZb
4xYjz>B#?
-1-PF;Q
&}}W}}L
v}-}@}}a}
Z}-}(,"D}B8
}}}}9F
}}}}jZST
1};S}&Y;}}tnr}M
}'}3BK}5<
+Z@bj
mMUnFI
JxK.Lf
K};_5Q
|i1Hf]kpr
q;tWaD
i\CgQC
]VU0_]6f6P26k
](tr6]w/
*]rk6]
6*66s]F]76v6~]
]V6r]F;8]KY
6)]]]_]]]6(7]G6
]]]66666]#M
66(]6^6].o
kG6966I
/%+s%%
'%%I/%o%%6qj[%%1r%1%%'%=
%q)Zi%hM(o%U
YVx}%Q%
k`(1W0g
4Qngg
g(}gg
g/ggDg
ggggg5
g"ggt
?g(p7D-
b---7--
H-GRL$C
KQ\9Jl-
{-sA-2"
"QtL-"mv
-""`+v"Mq ""
"-"4ZlS:[!"
y-i-""sI"
DG""s""}"/"""
d-)->x
\S- "V
--"""*PqR"o|2"9wh"
3v($g(
|((4(n(3vC^9(
((}w(d*=(d(
qWN)sT{]]
]TV]=]
]SP]z<}9]$f]i]]t]]
?z]1z]O1W]=yK
e\]]]AH
^03mZp>
2:I~@3
$S&g5E
2LGbn;T
I!}+A`
:FS,i"Kzx
kw29=X@/D5ZGT=Hh
*^i/Gf%
ee/&!e-
/FkUlN
/2:/gP/e/eCTseeaea//\
rhAj/o
//e///`Jej"y0[j
S%/eeee/`De/
//aeeeeee/e/e0/4e6f//eee}w//eeLe'?
\6\\`Ib
\g!v5\
\gh\ZnVP_
\{Z+lb:\o
V}r\A2\\g\@\
b \%j
..2]..,,FDo
Ov\Ua!.
=.W.&xU
..5.V.P
...|-.e)
\.B X%C..in.[.R..
.] e}\\98
DH+%(.
B|.c}[;
p5pppk*
A<pf@Lt
pp&dpppp
_p=pp:
qppIwAn
pHgVrpMpp
pz$p]_p_
vpp'r%pppypB
9&vleV
&.H1*}_2| U=O
svE]k)7
0k#pu8PEROYH<
6$h?n$HR$R$]"Z
!n$?$<$C$$
$ 03l$$$$$!
$U$$7V.$
2$q$q$U>*
+$'j$:
4D_E"sp"c
\-:4?J.X
m|S _A
0E#ka`A
4;u#s"
:Cc(n8_CZy`
T9t-o/g}
T!&H0j5dD
#9vK}?9e
o/.uI_-!XNo2F#ZR
_ 4sFC
_x_W__
_mO_6O__\5__*!a_a
_r<Xd_
_________In__js
z:\EuX
;V9eB/
44,`4jm
R@4p4ynM
K(S&[44
F:ubh4N
$b3A:261P
v&!m*l'Q\
h]@N=]v
$vSrv9
z1Ai{pw
=+$Gc'u{R@c0py*lpq)R
`}!`G`=``
[z:eoQi`
/VO`&``^
?`LuTwE
:j7qF'K:0
[ZW?KTh
t'CtjW7M].
Zdx5gE<aa
cHOa$D
(((wA(
B85Pm<Y((SE(((yFq|kXU(
!(((F(zy 1
[E(0(`((
`(((!t(R$
%4|4l_4J4{GJ4\44404
4.dv44BIs9(
+4E!Eh4GI
4b4oc4K
444xu44
!4A44444
x4344S
|CK1=Kf
LF|KK3iKq0QKWKK
nK9".l`{}
RaAKWrXKby\KK
KJtKCK
K7K}< y~z
LLgLUa7LL
U2x"pc3CJ
8sE\`-n
7.nn[[wnnn
nwnnw"
W`TrnnZu
|B}snnnt
AnUn`bnn$MA^Q
nnnnn13Vnnn5
[+~p~:+
MrP}.@DY"
F|!FO;c$,e>>
WBV6Je8Y
_]>Fxx\$x\xpx\
\\\~xx\Exxbq
xsx\9sxh%\2w\\xx6xx-euR^
oxxE\GYx(\
x^|S\\xk\m
x^\{Tx\a\\xzj\$?xxA\\lxu\\\\x
\E#b9xa&
Gh(BZ@BBB,BB
Y~MOaF`
/iW;yBz
gUV~)=q1
lllT[3
SFlQ&i
l,ylGal
WAj%ne
-()>kB]^]LVKpQ
fk>utPH(%kwkk{k
kfak9;kO
kR$kkkkkGF
0ktk/kE:>iU
9=mD/x;5
P fMsACu1
9I]LDb_
>iUx<J
p+(=WD#
^\wtt.t9
t.ttt9.gt?
..tt4ttott
..K[tttf|6t.vj*H=7
.hF.|-.t..-.BgOtt.tt
.f.tt;.wbY-
.(jjB.r=tt.A.REtT#V&V1j7*
w,V4<W
VVVVq}<ZHJVV1[
VvZWuV{V
s+VVVfVV
:xb#V7V/V#0
Gq:^;6P:6&{
gqe0D^
L "sgRlz
o7)sH)s)
sV@R,v'
edsT9slssRss:s\Gu]G[s
ssncs l
ssVQz8s!ss
#DssRUs
s(ssP7s@!z1
ss.>s^BKYC
-PNN;`d
";39$&N
B;_G{$ju"V!ZvE6Vq7V/V
V7VLTV
%VVV<E
VTV"VVa
SVVVR%
$$mGJ':2
GGPG$RnFw
G0G"_0.z
G!AGJGG
GVGGKWG6mG
/bPT5mGb:aGVGmlG
k}R|<?Ql8
/x=i~nzkKN[
xTM8q7
nq[hqqq
q%@q+dzqq^\l)qqBqq
-quCWqqn.p
qqIq<oa|@]c@@U|9||>
C@>@D||"
@u@|@S@|3|!|@@tH@
:@||@||@
@@|v||P
H@i@@M D@||M
5@-||@|:u
|AM|Q@)
@&@G|||-@|t
;2bYnDN
|1omKSm]
zJ'!o;#
g~vRJy
84UC2/CX[=
WDUZE]=
xYWs6c<4
9|k?(Ko0
YBA>Tko6MHix
HYH`"a
H@oR%H:G5
Y:HDHS1V4HH
%09H3HH
.HjHHHHHkzHHHHH=TV
H|?"(HH
HHH4K9
O&IB5!3.wE
9YO,T$
OJOTXY
V aTlX>
5t`%[Q
XYypAW
XXbF0%Q
_b!?c1^hd
HeHHbHHLHOHggH'
"Hg-gH>7HH
H.;gg|T(H;g3
6HHNbFHM
ggggHgg;lHggH
cggl|g|g{H,ggt
gH\bg{H)HZpggH
g:gMgg
y~'ppppppp
pppppp
vppkXv(pphpr$7p2
p(_9$YUp{hpdC5K
=pTbp>!;]%Ap&4y
48$4d4
z484GzJ4B4d4
4;v4Qx5
V4Z;n|
Q+4822
44j6Ph4
]44/4`
44L4)494J
GFGGEG#xG
h\]G/|GGG-
RGiWGi1
G'plc,T;GGL8GGD
f26GGH8
[e.GG:s{}}C}
}}}di2
N|aSgj}Fv~
}}Vww+}}|-K}
}}}}{pS}}
+l=?fo
%t0h}R-.
n_bJ"8S
?N: iH&
3[c@k8
1fA5>n0
JjMF<FX
2FF5FP]
*();XF,
FGFFF,
;q`,FFFh
FFW~FwFyU
FF1DDD
QDDDD`
DD<]+Q
4'DHDDD57DbDs}
XDDQD`EaD
TD>,D
13hDM1
,D~xVo30&eN
z Bz%#`:
EpzzH"
z0)G]zXk}qw!
!zez{Hzzzz
w""y"'"I""Y
@HBH"""
@"B3"*"
""sg"$
","L""35z_V
JlVT"v_
^6b*""""r"-"EY" 2ptUNUv
QU(DSU
Un!-U|UU
"U-RU1!3
UMUUUHU
UeUUt)mDC""_?V""k="
""8""
C""d""
"#a""o"p-y
"""k#;Bt
#'r>U
v8YI_#
45AUxNa5
.YpaGj
"c+3@C
Qf5e=p/
iJRyr
TMn,w,8l9
c3,|",7
V,,R,
N_3,,-,-,,,,,c2,ggR
\iAa,n,w,,3;[}+,
x?[?c%'g
cv*1Qwp
`b{Jx-2
X|\Sc9
E$hImKBh9
/H}9h9
c99pB9
9-9_T0rY
?999HPi/3N9i<
JVh_[+9
D1J:'9~!
7_/]SnxJ49TUo`999
8jS'nR]wf
N/=FU=Fh0(
YPEscp
&)6iGnQ'
;R^OQ0*
#$yX~^k_NB4
Y3X{Ix
7`+e&7UH'Z-q>
r1(0H0
2p/z*trqTEGXjk[
'RmsE)H"*
yb.ko..
Lvvv}m.l
a./.v.v<vdvFav?nvc..
S v.&F.qvc.v<.
,v.v.vlvvv7{pqvvvvv. s.
.vv.v..v.Cv.>:vRz}F<...h'{qv.v..lGFITB
:a\QJa
?kBJRJJe}
yJBfNJ#?fJJ X
YyJJzqJ]5JJJJ|oJ<
J4JJ3Jf&s
%|J")JG
*%JJj%tJJJx
JJ<=JJ
t`FGba$3
:abaababbaab|bababb
aabaa"}A
rngbba
abbpba
baEawaaaYe
bPdaPb,aGbbb
RaabaaabbTaGw
>ba:bD`aat%bbb
o$H9o8MI7UM
)uu)8T@u`
(4.uDuHuuuuuu~quuu=u
u?u/uudz3uLu-Lu;uk`=n|@
u~R6u>uuOu}\s~3quJIY[U6
TuQuu15-?5K??5jLX&?U555
k?5?5S5,:?d5????5?
5l?0a3z5??5.g?|
5?5:5j
=5?S?d?5
?5i5?j?5??5'?
5k{55K
;awx=<ly
l$mN9w
x^\*,
k1nZ!c
D o;df
B}slx+
4]eWgs!H0
N34V;D8IC)()
X(KQ=(
J(8((~M
Q`(yW(oW
((Ko( (
((W^eb5(M(((uV
2(((FP(
(*A$'5Aw(=A=w?=@A}AD]q
.l&}EAA<AAAi==
)Sy=~;phAAH"gA
=KfAAa!yAASA=FA`EA=o
A=A3A41
,=AOJ^AA
=Lq_w9
4pL?~>N>
>U->>>
8$0c>pL>>
d=>^>>>(>/>6R>H9>
>>4>>0
>}>>`>JT>|
@>n%m0
oqB=%;
dk,)]xx
?yM+)^JO+0&ORA
]mFlE5_
G;-(dAL[
|2AIVdA
-snLA.
j"AAAAa~
A%A A>@A*
g;111A1A<%HK1
11T$114N
B'MlA]
A1YZ^1)1,11a(1(w
AW1FV1!1Y[61>AA1
1>1);A1An)
Mj>9No
{_J:(
C7lg{4
qbjak{[>
X$cE(3lG(
cg{yny
...^..
.1W.&.
..u...._2
Z`?^..
R-TIl.2#
.R.)w1iK.:V}S
rrrhOKt%
9GUFrtr
|r-.MPr.
rrMrrI
\zCzz2
zzz+uWiztg
!zzzvC\zW
]/3zz9z1@zztzz
_zzgz8z
zz-s?),:J:V
R(|e:::@
::enUq 1::[7
:I"o::g:\
:8..:{f:}=:
_::xKV:g:::
3:\@3L(
!7K2S/
f.$ r.
.L...,9.p.txo.....Z.D.f1
4i+L|fI...l
|.r.j#.'
auRzDc.o...+)C
;x;w;)
;[5F[fd;;
e;D;fD
;T;;hE7
v_vTHIvK
vb}(XvS
Cvvgvc
vAvvv@
vvH!vjv
vLp:33333sG432;`3
h3!M31
3R{/3w15
3}MJ?3
P[j]q1^uR
B'j}]F}
:-eRd|R
g?`#vG
T(MTE{ [TT*
*'8[TW0ETZ#T',TYT]T
|TT;RTT#gyy
)bTTrT
/C(O|7T
5v9T6OTP
q7gs;4RZv'
X+MSao
zVmDmht
Jr.=v}A
YaoooUN
_ooo8 a
6z382VU1\^B%TFX
Gz22z2G9)2"2X"z
Hzzzzz242q32O
2z2~zozzu!2K
2Tazz!2
g2 22v
*2Pz22I/z5z@zzwL?z.v>z
&2z2z23z2w22X
zjzz2z2z
KA+zzrz
z`zD@zz
>'zHEeb=
dIz~:h<
er^MVe
ee{maeaee
ejbe8Na
m6aaBa
aaa"[a%n
'b:a>Ha\)
Vlaaaa,aa
aaaGW"HI20a!a0a5
[3yFa,
xN:33(p
um>0C^2y9
0:8>rk
+0vT2
|>b!JZR
)H*)<ac>)T})
))E+-)B
)).11
y<))))J))0^}r2/I2Ll.
JL/)}))q
W3ql~D8
4,q@q_t
Ctaq Nq
"vWYiy
Jqq7q+xq
Eqq)Yqq
kqqqFxB6qqqOq@q}
qfzqqI?.
qq+jy
sQMNAe
/q}<e!
r@owSaYO
joT$5j
Jo=o';
H.l+]}3F,
oMvo^o6O
E=o#o1
oSooc!BBoo("
oK=WIr8rra8rr
o=rrorrCrr
Mru9oZCoG
rra/?%okrr.DV.r
oVYrrKoo
rx&oeroror[rNo~
FOvD'r3
>1G@<,%c+
&:|ToandVvsI~zs=Ed.
Y#@}SH
_v:|0Eku
3EKxMF(.oO
V+#5UE
q81W7Ez
U2N:"F
efwffR)
xNGh@f<Z
f_njDmfJ'f)\
{%}*1T5iNix
F~Kf>qoN
hRC6=5
Sy?=<;af.ZfRgfKffif\
#afffx>Jf
fofQ6'
IJ\NV
!=)TC`b
VLWIRQv
4CK>`:]M.
y&A^^^^^B^{
^rC#^A(
?`k^^(
^5j^Hp:
^4Y{lT
^yY^^v^/H*HoP;^
J.mDVa6>a/
+WUi|R,
>jo^oP6h
0[%N1e
=cUUseIZv
NAU-{&UUU
n8%UU2301
vZU{ULUU[yKU;;Uvc(
%,-<p=(UUUUUa;
&1U` UU
OUUsSyUUU~(UUUw
E#.tM0#tFztPta#tgbb{vtt#
t##|$`t #-Mt>t
#{###ltE##tt#$49
#tNt##m
#t4)Pt
ztt#tV
'F(})9t##tot
8t###\ttt
2#ttt##
ow'f}}8OU}|}7}
@}<HT}}
}!jL!{}}t
9f4}t}gJ3'9(}}}
}Ln}=p}}/}xtl
AR'U08
cOYbCoz8S
t0FD{%+
;;'|;;;;g;;;(;vt
P;;k%;A;
6;;};;z;a
`iu;y;{
;+r|;;;o\;|;s7;;
/bKJsy8nn7nCn{/<
,nTnnnnn]tPHnAUnn
4&j+zn/d#WUn{
n'Dnn
xwwwwwww
JJ`GJJedJ=\J
BkQJWdJLyJJ!
\FSH@J
^OJJi^AMJU
7I7I%II7
II7tI77II7I
777+!#
III77IB7II7I7
wwwwwww
pxwxxwww
wwwwwpwpw
wwwwwwww
P2kPPb
Oqd_;rAkCQ;;
BJBBBB
BJpJJsB2
>DvI<;
!Ctf+t
XXXXXXX
t#Emttt
@t7FtF
_+Mt`E
%AA;AAA;
A$A1AA
kkkg;A
ckk<kBgk;JkQkQ
kkkkkkJ;kkc
;kQkkB
<Ak;kkkkBA;k_>>k
/;AAVYAAA
}DuMMMMMuuVuuMMMMMhuuMMMMMM
MMuuguuuuMMMuV
MMuM|MMuMuuuVuMuMMMMMuuuuuMMuMMuMuMMMMuMMuuuMMuuu}F
222Fpq
5H????
xwpwxx
;:5;7)
77X;7274;
BSM>;e>
;D7'37
;@77H0d
;;6;@;
DB8/;4
9/;07;,qJ
H57"77J;+\c.!j<
:;7FH7;
-777;77;A;77ED7@67=70>7u
n~~0~_
~d]x}j\~`Z~y
~xy~Z}
o~~^~z
7CCI#Ch
{{{{{d
{{{U{a{
da~~o~~
~~~~~v
~~d~~a
wwwwww
wwwwwwww
wwwwww
wpwwwww
wwxwww
xxxxxw
xxwxwxxww
IkkHP%
;;A;;F
EuqCqq
@5qIW~
q@Oq_q@qCAGq
qqqWWGqrqq
yq`q\ qqq
DIyDDDD
DDDDD;DDqD
IIDDII<<
DIDI/HDDD
DDIIID/DDIDDDDIDDD{II{III<E]
DDIDDID<DDID
0O{N{N
iiVv0NN
7Djoj(
DDHDDDDDDDD
Cyk}}}}
QD>q;M
k;>kc<JB
_Dj;}Jk;
;;D;xx<;
GVV;Y;DA<]
}IIIII
>yIIGIj
`^hqjvY{Vq
VqqqqqVFqrrrF{FVa{q
Fr`Fp9
x'qe~p
acaFsa
E}EEEE~\EEEEEEEEEEE
xErEEE
EEEEEEbEE
EEEEEE
JJJJJr
KKhKKK
hKhhhhh
hLKKhK
G!HtKH}H
^PBonJ
HHHJGH
y Ptc s"meieu eslci<m cc. e
c>mvar t<cq"ccrms "co <cm i ushecctmcnr>cuecm-:occscr mti =c3o o- s-c eaat.0ruso
c-sotloecca1cnq c" >f
ciifemiscrh=fexcvroa.m
c:s csgs<c ccVt
cccc>:r"1ccd
vnssrfnIccn>nn
nrnn<ctt<cc nn"envt"nIsnuennsnennnnn nuiE naenndniuLnl
nr< neAesrnnnuesu"nok=nEnrnl>niunne>seePtni envtnencineedgLnnn>ne//e qnlnnelnf nnunxt
enrnxnnlesvsyv" le ni eneons /ncs= vnnnndnnnnon
nanDPIXGDIGDPDGNDD
DDDDnDXDD<DAPA
DA>IDD
GIADIAPDus
DmDIANPAPXDDDDDPDADDt>sN A
DGNDNDDyDDaIDI
DIDP/IDI
/GGrDPXAoXPDP
fGXNDD
<DPDGI
DDXDDDXDIDPDNDPXG
8744421
641?2D
1n252izg2<
3;2E4725629
2405k22442<7
282084
_220246S4330=40228922<01
4;002m4
9Z<2220R3303 =32
bD>0*10f3?(24%$0?
?2??2x3z>>>R0?.
3>1]3>?30l
4231u>3
43?:30330#31r
i2?232>03x2
?403Y?321
=1>x89I6
5:688:665585
C64:7/:7j7:6p
:9^6::><;1=<
<">:=<=.22=r>0:=:===
<:<={<=
=>L$<=
=<>=O=?<<==T<==;;==::?==;=<:?_?=?=??==2=
>;;=\=
Z;=?=2=
==<;<=y=<=*?=
0==+1L@F;
888:5:=Gz
s:8b78:q:887:2w:7i744648F:79:7wL
4767::N::Y:78L:::}+89::469295::c
8:6466
:^:2:8::
9::8:O4555
::::8:c:6::,:7X58:778:4:49i&7
9Y :<5;@
0;0>;;;>q><;;<?<O;;;;;00T<;J;=
(Z00??;
;00S^?;;B;v?;!0?;;.;;
hi>;?;<-?;;;;0
>;Z;;;d>>;t;^0;<>R;;>0;
<<?;;@
;;?;G;;;;;;>>?
;;?o;;;0
801040?434118:1
6273068071]4N5
22#0UH60899006_4410;00009#085n9601u7419
50r1&11501094165
390587
}072810/
049`X50070093
=<>J$$M:?=$=;9$>?<$?<
$=$l >;?
<>>>P?=?$=?><
$,9z$?
<9$?<>
$;?$>z$:7975>4
89;=a7>2>A:$:::>Y>>(==}w5>:>63$l4#>
>$>366]=7>>7>
8A>L::I`6
=$>:t`>7>1:$>$7
::<>>>407}6$$>:<>$106_>i$$$;9<2qE>;I:(Y7>3<~69>1>>6$$3>$$@0F942>)=06$
R:9*::4P
C1744;0
44>;::9?
3>1:v9:o@:
333243=3333
332d3p333<3X3
3h;383\
333<3H
33=333
33<23333=
@d333,33$
3<`45XX4(43434
45::\3d9X
X:4XX4434
:X8pX4::5:
:X440:X534$:XX:443:4LH4`3@XlXX3XL
3X:: 53X344X
XhX:4t444X4:545(353
X34P445|4XX3X,4<4:4:DX3:d
XXXXX\
CryptBinaryToStringW
CertFindCertificateInStore
GetProcAddress
LoadLibraryA
RtlUnwind
VirtualProtect
GetModuleHandleW
GetStartupInfoW
lstrlenW
GetVersionExW
LoadLibraryW
DefineDosDeviceW
GetModuleHandleA
GetLastError
QueryDosDeviceW
GetDlgItem
GetDlgItemInt
GetWindowLongA
ShowWindow
LoadStringW
SendMessageW
MessageBoxW
DefWindowProcW
PostMessageW
__GetMainArgs
signal
InitCommonControlsEx
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegCloseKey
?GetStandardError@PROGRAM@@UAEPAVSTREAM@@XZ
??0DSTRING@@QAE@XZ
??0PATH@@QAE@XZ
RtlFreeHeap
RtlAllocateHeap
CRYPT32.DLL
KERNEL32.dll
USER32.DLL
CRTDLL.DLL
COMCTL32.dll
ADVAPI32.dll
ulib.dll
ntdll.dll
@MJe!V?$w
C{V.ny
`yIb]
b#~AIz)q
6T0P8ZrceJbAJ
? Z8zH
d@hj&N
E2zix'4t
Q]_G:;
C^$b,6cMj
t;Ef5dp7
q6^\$B}9'4b{
Ru`I%-b5%
u6F9KMj"T
(ukE#
zkrE`hB2_
zA3ipV.Evt\
e0Q,TR{5
dxGf^_ s:
=|qz\`>:
YoKZ5`I
iRP))X9b3ysN)0c'
'{<injb\-gH^w
+-!AGE#
S%|m5+`
22p222
(C(C(C(C(C(C(C(C(C
<C<C<C<C
dCdCdCdC
xCxCxC

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255 131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.