1.1
低危
62 个模型检测该样本为恶意！
重新分析
更多

185279009ed1b0190c1a5aebf646c9c395c7b70603c895a65abd55d87f2ded73

185279009ed1b0190c1a5aebf646c9c395c7b70603c895a65abd55d87f2ded73.exe

分析耗时

193s

最近分析

364天前

文件大小

206.7KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN WORM GANELP
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.80
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Dropper-GHV [Drp] 20191125 18.4.3895.0
Baidu Win32.Trojan.Agent.dc 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20191125 2013.8.14.323
McAfee W32/Autorun.worm.aacd 20191125 6.0.6.653
Tencent Trojan.Win32.FakeFolder.bba 20191125 1.0.0.1
静态指标
行为判定
动态指标
在 PE 资源中识别到外语 (3 个事件)
name RT_ICON language LANG_TURKISH filetype None sublanguage SUBLANG_DEFAULT offset 0x00040568 size 0x00001ca8
name RT_GROUP_ICON language LANG_TURKISH filetype None sublanguage SUBLANG_DEFAULT offset 0x00042210 size 0x00000014
name RT_VERSION language LANG_TURKISH filetype None sublanguage SUBLANG_DEFAULT offset 0x00040220 size 0x00000348
网络通信
与未执行 DNS 查询的主机进行通信 (1 个事件)
host 114.114.114.114
文件已被 VirusTotal 上 62 个反病毒引擎识别为恶意 (50 out of 62 个事件)
ALYac Trojan.Generic.8087212
APEX Malicious
AVG Win32:Dropper-GHV [Drp]
Acronis suspicious
Ad-Aware Trojan.Generic.8087212
AhnLab-V3 Trojan/Win32.Npkon.R18258
Arcabit Trojan.Generic.D7B66AC
Avast Win32:Dropper-GHV [Drp]
Avira TR/Spy.Agent.586689
Baidu Win32.Trojan.Agent.dc
BitDefender Trojan.Generic.8087212
BitDefenderTheta Gen:NN.ZexaF.32253.my1@a0a58mgG
Bkav W32.SunimodG.Trojan
CAT-QuickHeal Trojan.Mauvaise.SL1
CMC Worm.Win32.Juched!O
ClamAV Win.Worm.Ganelp-6776766-0
Comodo Worm.Win32.Jushed.KA@4cysvx
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.86ba53
Cylance Unsafe
Cyren W32/Agent.KI.gen!Eldorado
DrWeb Trojan.Proxy.20270
ESET-NOD32 a variant of Win32/Agent.TNE
Emsisoft Trojan.Generic.8087212 (B)
Endgame malicious (high confidence)
F-Prot W32/Agent.KI.gen!Eldorado
F-Secure Trojan.TR/Spy.Agent.586689
FireEye Generic.mg.d5c365086ba5349a
Fortinet W32/Agent.SRG!tr
GData Trojan.Generic.8087212
Ikarus Trojan.Win32.Webprefix
Invincea heuristic
Jiangmin Trojan/Generic.acomf
K7AntiVirus EmailWorm ( 002a8f0e1 )
K7GW EmailWorm ( 002a8f0e1 )
Kaspersky Worm.Win32.Juched.fkf
MAX malware (ai score=82)
Malwarebytes Trojan.FakeJava
MaxSecure Worm.Juched.dho
McAfee W32/Autorun.worm.aacd
McAfee-GW-Edition BehavesLike.Win32.Autorun.dz
MicroWorld-eScan Trojan.Generic.8087212
Microsoft Worm:Win32/Ganelp.E
NANO-Antivirus Trojan.Win32.Juched.dfacwp
Panda Generic Malware
Qihoo-360 HEUR/QVM02.0.74DB.Malware.Gen
Rising Trojan.Fakefolder!1.6944 (CLASSIC)
SUPERAntiSpyware Trojan.Agent/Gen-Ganel
SentinelOne DFI - Suspicious PE
Sophos W32/Ganelp-A
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2011-07-26 04:59:34

PE Imphash

43df92b7b77db2760430968647afb835

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00025b40 0x00026000 3.874682388287175
.rdata 0x00027000 0x00001a5c 0x00002000 4.3476560547050065
.data 0x00029000 0x000156a4 0x00004000 0.44307457518515214
.idata 0x0003f000 0x000009e4 0x00001000 2.9006850755721927
.rsrc 0x00040000 0x00002990 0x00003000 2.3785339001265813
.reloc 0x00043000 0x00001352 0x00002000 4.126025689189836

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00040568 0x00001ca8 LANG_TURKISH SUBLANG_DEFAULT None
RT_GROUP_ICON 0x00042210 0x00000014 LANG_TURKISH SUBLANG_DEFAULT None
RT_VERSION 0x00040220 0x00000348 LANG_TURKISH SUBLANG_DEFAULT None

Imports

Library KERNEL32.dll:
• 0x43f268 GetLastError
• 0x43f26c GetSystemTime
• 0x43f270 MultiByteToWideChar
• 0x43f274 GetLocaleInfoA
• 0x43f278 GetModuleHandleA
• 0x43f27c FindNextFileA
• 0x43f280 FindFirstFileA
• 0x43f284 FlushFileBuffers
• 0x43f288 SetStdHandle
• 0x43f28c FindClose
• 0x43f290 Sleep
• 0x43f294 SetFilePointer
• 0x43f298 LCMapStringW
• 0x43f29c LCMapStringA
• 0x43f2a0 GetStringTypeW
• 0x43f2a4 ExitProcess
• 0x43f2a8 TerminateProcess
• 0x43f2ac GetCurrentProcess
• 0x43f2b0 GetStartupInfoA
• 0x43f2b4 GetCommandLineA
• 0x43f2b8 GetVersion
• 0x43f2bc DebugBreak
• 0x43f2c0 GetStdHandle
• 0x43f2c4 WriteFile
• 0x43f2cc OutputDebugStringA
• 0x43f2d0 GetProcAddress
• 0x43f2d4 LoadLibraryA
• 0x43f2dc GetModuleFileNameA
• 0x43f2e0 IsBadWritePtr
• 0x43f2e4 IsBadReadPtr
• 0x43f2e8 HeapValidate
• 0x43f2f8 WideCharToMultiByte
• 0x43f304 SetHandleCount
• 0x43f308 GetFileType
• 0x43f310 GetVersionExA
• 0x43f314 HeapDestroy
• 0x43f318 HeapCreate
• 0x43f31c HeapFree
• 0x43f320 VirtualFree
• 0x43f324 RtlUnwind
• 0x43f32c HeapAlloc
• 0x43f330 HeapReAlloc
• 0x43f334 VirtualAlloc
• 0x43f338 GetCPInfo
• 0x43f33c GetACP
• 0x43f340 GetOEMCP
• 0x43f344 GetStringTypeA
• 0x43f348 CloseHandle
Library USER32.dll:
• 0x43f3a4 MessageBoxA
Library ADVAPI32.dll:
• 0x43f238 GetUserNameW
Library ole32.dll:
• 0x43f3d4 CoUninitialize
• 0x43f3d8 CoCreateInstance
• 0x43f3dc CoInitialize
L!This program cannot be run in DOS mode.
b,b,b,n,b,i,b,Bl,b,h,b,b,b,q,b,c,b,t,b,
d,b,Richb,
`.rdata
@.data
.idata
@.reloc
UDSVW}
E_^[]UPSVW}
_^[P;P
]UTSVW}
_^[]ULSVW}
MU;U}gE
E}^}7M
_^[L;"M
]U@SVW}
_^[@;WL
]UDSVW}
_^[]UPSVW}
>E<DQC
_^[]UDSVW}
_^[]UlSVW}
u,U;Uu
t\U;Uu
E_^[l;tD
]UpSVW}
EMMU3f
Q<UE8PE
MQxUEH|MU
M;M}-U
_^[p;xB
]U`SVW}
EMMU3f
Q<UE8PE
3_MQxUEH|MU
ME_^[]UtSVW}
_^[t;>
]UtSVW}
_^[t;W:
]U@SVW}
3zQRi;
]U|SVW}
_^[|;.
]UHSVW}
_^[H;:%
]UHSVW}
E_^[H;
]UHSVW}
9Us)E3
_^[H;-"
3EEEfE
jdTQhDB
MQh`pB
URh@pB
EPR ;J
MQPp;
MQPx;
fUfUfEfEfMfMfE
-oje`[VQLG_^[
;}}PRcP
wuWhHuB
E}tEEP
9UtOEi
9UtVEi
9MtVUi
9EtVMi
tAt2t$
PRSVWhvB
_^[ZX]
r)$He@
DDDDDDDDDDDDDD
GIt%t)
Gt/KuD$
GKu[^D$
[^_U=C
]UQ=,C
]UjhwB
EMQUR'
eEPJMd
_^[]U=<C
E]UQlC
t h|xB
@v)URc
RPQRPQRPQREPM
EE]UQE
u&hpzB
E _^[]UQj
EE]UQj
EE]UQj
3u&h0|B
;t!hX{B
$REPw:
M;Mt!h${B
;Et!hzB
E_^[]UQj
EE]UQj
]UQSVWB
t!ht}B
uCE PMQ
uCE PMQ
;Mt!h|B
;Mt!h|B
_^[]Uj
t!ht}B
EE_^[]UQ
E]UQSVWE
t!ht}B
_^[]UQ B
E]UQSVWE
E_^[]U
3uNh~B
u&ht~B
u:U REH
QURhH}B
u:E PMQ
u/M Qh@~B
QURh ~B
RE PMQh}B
E_^[]9@
REPn5
ucMQURE
E]UQ`C
H0_^[]U
A,+B,M
J0+H0U
E_^[]U
u_^[]U\SVWE
UB E=\B
EPMQhB
u_^[]U4SVWEP
3_^[]UQSVW}
3u_^[]U
E]UQ=C
=tGjyh
EMMUREPj
UREPMU
PMQUR#
EPMQUREPj
3%MQUREPO
MU;U}eE8tXM
E}tXMQ
E}@}2M< C
]USVWUj
t.;t$$t(4v
VC20XC00U
]_^[]UL$
_^[]UQE
]U0SVWEE
E_^[]U,SVWEE
E_^[]Q=
EE]UQ}
PMQUREPB/
EE]U0E
REPMQURR,
MQUREP
UREPMQ$
uKUREPM
UREPMQ?#
EE]Uh]U=
UE;Es%MU
MU;Us$EM#
MU;UuIC
U#TDU}
E}?} MU
UE;Ew]MA
UUE+EE
M;tU;u
tn} }2
,3]ULB
u3]UQE
MU;UsiE
MU;UsiE
EM;M}4U
s3E;Eu
3{UU[E
UE]U(E
3]U0SVWEE
E_^[]U
MQUREPj
]UQ=$C
s{Uk0E
Mk0UEfAtB
Ar;Zw2C
Qar;zw2C
M0M_=\B
B8t6t8t't
8t3^[_G^[_
^[_UWVSM
[^_SVD$
ddIdd.wld3
``C``5
fEfMQRa
U tHE@t
RPRPu0RPQR9~
ERM+MM
fZfZPxQ
QtRxP)
fA]UWVu
DDDDDDDDDDDDDD
^_UjhB
SVWe=C
3CMQURE
PMQURE
_^[]UjhB
SVWe=C
REPMQU
EPMQUREPM
EPMQh
QUREPh
UREPMQh
QU+RQU
E+]UQSVW}
_^[]UE
@]UQ= C
M}-s#UE
~VUREH
;Eu!MQ
E_^[]UQE
EE]UQVE
3^]USVW}
_^[]%C
Oe !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_abcdefghijklmnopqrstuvwxyz{|}~
VmfantunmoelIriGoeotA
WoitAtdDcyenserGiwro
yeploiCFA
EreabtimVaAevntieGnonrl
MllmtuiaedFNAGoeee
aitAeDcyreerCtro
FAieterteltuASitbs
erebyrirFLa
drAabyoirLLa
MlnAtuaeedHlGoed
PAetcreodsGrds
n2lr3leldke.
broFlleGae
bloAclloGal
FSteeelzGii
dealeiRF
tliirFWee
aieFAreeCtl
snoaelHlCed
c3xosersNPe2t
c3rosirsFtPe2s
CerstrPedertcIGunos
aoe2pteTh3aorelpnhCtolSs
LcrSntiDeiAeglvrsGoaitg
DeetvpeiyGrTA
eilFAeeeDtl
oitAmDcyeeerRvro
dsnoilFCe
dtenxlieiFNFA
dslnriiiFAFFte
etsnteoaennlHlIrCed
GipFAtteFel
etnAtentnnocIrCe
etnteennpIrOA
i.ntlielwnd
PipFAtteFul
leeexthEuSlcA
l.e2lh3lsld
$*$%u}-sEBB5>Ds?>DB?<$5D-$5BF935C-$81B54q335CC-!1B1=5D5BC-v9B5G1<<!?<93I-$D1>41B4!B?69<5-qED8?B9J54q@@<931D9?>C-|9CD
bd:ael*nE::
CegsyeoeRlK
SaEgVeetuARelx
OKxgnEeeyRpeA
a2lv3ldidap.
DtlgeaAelVeReeu
CtygaeAeeKxRreE
\Java\jre-
gFsomeralPri
$?6DG1B5]aaaaaaaaaaaaaaaaa]sEBB5>D'5BC9?>]#E>
e.gteeixrde
/Downs/HelpVer.hlp
/Downs/Help.hlp
Help.hlp
/Private/
Pfile.hlp
gdaheb123
?>D85<9>EH
6D@]DB9@?4]3?=
gdaheb
eedeia
7B9@D?<?:9]8?CD\54]>5D
ieagecJH
2ab0h_hbige
6D@]2I5D8?CDab]3?=
jusched.
!B?7B1=v9<5C
Fi386\chkesp.c
The value of ESP was not properly saved across a function call. This is usually a result of calling a function declared with one calling convention with a function pointer declared with a different calling convention.
Assertion Failed
Warning
%s(%d) : %s
Assertion failed!
Assertion failed:
_CrtDbgReport: String too long or IO Error
Second Chance Assertion Failed: File %s, Line %d
wsprintfA
user32.dll
Microsoft Visual C++ Debug Library
Debug %s!
Program: %s%s%s%s%s%s%s%s%s%s%s
(Press Retry to debug the application)
Module:
File:
Line:
Expression:
For information on how your program can cause an assertion
failure, see the Visual C++ documentation on asserts.
<program name unknown>
dbgrpt.c
szUserMessage != NULL
Client
Ignore
Normal
Error: memory allocation: bad memory block type.
Invalid allocation size: %u bytes.
Client hook allocation failure.
Client hook allocation failure at file %hs line %d.
dbgheap.c
_CrtCheckMemory()
_pFirstBlock == pOldBlock
_pLastBlock == pOldBlock
fRealloc || (!fRealloc && pNewBlock == pOldBlock)
_BLOCK_TYPE(pOldBlock->nBlockUse)==_BLOCK_TYPE(nBlockUse)
pOldBlock->nLine == IGNORE_LINE && pOldBlock->lRequest == IGNORE_REQ
_CrtIsValidHeapPointer(pUserData)
Allocation too large or negative: %u bytes.
Client hook re-allocation failure.
Client hook re-allocation failure at file %hs line %d.
_pFirstBlock == pHead
_pLastBlock == pHead
pHead->nBlockUse == nBlockUse
pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ
DAMAGE: after %hs block (#%d) at 0x%08X.
DAMAGE: before %hs block (#%d) at 0x%08X.
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)
Client hook free failure.
memory check error at 0x%08X = 0x%02X, should be 0x%02X.
%hs located at 0x%08X is %u bytes long.
%hs allocated at file %hs(%d).
DAMAGE: on top of Free block at 0x%08X.
DAMAGED
_heapchk fails with unknown return value!
_heapchk fails with _HEAPBADPTR.
_heapchk fails with _HEAPBADEND.
_heapchk fails with _HEAPBADNODE.
_heapchk fails with _HEAPBADBEGIN.
Bad memory block found at 0x%08X.
_CrtMemCheckPoint: NULL state pointer.
_CrtMemDifference: NULL state pointer.
Object dump complete.
crt block at 0x%08X, subtype %x, %u bytes long.
normal block at 0x%08X, %u bytes long.
client block at 0x%08X, subtype %x, %u bytes long.
{%ld}
%hs(%d) :
#File Error#(%d) :
Dumping objects ->
Data: <%s> %s
Detected memory leaks!
Total allocations: %ld bytes.
Largest number used: %ld bytes.
%ld bytes in %ld %hs Blocks.
stdenvp.c
stdargv.c
a_env.c
ioinit.c
__GLOBAL_HEAP_SELECTED
__MSVCRT_HEAP_SELECT
runtime error
TLOSS error
SING error
DOMAIN error
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
abnormal program termination
- not enough space for environment
- not enough space for arguments
- floating point not loaded
Microsoft Visual C++ Runtime Library
Runtime Error!
Program:
format != NULL
sprintf.c
string != NULL
vsprintf.c
GetLastActivePopup
GetActiveWindow
MessageBoxA
("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)
_flsbuf.c
str != NULL
`h````
ppxxxx
(null)
output.c
ch != _T('\0')
_getbuf.c
_file.c
osfinfo.c
fclose.c
_freebuf.c
stream != NULL
aa3vd2apeJUt
a3d2peUt
htdocs
GetModuleHandleA
GetLastError
GetSystemTime
MultiByteToWideChar
GetLocaleInfoA
FindClose
FindNextFileA
FindFirstFileA
KERNEL32.dll
MessageBoxA
USER32.dll
GetUserNameW
ADVAPI32.dll
CoUninitialize
CoCreateInstance
CoInitialize
ole32.dll
ExitProcess
TerminateProcess
GetCurrentProcess
GetStartupInfoA
GetCommandLineA
GetVersion
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
GetProcAddress
LoadLibraryA
InterlockedIncrement
GetModuleFileNameA
IsBadWritePtr
IsBadReadPtr
HeapValidate
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
HeapFree
VirtualFree
RtlUnwind
SetConsoleCtrlHandler
HeapAlloc
HeapReAlloc
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetFilePointer
SetStdHandle
FlushFileBuffers
CloseHandle
)y)y)y)y)y
)y)y)y)y
y)y)y)y
kkcccccJ)
})y)y)y
kkkkkkkkkkcJ)
)y)y)y)y
sssssssssssssskR1
)y)y)y)y
sssssssssssssssss{{Z9!
)y)y)y)y
!ssssssssssssss{{{{{{{{{ICONMD5.6c78a9fa
!{{{{{{{{{{{{{{{{{{{{{{{{{{kZ)y
!{{{{{{{{{{{{{{{{{{{{{{{{{{J)y
))sc))y
11kcZ1
RRkck!)y
Zck1)y
9kc!)y
)9{9)y
6666666i777
8(8<8L8^8k8|888888
9)909=9D9Q9X9b9l9v999999999~::::::::
;";,;6;=;J;Q;[;e;r;y;;;;;;;;;;;;<<c=
>2>V>]>n>>>>>>>
0K2c2o2v2222222222
3-343@3G3_3f3r3y33333333333
4'4.4:4A4Y4`4l4s4444{55555555555
6)606<6C6[6b6n6u66666666666
7#7*767=7U7\7h7o777777777777
8$80878O8V8b8i888888888888
:.::::U;;;
<.<E<p<<<<====
> ><>H>O>k>w>}>>>>>
?5?E?a?m?s????
1,181?1[1g1m1v1
2!212M2Y2_2n222y333333/4U44
585L5q5}555555555
6u6666
898^8r8888888
9"9G9R9p9}9999999
=?=K=i=z=========
?"?-?@????
0)0:0L0^0q0z00000
1'2>2L2V222222233_4!56666
777777
8 848b9x999:W:';;;q<<~====
>">7>I>[>l>q>>>>>>>>>
?$???N?i?
1)1.11&2Z2`2l222203?3`3333333
434C4S44444I5q55555555
6B6r6666677/8O8[8o8899999
;*;>;R;;;;;;;
< <'<@<T<w<======
>X>_>p>>>>>>
22222222222222o3t3{384P4W4_4d4h4l444444444444B5H5L5P5T55555555
6;6m6t6x6|66666666666999999:::::::::::
;,;C;Q;;;;;;;;;;;;;
<2<7<A<a<<<
=%=D=U======
>$>3>E>Q>>>>>
?$?)?/?G?T?d?i?o????
0#070`0}000000
10171A1U1_11111
2>2G222
3/3I3U3i3u3333333
4#4w4}444
6"6>6J6k66666
7[7`777
8!8'8/858;8C8T8]88888W:l:x:::::
;7;;;;;
<x<<<<
=$=,=2=;=A=G=N=S=x====<>F>R>s>>>>>>>>>
0I0U00000
1 1D111111=2I2g2o2u2222222
3+3=3q3333
4h4t444
555%6j666666
7:7?7b7g77
8>8i8888=9p99999999
:d:|::
;.;5;@;~;;;;;Q<<<<<
?q?v???
70h000
1J1111`2222S3e3j333&4N4444
5$555@5T5n55555555
676O6W6d6m666X7l77777!8k8z8888888888
9g9p99:<
======
>>>>>>
?#?w????
0!0O00000
1 1111A2T222
3$3S333
4Z44555
6"6)656G6N6h6t6666666666
7#72797@7T777
8!8%9.979M9V9999999
::(:/:U:^:::::
;U;h;t;>>>>????
12191?1K1R1^1f1q1y11111
2O2g22222
3r3{33333333
4*44484<4@4D4H4w444444444
5&5+505:5?5E5N5]5j5555555v66666
7'7.7e77777@88888
:::::,;;;;<B<Q<<<<
===D=L=======
> >*>e>m>u>}>>>>>>E?K?
????????????
0 0+0I5U5^5z555555555555
6)60666>6F6R6[6j6s6|6666666
7S7_7777728;;;;;
<<8<><G<L<U<g<n<<<<<<=
5"5)545<5E5U5c5o555555555555555
6$6+6=6j66j74<\<x<<<<<<<<<
= =)=5=(>/>=>D>c>i>z>>>>>>J?\?d?
1711w222I33r44 9%9*;l;u;;;h<<V>>>
0.040>0L0x000000@1L1t11111111
22-272E2N22222222
3!3H3r3y3+424X4|444
505U5c5|5555
6"616F6T6u6}666
707H8r8889<<==
>>>>???
0G0S000
2!222t3F445
6#6T;X;\;`;d;h;l;p;t;x;|;;;;;;;;;;;;;;;;;
> >'>/>4>8><>e>>>>>>>>>>>
? ?$?????????
0=0D0H0L0P0T0X0\0`000000
181F1N1X1i1s1}111111
222222
3.3;3E3q33333R4w44J5w55H6w666&7{777777758O8n88888
:I:S:o::::::
;';C;L;Y;;
<<+<4<B<K<Y<_<h<v<<<<<<<
=(=K=u======
>->9>?>U>s>
?8?]?b?j?
0%030F0V0`0y0000000
1 1*1H1]1|11111?2I2~22222
3%34444
555I6^6p6666666
7!7+777777888888888888888888888
9$9*90969<9B9H9N9T9Z9`9f9l9r9x9~999999
555555
3 6:::::::::;;;;;;;;;;;;;;
< <(<,<0<4<
H<P<T<`?d?p?x?
2d74<<7?:l?<DD?GBtGDLLGOJ|OLTTOWRWT\\W_Z_\dd_gb2d74<<7?:l?<DD?GBtGDLLGOJ|OLTTOWRWT\\W_Z_\dd_gb2d74<<7?:l?<DD?GBtGDLLGOJ|OLTTOWRWT\\W_Z_\dd_gb4d74:k?@<l?<BsGHDtGDJ{OPL|OLRWXTWTZ_`\_\bghdgd384<5fgm;@<D=nouCHDLEvw}KPLTM~
SXT\U[`\d]chdd2chhgjil:kpporqtBsxxwzy|J{
RZbjrz
3d6h459>;l>p<=AFCtFxDEINK|NLMQVSVTUY^[^\]afcf69d<8f8>>AlD@n@FFItLHvHNNQ|TP~PVVY\XX^^ad``ffilh1f7ii9j
9n?qqAr
AvGyyIz
I~OQQWY'Y_a/a92cdeg;mA:klmoCuIBstuwK}QJ{|}
SYR[aZcibkq278ie<9i:?@qmDAqBGHyuLIyJOP}TQRWX\YZ_`dabgf2h888kkn:p@@@ssvBxHHH{{~JPPPRXXXZ```bhhhjppprxxxz
9c5857jmAk=@=?ruIsEHEGz}Q{MPMOYUXUWa]`]_iehegq6ce;j:=@>kmCrBEHFsuKzJMPN{}SRUXV[Z]`^cbehfkj8ehe:>=<@mpmBFEDHuxuJNMLP}}RVUTXZ^]\`bfedhjnml6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffiknd53e<<;:l=;mDDCBtECuLLKJ|MK}TTSRUS\\[Z][ddcbecllkjmkttsrus||{z}{
72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffiknc9:e;=g:kABmCEoBsIJuKMwJ{QR}SU
RYZ[]Zabcebijkmjqrsuryz{}z
72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemmd53e<<;:l=;mDDCBtECuLLKJ|MK}TTSRUS\\[Z][ddcbecllkjmkttsrus||{z}{
72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemmd53e<<;:l=;mDDCBtECuLLKJ|MK}TTSRUS\\[Z][ddcbecllkjmkttsrus||{z}{
72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemmd53e<<;:l=;mDDCBtECuLLKJ|MK}TTSRUS\\[Z][ddcbecllkjmkttsrus||{z}{
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffiknd53e<<;:l=;mDDCBtECuLLKJ|MK}TTSRUS\\[Z][ddcbecllkjmkttsrus||{z}{
6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn72f5g==l?:n=oEEtGBvEwMM|OJ~M
UUWRU]]_Z]eegbemm6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn6d9;e>lh>lACmFtpFtIKuN|xN|QS}VVY[^^acffikn
(null)
((((( H
VS_VERSION_INFO
StringFileInfo
000004b0
Comments
CompanyName
FileDescription
FileVersion
6.0.150.3
InternalName
jusched
LegalCopyright
Copyright
LegalTrademarks
OriginalFilename
jusched
PrivateBuild
Sun Microsystems, Inc.
ProductName
Java(TM) Platform SE 6 U15
ProductVersion
6.0.150.3
SpecialBuild
VarFileInfo
Translation

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255 131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.