1.3
低危

219c02fde6ba7b6ccc23f3fa240b4443fc8177abfbdf22fa4659e3c137befcde

219c02fde6ba7b6ccc23f3fa240b4443fc8177abfbdf22fa4659e3c137befcde.exe

分析耗时

194s

最近分析

368天前

文件大小

88.4KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN PWSTEALER
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.81
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Baidu Win32.Trojan-PSW.QQPass.p 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20200514 2013.8.14.323
McAfee GenericRXEP-HY!D8C5C590B3AD 20200514 6.0.6.653
Tencent Malware.Win32.Gencirc.10b0cf17 20200514 1.0.0.1
静态指标
行为判定
动态指标
该二进制文件可能包含加密或压缩数据,表明使用了打包工具 (2 个事件)
section {'name': 'UPX1', 'virtual_address': '0x00068000', 'virtual_size': '0x00016000', 'size_of_data': '0x00015600', 'entropy': 7.913779073514341} entropy 7.913779073514341 description 发现高熵的节
entropy 0.9884393063583815 description 此PE文件的整体熵值较高
可执行文件使用UPX压缩 (3 个事件)
section UPX0 description 节名称指示UPX
section UPX1 description 节名称指示UPX
section UPX2 description 节名称指示UPX
网络通信
与未执行 DNS 查询的主机进行通信 (2 个事件)
host 114.114.114.114
host 8.8.8.8
文件已被 VirusTotal 上 56 个反病毒引擎识别为恶意 (50 out of 56 个事件)
ALYac DeepScan:Generic.PWStealer.C5B650BD
APEX Malicious
AVG Win32:Trojan-gen
Acronis suspicious
Ad-Aware DeepScan:Generic.PWStealer.C5B650BD
AhnLab-V3 Trojan/Win32.Stealer.R143066
Antiy-AVL Trojan/Win32.Scar
Arcabit DeepScan:Generic.PWStealer.C5B650BD
Avira TR/Spy.Gen7
Baidu Win32.Trojan-PSW.QQPass.p
BitDefender DeepScan:Generic.PWStealer.C5B650BD
BitDefenderTheta AI:Packer.0969EBF723
Bkav W32.AIDetectVM.malware
CAT-QuickHeal Risktool.Flystudio.17330
ClamAV Win.Trojan.Pwstealer-162
Comodo TrojWare.Win32.PWS.QQpass.WE@5reqqq
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.9c7a4e
Cyren W32/S-fe4d7b20!Eldorado
DrWeb Trojan.DownLoader12.3953
ESET-NOD32 a variant of Win32/PSW.QQPass.OUO
Emsisoft DeepScan:Generic.PWStealer.C5B650BD (B)
Endgame malicious (moderate confidence)
F-Secure Trojan.TR/Spy.Gen7
FireEye Generic.mg.e1141bb9c7a4efee
Fortinet W32/GameHack.AX!tr
GData Win32.Trojan.Agent.WP
Ikarus Trojan.Win32.PSW
Invincea heuristic
Jiangmin Trojan/Scar.bdff
K7AntiVirus Password-Stealer ( 0055e3dc1 )
K7GW Password-Stealer ( 0055e3dc1 )
Kaspersky HEUR:Trojan.Win32.Tremp.pef
MAX malware (ai score=86)
Malwarebytes Trojan.QQPass
MaxSecure Trojan.Malware.300983.susgen
McAfee GenericRXEP-HY!D8C5C590B3AD
McAfee-GW-Edition BehavesLike.Win32.Generic.mc
MicroWorld-eScan DeepScan:Generic.PWStealer.C5B650BD
Microsoft Trojan:Win32/Wacatac.C!ml
NANO-Antivirus Trojan.Win32.QQPass.dlxkwg
Panda Trj/Genetic.gen
Qihoo-360 HEUR/QVM11.1.368B.Malware.Gen
Rising Trojan.Kryptik!1.B3E8 (CLASSIC)
Sangfor Malware
SentinelOne DFI - Malicious PE
Sophos Troj/Agent-BBAC
Tencent Malware.Win32.Gencirc.10b0cf17
TotalDefense Win32/Oflwr.A!crypt
Trapmine malicious.high.ml.score
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2015-01-08 14:30:09

PE Imphash

b8d2fb47d3c1b25fb34f5d4eb1f191e7

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
UPX0 0x00001000 0x00067000 0x00000000 0.0
UPX1 0x00068000 0x00016000 0x00015600 7.913779073514341
UPX2 0x0007e000 0x00001000 0x00000400 3.270811803031493

Imports

Library KERNEL32.DLL:
0x47e118 LoadLibraryA
0x47e11c GetProcAddress
0x47e120 VirtualProtect
0x47e124 VirtualAlloc
0x47e128 VirtualFree
0x47e12c ExitProcess
Library ADVAPI32.dll:
0x47e134 RegCloseKey
Library ATL.DLL:
0x47e13c None
Library GDI32.dll:
0x47e144 BitBlt
Library gdiplus.dll:
0x47e14c GdipDrawLine
Library MSIMG32.dll:
0x47e154 AlphaBlend
Library MSVCRT.dll:
0x47e15c atoi
Library ole32.dll:
0x47e164 OleRun
Library OLEAUT32.dll:
0x47e16c OleLoadPicture
Library SHELL32.dll:
0x47e174 DragFinish
Library SHLWAPI.dll:
0x47e17c PathFileExistsA
Library USER32.dll:
0x47e184 GetDC
Library WININET.dll:
0x47e18c InternetOpenA

L!This program cannot be run in DOS mode.
fAz5Az5Az5:f5Cz5u5Ez5f5Cz5.e5Cz5w\5Cz5w\5Nz5w\5Cz5Az5z{5u5Vz5Az5@z5e5
z5RichAz5
3+/)99PLCrB
ehkuuEP
JIhw0M
cm}&mUC|
37B+iL15~SE
DIfH1]4BGDCE@T"d
4`6|E@1M
4rH[D8UQTtSwCs
{)Q=a<mG]_
+<$wLQ
wh^F>X
co?X+QSPz
Se(dY*P
t,YI>!CXSo
YxWBVdT
K$P&Hw9l4}}zp
M7dL%]S\Sp5
\jy<#t-k
'T$tL$
UMh].`p
T;qy-q
Av+-ps
!^0O3 P)
-ov.5`AI
.o]$LMJ~
*5E<]11
4%[uR9
a]Z-|S
0Xa!,+)/p>zg
ed"N@!
^m[PFq
c$hDK- "tp}-Wj
c7.G8UPJ
3GvDB<'s`!R
1.PBp
.(8d8".R
$4Ui*1M
84(jJ8
B~E]5(f
3-Yc`y9
%/ "M,&X!-eR=I0]
EZ>vP
zBNBffLs`uI
6fXJuI
IDuT*%>
ggEAbVQ.bS8.Bq5
1'2JBm-
s:8]0S
yT)p/!b
Vk<naPP1B6F
G>*C?*^!
)8~B}:r
h%hw(hQ
2D:s\tjQ5B
U$3gOh
D"VW|$
uRFGHt
tt+t'NWJ
P8F@3R
gL5(1?
F@Lc ,
eq!Gt=
7#)Uv
Wa= P#
e9w8E]
I/yB$4L
`U"iI>
[a;X+u
-=ucVGUB
JhRi O(
PrEB_uP@
AhG9ibX^i<31Jd!
e3;)iojG
,U,xgGauti0hS
Qd!,@`
3z$WJJ
{jLqV\3
\Ho "z3S
$,3S$W?HPXAQS
Y[;|1$
X[YrMsE2$
E7n5w/FH<
L47KFD!n<
1j8jC TBj:Vr
B8qn5j
T*LD<4,JR$
^Hz+Ku,
Zh.HL`n
*j]ZCaI^2P:)c
GlP0d?=
Ub`@Ue
LHD+PiXW%
#0o 9*H9
$5TAL
PjXi\E
VL;5R!
x{atg_
F9D(F J
x<c>`5`F=8@a
.Q@[#<*.
-FQ(5(od
9WeGL_c
7HTE<&
G U'7i|A
tjX%cj
)WP"o9iv?hs)
G4o1FU
z}rLBa
>0t)ne
p1(co
aGx oN
/PI&UMV
vjO\MgH
KX'&GL1(/f
z thPi6
)8Tu|J2Tc
uFxA 1v
!v/;/ZR&;
:n[%T%R0
$B$OZ=E
zR7"3.
4\@=#6
MM{GD=E
u&0Rz]jihm
1<@q.@g
Kg"xJ%_(
:B! IC
!qD2u#=A
(d y]u|+kO:
2Wc!".@.!
1GB-d=
$+F2~)ls?
I-mUEed+gFfS\2
kV0!)-ADA
oDlDrAP3^ vlszk@MZE
3_hD,=yB8
.yAm0@&i18,-Zm8
3!`g%A
mEc`$]Qx
[Y#C@[
I%(N8M
4Q@-1eA3
Bm9U4X``
)"op`46F
7PI9pX]0Z
](WJUM
$ @h0z
:g<<8E5z
C<^c%B
][tN ? 3:5
J.ZH(>V_
;##ZHy?
A7Bew[_^
E57ErT)@
t7?(4'C[ &
.\lU{g
:_/0c1fm.-^R#v&
2>SL$W
4JPD24
rI0UlB
MK&( 8.u(
f+(=a0Q
hEAUh" E{H`
!*i@mXF
_Rvm*"q_
0VH;GHA#
<rC*p408h+
,:lGOJZ i8"
CC--0K
FIOB42
,Fdu W43
X;<'@=
pmSId,
M@FHsX
FB:RMDdm@
d8jD*2
6V0HEYdh/"G
"$q/`%
WbT^DDGns
H+y6'hC%^
`M][|5DW
g[6F&@>n
Ss yU!4
bq yADw
-'Dm#H!\m
Hi./dA}
^3wP51|@W+A
a!Cl5oBN"V
1`}\IM
^h7rmSo1!C
(d`*$*
RmM[@bYk
QL5CHG
Eh%#`F
2 D@<h;B
={`3iI
\GBid6
$C2CC0-\$W2.G*b
H\K<BAK###S
\ O$C-DeOnq]!
c*E h!(
&#8>eJA
! - cX<cub5
W Vr!C<E5!c'
9Q7"|:0
/egK$!
zS%A*+h9$,,W:
VI,>Wg
UX%gHX
+H5KWG&P
) m*PMiu"@6xXQ
V2 /0T
F!3+xX(,ox6B
]0$-md..Y1~
dWvW&c
1|<BA
9bT7D8w>p
E&22+t
c$$99kT|;W6
DgJBg;
e7S|+F}
lQi5A-9%GpXBfS
UdHH/`wbi}w
C1oMJ%yqU
@9iiRR@
C^i#iw
nW0s|$i"E#
:Kn$EZ
x@*Sr{{
UEXVKdb=
F922 d
YXOFPgOc
r#KCZW0
MNt:H4
7k>`5xxRC
WDZ;Hd)
Tryy0)L
'pa^(M
S_KHEam#9
t,)6y)B(6
1B0:<h9OT
4HO"J.P#x!G@2
!9.m1m#z
\.})a$
olpo`
rPsa%B
=Er$,mZl
{muIm-*e
`D_[{J)
hh{.wm"{
Ij4;B.
P$||\2rxxtt!#ppl
%)tx|=)]
PLxq\U
~WR4w-A$b
c-s#*Uu
+@ &s"T
P@(WZu
sH0Po1
E:#J %<
yA"9!yd
%u/>Na'0
u`J'}2M<
DhkLT)
T5kW4785P$=A%'|
T]_8|+
+@@Jb%
R)&F8tUU
U-4<kWL\
i$lhhdd
r`d%BhJhl
k7RE5jZ22PEMUB]
8J^T}R
:is(Ol
`kQ%e"=M0L]y(44Rp
T(9@d40B
y!SL\!"HT)B
H#"4v3pp
oLoqAB~Q~$'Cp~m
a+qF4g(
#dMet2
qy#dd@
pZ)JX D
O !%]22R
_d9kH$[
jDmj@C
7A5$fI
*9gK0N
iU"[J(C
A(CT*A:H/[
5c0Uh5`&0A< 8`
2s@?BKdJ&
7J5avEP-
0fUau3
W<7WU}O
:!lq'@j^'<tiQ
@CfS=IZA
%t*AWH
(21(5W]
2d7>$E
!Hs+1D
QJ@8(1y
1D2!C*?M%'A5
iF%%#Lr
,Pq!!$C e
UV0#,,}VV Mq
0`[`Q%
r(3B#iX!(S%(
$?<]Ru 2>Ut4
`0yFpyUh
!iQ0W
]_IJ,Up"
!cfZ/.j5GQH
ZY-<y
XSc!L
(/\CO
Dfh[BSn\`
)o$\(Q
g@+9Q2Q3
7<F;?M
CGA(]K
O\#y2W
om[QAg
9$(9iN,048<
9iN@HNLDP
9iT*dzo
2 2Eq
eX\$L`ltL2x|
s9@c(pA&l[\
tOd{7h
Di#kX-hE
B]nnc
r&oLbE
S2)%S2%2%S2
djS%JdJdJddJ%GrJ
8S2%#+J@
37%;))?C)GKOLm*SUWq[L
Lksw%){
upiG,E
7l4avA
kcm!w3lAR0Dt
#.@N-x
nE`+TB
3zMLF!
".y| bCB
X)N[GZ
am|/YX\a
[my.0X[jAOs1B"Lp
pV8_Ru%
rL]WB:4.CI
,v%cqDh
BR1u/
'r\Sog=F9$R0p>
GQ PY&~&j
]xEAOorgRQ
uEEYZQQ|ZWWR[A
wY:[Z_
*RSh4l]
yygRRt`
BNPbjMK=
Vem:.<
@V'p+)
G:l!5u8
,RE5'b
TZq1[):N#b
N!5i@2
L;$0E2
&Gl@r =
nT[UM{$W0
0zaLL$EQ
(4BqR0H&B
r*9Re6P.y
F@b]o/
V?0UkdO
RS5RN(=rT'9G
/s"d!9
\ LM#7
\9Y0g!$gls%
!eUF)oevOLK3
0Nd`='[QxW/p-}+o
RpHlXo
sDK!>Q
\7) %S
J-:PV$
{He3 =#
i\xl.D
H@TeLe
PJ@sqBB#PF
-:d"_n
8F@Tu@q!T{J.s
W{"}7X_^b
%E-ncq$0
9EbC6_u
]k!iDG)gU
tkZQGL
aUu4[e
fP-m%'EO}4BbugkM
DC=J8:u0
$E00r`
=fk(y)4@
a 'kC(ePXr$'(cU
'kN/:{hsn
@@rbW*D
E0(XY'
CaQE*e
"bLTZ
A=Sp(9
m!/B P
8#r("b
r"' /G#=#ixT$
Y+Pr$j$
#S%9!*%3
&79"'A'!h
JN))Da7
5y*wb8"
CyC)*+0
!+GC)B,
,<"K-H
r0nW0%/1'D
c##0[f
HP0BFFc8
6q!ND2k6
E7R7#B
oHP80_8
8sPr9`9
&T /B<
Pr<=@Yy
>!QH>s)B>
@"+boaL
?Q%YY`=N
`5Bd$B.
$U@G0IHa ,Bk%
90;h@
IB[P`B&!U
bAr@Ts
JsKLULS0@ F
MNtNO$1XG)+
$MO*DL
JNOO"Qr($*9
`Y4X: "
t(dS!9
m)$_e%A%
EIU="|U'
h(8GT(
[#!W4e8`%G$!
8Z45$q\
jY EH(_cEb
dVI^QdPreJeB
g<(d(2@((
jhWH<(
B^`"u;V7
3? *dC$S<q;G
d_tA((
E{v%S%
SSh,3(
6'hE4T{4;ilEgU[Jsy{u
K{s;j'0
|T|j!r0
X0uX(.W-
Ik80V<(
a0SYF
]!;"R-,8(
@LU25H9C2
\ ,(*.V%OH@
0!%mTVT^P
&&<-\X86XSW
ckf"HA.
<&<X8H
y07_He*
]BX=CH
)wH~IELP
|i"P:a
U3IyW#i "
9mx,j
W`XOB5
C(G\*8
VEqH$c
quZ 9w
]d`4A4K&
^ HX3sC
\`q!+@
h8%i,)h
C%;3]&s/
-hY\i"{`RH
0*Zh0!:
CRu`Us
X$~4K3ra
KRsm2@-
Fw2.i!L
.B/B!-
[p:H|M@j
Q*`1v|
SW!'J!
0nb8yMZ2
"I03i+
s74@\%L<HMifD0
J.`JDPP
9LJ.!XT
r T`y^r%
%G p$@l
.,`*4%
0HUHN2m-D
-*"HpdA
`lLIppJax2]FZ
U*$h0c
H2T@"d
gUv6yC
A*K7W.
s=0/Dpb`9&F
TKaUlZ
f5Bh\S
k7uj$H3Vg0
9%$a?o
$Iu|X]+
:'xRs
]-1&MK
aYu1AA
H}lS C
P )CT+I
CJU 5H)G8
!?|Bxq
M`@CH.
e!Ppi!?V
T0%5Gr
CTrD0tmxC)AIk=s(!;Af];
4]q|j^]0kkP
zyI. &
g}4B9(
An3.DT
P18*w_4
.Mu+?{
6he)Hl
W7i0,sF
KSW?f(`
8`'@?[
01uD']k
v}0Abq0w8U
NC8 Vlf
*&!t'a[Q
:U.w6H]
I0XC4@V
qH/v=eE
i.]RPE
5%\+yCn7Dm
"4+|RL
aUb\eq+C,
JDq 9 3`h0LA\C*
'UBzK'x%m'3
"HbAptWM
Z'W/.;
!Ugtk!BMmP
FcF*(=[I
QLm"1ctCb4-)k
ue\1UwH
TVMc.r%k3kC
z/_3]'`
S4KA4<
!i}Q,@4
990%dH8dPx}t
C9T7_n
A+7`.,
8$44C&v|)yk
uVb<F<}H
yBPd#`F
$/'9P`
@ul!$9XD
s'diu\2H>W!$Keu
BP|"%y
b_mG)$X
(9$fCv"
tRwNXqIut
XW!c`n
F\ dhi
PNLqYP i5
OJ&eBa%Ijcj
@o.9(P;BW
[\FZ(`@H
RjbM\U
W\#@ai
f6!WIf
Wy4_l-
@6E77l
-SD6;0
KC;ZI_a
*-ML;
^!0,xHb
I3j[ 6
HU[W0L
Jhlp)2
(a0ZA_R0@QO1CO
G:I<Xy
Rc899JG $@@%
EF'M@RZo
M'dRxN2PsG
mx'tI)0,*{
QHYT4xA?
Q5<j0Oy
CHa[RBA
@~umE\]T
7$I4BM@d-{
1if+<$G4
jkf-D(F
a1E8@J.
3$bDm*8u
V_dV|)?
b:/l1f
7)Fa*W
L/LCj?
an/3TM
C[l@a/a
C 7{Bg
L@ pgW
%\!Mg(!D
$5CBUI
P*U$}h
;PNQ4yK
vC}I9E
%cA`tS"$4Bi
\iaEM`%i
_ZhAr4 %p[m`Hc
T"1?4p@+yR
j\Ab_@
^|4AoP
icxUDU
H(+ ?1<x
w6KOXkY+
WaR:PSUR0
Tr^>Ax
+ohD>.
['4{fDD0S#p0B!
iVK{0B.px
noE0(a
a;-`01
/*yAS$
*GiUg_ ^@Q
?Q`j%Ik
.h)PiG
"'Hm q#d
e.yPm=,
Wh$a[ /&BQ,%
CT$$&$7
'BN"@!gV
Jdh|HMs
iI.W%dIpPM1!<xl1
Mc%Cr\t)
yv0_x,
cKkabB#
4'Sk:4GP0%
=-3Q4EPVI
$O2N`@+
YRfHX3w
F}ouxA
|hi5Am
T([KG^QF`C
RqB*T
/lZ@r4
r<I\1m
[c0i(eW
s^4f4
1t"m}c
5X1#yD
j J-e9rRmG%
DXM0s"\ |
ZQ^NP
E,p<|PC
6c]Dll\9H`p
a"@i5P9x
GnOra0o
uhy88\
k!At`("FuP(L
55X&DL
"/pBpl
QQJN(t
1BnSP2
iMLe%m
cdAe _K
!/@FX#Q}nS
#R4v$]
P hS:]%dE`dA
R1X?X$
0[TX$?HUURT
qL,%@r
^$MQ]H
McU"i(tt0
"VM:`,1
aoqVC=C
G~?RCP2
Uj6TVVv
A97#'t
9'H*[ :
3\r(;7
.:l`37
;<3#l/?
C"BuGGm
=Y #*O
iUQW3I aaT
?7JQA[$
rA]sB.*yCiw
{Db@ @
g"0YTe
[H1C"vBH 6RyD
NUEM9!*W
@"q2')bP#5(
-X%33'
O<y9U%
BIQa[sS
PrAPCh@
V)JR+YR)
QzLE23
rb'T!W
<+UFG\
8TmVg.
_*X3[TIX
jQd#U0B*!
\ Z@Z"B=X3S[
#,X]ZmO;
6X4sR0*,f
|Bo<802
@J:;XK
$L)4`uY
S+.T4k
8H.@L[
%^:D-,1B
pqAGZQuLB"
9s39+@
X(1kjq
"07Q#^
2..v4J
Ekt |+
o3v#q&h5E9
tx&[as,
*OIeH*!
IeH+N/$!n3T27;
K+:OWY2$!S
n_+cr!+Cg
oHnH!sUw+CR
IeHm$!
ZH*CRty
rIV#I7$'++!
2$7;IBV
CDG\^M8$KCO\JS+mWH!
[ge_8cBV.dg
I7$s+w$!{T2
^H*CRxT.de
5H*CRKf
6JeH*CW!
Ies2$T
7IeH*H#T!
'a+q2$/3
IeHCG$!KV2OS
IBW([\R>_
Iekx2$os
IeH*2H!
IeHO$!d{T2
2$!#T'R
+/eH*C37T.d
? C3eH*CGLK!
IfOv2$SW
c*CR9gk.deHo
T%w9+CR
J}w<+s8nH*W!\+.deHIBV
D.dwWdBV.
#.deH'
IeH;g?$!}CT2GK
OSH*CRWT.de[
c/gH*CRDkV
Ieoos2$!w{T
0%=4]m
eI=IMzQm
VQj/fNu
^M^g@N
R}6A{.
Vt(rav9$
rVpk^0C
3;wOwG
U)>:8^
l 2Nu0Jq
g0SH=`R'
^tugd{V
4*`vI_
{TQ-,M1%x
tt~}<K
YQ1%`q+O0S^44
#>t[tWwp;
*t.;w"$WR
FBv4]2ZDP
[p`W j
u4PSt;3o_[y
e&tigd
PVNZ<+j
jdl,[EBu
9Hmp2V,
j?ns#NF
phT\``@2wtQ*@#
!P?Q&mRM
>l|fCIEA+~*F
AWt ;r
WU3-N&s#o
B80S K9Ut4
Gl-V4
hBG5}@
<':GF`
+Rp+K,
sWb4JS(U
AE2f9Z4
;t^S#C:D?6FfP|l
Nu}U|[
z.vkLU
T,xHA.;|+(x
X|g6/|t*
1{sU B
*d<kckR
dMRu8WeBuB1S
%!}.mU!
(q-t/
_#$:x<RgG
,Qs%D|l<D$8o
s0H24:
;r\2uLs
JtXac\;(T(
\@QlR .
QSL!|b4NG~
/tO=<=
Ku,4%}K
TjO4 v["
Oo/rHA
Q@B$j\=
p*mSQ{
C9z$R^44
$P4Yby}
Di5F1l(
I'}oT u
iXTPS?R@
I<Mx4M3
UEjAe\OCP|V
G`(3fwC
CrmIitQ
GAy&EJ
bm.y{y
#MC$$<g@
Bu;}Hn
^P UuL>~
\Oh;/.@K
8WR8WED<ZWEF
H<8$KU?3
F&5=Lz"V
pRhPQu0
RxoQVj
rmQvR
T=t.=B0bR
LsN7-w_
?/=!'&@
y+]-0PA
&c%,pt
$n&F(QH@ "1
<\a^Vd24
@,.y|$
b&t0$;
Gt?UWu@R>88HF =,)H2J
_R<a(!
GWiD#$E4~p
<O`9Xt
=lm3q}+";
/V}lPW
H,t)rj?G;|@bI
D3F#B\;
ntLU4J
ON*Zt+
9=u<?rx
G[4+4W(U=
;\5B2w]b?[
;r1p^OEV6Q
<\y*Q` }q
HtKhtTh#\=
Ou&-z:0(/E&
3pFJjK$
@(@;fS?VUF0
vh=|0oWK
$SWbRZPO}J?g
~;QA/c+q& LhSxz(
@JMkGSU;V
#XQ3qeBu4@
TM6X9u@
A57_2=
Si|&@&5
-hL(|w
vbq"-:
Gj1pVQ$|8c-
$8,PCa*2gVwbt
{0D7J#W|Hm;|
x03HGz
?_t!H:
R9Q}:e"-_?P ?'p2#D5+
(K8j\%\<X
5(4H$E-xt@H7Ez6'yG
\//$8h9
pS0jaejBg
CqiX7M
I@WZ;+
t(>F{!
':-8Ch
-m$_<F
n"|_vwi8$
03$<0U
tpX@58*
"GIA}%
u=B~u!
D-8`}<@j`K
ZaF)wO<Zu
koApJiVu^}
s-0)N<E8
7[Q=n_}
.[U_Ppp3xTqR_i
W/_.f}pQ
#YYZu'
F~/ToU
:u_uDhQ .]V}
.u_X@t
|,A<zS
@B8aw
4XLHX|
Y<Y4xA8
{t(g8+=i 9e
O>|n8e{kf@
Iutw$rtE
([@5 N,G^
U@fh-W"
Be:C%S
g8GaLS5_~
50Wij@<|<r;m(
"|]R7d
KX@y*cx+
vQPQNtZy
THD(tq
m v- C
DqHCgj>9,
DJ@pr}
W!$:%~Psp9$$
oH$N?t
\Kjh*(dP)
w@l\tOliPB~~
YWl)~~A
FmP+*Fj
N@VTFLT
#9 #H,
#Q0.\SP
|:Dl^p
wp?P;@
*PHi*0
L#?`vP.T"
>#&8XC|Dy
#i*?h$|QZ^&
Hz2F`S
=D|;!xRKj{3%OyXli
rah,HJ
K]&XK(Sli
L*4e0{*j'x33
HD33n|<X
l83dE$S`
Ktwi^=izX
`Kv2P<hb3
Dlnpkhoj34t
|8~((
@prf4i
;b=$x@
(<h9Fj4
"3-jZD>D")
b`ZVTt3*
4PdQRFA
ZPR/hY[ej
R+Q+~Mph
a3d@M%
(,P$%,bhd
B$(g~p@w6O~o
t(,TKg
t~S $g
0(6tOD*(,
Kg$(D^%
"L( RUuV
;r^_i]'$
QhH1 $
$U@d8G"|i
CkUSDV
@,]2P94@UvSVpG
W@2@du
;r?+U{
QndVl|
dQHTZsKY
CS4Kl"u
3*L# ys
VQ=g'1
??l"~0
><L,8#
VdF<fn
=vh'p=
j<&`~n
`CSwrYH0t
N<OFPNVFO
S\JN n
CE!0J1<3)
6_wub,w
GtWxYOop
sJ2VW0F
;r xXN+
(,6WxG
$D0L;w
hhVpV\nXt
.sO{<@
NVWh+8
lNp9l
01dT/A
:1NqAH0)0
)@@n0x!L
*P85[qc\7
,f(9$F
a^i'fVIu
j^?<BR
~b=\Wf
f+_fB/^[:v
iN|.P~
XfNgn8d-`/H
XpAhp;
''c~>f:
T"fnkp}]
60#HV@#S
_'*Y_J
O^GRr%p
<;~fY/u
*e='`E^$$
hP+$?'
4P([KR
8Ef (z|S
kG@|>;
`ePr6B
v|R+*l<
RuORN!
E50tb0<m%MN
4Au|6v
~v>"fL
fwjtG;>tn;}
o\L#V;?.K
4*Q9fST/UT]
WU]NV|B;
Vx@kGx
HST}T7
~^HT/-H+>+b
ShVWBo
p*oY%6
Kk;\~_tf"
&Pb=fL:
6V.b;~q
P{vxapU
IuUWi0y:(T]}
JpA^`fW
jup2^W
G9tI$Vo\(
JC@IHu[)}e%d:
lp\.tx|rr\.
Eg>@g
\yy<|y
Ryy2ry
Zyy:zy
Vyy6vy
^yy>~y
Qyy1qy
Yyy9yy
Uyy5uy
S<S33<<ss<
K<K++<<kk<
[<[;;<<{{<
G<G''<<gg<
W<W77<<ww<
O<O//<<oo<_<_??<<
(04M48@P`p4M
#+3yy;CScsNy
~!1Aa)
U{6AEDBD6D-3FB5-418A-83A6-7F45229DC872}
CometLoadDialog
@?_ThreDY_Image
St0m?HitMov2
CrackMe
%,5>GyyP[`ir-{
7)myyE)
lB^-Xc0
$yy+29@GyNU\clys|yy7Syslem
alpath.ini
WScrip\Shell
TASgSoftwa6\Tc\LOL\Insta^P
0@httpn_://aq.q
c&/cn2/ion
_jump?
]uAne=s~que>&Pv_Ti"
mod(gIvLpNpJBNhEkBkNoBjD
~8oLiNkJiD
mMsMbM
f86c8d4cI
d2e56x<
Vui.l2i6
/+?appid=20016
&no_}<g=
url=Q*ror8t&lan
rgF=top&h`e_
b*psEh
Md&q_CFg6
-p(&d`!kD25cssMpvsv@4.
}foxURIVp&
>~(<&u1mF
LVwjsiw
ck?u"L'([\s\S]*?)'DPOST|E
Us-AgT:
a/4.0 (h
; MSIE 9*
WZows NTo
.N CLR 0.50727'3*4
f`648/5.22
HTTP/1F
AcFpqo
*/*+-Lu
~g=% zh-
LodcokiV
0;xd_F 3
tvFW`V
(){rld
ExL8uS
tBCDEFGHIJKLMNOw
N236789abc
fgU@jklmpqrsvwxyz
Y @{B96B3CAE-
3-9D7B
F8132E
NtJZVjClAnAmCm
sEuAiCzEnnEqA
uCyEmApCyIwKwDgVJmLhJoLtNQg/W
@ggd9+@o@2E/9
Y@4\TdS@
\nf\QMv/
Q!ORgd
LBV(*Rg^6dDxnl
Safe_12O
q74W 4O.l>/{
Oo$e|'
i6:Ys>
%VB&o'|(
*|+,h-3/>
0t1l2fl34C5p6l6
789:;w<f
@1A|C<D
Fi6\GHI2JlO$K
LJM}Nf
OPZQfRSflFBT
bc>fifi
zj-knfi6
u.vFw;$yVrz
7i6QEi4Bf
<@7ui\p
music\J4|{htmldembedu?lay="true" src
sL.mpo3
width$1
height/>
Ei2.tiku!2ef3
438e7579013b.jpg
{56CF400-04
DsA73M1
6HNfz5,@
lolaq}act
lngi?a
]x_cl=ps&
7?ADTAG=miaDPCv
@:pNovDlAhEt?
K9MqIiCtMyIlKkkArKt
9KktjMlI'
8>kMuKvLqKW$bvrniKpMnImK5lAxCgEmIfK
LaJnK$
30&ToK<=%B5o
2%BC1%A3
B4%5B`NO
6%FE96%C;
WEB?&Ba=
pDb)=Add'&S
.f-%iPy@&gcaptcha}Aofi^?f8
a-2:2A6<4Zmio_#C&
p%AuH=
1NTNINQKSL6
LnJdLkNeJ7LLNmJcLiLjNSJjD9N8
@<h3>$#</
.uNdNAnswn1v
ZLfWJ_
Hcl}NE839 mt
C3ncH^
Zqf14mj}
bi"revry
)Ln9nWpc
_uvvhoo4cm/wf4/Ef`?fls.`
:pNrLxBjCiDr
bhJulJiLyFu
:hMgF8LgNkA8JpKoI
&Cp@ardP66sgaP
Ha}fKUBR&l$_t
/y-8mL9KiC9IsM
=))ig&
nur]ocusXput%ubm
3sw?RgJbEl
f/qoZHTM
rId:$1,4,7
awos>)
464D30C1661-CDAFL8A3EZ4T?FE266D5
>7R436LCE034AA7#n
3clZLvL
RVvIgEgIsJl
XtJkNJwFn&
lA8NkJ!N/
aLuNPnYv!upgd
Sxp^xyS
ggWkx-.Ds
i`M^/[`
cb&dWg8
Tdke2sH
697&_Q s.U
gx`?=.l&
|HLs%"|<
6iHoN":"F
b.duHk${jaxGWzt
kjLxBkBjC
V}"iDmL
|/, Dat".gT7V
lok@%,MSeOT.ava#
sHu = ~H5;0
1LS!MTQMC
b8d6838pngU3d
f33Zb"lBVl94U.<
Qsys7E
lEorc 0
>|&9L_bOiu
)<4>ey
{6>2E3
|e:w=>i6@BuCUDyO/EY|%FOy<
Y|CZG]`|c.e)g6f'i$k!m?o
tT<y7u4@vEw4Ox
{yu7|l>O*}
l66fwhP8)
|'i>Ox
R|gf}hK;
>A~,DpD
2yu5|6n
7m8y92:;yf<=
CWUD{34d?A715A0-658792&e.
20AFC7AC4D
59Go=@D
<Fi>hG
HAIi>O
JaAKl>O=LaM
!Q5RsSl"TV.ks
D@' cFN6
dz@jA~@
|_kEKtf
Y^Z?[4
\C]f4^F_`y
bGcVd|OPeqf}Lgh]ij4^
ZkCll>Lmn\oWp
O#qrNsV
&Task>C+}$8WTBJa
RegUignCZe4ultil
Glol\r9Dn;
BbFi}SuF
27CDB6E6Dcf-
553540
ietZoomR
Lh-BBs'n
L*elT'T;T
ertGCM
Sez}fP
FfeN\8
[.bbMSH)
g8Dcotas0y
g)Alpha0
+WpU|M
&vy@{d4|e~
1~/4WD
)is/#LpNr$
EeW*c%aE
ChFd/Ed!0
pSsVOfful0O
v},FVdP
)\{!g#
pupHan
'|+L~:Jposut
(6ndMhAN
#sg!p{p^p.ObjxW"Canc[B1
:pwo<F^"
]l!<9!C9CZya
LTmyI5yUnki!OnH7YPic
lrcn?1B`5BmW`5m
L9+UomU!
lDKM9otBl'
AK->Oe37sDD
HBT.sl=
ds66!umM#
-YB^AR"
lld?Non5`&G 7^6~KeyO
2AH^"{Wr>
<G2$Adj
I[qCM7m-tb
GUID2`
lnH?Raw
MF+B`$is%0
V+ !88WL#H
)V|J5T
1=`g;UPLP%IhHnais;%4/-F
<LQ5c.Jj7/J'ST;X
Gd9R`tn
+Vn03*
,&b5HBITM6%AP7ON3kkc_9m;O7V3AH'wD
vtG%SB
yEffOBB
ccwWNDz
#29e(m#g/
8\ngS-
]Z|pHO
mcXa3S
my5j7/
1WlAmo[?A!xlDpiX
{bs'IiN!r~p'`
%s9>I<-c
1BezhC[L
=sB[WZAW#Is%ME
1HyZhgA
2=}im3
'Q2)5[PHE5EI%
i+sM5!-AV
b'2)IS@0g5oxWo
#uE8j2
UgachY$vYG5
I-['V[Q-.
_saEdP
9tIh=}s?
Y#Hrgn
#i`#a,
eIs#Emp.V[
%I'S#`
I'2dq[K@BPc6iz
nH#FWv
hsync8j>
2fvefn9
;'He)u
NVF2iEg
>lgAFG
V_Upd&`
p`0*3f
RgI/G`=E!
c*]Ab+FH2`nr!
v,*U-\`
\adveS
w)I+{`
3^8~y)E
5+AjoI-
"QTz)Eq#vm
K11""Xm/
`6up[
[ZRDo5
00!_a[+/
!z+Z5]
2mF.'31^
on9FaH[+^y)QZ2
<O#9Oe{<<y
3I_<<uy
%;yQg}Oy
-<<CYo<
y5Kawy<|
/Ey[q<y
!7<Mcy<
y)?Uk|y
#9Oeyy{4
3yyI_uy
<O%;Qg}><
5Ka<<wy
/<<E[q<
y!7Mcyy<|
1Gy]s<y
#9<Oe{<
y+AWm|y
%;Qg,y}
al 1 
*s %d. (0x%Xh)
lfI64d>
wSi~~ERROR
B Z AvEY:
;;O000+
;3+#>6.&
'2, /8
+0&7!4-)1#
'lw]/m
{]; O.
vW{{7Wn+W
-7?_n{'
@ ;^7w
' .eO'
mocWwN
{n!'GX;
U7--{+?-'
g{.W`)&Wmo;1
wKO/Gg
"Ca7 v
Ns"ic& m;iNaCs
L]g`di
s>R/pn
S;yx8Q
9999h(
U+NNNNt4
NNNNd$
TS|<?\p
?n.NNn
y9i9999)
99IUdB^
uN.5e%NNNN
NN.}=Bm-
MBNN.S
.s3cNNNN#
BNNC[N.
{;BNk+
r?o?/v
?OH&d"H&
dd"H&d"&J&d"HH&
d"HJ&"H&
&dd"Hd
T!\ OSyR
BAE8 "LnCMap
1!TJ? f
n7F"IH
uLID&L@gJw
K7b)-*
[R/$4PE
doI[DC
5o91YK
C]V_+]+Hc|
m6:jWf
tw??2@YAPAXI@Z
T~CIfm
FfxUG+(X
_xxxkp
OVvM[4dkVg
${AlPRWs2
(eD=4v%P
v1StJq
%o/PeekwQ
VB{G8%e'_;nUQ
in!Gf0"Q
1QuVLi
3kX{;SNJ/
E.tR#NJn
6PAk9[7?A)
Ll({#T#
_ <.rt`+,
>$IhH.
GPGWHU
XPTPSWXaD$j
KERNEL32.DLL
ADVAPI32.dll
ATL.DLL
GDI32.dll
gdiplus.dll
MSIMG32.dll
MSVCRT.dll
ole32.dll
OLEAUT32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
WININET.dll
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
RegCloseKey
BitBlt
GdipDrawLine
AlphaBlend
OleRun
DragFinish
PathFileExistsA
InternetOpenA
SyslamfwrgjSyslemscqfoSyslemcccvvSyslemkrjbuSyslemrimzoSyslamocasbSyslemckcazSyslembejbrSyslemhxjxuSyslemjmpsgSyslemocyedSyslemvcywfSyslemxyhmvSyslampzxslSyslemmvxnbSyslemiekeeSyslameqfybSyslemdrkddSyslemarugpSyslamdlgfdSyslamzhtvySyslemhkwihSyslambmspfSyslamyupprSyslemvrcokSyslemiwuicSyslemmpesvSyslamghlfeSyslempaqakSyslemjbopgSyslamodbxzSyslemoklsdSyslamgvdgrSyslemrkhveSyslemscjudSyslemdbjfeSyslambsgzcSyslemtpzsvSyslemuaepmSyslamuzluuSyslemtpzsvSyslemgteaoSyslemqljisSyslemuzlktSyslemcgxjkSyslemkbvqiSyslemkijstSyslemreltjSyslempifowSyslamktmanSyslemtpzsvSyslemqiknmSyslemxrxtrSyslemgfbooSyslemejdbySyslembllkmSyslamyqynySyslemoqeepSyslamciazrSyslemwyynzSyslemrmlatSyslemqibhaSyslemmcdodSyslemzaocjSyslemhyrkfSyslemzndxiSyslemjbjnsSyslemlfoajSyslemaajfbSyslemdvkceSyslamtmofpSyslememrwjSyslemiezctSyslemqrxkwSyslembmnjhSyslamimyxoSyslemjoxewSyslemiyqufSyslemnfqgiSyslamquwfaSyslembnjjnSyslampwfbq

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255 131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 61714 8.8.8.8 53
192.168.56.101 56933 8.8.8.8 53
192.168.56.101 138 192.168.56.255 138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.