1.8
低危
59 个模型检测该样本为恶意！
重新分析
更多

0e56e147c030cf8a6ec7520788436e6cd064b94d0b5db838d4873f163db228d5

0e56e147c030cf8a6ec7520788436e6cd064b94d0b5db838d4873f163db228d5.exe

分析耗时

16s

最近分析

379天前

文件大小

216.6KB
静态报毒 动态报毒 CVE FAMILY METATYPE PERSISTANCE PLATFORM TYPE UNKNOWN 更多 WIN32 TROJAN SWISYN
鹰眼引擎
DACN 0.14
FACILE 1.00
IMCLNet 0.62
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:VB-AJKP [Trj] 20191121 18.4.3895.0
Baidu Win32.Trojan.VB.at 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Kingsoft None 20191121 2013.8.14.323
McAfee W32/Swisyn.a 20191121 6.0.6.653
Tencent Trojan.Win32.Swisyn.f 20191121 1.0.0.1
静态指标
查询计算机名称 (1 个事件)
Time & API Arguments Status Return Repeated
1727545346.515
GetComputerNameA
computer_name: TU-PC
success 1 0
检查系统中的内存量，这可以用于检测可用内存较少的虚拟机 (1 个事件)
Time & API Arguments Status Return Repeated
1727545346.5
GlobalMemoryStatusEx
success 1 0
一个或多个进程崩溃 (14 个事件)
Time & API Arguments Status Return Repeated
1727545346.531
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636028
registers.ecx: 2
registers.edx: 0
registers.ebx: 8865344
registers.esp: 1636028
registers.ebp: 1636108
registers.esi: 8865344
registers.edi: 8865344
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545346.609
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636080
registers.ecx: 2
registers.edx: 0
registers.ebx: 8865344
registers.esp: 1636080
registers.ebp: 1636160
registers.esi: 8865344
registers.edi: 8865344
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545346.609
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636088
registers.ecx: 2
registers.edx: 0
registers.ebx: 8865344
registers.esp: 1636088
registers.ebp: 1636168
registers.esi: 8865344
registers.edi: 8865344
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545346.625
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636080
registers.ecx: 2
registers.edx: 0
registers.ebx: 8865344
registers.esp: 1636080
registers.ebp: 1636160
registers.esi: 8865344
registers.edi: 8865344
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545346.625
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636296
registers.ecx: 2
registers.edx: 0
registers.ebx: 8865344
registers.esp: 1636296
registers.ebp: 1636376
registers.esi: 8865344
registers.edi: 8865344
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545346.625
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636296
registers.ecx: 2
registers.edx: 0
registers.ebx: 8865344
registers.esp: 1636296
registers.ebp: 1636376
registers.esi: 8865344
registers.edi: 8865344
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545346.625
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636296
registers.ecx: 2
registers.edx: 0
registers.ebx: 8865344
registers.esp: 1636296
registers.ebp: 1636376
registers.esi: 8865344
registers.edi: 8865344
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545346.625
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636296
registers.ecx: 2
registers.edx: 0
registers.ebx: 8865344
registers.esp: 1636296
registers.ebp: 1636376
registers.esi: 8865344
registers.edi: 8865344
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545346.625
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636296
registers.ecx: 2
registers.edx: 0
registers.ebx: 8865344
registers.esp: 1636296
registers.ebp: 1636376
registers.esi: 8865344
registers.edi: 8865344
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545346.625
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636296
registers.ecx: 2
registers.edx: 0
registers.ebx: 8865344
registers.esp: 1636296
registers.ebp: 1636376
registers.esi: 8865344
registers.edi: 8865344
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545346.625
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636296
registers.ecx: 2
registers.edx: 0
registers.ebx: 8865344
registers.esp: 1636296
registers.ebp: 1636376
registers.esi: 8865344
registers.edi: 8865344
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545346.625
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636284
registers.ecx: 2
registers.edx: 0
registers.ebx: 8865344
registers.esp: 1636284
registers.ebp: 1636364
registers.esi: 8865344
registers.edi: 8865344
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545346.64
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636284
registers.ecx: 2
registers.edx: 0
registers.ebx: 8865344
registers.esp: 1636284
registers.ebp: 1636364
registers.esi: 8865344
registers.edi: 8865344
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
1727545346.64
__exception__
exception.address: 0x76e8b727
exception.instruction: leave
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.exception_code: 0xc000008f
registers.eax: 1636592
registers.ecx: 2
registers.edx: 0
registers.ebx: 8865344
registers.esp: 1636592
registers.ebp: 1636672
registers.esi: 8865344
registers.edi: 8865344
stacktrace: 
EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf
rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228

 success 0 0
行为判定
动态指标
在文件系统上创建可执行文件 (1 个事件)
file C:\Users\Administrator\AppData\Local\.exe
将读写内存保护更改为可读执行（可能是为了避免在同时设置所有 RWX 标志时被检测） (3 个事件)
Time & API Arguments Status Return Repeated
1727545346.359
NtProtectVirtualMemory
process_handle: 0xffffffff
base_address: 0x003a0000
length: 24576
protection: 32 (PAGE_EXECUTE_READ)
process_identifier: 1784
success 0 0
1727545346.39
NtProtectVirtualMemory
process_handle: 0xffffffff
base_address: 0x003a0000
length: 40960
protection: 32 (PAGE_EXECUTE_READ)
process_identifier: 1784
success 0 0
1727545346.453
NtProtectVirtualMemory
process_handle: 0xffffffff
base_address: 0x003a0000
length: 40960
protection: 32 (PAGE_EXECUTE_READ)
process_identifier: 1784
success 0 0
该二进制文件可能包含加密或压缩数据，表明使用了打包工具 (1 个事件)
section {'name': '.rsrc', 'virtual_address': '0x0002f000', 'virtual_size': '0x00002000', 'size_of_data': '0x00002000', 'entropy': 7.551792011505102} entropy 7.551792011505102 description 发现高熵的节
网络通信
在用户文件夹中创建可执行文件 (1 个事件)
file C:\Users\Administrator\AppData\Local\.exe
文件已被 VirusTotal 上 59 个反病毒引擎识别为恶意 (50 out of 59 个事件)
ALYac Trojan.Agent.DHCR
APEX Malicious
AVG Win32:VB-AJKP [Trj]
Acronis suspicious
Ad-Aware Trojan.Agent.DHCR
AhnLab-V3 Trojan/Win32.Swisyn.R259306
Antiy-AVL Trojan/Win32.Swisyn.bner
Arcabit Trojan.Agent.DHCR
Avast Win32:VB-AJKP [Trj]
Avira TR/Patched.Ren.Gen
Baidu Win32.Trojan.VB.at
BitDefender Trojan.Agent.DHCR
BitDefenderTheta Gen:Trojan.Heur.VP2.ni2@aqrWDfai
CAT-QuickHeal Trojan.Swisyn
CMC Trojan.Win32.Swisyn!O
ClamAV Win.Virus.Sality:1-6335700-1
Comodo TrojWare.Win32.Trojan.XPACK.Gen@2ho5ur
CrowdStrike win/malicious_confidence_100% (W)
Cybereason malicious.97f4e9
Cylance Unsafe
Cyren W32/S-16107dfe!Eldorado
DrWeb Trojan.Siggen6.54687
ESET-NOD32 Win32/VB.OSK
Emsisoft Trojan.Agent.DHCR (B)
Endgame malicious (high confidence)
F-Prot W32/S-16107dfe!Eldorado
F-Secure Trojan.TR/Patched.Ren.Gen
FireEye Generic.mg.f8d013497f4e91d1
GData Trojan.Agent.DHCR
Ikarus Trojan.Win32.VB
Invincea heuristic
Jiangmin Trojan/Swisyn.rmj
K7AntiVirus Trojan ( 00092db21 )
K7GW Trojan ( 00092db21 )
Kaspersky Trojan.Win32.Swisyn.bner
MAX malware (ai score=88)
Malwarebytes Backdoor.Agent.Generic
McAfee W32/Swisyn.a
McAfee-GW-Edition BehavesLike.Win32.Swisyn.dh
MicroWorld-eScan Trojan.Agent.DHCR
Microsoft PWS:Win32/VB.CU
NANO-Antivirus Trojan.Win32.Swisyn.kfrsw
Panda Generic Malware
Qihoo-360 HEUR/QVM03.0.5E4D.Malware.Gen
Rising Trojan.QOT!1.6519 (CLASSIC)
SentinelOne DFI - Malicious PE
Sophos Troj/VB-JVT
Symantec W32.Gosys
TACHYON Trojan/W32.VB-Swisyn.221797
Tencent Trojan.Win32.Swisyn.f
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2011-06-15 03:01:16

PE Imphash

98f67c550a7da65513e63ffd998f6b2e

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0002e000 0x0002e000 5.802311028000031
.rsrc 0x0002f000 0x00002000 0x00002000 7.551792011505102

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x0002e000 0x00000cd0 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_GROUP_ICON 0x0002ecd0 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_VERSION 0x0002ece8 0x000001f4 LANG_ENGLISH SUBLANG_ENGLISH_US None

Imports

Library MSVBVM60.DLL:
• 0x401004 __vbaStrI2
• 0x401008 None
• 0x40100c _CIcos
• 0x401010 _adj_fptan
• 0x401014 __vbaStrI4
• 0x401018 __vbaVarVargNofree
• 0x40101c __vbaFreeVar
• 0x401020 __vbaStrVarMove
• 0x401024 __vbaLenBstr
• 0x401028 __vbaLateIdCall
• 0x40102c __vbaPut3
• 0x401030 __vbaEnd
• 0x401034 __vbaFreeVarList
• 0x401038 _adj_fdiv_m64
• 0x40103c __vbaPut4
• 0x401040 EVENT_SINK_Invoke
• 0x401044 __vbaRaiseEvent
• 0x401048 __vbaFreeObjList
• 0x40104c None
• 0x401050 __vbaStrErrVarCopy
• 0x401054 None
• 0x401058 _adj_fprem1
• 0x40105c __vbaRecAnsiToUni
• 0x401060 None
• 0x401064 __vbaCopyBytes
• 0x401068 __vbaStrCat
• 0x40106c __vbaLsetFixstr
• 0x401070 __vbaRecDestruct
• 0x401074 __vbaSetSystemError
• 0x401078 None
• 0x401080 __vbaNameFile
• 0x401084 _adj_fdiv_m32
• 0x401088 __vbaAryVar
• 0x40108c Zombie_GetTypeInfo
• 0x401090 __vbaAryDestruct
• 0x401094 None
• 0x401098 None
• 0x40109c __vbaBoolStr
• 0x4010a0 __vbaExitProc
• 0x4010a4 __vbaI4Abs
• 0x4010a8 None
• 0x4010ac __vbaOnError
• 0x4010b0 __vbaObjSet
• 0x4010b4 _adj_fdiv_m16i
• 0x4010b8 __vbaObjSetAddref
• 0x4010bc _adj_fdivr_m16i
• 0x4010c0 None
• 0x4010c4 __vbaFpR4
• 0x4010c8 None
• 0x4010cc __vbaStrFixstr
• 0x4010d0 _CIsin
• 0x4010d4 __vbaErase
• 0x4010d8 None
• 0x4010dc None
• 0x4010e0 None
• 0x4010e4 __vbaChkstk
• 0x4010e8 __vbaFileClose
• 0x4010ec EVENT_SINK_AddRef
• 0x4010f4 __vbaGet3
• 0x4010f8 __vbaStrCmp
• 0x4010fc None
• 0x401100 __vbaGet4
• 0x401104 __vbaPutOwner3
• 0x401108 __vbaVarTstEq
• 0x40110c __vbaAryConstruct2
• 0x401110 __vbaObjVar
• 0x401114 __vbaI2I4
• 0x401118 DllFunctionCall
• 0x40111c __vbaVarLateMemSt
• 0x401120 __vbaFpUI1
• 0x401124 __vbaRedimPreserve
• 0x401128 __vbaStrR4
• 0x40112c _adj_fpatan
• 0x401134 __vbaLateIdCallLd
• 0x40113c __vbaRedim
• 0x401140 __vbaRecUniToAnsi
• 0x401144 EVENT_SINK_Release
• 0x401148 __vbaNew
• 0x40114c None
• 0x401150 __vbaUI1I2
• 0x401154 _CIsqrt
• 0x40115c __vbaExceptHandler
• 0x401160 None
• 0x401164 None
• 0x401168 __vbaStrToUnicode
• 0x40116c None
• 0x401170 _adj_fprem
• 0x401174 _adj_fdivr_m64
• 0x401178 None
• 0x40117c None
• 0x401180 None
• 0x401184 __vbaFPException
• 0x401188 None
• 0x40118c None
• 0x401190 __vbaGetOwner3
• 0x401194 __vbaUbound
• 0x401198 None
• 0x40119c __vbaFileSeek
• 0x4011a0 None
• 0x4011a4 None
• 0x4011a8 _CIlog
• 0x4011ac __vbaErrorOverflow
• 0x4011b0 __vbaFileOpen
• 0x4011b8 None
• 0x4011bc None
• 0x4011c0 __vbaNew2
• 0x4011c4 __vbaInStr
• 0x4011c8 _adj_fdiv_m32i
• 0x4011cc None
• 0x4011d0 _adj_fdivr_m32i
• 0x4011d4 __vbaStrCopy
• 0x4011d8 __vbaI4Str
• 0x4011dc __vbaFreeStrList
• 0x4011e0 _adj_fdivr_m32
• 0x4011e4 _adj_fdiv_r
• 0x4011e8 None
• 0x4011ec None
• 0x4011f0 __vbaVarSetVar
• 0x4011f4 __vbaI4Var
• 0x4011f8 None
• 0x4011fc __vbaLateMemCall
• 0x401200 __vbaVarAdd
• 0x401204 None
• 0x401208 __vbaAryLock
• 0x40120c None
• 0x401210 __vbaStrComp
• 0x401214 __vbaVarDup
• 0x401218 __vbaStrToAnsi
• 0x40121c None
• 0x401220 __vbaFpI2
• 0x401224 __vbaFpI4
• 0x40122c None
• 0x401238 __vbaLateMemCallLd
• 0x40123c _CIatan
• 0x401240 __vbaAryCopy
• 0x401244 __vbaStrMove
• 0x401248 None
• 0x40124c __vbaCastObj
• 0x401250 __vbaR8IntI4
• 0x401254 None
• 0x401258 _allmul
• 0x401260 _CItan
• 0x401264 None
• 0x401268 __vbaAryUnlock
• 0x40126c _CIexp
• 0x401270 __vbaFreeObj
• 0x401274 __vbaFreeStr
• 0x401278 None
• 0x40127c None
L!This program cannot be run in DOS mode.
PEC2^O
uExWatch
sge-@l
frmExplorer
uExWatch1
Win.uExWatch
tmrSec
tmrPri
Timer1
picIcon
picCapt
VB5!*
sge-@l
mExInternet
mExComp
mExJoin
uExWatch
mExReg
mExMatch
Win.uExWatch
uExWatch
mExM c@
Q|~hC6l<
frmExplorer
mExMain
mExHooks
mExInternet
mExComp
mExJoin
uExWatch
mExReg
mExMatch
user32
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
kernel32
RtlMoveMemory
GetWindowTextA
GetForegroundWindow
GetAsyncKeyState
GetKeyState
user32.dll
GetWindowTextLengthA
gdi32.dll
BitBlt
CreateDCA
DeleteDC
gdiplus.dll
GdipCreateBitmapFromHBITMAP
gdiplus
GdipGetImageEncodersSize
GdipGetImageEncoders
lstrlenW
WideCharToMultiByte
GdipSaveImageToFile
CreateToolhelp32Snapshot
GdipDisposeImage
GdiplusStartup
GdiplusShutdown
ClientToScreen
GetWindowThreadProcessId
kernel32.dll
Process32First
Process32Next
CloseHandle
OpenProcess
Psapi.dll
GetModuleFileNameExA
TerminateProcess
Thread32First
Thread32Next
ResumeThread
OpenThread
FindFirstFileA
FindNextFileA
FindClose
advapi32.dll
OpenProcessToken
GetCurrentProcess
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
9ShellIE
GetExitCodeProcess
fsge-@l
+3qC:\Program Files\Microsoft Visual Studio\VB98\VB6.OLB
picCapt
tmrPri
Timer1
tmrSec
C:\WINDOWS\system32\ieframe.dll
SHDocVw
uExWatch1
picIcon
DeleteFileA
ShellIE_WindowRegistered
+3q"=h
SHGetPathFromIDListA
GetFileAttributesA
WritePrivateProfileStringA
shell32.dll
SHGetSpecialFolderLocation
RegOpenKeyA
RegOpenKeyExA
RegCloseKey
RegCreateKeyA
RegCreateKeyExA
RegDeleteKeyA
__vbaStrToUnicode
RegDeleteValueA
RegSetValueExA
SHGetFileInfoA
DrawIconEx
DestroyIcon
WriteFile
GetComputerNameA
GetUserNameA
urlmon
URLDownloadToFileA
GlobalFree
wininet.dll
DeleteUrlCacheEntryA
mpr.dll
WNetOpenEnumA
WNetEnumResourceA
WNetCloseEnum
GlobalAlloc
lstrcpyA
Netapi32.dll
NetShareAdd
NetShareDel
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
CreateFileA
ReadFile
: & p
SetFilePointer
VBA6.DLL
__vbaNameFile
__vbaCastObj
__vbaAryUnlock
__vbaStrI4
__vbaAryLock
__vbaLsetFixstr
__vbaStrFixstr
__vbaAryDestruct
__vbaGenerateBoundsError
__vbaStrToAnsi
__vbaRecAnsiToUni
__vbaRecUniToAnsi
__vbaAryConstruct2
__vbaLateMemCallLd
__vbaLateIdCallLd
__vbaI4Var
__vbaVarTstEq
__vbaExitProc
__vbaLateIdCall
__vbaFreeObjList
__vbaI2I4
__vbaErrorOverflow
__vbaFpR4
__vbaFreeVarList
__vbaNew
__vbaObjSet
__vbaSetSystemError
__vbaFreeVar
__vbaInStr
__vbaLenBstr
__vbaOnError
__vbaStrCopy
__vbaFreeStr
__vbaStrCat
__vbaHresultCheckObj
__vbaFreeStrList
__vbaStrMove
__vbaStrCmp
__vbaEnd
__vbaFreeObj
__vbaNew2
__vbaStrR4
__vbaPut3
__vbaPut4
__vbaFileClose
__vbaGet3
__vbaFileOpen
__vbaI4Str
__vbaVarDup
__vbaAryVar
__vbaAryCopy
__vbaBoolStr
__vbaRedimPreserve
__vbaRedim
__vbaErase
__vbaVarAdd
GetDIBits
__vbaUbound
__vbaI4Abs
__vbaCopyBytes
__vbaStrComp
__vbaStrI2
__vbaFixstrConstruct
__vbaRecDestruct
__vbaRecDestructAnsi
__vbaStrVarMove
__vbaVarSetObjAddref
__vbaVarLateMemCallLdRf
__vbaVarLateMemCallSt
__vbaObjVar
__vbaLateMemCall
__vbaFpI2
__vbaVarLateMemSt
__vbaVarLateMemCallLd
__vbaVarSetVar
__vbaPutOwner3
__vbaGetOwner3
__vbaFileSeek
__vbaUI1I2
__vbaFpUI1
__vbaGet4
__vbaFpI4
__vbaR8IntI4
KaPN~K
MIEObject
UserControl
AddSubClass
IEObject_DocumentComplete
IEObject_OnQuit
SetIENothing
ValidatePath
PathChange
IEClosed
__vbaVarVargNofree
__vbaStrErrVarCopy
__vbaObjSetAddref
__vbaRaiseEvent
uExWatch
lCookie
strPath
MSVWeE
}#jhh0e@
}#j|h0e@
}#jPh0e@
@fPEPMQj
}#jPh0e@
}#jPh0e@
MQhDe@
}#jXh0e@
UREPMQUREPj
MQUREPMQURj
EPMQUREPMQj
MQUREPMQj
MQUREPMQURj
LRh(o@
LRh4o@
LRh@o@
LRhLo@
EPMQUREPj
EPMQUREPMQj
EPMQUREPj
EPMQUREPj
EPMQUREPj
}#j\hxy@
@f`MQUREPMQj
dMQUREPj
dEPMQUREPj
MQUREPj
}#j\hxy@
EPMQUREPMQURj
f`MQUREPMQj
EPMQUREPj
MQUREPMQUREPj
EPMQUREPj
EPMQUREPj
}#j\hxy@
DEPMQUREPMQURj
EPMQURj
bSVWeEh
fMfUf;t
MQPLE}
UfEfEE
MQP E}
fEMQURj
MfUfUE
} j hw@
EEPfMQU
MQP@E}
UREPMQj
%UREPMQURj
0SVWeE
7PURPWV
UREPMQj
xSVWeE
MQVPL;}
UREPVQ@}
MpwM|1E
(UREPj
MQUREPj
=ZSVWeE
WSVWeEp
VSVWeE
QxRhU@
MQURhP
@f@`RdPhQj
xPQhU@
PxQhU@
-`RdPhQj
]OSVWeE
xRPhU@
QxRhU@
dQhRlPpQj
xRPhU@
RxPhU@
dRhPlQpRj
LPPQTRXP\Q`RdPhQlRpPj
dQhRlPpQj
hQlRpPj
`RdPhQlRpPj
`PdQhRlPpQj
\R`PdQhRlPpQj
^LQPRTPXQ\R`PdQhRlPpQj
:SVWeE
]EPMQUREPj
MQUREPj
]UREPj
<EPMQUREPj
MQUREPj
]3SVWeEX
MQPLE}
fUfEf;t
EURfEPM
EPR@E}
MQPLE}
fUfEf;l
EMQfURE
URQ@E}
fUfEf;d
UfEfEE
} j hw@
EMQfURE
URQ@E}
EPMQURj
%MQUREPMQj
}+SVWeE
|RPhU@
Q|RhU@
lQpRtPj
f<lPpQtRj
f<pPtQj
UREPh@
@f<pQtRj
|RPhU@
PMQ+P@
R|PhU@
FlRpPtQj
EEEEExHEEE
HUQxRP
xUQERMPQj
MUQERMPUQRj
EMPUQERMPQj
xERMPUQRj
TSVWeE
xSVWeE
UERMPQj
EMPUQRj
pqE4UM
UERMPQj
HSVWeE0
M;t(f9
SVWeE@
MQURS8
EPMQr7
REPhp@
EPMQl5
UREPMQj
u<U3+B
UREPMQj
u<U3+B
REPh4@
QURhp@
REPh(@
UREPMQj
u<U3+B
UREPMQj
u<U3+B
UREPMQj
u<U3+B
EPMQ:%
UREPMQj
u<U3+B
REPhH@
QURh(@
REPhh@
h Pj8j
hB PpQ
EPMQR!
UREPMQj
u<U3+B
UREPMQj
u<U3+B
UREPMQj
u<U3+B
UREPMQj
u<U3+B
QURhh@
REPh0@
PMQh(@
PMQhl@
+MQUREPj
SVWeE @
MfE_^d
SVWeE0 @
MfE_^d
]SVWeE@ @
RfEPjh
fUREPj
SVWeE @
QfURjj
fEPfMQ
fEPMQj
SVWeE @
EPMQUREPMQURj
7UREPMQUREPMQj
<SVWeE !@
SVWeE0!@
UWRh0aA
SVWeE@!@
UWRh zA
SVWeEX!@
]]]]]]]]]]]p`P0,($
MPhXo@
ERMPQj
ft*hHB
UERMPUQERMPUQRj
EMPUQRj
EMPUQERMPQj
UQERMPQj
p0P`QR
`pQERMPQj
R P$Q(RMPQ
UERMPUQRj
EMPUQRj
VUERMPUQERMPUQRj
`pRMPUQRj
SVWeEh!@
]M]]]]]]]]]xhXH8
MPhXo@
ERMPQj
E3MEPQ
ft*hHB
lMUQRj
UERMPUQERMPUQRj
EMPUQERMPQj
UQERMPQj
HXQhRxPQj
S,C$M+
QRSMPQ!
UERMPUQRj
MUQERMPUQRj
UQERMPQj
HXQhRxPQj
S,C$M+
C44M++
RPSVMQ+
UERMPUQRj
\MUQERMPUQERMPQj
HXQhRxPQj
$SVWeEx!@
QR3PV}}}
EWWMPQ
SVWeE!@
$PQhT@
R$PhT@
SVWeE!@
MQUREP5E
SVWeE`"@
u0E3+H
EPMQUR
u0M3+Q
u3E3+H
mSVWeE"@
EPMQURj
MQUREPj
SVWeE@#@
}SVWeEp#@
-SVWeE#@
PlQhU@
lPQhU@
QDRhU@
DQRhU@
REP,fE
fMfMAE
SVWeE$@
EPj(MQ<E
EPhLS@
SVWeEH%@
R@PhU@
@RPhU@
UREPtQ
fhpRtPj
SVWeE%@
xR8PhU@
8RxPhU@
UREPlQ
@f`hRlPj
PxQhU@
fMfMh7A
SVWeE(&@
SVWeE8&@
pQRhU@
PpQhU@
TPXQ\R`Pj
M\R`Pj
pPDQhU@
DPpQhU@
HQLRPPTQXR\P`Qj
XQ\R`Pj
<R@PDQHRLPPQTRXP\Q`Rj
fMfUf;<
<P@QDRHPLQPRTPXQ\R`Pj
X(f_^][
}vSVWeE
PPTQXRj
uFEM+H
\QRhU@
R\PhU@
@QUREP
\PQhU@
P\QhU@
PQTRXPj
SVWeE'@
uuuuuuuuuuuxhXH8$j
EPxQ=(
MPhDe@
UREPMQUREPMQUREPj
XQhRxPj
XPhQxRj
XQhRxPj
XQhRxPj
XQhRxPj
XQhRxPj
XQhRxPj
XQhRxPj
XQhRxPj
IUREPMQUREPMQUREPj
XQhRxPj
SVWeE'@
}}}}}}}}}}}xhXH4j
WjUR|B
MPhDe@
UREPMQUREPMQUREPj
hQxREPj
hPxQURj
hQxREPj
hQxREPj
hQxREPj
hQxREPj
hPxQUR<
hQxREPj
hQxREPj
hQxREPj
FUREPMQUREPMQUREPj
hQxREPj
]KSVWeE
JSVWeEP(@
MQUREP
HSVWeE(@
MQUREP
mGSVWeE(@
EPj@N<
UREPMQUR
j UREPpj
4pRtPxQ|REPMQUREPMQUREPMQj
4@RPP`Qj
hpRtPxQ|REPMQUREPMQUREPMQj
4@RPP`Qj
=ASVWeEx)@
?SVWeE)@
j@`QUR
j@`REP
j@MQpR
QURhho@
MQhho@
<SVWeE
PUR2}E
SVWeEx*@
]]]p`\U
QURS5,
EPMQURj
SjhDe@
?;t&f?
Euf;}}Pf
$MQUREPj
(SVWeE*@
d;t"f9
uft'f9
SVWeE*@
]]]]]]U
MQUREPj
!UREPMQj
z~_^][
,SVWeE*@
E;t!f8
lSVWeE*@
EEEEEEEU
UREPMQj
EPPjh
|BPEPj
EPMQURj
!EPMQURj
@flMQUREPj
!MQUREPj
SVWeEH,@
EPMQURj
4MQUREPj
SVWeE@-@
SVWeE-@
@fEUREPMQUREPj
MQUREPj
)MQUREPMQURj
@fEMQUREPMQURj
EPMQURj
)EPMQUREPMQj
SVWeEx.@
|xtplhd`\XTPLHD@<840,(
QVPP;}
PP RSSP:
QRPQRj
RPQRPj
M;tKf9
kM;tOf9
|QRPQRPQRPQRPQRPQRPQRPQRPQRPQRP(Q,R0P4Q8R<P@QDRHPLQPRTPXQ\R`PdQhRlPpQtRxPj3
QRPQRPQ
|RPQRPQRPQRPQRPQRPQRPQRPQRPQRPQ0R4P8Q<R@PDQHRLPPQTRXP\Q`RdPhQlRpPtQxRj1
PQRPQRP
(P,Q0R4P8Q<R@PDQHRLPPQTRXP\Q`RdPhQlRpPtQxR|PQRPQRPQRPQRPQRPQRPQRPQRPQRPQRj3
PQRPQRP
px+ptT$ D$ \$
SVWeE.@
pZuhtYB
MfE_^d
SVWeE.@
EEEEEEEEEEEU
MPVEPj
@fpEPMQURj
EPMQUREPj
MPVMQj
uKURhD@
MQPjh
|7MPEPj
'PURh@
%EPMQUREPj
`SVWeE
3}}}}3EfE
MMMM}}}U
}WURWEP&WMQj
}WMQUREPH&WMQj
M;tf9
MWURURI
MQ%WWj
EPMQURe
}M;t&f9
REPMQA
URft6EPG$E
SVWeE(/@
Puuuu|
UVRMj@QP
UERMPQj
MfE_^d
SVWeE8/@
SQSP7 5t
SURj@|P
QSURj
SMQj(S
URfUfk(
~9t!f9
3Et!f9
SVWeE`/@
3}uuuuEEEEuuj
uuVMQU
MQfUfk
MQfUfk
SVWeE/@
uuuuu3
MMMMuuj
DMt"f9
@Mt"f9
<Mt"f9
MQfUfk
8Mt"f9
4Mt"f9
Ex|t$f9
0Mt"f9
,Mt"f9
(Mt"f9
$Mt"f9
Mt"f9
SVWeE/@
SVWeE/@
(SVWeE
HSVWeE(0@
URPQx}
MQUREPj
!MQUREPj
SVWeEP0@
SVWeE0@
SVWeE0@
MSVWeE0@
fMfUf;U
EPMQUREPMQj
EPMQUREPMQj
EUQERMPQj
ERMPUQRj
MfE_^d
SVWeE(1@
UREPMQUREPMQUREPMQUREPj
(MQUREPMQUREPMQj
]SVWeEX1@
EPMQUREPMQj
MQUREPMQURj
EPMQUREPMQj
(SVWeE1@
ERjd]E]
MPhDe@
}SVWeE1@
EPMQUR
=SVWeE
EPMQUR
SVWeE@2@
EPMQUR
dSVWeEx2@
M]]7]]E(
SVWeE2@
uuuuupj
dPMQ5
MQUR3EPMQj
UREPMQURj
UREPMQj
MSVBVM60.DLL
EVENT_SINK_GetIDsOfNames
__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarVargNofree
__vbaFreeVar
__vbaStrVarMove
__vbaLenBstr
__vbaLateIdCall
__vbaPut3
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaPut4
EVENT_SINK_Invoke
__vbaRaiseEvent
__vbaFreeObjList
__vbaStrErrVarCopy
_adj_fprem1
__vbaRecAnsiToUni
__vbaCopyBytes
__vbaStrCat
__vbaLsetFixstr
__vbaRecDestruct
__vbaSetSystemError
__vbaHresultCheckObj
__vbaNameFile
_adj_fdiv_m32
__vbaAryVar
Zombie_GetTypeInfo
__vbaAryDestruct
__vbaBoolStr
__vbaExitProc
__vbaI4Abs
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaFpR4
__vbaStrFixstr
_CIsin
__vbaErase
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaGet3
__vbaStrCmp
__vbaGet4
__vbaPutOwner3
__vbaVarTstEq
__vbaAryConstruct2
__vbaObjVar
__vbaI2I4
DllFunctionCall
__vbaVarLateMemSt
__vbaFpUI1
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaFixstrConstruct
__vbaLateIdCallLd
Zombie_GetTypeInfoCount
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaFPException
__vbaGetOwner3
__vbaUbound
__vbaFileSeek
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVarLateMemCallLdRf
__vbaNew2
__vbaInStr
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
__vbaVarSetVar
__vbaI4Var
__vbaLateMemCall
__vbaVarAdd
__vbaAryLock
__vbaStrComp
__vbaVarDup
__vbaStrToAnsi
__vbaFpI2
__vbaFpI4
__vbaVarLateMemCallLd
__vbaVarSetObjAddref
__vbaRecDestructAnsi
__vbaLateMemCallLd
_CIatan
__vbaAryCopy
__vbaStrMove
__vbaCastObj
__vbaR8IntI4
_allmul
__vbaVarLateMemCallSt
_CItan
__vbaAryUnlock
_CIexp
__vbaFreeObj
__vbaFreeStr
m?(o_cP`0
n\n@'T
{l^JyM6wJ3wK3WBsdp?&U
xL6ZE\)
n>$~U@]HqR
l=$k;"_,
m?&k<!d1
n>%qD+qD+rD*o@'h7
tG,wM6wK3vH1yM6ve
zM5~T>|R;zO9|P:ygl<#i9 vi5
S<\FYCYDWAvI2k<"|sD,zN7kX{O9]GZE}R<vH1l="e5
ZDcN`K`K`K_JW@~T>
lZ}T>^I`J_I^H`KbLcNfQfRcNaK]I~S;b-
`KiWfSfSfSfSfR`JrgRdPgSfQdPgSfSfSfRfRgSgUiUlXiTc/
hTp`m[m[m[m[m[lYgUkYm[m[m[m[m[m[m[m[m[m[m[mZo\lYc.
s_~mzhzhzhzhzhzhyhzhzhzhzhzhzhzhzhzhzhzhzhzh{jygd0
r^mzizhzhzhzhzhzhzhzhzhzhzhzhzhzhzhzhzhzhzi}jwec-
kernel32.dll
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
d-FFp9gwfW?4;"V
GF$D3/
0oA%*'(
92Om8g
D#~^ 7Zv5
>?@8O1
#i4I=-
VI40w
w\t0;sm
i_.H`^7)
$9Q@7q
=X`B9L
3!:@;W
7'?,2
>50:8ygK[CCUMaNBZI8J
Tde{~ui_
o}ANvm
|-$037!
mq.5)
;,+@/O !
OJCHF ^
[SYRTuNJLVH
0>|Poa!,i0S{
;,Hztxq
NFMZq?99%
D[##P]^tXhfv
v@3>:X*8F
6JsrkE!l_[<
$\}s0z-Kx
q<6@ms
ASWTpLv
*{|+zHD\VMr
Q;+6{?
6nkl:ec
gUy{"mdt
`p5Ei.G
=9hPO9
yzefgHhPm
\EFGHABC
DMNOPKL5
6781a=<
9:;<%&'
(!"#$-./
xwvu|{zy
~}dc`hg
felkponm
TSRQXWVU
\[ZY`_^9
Virt=yock}eQna
tfpy(j+
PE/U(;#5E4#
*fY*W^qf;M
3)4H9H8eg
7*Idu9MX
>tgxs4
W0UVUDM9
$46"Si
sGDSR,:
1[)+'qH*
2z;Td*$
|U]Yybk
`j!a&.
y_sT]"
Xr(If@
J>FA(0Jt
yc90s$LM
G[]-2%ALF
;+y{LVK
{@G~yX
,+K'&Q7!6'
\8AR?-
B7D%@uCJ?K@
3EZ~X0
.0ZY`
fLbu}t
RdZzl@^
CENtbMs
BZrm;2=
1}q&nH<+)6Q^2|
g@tKwFQ
+RI^99
-I-@<H!VWB+
5%df2!
/E^WV
^PO:MCWQ
j@R,3s
fCNAK!{P
WQS}@BHF
!NBNTePT*;P
Q@2:Zh]
"vCO-nJ?
msvb]x
ApAlicaton
7%s5l.ntb=}a6iwdSDL
5d,al 3^p*vuu
MoagaBoxAwcPtf,E
xitPMLCNp=Opx
AcMdC:O_;3b!"
`t$$|$(3
r+|$(|$
USQWVRW
ZPR3C
Z^_Y[]
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
htd*e(c
uExew`66'1f
|N#!v6-:l4tB
t$&OlI
S\Gme}l,]?&TP1mB
6E$s+Uz
0R3f<Ok_c:B,'Ec
`N!rg_
kpvG8(@r86b'
@@@@@@
@@@@@@
@@@@@@@
@@@@@@
@@@@@@@@
@@@@@@
@@@@@@
@@@@@@@@
@@@@@@@
@@@@@@@@
@@@@@@@@@@@@
@@@@@@@@@@
@@@@@@@@
@@@@@@@
@@@@fA
AAAAAAA
AAAAAA
AAAAAAA
AAAAAAA
AAAAAAA
AAAAAA
AAAAAA
AAAAAAA
AAAAAA
AAAAAA
AAAAAAA
AAAAAAA
_extentx
_extenty
SeDebugPrivilege
Microsoft Internet Exp
B*\AD:\Code\Explorer\Explorer.vbp
SeDebugPrivilege
Microsoft Internet Explorer
http://schemas.microsoft.com/cdo/configuration/
RIKVdO4>+
hZ\1*1
dw(/.,J,
system\
vWe=<7
IK?:M9U]G
I0[dCi
"Ya(__Cxq
pfbvoh=NA.M6
7*X(&HVar\gr
MGB+!.F4B
uoOTBh
I0WdCj
|b.5}SF%*-
LUFPvPk
7'W(#KVOk
:ms+im
e_7xu(
w_{STc8js}
JL>zof
yL_@.>1*273?
IK?:M8U]L
yn^@S4
system32\drivers\
1*7"&&RFG
vvseXbjO}
I-XbLq
eu%-9
IK?:M3U]K
U?ddr
TWbi[jZ\noc M)z
jH]1*6
jHV1*6
MGG+!,F4C
ufOTKh
I0ZdCo
"Yg(_iCxu
pfevok=N;.M/
7*X(&OVal
:DMjds
7Z<(V2
MGGjEX1*2
^[UOT@
YYItod
I0V:,Q
wJLU!+dT[
YYQto`
I0Z:,M
wJIU!.dTa
IK;:M7U]L
IK=:M2U]O
w\%iJ+rK[
I0[:)NU?_
U!/yaij`f
U/l1!N7*YgJr
aVu=HXCQdsq{
:/;UBP
picsys.
psVjH\dJ
CE>^[SbjN}
Process
<Mail>
</Mail>
</DblClk>
<DblClk>
wp1*4JFE
#&+36pi]a_[
I`BdvT
C9T4;OOKi
</Click>
JFFzx\
icqw[:J/hsS
bLjST`%K`+To[t
e\xVOa
me8UDSwI
WYqeI:8
%9R@Rc
76~(5%
</Enter>
:G0SiC
<xCommand
</xCommand>
<Title>
</Title>
bCapture
Capture
<Enter>
<Click>
UseSSL
Authenticate
Username
Password
<Instant>
</Instant>
Keyword
<Attack>
</Attack>
%SystemRoot%
%ProgramFiles%
TextBody
<Download>
</Download>
<Update>
</Update>
Version
yymmdd
Clipboard
d/m/yy h:m
DISPLAY
image/png
image/gif
image/jpeg
image/tiff
image/bmp
["szPW"]
\SystemRoot\
%systemroot%
Ul1';vZcPaG
IK@OZD
U?d8pr
1U'3dWd
%{P>=a
59ABCQEF01
CDO.Message
BodyPart
text/plain
ContentMediaType
base64
ContentTransferEncoding
Charset
AddBodyPart
dd/mm/yy hh:mm
Subject
AddAttachment
sendusing
Configuration
Fields
smtpserver
smtpserverport
smtpconnectiontimeout
smtpusessl
smtpauthenticate
sendusername
sendpassword
Update
Remark for
00000000
file:///
explorer.exe,
yLb+$8
VS_VERSION_INFO
VarFileInfo
Translation
StringFileInfo
040904B0
CompanyName
Microsoft
ProductName
FileVersion
ProductVersion
InternalName
OriginalFilename
Win.exe

Process Tree

0e56e147c030cf8a6ec7520788436e6cd064b94d0b5db838d4873f163db228d5.exe, PID: 1784, Parent PID: 2264

default registry file network process services synchronisation iexplore office pdf

Hosts

No hosts contacted.

DNS

No domains contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name d601cd5b7f80df71_.exe
Filepath C:\Users\Administrator\AppData\Local\.exe
Size 224.7KB
Processes 1784 (0e56e147c030cf8a6ec7520788436e6cd064b94d0b5db838d4873f163db228d5.exe)
Type MS-DOS executable
MD5 62cbbb353113c9c1b90581242e979af7
SHA1 93d9ab6d074cd298718db61fafd2893113e0a882
SHA256 d601cd5b7f80df71baef53746c31a09d255f79c39f4b2c6406502f556c73bd8a
CRC32 81F2F725
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 284c2513601cbeb9_~DF869C7FAC1A4B082E.TMP
Filepath C:\Users\Administrator\AppData\Local\Temp\~DF869C7FAC1A4B082E.TMP
Size 3.0KB
Type Composite Document File V2 Document, Cannot read section info
MD5 609214469787aab61f2d5b5c1edb9128
SHA1 f5dd707a748aa10e9b7914f3b08692e018e0ccb5
SHA256 284c2513601cbeb944e2ac0f655a49889bb5f6db5d9c4dc4b6940de63df46fae
CRC32 E2AA5D80
ssdeep None
Yara None matched
VirusTotal Search for analysis
Sorry! No dropped buffers.