1.2
低危

161074481ac76b5bccbb7b39d02d324967632a4d047726dfa182c20e30ae3a0d

161074481ac76b5bccbb7b39d02d324967632a4d047726dfa182c20e30ae3a0d.exe

分析耗时

193s

最近分析

374天前

文件大小

85.4KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN DEEPSCAN
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.86
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Malware-gen 20191007 18.4.3895.0
Baidu None 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20191007 2013.8.14.323
McAfee GenericRXEP-HY!4CB7E489D7FE 20191007 6.0.6.653
Tencent None 20191007 1.0.0.1
行为判定
动态指标
该二进制文件可能包含加密或压缩数据,表明使用了打包工具 (2 个事件)
section {'name': '', 'virtual_address': '0x00001000', 'virtual_size': '0x00066000', 'size_of_data': '0x00014c00', 'entropy': 7.976928395822499} entropy 7.976928395822499 description 发现高熵的节
entropy 0.9903634393316165 description 此PE文件的整体熵值较高
网络通信
与未执行 DNS 查询的主机进行通信 (2 个事件)
host 114.114.114.114
host 8.8.8.8
文件已被 VirusTotal 上 49 个反病毒引擎识别为恶意 (49 个事件)
ALYac DeepScan:Generic.PWStealer.6BE8E1A0
APEX Malicious
AVG Win32:Malware-gen
Acronis suspicious
Ad-Aware DeepScan:Generic.PWStealer.6BE8E1A0
AhnLab-V3 Malware/RL.Generic.R256475
Antiy-AVL Trojan[PSW]/Win32.QQPass
Arcabit DeepScan:Generic.PWStealer.6BE8E1A0
Avast Win32:Malware-gen
Avira TR/Crypt.XPACK.Gen
BitDefender DeepScan:Generic.PWStealer.6BE8E1A0
CAT-QuickHeal Trojan.Zenshirsh.SL7
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.965844
Cylance Unsafe
Cyren W32/S-7ef0bbbd!Eldorado
DrWeb BackDoor.Bifrost.29297
ESET-NOD32 a variant of Win32/PSW.QQPass.OUO
Emsisoft DeepScan:Generic.PWStealer.6BE8E1A0 (B)
Endgame malicious (high confidence)
F-Prot W32/S-7ef0bbbd!Eldorado
F-Secure Trojan.TR/Crypt.XPACK.Gen
FireEye Generic.mg.fd80f3d965844077
Fortinet W32/GameHack.AX!tr
GData DeepScan:Generic.PWStealer.6BE8E1A0
Invincea heuristic
Jiangmin Trojan.Scar.nkf
K7AntiVirus Password-Stealer ( 004b38871 )
K7GW Password-Stealer ( 004b38871 )
Kaspersky Trojan.Win32.Scar.ievr
MAX malware (ai score=84)
Malwarebytes Spyware.PasswordStealer
McAfee GenericRXEP-HY!4CB7E489D7FE
McAfee-GW-Edition BehavesLike.Win32.Generic.mc
MicroWorld-eScan DeepScan:Generic.PWStealer.6BE8E1A0
Microsoft PWS:Win32/QQpass.B!MTB
NANO-Antivirus Trojan.Win32.Scar.epyqop
Panda Trj/Genetic.gen
Qihoo-360 HEUR/QVM19.1.642F.Malware.Gen
Rising Virus.Shodi!1.B830 (CLASSIC)
SentinelOne DFI - Malicious PE
Sophos Troj/Agent-BBAC
Symantec ML.Attribute.HighConfidence
Trapmine malicious.high.ml.score
VBA32 Trojan.Scar
VIPRE Trojan.Win32.Generic!BT
Yandex Trojan.Agent!VGTc/RQle54
Zillya Trojan.QQPass.Win32.59476
ZoneAlarm Trojan.Win32.Scar.ievr
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2014-12-08 13:58:29

PE Imphash

352063077f27a851dc2b08e15f08105e

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
0x00001000 0x00066000 0x00014c00 7.976928395822499
petite 0x00067000 0x0000033b 0x0000033b 3.997365146900804

Imports

Library user32.dll:
0x467222 MessageBoxA
0x467226 wsprintfA
Library kernel32.dll:
0x46722e ExitProcess
0x467232 GetModuleHandleA
0x467236 GetProcAddress
0x46723a VirtualProtect
0x46723e VirtualAlloc
0x467242 VirtualFree
0x467246 LoadLibraryA
Library ADVAPI32.dll:
0x46724e RegCloseKey
Library ATL.DLL:
0x467256 None
Library GDI32.dll:
0x46725e BitBlt
Library gdiplus.dll:
0x467266 GdipDrawLine
Library MSIMG32.dll:
0x46726e AlphaBlend
Library MSVCRT.dll:
0x467276 free
Library ole32.dll:
0x46727e OleRun
Library OLEAUT32.dll:
0x467286 OleLoadPicture
Library SHELL32.dll:
0x46728e DragFinish
Library SHLWAPI.dll:
0x467296 PathFileExistsA
Library WININET.dll:
0x46729e InternetOpenA

L!This program cannot be run in DOS mode.
RA3A3A3:/C3
<E3/C3.,C3w
C3A3y2
<V3A3@3
3RichA3
`petite
Y|^)GM0QC
2vmz,P?
`>Ev447
FTUmpj8
z0<)-tdA6
lh<[`6c
}`AV(Z3Ng
cy-)),
6dV0$5
~tz"x(MECYw
Y<.Ox
y)`dr/
{O$)`tf
&)VMM@
A0DQhBJ
TJP<71JlVhpR
A<*$d#^$
a16F|w
3M5}
$usjN<
yk/q8L
O$"diPi
;JgmlL
nfcf&X
4B=>@m"Mc
^d=!x@
f-%_~qL
((3|bh7
/pI"']/U{
g^#H~/
%(ZK4p$M}
yVkM=Y?
<WuQhT7D
UXRT4eV<B'2
HThu{|}ccw=:!
GAL"><`
w`h{_3h
7pZtXe<r`
K[_4>
d6O)~)L
B1B(/f@
w`O]xSS@Q
#]n ]&
IW1bvX\
H(FB/&;
5s[\ 1
'`fWp*t1>*|mGI%"
".6TCb
))y041={
Fu2R&4tL
xZe\So
YA":W!!i
$Um*an
4SKIh"
JBJG0P~
+e!R -lo
n&V+=rYZ
ty|ADtuo
6XV]kt(
HX(C}K
%a!SYc:
Bx`n$!B
E[.dG`D(*
DEm! &*J
,+E!jIk
=x_i+,
#>5IJ!
*uPn_v1V1
h}|!b/
[:5[\[
%IOs1Q~
q'U?$Da`;+
3Y}=2H
c Zdq% :"tC~
b"uMDCAs
S&[Eu+w:>5
#_c\G8
<Mt-EWu6)
4p!APU
|;Tn|sqNa
5FV?CsM
7c.k3d
GP[ZQ4k
[?H7C>
=UF0#$
$oa2soYt)
NO)J'D
lgb
(;6*
xz0ozI
NE`ld_~
44$3pNC~z8
d#hD^
j\dd{+\S;E
0x?=v^0
W!Jd|om;
@vA/sB
T jnEhM5k3
P3abcg
10sX/
t&uNk_:
NJ> 2$$!]zsS[
+=Pl j
x$aL7Ocngt
cI[07(
6|xpm*
FS.tiEE
lVnha RdC
5SGzb<XUp
uU*@xYfR
XWSYOCYhE
IsjY0q
v#lk}]M
TOAg;18a
JU}f_/SAHu
R%Z|1aow
=?AKMA
<X,&`e
$$I,:;
cCC'7DCi@
,a`KIJqCxb#Z
)gzyiL#3lD
fu'k!J@CLbvR
6v$BzTfu
WV*jv51|TE
mo|_.Pm@D
q`xR=0
Cg..5t
<gi:a Fs%
dc0JftE
3 &C-
)nAl@(!t
71do2(.;or6`^'
6>$GW8
w- N~T
v,*#m8
Y^"tjWA4)Y"
?,lA.y\
/m~P=nE"X$)
m`I$Ik6W%?
M7di_'-
sd~v@H
$^,~/tM
kE]uY.l
Vy`oU,$
EEJz";6
:"CF-[@?/
]O](pth
e.F=YxXS}
$YCI!&
L"F*}e>vLF~
5dX+5DY|RP._6
AVY-K ?(^X(sn
WjAW3m
V[Bw)F?:KQU0L(D
nn_BLQ
LK1AK2
>&b*G%
RSe^WK5J
Lbj-.VP
P6!Ko{_
qA25|!
ldS}i{
X__C1<
T0DM[[k^_+
rhFx:N63LOu|2+Wwgg|mr
xj@EJz8<VFZf
yWautJomO
!o{b}):
tWh>@gj=!msZT"
B)&DDlM
mkCAVz
$$++*4-a{C*
{YSy2V
UjH=!Q
"!~((lH
u.IjNRp
7(=70Ia
]+]QHx
;pD)JL<
#!eWiG5/
%Ht)ksCw|H
^wEV0qj|YIWjOf(hP
W*vpZ\#
Tp1c \
6y!lJ-
[W&jw$
=]BXQ=^w2
WRqoy]
qbB[x!|6!
6c@=4A
_Dc9OIw
B]S_]D
dYyy&U
_Dp57{s
?Y)k/~@
11Pa@yCW8
iB+"9L$\c!Op
F3LsMX$
oT>jOXNI%/[
k6/A!j>
wP:OM 1H:
<<I([.
7H oz
{4WC&x
75W:XP
u%V[_(H
G8$+hmvskpD[kG
+]/3O'i
A4hU?ar
yXu1$faId2
%(hZ}=
,ogtP'^`)
f[B<u:NN0S
t@Q=$|
R}=\t]vj=
C!D;{W
zi\n(`+sC-7!
;wMUxWP
ZUjprau
1>}%( x3z;(
2m|c~?RDY
n#bXjL8
y3"?Uyb2@CCj
Qx!/nL
XqsPMBb2S_k$dpoU
G.I1GX
^_'Z*?
wWZ%]P
Mwn1z$l
pnY.a+X
IC?E}*
`G{/<sEA@wm
%2w e>rI6)|h"2o
Gq:#*X*
_0\Q}C|h`89&VP?|
?Vu,>85F,
!c#\Q7v
3mg!JOS
+;*[_]=;
5Tj^]*
l Q|+
U;@Xl#BNU
EGP0DB
k7&>D.>
:P-qp
G)P-HC&
Hr1h}pS+
oNk%-]+
)|TYb9X3$I}{
}!5UVdyq_R,[
rccu;j
N}nvN~S(;aY{xs
!>F@Kqd
}HxP{/
'/Ckms
obh{CB6>
?"8Uj!V
J8C+j:<rR
A[ub!h
x9K^g<
`W?!sQ
~Krp"V/
C@.#+QqT%
DQ_M@Fu>2
i[gUUx1?(
5/`4[c
2_[FB*BAbC
-s_7}Cb4S
_(7UA`GW'r\2qxU
5vUZC:wvk]
h>_i__*:
C0NFUWO^
u0[AD *r]n_%+
G2sc_P519nn}p~m )H/
%9}yud^
YOSEZBq".~vW:
@wJe]'{cFWgA@`
<_'1x_Z[A
a{Ab/)V
sPr%!
7|?$\f?d}#JxV
G:[ [U
-/h^mD~0,+
\w.wWD3vx!
wpuKIFV
-t_A<`+
y.NUV5
lPWqK4
$1_~At
,H!}u]@tM
b &yg3Z&7
e(Hf
Wa]WC+v]|S
]KOyWJ
8`FrpGf
g@cF)a8(
1%$9Jb
dpT?:G*
!{ !7d
'-aUtK
UddfgddhdddMFdd
ddUBddDEddVw
Z$@02MXB
=&j\dP
!C.`Ba$d
<svXOU!J
IV64j'A]c[u}0J
n!KaG+
PkbP.OA2
lEM;c;tSeb
9. C*L@4
C!R|y!
@0WDzX
#}}]-+
QJ]PAT
*p`9,X/|
y4`K1|J
!UHW0l<
GO4l+RL
W-+Zv]
j~S8)4O? G
CK7V&wz >B
qS(~q#cd~#
gFA^bc7cQ#L
rd}|A@z
KD/c
EnvIF=v
3Q %G-}UY+j
A<+4dd
x0^]ewLy
tfa~B$"
<W? D{!
h{}P4
Tex[+z-$Wtu
UTA@Cn#
t;)D7S_!7b
)5m5Zr%
M4|!fG\CC7Ws
SsM{l@L
^71J&[J
ZSBgAK
Zixz'Ws'st
s(BfU]
U#2FmX1P
$A8a`l
10)&st
{(HA"g_
J.OT=6=
NM#Um@
age_!E|~
J}[luPVju"@} c
A Fn\@7
V?fgK!cH
z7Z?]"LuQ,IZc9
+< {/c
!|'HZI4L3
GZYSSKuk
F9-^S_i`
igMAs
B_AQy4#
+1Be=P0Yw^
NvCJrz37)8\K
IlNm;w
S?o\n#f^A
7MWyJL{.an=
dAfaXL
4t\~6_|Vu!>,
Q5GxUATn@
+;W]iA
9p)_ow
:k&u^DE
_!s:EWU8
x<QCARD6$
i5O9-$
3k?q?V
W!m2;l
OTC(@8k
<yCdYY\u
f/l+Wzl20k
C}Wf}WD+>
h|RU(f*U
ZpWT+HAh
+r$W!BC
+kqHvZ
#V}"y}S
/RsF}gb<=M
5[\3tHmz
1LI+A2
7sgJ*{GmVQ<` ;
%u\%TA
r@^$7 x
cw=0X3]-Y~/D
rA\`'%%..
r5SSB^
_A+WP^W
9p;=\AcK+z
urCfk1W4qr
7Wu':7
SEXzV!hU?=Y];t5+
w_/zuglm)'
a-6Q\CD3Po
o+G2FA
/V-c0G
NPs'Hv
dU_Qi$
x.$_>l
qPnfhfd]oq3
zHx>TQ'
V] E_i2
W%+ !X0hR4XY
[+ov"gTW>e
t@\? jh
S<m=M"k
];gc`adE
$YQ8cqw Ypz
!KTmD3{ZWU2c
FtlC|,.*z"+M|?C
!* 'xlr
#;u!S!
t:ZU;OPC
!KSi":10Q
UCpHZU
+(H:dw
+-?hp bxY
F+!KHQB-
cM+fau#NUzfuXTT|
O.{PQ4
1kOXo<J
)asm^os
Sj#m#
`z/N|~MCAC
XS@>SC
BS6qx
Sk@B%@8D,]V'&
MF|U;]\@ku`N|
s0W}nUi
B3~d0/ >+
O}J8s A#
kC{lC+
BxsZLCz$1=
Vz!`%fIp$$I
!A{1SgkA
7{GSaC>
Y\X+(BU
'K TE%~
s+LsE+
msA(DcP!#
:!"{BRtS7
r5<6{o
y,!Ac\#X=3\{DA&
K' A{W
pqc(C+Zu
- .#%n
?dnWdDpw
H08X_ +LP
{/T/{=b
wc{8&
CPT{#a
}bQ{:x"ZB{
>X!Wz0aQ u
v|}'PO7
!bJT!
PxGQ3+
!)tANx6*+
O]K)w<]
'~,~)|1&CCb
h.H~xZ<
}(nseR7@JSsu
-WsSAkY
%R9G.:,WY3&q+s;]
fCtl{H
5VUe>wPZXFWU*+wSD7
1~x}!fx
":?F!AC
4=RwS"\[{ ^cP
#~A<Fa=$
j% j.<
I"qyF*YG>~(@C
o- Z?_Q
4LIhB z{
!As VACUfBW
bb&Gu+CS
!AsuLp
<zO<,Av
+s9[]\1kA
*\zz+UT?tB
AtC~ve FK
%>m1]t
~])J($WdP
*AV!U/@[u*OS
,+Unsw%J'^V0:U
~V\`aq.R&k:QM'
07e#]`xKM
YUZo$fd!<Rdo1@hO}
nXRX7x
?|(uAm
DX^O >6
D^QA W(dzZ
)]fNRka
1R|AAKeB0
aIDxKr4,
C"#aBdRJh19
vuUT=Y
X A`*V
^qd<8@|Q!
BK!A]J1OK
X@*-rHh}?]
m/qR\y
U*rvtxqxDw>0
:y7bX~*.= k
~K2?R!d
$YU^|!4
v]"'Y:A
\*3FXMAON
&`uXJA15
Z !lJb,JDBWU
NOZePx!
EA>OQVyBNU
(|9#6J7G
.7JCh4
,EY-#U_
jq]qL,UB
1|Oo;]C:<0X
OcE7/_U
y:\gCV!Fm
rtpLxZ
S8[QO]{
Q>~|m !?H7)
H`G$}*p
j!eXE}F
]}!DWlVS8CUgq|4
LU([g V
wvM ]x-aa(,FB>
A!h|:M8 l 5(FZj)
]sO;%Uokz
<dcT.@Q&Cm
uxwI6
dsW*Z&
swvwSAxXLR/l/9
]FaqH^"
l<H@6N6c)W/c
'WL#BAaEg
92+._8r
aW,Ks
]=@%{vl
:KC'U#
6fR[X_
h#xwC9G3!M]Y`
l2&BoLn81
WxTs]>vut
Q:}_+6LS8c
FfYkWZ*
viqYl}d(g* <A
r{x(Q
.Dspp_
>]Y(>,E?8a
Y_,h2
&_lib}
vYwKW4i
=^emN*N*
Pp!:bdY
MQ;AP(~r5S
J\u`xU"e
oGx;:`!_Jh$
zZW3&C
gl`'-![Tt
Bef;|A
`d;*]G36
HcU D6
_"S,t|
C2}GWw)I4#4hX.
P{uA&>#
t"RXAY[+3VP
)Pnc3@
).[zVA
>0J_}+
G|=Efx
p\e vz>
HXj[Bj
= dY?W)
qV(gzeMWQx0Q4~Qd&<
Q_+UFnsawW#
_&*LXR
PuPyxi*
JuqFk_{!
lhpUVU_s
fis]RG
ox:8H~
aez<"JA
B3kNG5w|@ESl[]QC"0
!u_xGan
?J<ae`]5$
BR<&hY`7!uhj
0Q JQgXqu
RA8X"X
g[%]P]
|*Yr~? g[
B|CWK1kC
0FVc{foHRa!l
obZV]DTA6
bIHp+0Nv)5
b&|<qgB\
RJC> 7ds
9rhb0(xU /
9}4=^u+`
PSCSu7#
.#tC`Gw
{]W3AS
m_v.)Wzra_Wx2$+fA6a
d3_.?wF
dK'(]w.x
i!Vzdc)h
.!J1\+!(9
h)!ZV&8
=S;Ilv
YfUZNq_
)]ujCl8Ub
MeKE"
!q6{ 4)zUy
(h X%L$(%'$)
w=/@S1
T[Qf"n]la
4I[Xkuh|&
Cr4T4a
3[5MiAE
Ae0WsI"
;[> om
K/z'a;j
~a|!w=
"`FWgT
(8c>AA
}j"Bb<0
@3Um?jL|!
z <
n-!dW
hi+F+$
er 1XdSGic #?@5rT
wY{Ud|
QX!:$a
9zW[&1C;
IFKFKC=\
[3@_ANYBF#_
x{ :l/
Dw=+GV>s
6eG9<@5x*#w=X/
Jaag4&e6Jf
bF|!C)
QwK_\/1w
E/A#>vO
TYSL)@v4cnWk
\|r|5
J"gSD;EDN&\
>U`ijUSm)
WBG]B9c_(k=
SeaTA!B
r*P fI[5]
w>%&t]
dx!!iKXmYN,QA
+9_F]*856
*0h.Fluc1|D~Lq:
xHMC5b
E<$],'5bF
$;8Q5zUZyTHRV
O}KT`l9=4W(
[\Lu`Y
m^dyUH
_c]ac_(p&
TC$Sw+?5
NVk?96[
}xVh6$%W4NAZ
r!XO7KE<
OK;K~TMU6/B
>Ml!;/yw7D
wzclB1n
%,lRFu
mBQN;G!ujp
.xn&}yX
[ug@\w:
:W,~s+S
UySnA<8pH/A
/pc>H}
CcSZ[!Jc{
1`o%3aC4t#A"yb>
-YJ2{WWL
4IYX(U
J0N^YS
Q,Y4(u
(2ig4?gXY
`{\}>4+0!a
TR]}@Or
\Bd}p~?I
*Ftf=A-
#*q<d8m
9u|j[S
H#woKQQP
"dQlOrzBC
u>rCoU
m?+b!#&C
|O}mgk
},Q\NS
#v`b4VG{t~2
G-k[b"`P+UU
uK1LWb
5Z}cY,}gZb0R
:KrS3]::(h`j(J
@~j4 N
.}Ntu/
eZ@!2PU
@De0PkI{:N&
pUTXEY
icJeNi
u\WX&`
%V2QM,uy"
RS)][E~
Jckh46!.
tZbFmudJ
!CZ>( 8Y
e}&(ADY"X
y_q]pM
mX!=kz
,2Pheh
4FdFKQ
>|o$8_W.7V0
na/%O}TCA
w`Um<H
dCqNW8
9zC43]@t
{B!a&*
I6^n77
5)2xy_E]W
Do%(k]A
E0A?w '
_U~kYUE
U&a1Ub:dvYd
SOq2P#
qWmEb)W"-E
m/?7H\]
r(,Ww
j?|$/cdc]_
/MtLBO
F~G Xq
d *C6F
zOw7|!
xbCc=4}olC
UvAH5M[?
zbWq~$R
Mh,wG&W0
LT(+(`(QH|Yu=/5d
l~!Mnux
[AUHA<dY
s;Auw]-vg
vV;]w&>
F*}DH,l
%<~_ Ar5,Y
,z?M?VTW
SO+w]A\
o;\EvA$
^5 HkH: v~
Pc|C%m)o
!jC<dwd
s#T#! \
J H9D!Fc[]
EH){eHd N
EK.n<m
:X&? <t}KC
6}&Z9G
X|S4yC
xsGU9Y
x{Ou7Z8
_X78{O7
q0] 0\A
Vd7uY#
mG]xD
IxIjBIS
g7?;'
@:Clp,:J("K
SoYuU}b
6wlGx\w
{X,A\`D]~o
0_57"O
Y,Z n}
h{]%&`w_~/
dQZ8<rc
R w-^0$
2uVkP|S
up 4b
.=r .41|!
JH1U]p,7
1u B"^YAZWgaBmV
_<y]^dA(
=OZ]cjwd
uDQnu<+]
} w\z\p?C
1&`W.yS]C(
V'4Y]'c=U4B *.
)xoWw}RAx
tC >sS
VdA^A^
HGqR_Q~}7y?
v{z].djE}i#h^7
0TAk{:.
M3wjw0
<[+w':XC
)*uR?ErZ"1)o
+}rWWZ}_w,
c2ClYu
3ed#ffDA4\x
Au!|exst8
i>IS!4/
1^2W>'kvB
s:zijsQ%t
;7U>@[%.
ozb>d04
i{Ab#^_
Wg.Y:(
@DL*~J
3:g<b|3
lyO=h
SlH*TUA<
GQ9liN
j}$*C@
_@+aSe
rQqdb5
2%Bv73#
9O..]D
9w` [ju
}l,UQ2;
{ky 0,TxeNM#v[Y\R^AV
qdkydSUZ_& \wak
_\T-CyX!
B|OmZi2+
G_oDsIkn
BjMPCD
R3BJGE
$ey@aUh
T_d0=!1i"j:zV
d@8tS3
*f+vZ9
L2U~v(
*+?Fa~
yGB*cA
KFDA +c
daNllA+TZ
xHQI ),~_F
C<FY$,&>
',DNY/C
_1c,F?.*7MT_
4&th>%
-OaFU?k
0m"HXWi
8Vn,]H6s)KiSF
U!LG=]}
wW(6NC
yMX=l*L<,
c.y$~9A
^Ust\UQ
!!5krln
<3!k={W>Ja.]k
1bF4Dt%*
M-U3.r]-
*WXLO
BCfGK+
,Y-\mW@
5,:|~k
)`GAb.hUem&wL.;N]a
=VoU_*p
S*=T2Ei~V)X^^
KpG}YU+?:\_
P-4<V_f
&E,2S !;eiu
VcF<p_1
U]KjXM
]8fL1+F
tU4yK@34OW
Q\CQJX_!
oB9u*Wd
BAqWuAd
P]W:&\/
3CDD9w
7f4@j_l
NXs:b4B)o
|\N{3+1D)MTQ"z
?!Rc9~U/]
s|A/p2a
@Ap2bM
)dYWS;
38,PwrAD
-FC$(F
.}CfKVH4
_1g?"S
Lha+UhO7ukHD]
<N*(*^
?+j2{G
HS~5qv(
n &&KG
32YG+
{YK;Je
/C+\zK
kXu~TxV~
.] TFG9B
)F VC
Oxt#jG.
7AX]g!
`SNsJ:U
5UVWaj
x& V6q
7T0ra/
=WIUgl8%.
>uh:]@}f)jam
oUacN(qu
2|(no,ASq~?9i
V]\yMv2
?()thU
h:!ixT!,
L?CUv
q2vD(
sCWCbC
g 8i+=AWuA>
?a[#w/
1"N;5h[BOB
fWo?SV
Db@%_C@6
=]a6aIT
C@C@<=
Y.lhAl
T1'\xE
! ITgZ!
! =O!
C@6C@<
C@C@<7C@<
iGyhz"R!{-nx8X
b,|&(0
bN"yUc13(@E[:7*uUS^$-7-
I:0K&L
lwe@K
D(LE1I
B7N}qF6Q(
7Gj5g`
D0sNd!Cu4N4xh
j- dte
["g4{{
Q[/}O5o
w6e`h#Pq&
UcmHKl*
(%dgh\~Q[qsAai
G71sT_
)~Sef`j<nv
AZ08M";/@
&R~<,0
C@f)*)1DL+/t$7QS
z,qz u3
;6)a-%OC9m
C4<;c}Q
H[G"&Y @,5.+:b'
(VZ1D'(x/rwYX*
@3I$M/X('y
3r;5w2
6hj/^(-
&\+$fkzVL
\Z<s^=
)@T}P# v
9JhQ->.=
HgQ8R|
Y8,htR
*9yTH&*-?
Aa<l$<,(es
THzk!.j,
2Ga0y_O
W0twG.M
8Zb"w
V<d 7#HLg
[L*'EB
d5vKX}
F#xSRW
(P)vva}~kIn70 6
]K6Wdz27
nexx1WP
U]a}he+
+:X]vj
T[Bjgt6
R|3m&F
.=e00
LQNv*r
I0|YT$Y
iTM%U}do8P<
E$51yU<fC_jV
a`q/eII)
[g9j><VE"
HVBV11/
M'o(s__I@
XhkMP^3Q+@xv_$f-
*QJ|,uUcL
q!U&H.
sl)`cy9En+$e1C'MV
dxuN%&7yA.BA/L
4=iG')
X9LEh
6XV5`0mLrjxv)rMH-[*k0b
J8[c3t
A/injNa&<g
L1Dj*$(e
'LQ@5d
}ygKAG
k"6)\S
-R.2*g
xEu:Z\
:*9TmlQs5}
k%(4,=L3rW
4}wXl-cz
`AN*[P
p#&yqm
5IEH`Jr
iS3Miy0
g;M&#Q
7T!}@rH[jU(
w<."5Z
4[A,$BC
nNDz\\.BDkXRPBW
@tA>Q:
2eH6|
t9v,d_cW
]+o[>Nw
F1EY'-mo
PV|)%C^
6J_)BK]
i<4@.*
UmK*uPO(W)
g@X;6p
V->dTz4peUe0V>H
B(vUiB1
DQ`j"M,[i
/mF* B
VRw`cd
]U<~{?hi7
W_I>!9{,
7[xPY5
EEV#-
n,grur
#_0\8
M[At7w
gJbE-
eB41<*
4$_lfGa
<Pk7hA
RHC^ZfT G
?e3P0e"
Kr`y&y
?1(4A]aXFN\
(tR;1:Bg
)|{Ar.{?\YY26
AQWDGD--
& *Bh%nHr
ZJW yn
D(xpMOEB
uT>#+r
uu _J
w7~2s50`b
*2nr}!fC@
zy)b9+U
]++[wG[c5
BB $&2d
HThdQH
8e$ *0r
J[j}1}
Np2FJS+`f@Q
-'gen'
6/m~I+*kcIr
~IRF_*
oQFd:`-
=&2Z;??
bLG1{_.qY_
jLO`Eu
yRER'MGAd>`J">K
"6'GZC9uSu%
b(jzKB
)sr8A]
|aW%-7]
O6 OC7
uUD|t|= :
+]JA"%
-w0@uMO[N
5C(@F48
Ljk>^5
x+42U1x`
9Ac1XE
Tc<C/JY
7QMjOO
2644D:AA@$8#}
d&+|*j4M
p[QOnIU*q
ON*EDeDX
"fL:;%0/
EB[]!$)oriP
hAuPEc
6e]W<(
#%cG2\r
ptdo+DxTO
2T@EU$D$93+MU
PhMpi)4+c4
C"CV1'Q7
/vkV>FS#B=
NMtkCEH(}yE
~H\\Yp3 _
6MvYm3UUkuCC
6CAT!"
%WM^#uep&?
xt6>R^!
h~w7bc
;]D6(/f
:5e{~F
0NM=0~!JXl
Y"'^OT
CaQ$$i
"Q-TDt
?>~LLHHL
wZk::=cR0E
+0K;JDS$
<~2XSt
P #vL/
x{D;b10j*
=z5+cU}W}`@w
4RW/\LIR;
R]Cy28
Le. L~[Y
WBhAov"I
TPz@Q/Hx
HQQ[=bj2
R8#h4ab_
A{p"`Pt%O
Ez#Ij]|MDt>6
o? gi$'?2&
vEL.,UN&O
iNpMdS
ry={V$"CLQx*Nh
X|zA#8/2
A_KQFLK2
^dbZiTMZ(X
c+5Y\>v3
(ipw(a
oMTO!6Tv
=Kuju;
,#g-uM
h dI@0%*S
0K'K!hL
&vGR"z@
"<cVIJv{x
`w$|u[
18wPmpC]j}"q
kR{"{ftG)
F/|;g`c59
T0i-Rw%a
"9.`KP|D
||;WjP
z!T#>Lyf8PYMA
zs#S$~
`W%AJh]Lw
F"M)=&
'!\(B4M$'pv8H
YB~AB_]0KhpHP
8Hh:tb
/n:Pst,
k>YAWv::E
d.0s82h+q>[
;|ZfU<eD0$`
.s080icq
o%mD]@&&
TUZ:J^K
!M>xCqs0
4)b&~%M
VW>}B1
DuGO?E
+}]Chlw
~kemMq,
d!s_(]S[I`:(
&v3I"66
&WhE^&_c
dCMdmYad
mF8rXfw
@{L9xx2
S2GA%CU
G-42t061
_+EI'r)W4k4P
]C%m%8lo+AW$
yUwbs`
HXCtL;TG
LIfXBWd'cBk
R-D#}D$b(%&)
3^,Y|@w
VYQh0a
(Xs"M\@
9/RDJ}#S' f=
{-i_I&
HY`S|`ds
a1eb"j
om,7\(
`[NuZu
P{#"6n
>bRlJz8x
VLDWFe8r/
KzlQ`q|T
}^m[Ty1}\IS
>0*P,x
gNK} )i
5fd'Ua
g3H'%EI
+H[GV
b!OG_gb!ow
VHiq>|OS
nz WH~Xl32#
u'^[:U
Pj`b3x)?!f2Hf(Pa)J
7?F5,P
`J855l
H#S pkm%VV+
g0XD8G
J"EwwL[oJ%
z|C1^n
j4P(j}5x1]j9
I;o;{O!x,LV
YsidSG
ST"p=)~s)]E3G
nV6ty@hxT
]8P3ykL@B
!1M`V
o9gGg!
mMVKgOz0h
;s~]rZ/<1]`ZMU
Xw?0p2U;
m((NcG%H
t^XpW5
!jakDu;
L:M=`@<
DS/A[|*rh2(
LSYJ-O*
p"Ay#'|7
tYR^hN<
h{4v~V}YL
78 .EXT
,HsN]/OAu
"'@V,
rx+"4U*
y_h)hJv
[zAu@\)L_=
p5>E2k+M
d*kTY[
hZV(P4*>
|"2mFbUC5T
Rbm;IB{x_j
j(Sc,P
{>pU[C?^
om^t0Cvy^+ev
DOEl`W
?]&V%C
EcO@a$@u9MR
")VftP O[
KdViV
'E~[?b,A~4$
G0:|KL#Cl
(J1WDFL*"t>(d
HBBBB~tRPBBBBV,:8BBBB.$.BBBB
3\`P*C
GenaTA?49L
)iqqDMi
94M4QymA
aMi}U2M4
=eiIY1)
Hji$4M=Msei}eEi
_42[-iir}]UiI!
Yiayqa~i1Ld=
WiykU5srD
t.Y5i!SL
mM4MmH
I2-l=U|di
I4M}m\I2M9
)4MiA!I2M
1YMdh5]1
d5{-M4MyE
@MiydiH!
AIimy]4M4)
Qir9QM4I`e!
I2my%4Md%
<M$]u'
y8`=AI}
Sl0cLe9J
p6Z b/&
u=4M4e-K4M
M4MS;s4M4+c
K7_M4M
4M4o74MC{
M4MK3K4M4#{4M
WM4Mw?4M4g/H4M
M4MP8p4M4(`
H4\M4M
4M4l44M@x
M4MH0H4M4 x4M
t<4M4d,Z&IRNE
vi:&iiJv:i&Z&
>i2NBii>2i^R
ri>"iiNr>i"^"
"n0Wr4M
a-I5M4MA
4M4eY-a
3XY*M4Mb:rY;
j?d?\V\
4Mgekqas:MIAqiey}
5nRH9VE:2ii:
:>"i6JVbziV2
nHi&b$
_i*r]_
4%LI2uN*64M^]
e=&8co9`
zP^KBw
MNLw{l((Jvvff||f_54bonyz\*3vpgFQ
Q-0&lWGY
BvJyDHe
BiAIUZ
zU=#x#N
i=Z!GX`
OtVA'5
W9z+i>&
~sV/cNq}
3^ /CH
1qE0j={&s
[r8Zcog
}O2dx>
j1,MWd
k*Y,fud>{OB*,uK
C\%1zPf
2#|Jz{N
bxV"xg%
v_X^Z"X/aFEb5U
j[dC'T
iY+T8=1_V^yK
JAYh\CJ[4E$@?4viO|kgv4&[<K}Y{~t
r)PEwid
t'TZ)
NKgrl%|JEjK
%/-eM|V
W[Ew*rYBU,nM[?
UYJw+L
="RV(%W@S{Yp
9_]pB-Iqj
aOjdDUdiWJ
Bm=m~@
Dr$V< +FZa,
NUvnYW[Rxm%i
|R>1*+hJ~
>guFU\
~|xW]pv
iem]gg
+3sR(*&
^ixVhtX-#2d|e:uOGti
#W~X%>#
KXUmEx\"Y
F[cw"I
=iwoI^:wS][
QN=?S_)iL
&% Rb8=FtFN?R
BT<GFHW)R,
ewi$mzc4
]tSk^3
DR4'}X1^sX/S<< B
XS}TXZLip
iii/"58;i0%(KFQibrA$e
iMdR{G\_4M4b
a{^UQAN"}<
hvb}:z|x
Ami$T%/2X2Cr
q=21t>?jc41l0kiex.zd
3b~c{.ji^Pp@|[BT
$<vb~u<&? /&
l^ndia8"LSJ
"k"(0]
@${pvr}
f4oD<`
pZRW+p/o}|jj,z,w
@Ig#Uc@[Ah
)S_*T%$!Ns
gslmita
qQyRzDsXwZq_mTiXk@kIcShNhtc)`g
~hQjCoKaIw~
\F9]FAjG?
k0CyQzO~+_t
G(2758<b
fQH"$&*!
-OD2I$
lI$986:
k;{>D"$
2'\$Hd$,z
t$L`3V$L
V-A\^L
ts\z$i4Z$
a"T$HY
ROLf[_#$
I2MVL&4I
4o4I$KKAx\2I$
lI$I0Awvryj3C~udrX
Y \SD"VID
#H&$l:34x
&H$pI29|$I"L]
R"$&pi
$H2F8&3$H&@%
j/$&W
%#s2I&zs}pt2MI
OeGB2MI
]<0Wg{
FyHUgT\O1^D
(RptlBd|
(Eu`a,n
v:E`0O
JXc/ZrPkXK
F33YXk$2*oh%!^/
1Z x!O
q3SL]FcV
lan7X/QM
>]fU Xd:7_
Z4cojc8s
q;tEs5LrWURbs.*N$ukztUj
\rTpQtjr]r
HVO_<#6C
gIU(pl
h?T3_o!C `B0@;?
~Ruquna
%K)WYj
"(4*]"~
FU<23
'd(\Y_X].S;&Ra
Q'<6L!U
H>*1C039~
D"lqwH&+k
I4x$&e
dL )>2
$$NL4M
z=YL56$
Dpr"H&|%b<x
PD"dLK
(0ww4Md
D"~rD"$
$dHlzgKY4e
WwdrYBx
_xh1IXKc
*4IiEr
qguFx5*>M
_PyjP5
Dk>z<}:G
Mi0~4II2N_&4
`cD"|XUROH$
LAF{"$
fdc["HhNm
q|EBW,BPxH z4
LD2S><f
i~$ir<
AS8Cc/&W>D"
\I"q}-D2M
L#U@D2I$
9z>W'ujl
$lV~77C61
a4X \`M
w\6"+C&>=$f!
Z:;$s-;,7Z
J\4dH&$Fd$Y
By9t)Ac;^H
I2I&w)1D2I%
0$I2#HQ
G/iifWE2UZTt~^
;p9w I2Im
.<r4I&54x[uu$
*W`pg8
U||u*2
cIk`!6
d6'h5
vDzBGSEY
DW|=tPc
G(int%(b
y2A:[<J4CRPWmzJ
+* +Q\
$I%uVQT/K}]VqD`L5_9ZDZk[
cY_&,:{
z^b)Mu5?uEa4"0iNTZ
uSwoP#A
-Ye#LWi"m| p"1Bb
7OY^Ko=<
VXRzw]FX}eK
Na.sX)
7F%WW8
mAhmnq3/
z%;Lojn
6|(eZFsj
IeXvJBR
v4@TcV
yW]j-'za^X5v]T
(uXu#\
z:|?NTVwS
U9q]6p@XCMNhN@uuuN
uv' t*
z*}q Op_
}.VA#1x!
W4*L{b:r|
/8o_,*2+
.4oO8N
#L,0/S E6
wWR?e0
9(5?H\
AsfV:j9?O};-WV
u#^TT}
Zmqm[A0u
Bb"[;Ua
380,:7%E65
\W.44H?
N6}~s])
K`ZH5:`uodF5
L2&FVX
?GgMcGXCm
Wj,wYmW:-[
vw^=27hF|#
hLRNyfMvtu
4;jhm&W-4T
Pa#G#$c
).KW8p
b?Uum"O
aop]L3EjL]
8K4UqU.`V7D
F<GKpG
Nq4")*
HwLBVBT
hOU28K
~@+>4>6_e
_ORCYS
Mw5ywebVrdU'
W!{7pz}
#Ncs}#)|V
hcb#4N
+E.@ffupV
J.KPsND:
jyYAZ6
M5>/wR}Z
|NDK5pP
UnwB5g
i[6g^OPW
iUHP~W
TG^]-U+u
TAV.v]
4M4l~`
f7HiR,> i.`4M$
8B\ipjD&
Xb|&4MnPJ
:$iTVx4MN0*
"<ii4M(J2
^@M4Mz
iil~`d
L4hrLii
HR,> 4M4i$
8B4M4\pjDI2M&
iXbi|nPJ4M$
:TVxi$N0*
4MiZ8tv
4M"<I2M(E2
^i@z$i
lL4M~`
rt4ane|3o
*>"Qdiqz
i.PE#;F?BIS`
I*1VD
$U^%f' F_;Ir
yYp1lL
<0^)=1|NEu$JO3r"[
y\/.De
x}rstyydgfeh7@
ksc}f|j|h`pjts
GZS@JV~fJw|gMh|ald-
aynpgqijsb\ AC61**
1hk--.
3s:q<1-o40
bE=Ex9
G<6:?Mrc
r_Lll*r
7nY&e?[X
[AeEt7H
?4,kl;.xe"q[Xv;^.
L(D2;M
jX8377_N?nXCEScHEM~
6aZXkvaye}r
wicZcyX6uz+`s4
Eza;fa@~X6dP
Kcek8m
KZ/ry9c
\l2h"EUCC9"<&&f>~mUp
d6 Vo3
8F<V>G|3
2 NR>G|3.
s=dA2<
dAJPdA
dA@PsA
!TG *
!z$$c;
@3U\E| !
yGC='7=d
CO/?C=_
CK+=d;[
AC!1Q=d
DmI?q5sM
CSYj/P
d#=1:#`A
$BE.43
TXS[U&B
@@i}M#tg8
:N9h{TS,@
$tl`l!
H/m+0*h
NB<=tC$\$K
t7s.CE
u*+\Hh$<.4
<*435`y
}$v}{h"t[WWV
U]\B^c
%dxnXe
V48^XXXX]
MessageBoxA
wsprintfA
ExitProcess
GetModuleHandleA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
LoadLibraryA
RegCloseKey
BitBlt
GdipDrawLine
AlphaBlend
OleRun
DragFinish
PathFileExistsA
InternetOpenA
user32.dll
kernel32.dll
ADVAPI32.dll
ATL.DLL
GDI32.dll
gdiplus.dll
MSIMG32.dll
MSVCRT.dll
ole32.dll
OLEAUT32.dll
SHELL32.dll
SHLWAPI.dll
WININET.dll
SystemkhkmzSystemdoeavSystamdcmxlSystemgpuzwSystemntqxvSystemotcykSystemjphlqSystemyqqxqSystemfovdtSystemcvhntSystemnuvomSystemkxshtSystemvinndSystamcaaxvSystamopjrdSystemebrqfSystamezmjrSystemdgfujSystembzjazSystamwpvvoSystemnnxifSystammlyuzSystemfsjyfSystemiibqqSystamisrszSystamrvefpSystamdnxnlSystemyjciuSystamlwsxnSystameamjnSystempziglSystemgkgcwSystamlpbvaSystemtkmbkSystemfiquiSystemffkvySystamiqddlSystembzlqsSystemaxyeaSystembidsbSystemofezaSystemdsyhkSystamieppqSystemgqfpbSystemmjzirSystemjggbeSystemulbshSystamngjnfSystamvglhaSystamycllgSystemgqxkoSystamllqiySystemuljhpSystemsahawSystamaxmpoSystamnjwqdSystemjddtjSystemhmogeSystamwrisp

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 61714 8.8.8.8 53
192.168.56.101 56933 8.8.8.8 53
192.168.56.101 138 192.168.56.255 138
192.168.56.101 58485 114.114.114.114 53
192.168.56.101 58485 8.8.8.8 53
192.168.56.101 57665 114.114.114.114 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.