Compare this analysis to...

#### Analysis

Category | Started | Completed | Duration | Options | Log
--- | --- | --- | --- | --- | ---
FILE | 2019-05-16 16:36:53 | 2019-05-16 16:38:35 | 102 seconds | Show Options | Show Log

    vpn = disabled
    submit_all = yes

#### MalScore

## 6.3

##### Alcatraz-Locker

#### Machine

Name | Label | Manager | Started On | Shutdown On
--- | --- | --- | --- | ---
win7-x86-1-101 | 11101,default | Proxmox | 2019-05-16 16:37:38 | 2019-05-16 16:38:35

#### File Details

File Name | BE3AFA19C76C2270CCAC7EACF68F89603032C0588F721215E15A9D1421567969
File Size | 117760 bytes
File Type | PE32 executable (console) Intel 80386, for MS Windows
MD5 | 35d93ccc99cf73c9c46349718aeae588
SHA1 | 26240234a28b2865e36ab09d38bd47093d0085f9
SHA256 | be3afa19c76c2270ccac7eacf68f89603032c0588f721215e15a9d1421567969
SHA512 | 2cd59d01ed052fdfe4a2d8e18424b3e0cab4c262fb5333423595484d3bdc25c555e69b4107a354862e8b100bdd33a3ebe58e26b752c94ae46f0202a2908880cb
CRC32 | F2DB6C37
Ssdeep | None
ClamAV | None matched
Yara | None matched
| Download

#### Signatures

Uses Microsoft Crypto API keys or hashes

Process: pQMupSSUjM.exe (880)
Hash 0x00278788-0 | Handle: 0x00278788 Source: CryptCreateHash Algorithm: SHA1 Input buffer: KhANFwJhHntndAQmXAWVfShhmitfxtpcTXWDaLbRcjwBDcDiKcyghAlHfGWTNMfsHLbwnKUoUoMoVVuXJMnqPAvEhUkmFtCNElbuJlOztCWEQiErepPkfovuUJBjxqlx
Hash 0x002813f0-0 | Handle: 0x002813f0 Source: CryptCreateHash Algorithm: SHA1 Input buffer: 0\x82\x022\xa0\x03\x02\x01\x02\x02\x10D\xaf\xb0\x80\xd6\xa3'\xba\x8909\x86.\xf8@k0\x0d\x06\x09*\x86H\x86\xf7\x0d\x01\x01\x05\x05\x000?1$0"\x06\x03U\x04\x0a\x13\x1bDigital\x20Signature\x20Trust\x20Co.1\x170\x15\x06\x03U\x04\x03\x13\x0eDST\x20Root\x20CA\x20X30\x1e\x17\x0d000930211219Z\x17\x0d210930140115Z0?1$0"\x06\x03U\x04\x0a\x13\x1bDigital\x20Signature\x20Trust\x20Co.1\x170\x15\x06\x03U\x04\x03\x13\x0eDST\x20Root\x20CA\x20X30\x82\x01"0\x0d\x06\x09*\x86H\x86\xf7\x0d\x01\x01\x01\x05\x00\x03\x82\x01\x0f\x000\ (1026 more characters)
Hash 0x00281370-0 | Handle: 0x00281370 Source: CryptCreateHash Algorithm: SHA1 Input buffer:
Hash 0x002eba78-0 | Handle: 0x002eba78 Source: CryptCreateHash Algorithm: SHA1 Input buffer: 0\x82\x03\x81\xa0\x03\x02\x01\x02\x02\x10y\xad\x16\xa1J\xa0\xa5\xadLsX\xf4\x07\x13.e0\x0d\x06\x09*\x86H\x86\xf7\x0d\x01\x01\x05\x05\x000_1\x130\x11\x06\x0a\x09\x92&\x89\x93\xf2,d\x01\x19\x16\x03com1\x190\x17\x06\x0a\x09\x92&\x89\x93\xf2,d\x01\x19\x16\x09microsoft1-0+\x06\x03U\x04\x03\x13$Microsoft\x20Root\x20Certificate\x20Authority0\x1e\x17\x0d010509231922Z\x17\x0d210509232813Z0_1\x130\x11\x06\x0a\x09\x92&\x89\x93\xf2,d\x01\x19\x16\x03com1\x190\x17\x06\x0a\x09\x92&\x89\x93\xf2,d\x01\x19\x16\x09microsoft1-0 (1958 more characters)
Hash 0x002eba38-0 | Handle: 0x002eba38 Source: CryptCreateHash Algorithm: SHA1 Input buffer: 0\x82\x03\xd2\xa0\x03\x02\x01\x02\x02\x0aa\x0d\x0ap\x00\x00\x00\x00\x00C0\x0d\x06\x09*\x86H\x86\xf7\x0d\x01\x01\x05\x05\x000_1\x130\x11\x06\x0a\x09\x92&\x89\x93\xf2,d\x01\x19\x16\x03com1\x190\x17\x06\x0a\x09\x92&\x89\x93\xf2,d\x01\x19\x16\x09microsoft1-0+\x06\x03U\x04\x03\x13$Microsoft\x20Root\x20Certificate\x20Authority0\x1e\x17\x0d190404224448Z\x17\x0d210509232813Z0\x81\x831\x0b0\x09\x06\x03U\x04\x06\x13\x02US1\x130\x11\x06\x03U\x04\x08\x13\x0aWashington1\x100\x0e\x06\x03U\x04\x07\x13\x07Redmond1\x1e0\x1c (1973 more characters)
Hash 0x002eba78-1 | Handle: 0x002eba78 Source: CryptCreateHash Algorithm: SHA1 Input buffer: 0\x82\x04\x08\xa0\x03\x02\x01\x02\x02\x133\x00\x00\x002\x80\xc6(S7\xd7]X\x00\x03\x00\x00\x0020\x0d\x06\x09*\x86H\x86\xf7\x0d\x01\x01\x05\x05\x000\x81\x831\x0b0\x09\x06\x03U\x04\x06\x13\x02US1\x130\x11\x06\x03U\x04\x08\x13\x0aWashington1\x100\x0e\x06\x03U\x04\x07\x13\x07Redmond1\x1e0\x1c\x06\x03U\x04\x0a\x13\x15Microsoft\x20Corporation1-0+\x06\x03U\x04\x03\x13$Microsoft\x20Certificate\x20Trust\x20List\x20PCA0\x1e\x17\x0d190405001711Z\x17\x0d200405001711Z0\x81\x891\x0b0\x09\x06\x03U\x04\x06\x13\x02US1\x130\x1 (1805 more characters)
Hash 0x002ebab8-0 | Handle: 0x002ebab8 Source: CryptCreateHash Algorithm: SHA1 Input buffer: 0\x82\x022\xa0\x03\x02\x01\x02\x02\x10D\xaf\xb0\x80\xd6\xa3'\xba\x8909\x86.\xf8@k0\x0d\x06\x09*\x86H\x86\xf7\x0d\x01\x01\x05\x05\x000?1$0"\x06\x03U\x04\x0a\x13\x1bDigital\x20Signature\x20Trust\x20Co.1\x170\x15\x06\x03U\x04\x03\x13\x0eDST\x20Root\x20CA\x20X30\x1e\x17\x0d000930211219Z\x17\x0d210930140115Z0?1$0"\x06\x03U\x04\x0a\x13\x1bDigital\x20Signature\x20Trust\x20Co.1\x170\x15\x06\x03U\x04\x03\x13\x0eDST\x20Root\x20CA\x20X30\x82\x01"0\x0d\x06\x09*\x86H\x86\xf7\x0d\x01\x01\x01\x05\x00\x03\x82\x01\x0f\x000\ (1026 more characters)
Asymmetric key 0x002812b0-0 | Handle: 0x002812b0 Key origin: CryptImportPublicKeyInfo of unrecognized public key, Exponent: 0x10001, Modulus: 0xdfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d, Key hash: c309f4eca61460854a2d0526dd32af9aaa790c52dc0396e5c4efec65464ddd43 Algorithm: RSA Public Key Exchange (2048 bit)
Asymmetric key 0x002eba38-0 | Handle: 0x002eba38 Key origin: CryptImportPublicKeyInfo of unrecognized public key, Exponent: 0x10001, Modulus: 0xc8607b9905dabe7b6ecb2ed276c7ff108207dfc31c294e825cf60da0d40362f621f5554419f24a2749e5ccf2ed1f5bf54d3db7d23c3fb2b8fa606eb5f51c6c49d355653caba189b0693a93001e8f374971b1cb80358d312095dc5c3b4813b9bed4586a8553b5487ef6282f65e4dd7d3e369df2a4c9b3896f6b9d3bc81dfa1b242591db1e8e316125fb784f3cedb4f5284e6c3f2cbf90ec84d29fff6602aeaf654c413ff3dc5c872aa979155d8c5c25f1db44c4055ed48dac50975bd7f5584a8518ecd89ec47525918b6c1fbc2bf9f0c329f4d83a26986affc54f7032414967ea253a3b9db5bb831e08a3b806a04e8d8005dc677234fb578232a2146dea3765d1, Key hash: e81715343584dfe840c191d72d7d994dd37a02a6053d0e4bffe3e168b23752b9 Algorithm: RSA Public Key Exchange (2048 bit)
Asymmetric key 0x002eba38-1 | Handle: 0x002eba38 Key origin: CryptImportPublicKeyInfo of unrecognized public key, Exponent: 0x10001, Modulus: 0xf35dfa8067d45aa7a90c2c9020d035083c7584cdb707899c89dadecec360fa91685a9e94712918767cc2e0c82576940e58fa043436e6dfaff780bae9580b2b93e59d05e3772291f734643c22911d5ee10990bc14fefc755819e179b70792a3ae885908d89f07ca0358fc68296d32d7d2a8cb4bfce10b48324fe6ebb8ad4fe45c6f139499db95d575dba81ab79491b4775bf5480c8f6a797d1470047d6daf90f5da70d847b7bf9b2f6ce705b7e11160ac7991147cc5d6a6e4e17ed5c37ee592d23c00b53682de79e16df3b56ef89f33c9cb527d739836db8ba16ba295979ba3dec24d26ff0696672506c8e7ace4ee1233953199c835084e34ca7953d5b5be6332594036c0a54e044d3ddb5b0733e458bfef3f5364d842593557fd0f457c24044d9ed6387411972290ce684474926fd54b6fb086e3c73642a0d0fcc1c05af9a361b9304771960a16b091c04295ef107f286ae32a1fb1e4cd033f777104c720fc490f1d4588a4d7cb7e88ad8e2dec45dbc45104c92afcec869e9a11975bdece5388e6e2b7fdac95c22840dbef0490df813339d9b245a5238706a5558931bb062d600e41187d1f2eb597cb11eb15d524a594ef151489fd4b73fa325bfcd13300f95962700732ea2eab402d7bcadd21671b30998f16aa23a841d1b06e119b36c4de40749ce15865c1601e7a5b38c88fbb04267cd41640e5b66b6caa86fd00bfcec135, Key hash: 60bded75c5fd119010d6832f76defc393473d7a0ce64fbd68daba29bfd0b2f7c Algorithm: RSA Public Key Exchange (4096 bit)
Asymmetric key 0x002eba78-0 | Handle: 0x002eba78 Key origin: CryptImportPublicKeyInfo of unrecognized public key, Exponent: 0x10001, Modulus: 0xf35dfa8067d45aa7a90c2c9020d035083c7584cdb707899c89dadecec360fa91685a9e94712918767cc2e0c82576940e58fa043436e6dfaff780bae9580b2b93e59d05e3772291f734643c22911d5ee10990bc14fefc755819e179b70792a3ae885908d89f07ca0358fc68296d32d7d2a8cb4bfce10b48324fe6ebb8ad4fe45c6f139499db95d575dba81ab79491b4775bf5480c8f6a797d1470047d6daf90f5da70d847b7bf9b2f6ce705b7e11160ac7991147cc5d6a6e4e17ed5c37ee592d23c00b53682de79e16df3b56ef89f33c9cb527d739836db8ba16ba295979ba3dec24d26ff0696672506c8e7ace4ee1233953199c835084e34ca7953d5b5be6332594036c0a54e044d3ddb5b0733e458bfef3f5364d842593557fd0f457c24044d9ed6387411972290ce684474926fd54b6fb086e3c73642a0d0fcc1c05af9a361b9304771960a16b091c04295ef107f286ae32a1fb1e4cd033f777104c720fc490f1d4588a4d7cb7e88ad8e2dec45dbc45104c92afcec869e9a11975bdece5388e6e2b7fdac95c22840dbef0490df813339d9b245a5238706a5558931bb062d600e41187d1f2eb597cb11eb15d524a594ef151489fd4b73fa325bfcd13300f95962700732ea2eab402d7bcadd21671b30998f16aa23a841d1b06e119b36c4de40749ce15865c1601e7a5b38c88fbb04267cd41640e5b66b6caa86fd00bfcec135, Key hash: 60bded75c5fd119010d6832f76defc393473d7a0ce64fbd68daba29bfd0b2f7c Algorithm: RSA Public Key Exchange (4096 bit)
Asymmetric key 0x002eba38-2 | Handle: 0x002eba38 Key origin: CryptImportPublicKeyInfo of unrecognized public key, Exponent: 0x10001, Modulus: 0xb09a5460c620107f6f5e99ae5c95c63ae122addfb0707792733e2aa377fb63a75f5ed2cde570727ed96b5b4979a87c287e17a10b136edcc7da750170f192aed1bacbe28838ed15f8bda08df0cac0910d8a0c71ba836ed9c8d9e766b35b22e3458c13bac2ab1283fe72638377e6cd74cd0db39cc86e8a27220fc57145665376f0f37ffea3271280a3036e5a6421de7463766cb8f7ab74eebcf51332fafaf322ce7b401cd4909676c91f3f7ca3c90fec87ea2f9703171ac2aa05a5caaa270fa65d3cc157e7f7043e7bb56d1d1e47de07e64bfcf9e568bdc4aba1e40f5a5ff71a8f2022975964cb2251e343e006ccc0212be12763f7a31f492540e16b067869e1f7, Key hash: c80070a86d43ae4fc918ed3c56260afe9b8e9c5869114fe22a176a0875dcc828 Algorithm: RSA Public Key Exchange (2048 bit)
Asymmetric key 0x002eba38-3 | Handle: 0x002eba38 Key origin: CryptImportPublicKeyInfo of unrecognized public key, Exponent: 0x10001, Modulus: 0xdfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d, Key hash: c309f4eca61460854a2d0526dd32af9aaa790c52dc0396e5c4efec65464ddd43 Algorithm: RSA Public Key Exchange (2048 bit)
Symmetric key 0x002806b0-0 | Handle: 0x002806b0 Key origin: CryptDeriveKey from hash object SHA1 GUID: 0x00278788-0 Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Unrecognized data) \xe7/jw\x82.jw\x00\x00)\x01\x80\x00\x00\x00X\xaah\x01|\xe5\x1b\x00\xe8,jw\x80\x00\x00\x00\x00\x00)\x01\x08\xb4P\x01\x00\x00\x00\x00\x00\x00)\x01`\xaah\x01\x00\x00)\x01\x02\x00\x00\x00;\x00\x02\x00\x04\x0d\x00\x00\x00\x00)\x01\xd8\x00\x00\x00`\xaah\x01\xc0\xa9h\x01\x01\x00\x00\x00X\xaah\x01\xc4\xe5\x1b\x00\xe8,jw\x80\x00\x00\x00\x00\x00)\x01h\xfae\x01X\xaah\x01\xdc\xe6\x1b\x00\x04\x01lw\x00\x00)\x01\x02\x00\x00\x00\x18\x01lw\x86\xcdiw\x00\x00)\x01\xca\x00\x00\x00`\xaah\x01\x00\x00)\x01P\xdbe\x01X\xaah\x01\x0 (765 more characters) Encrypted data 2: (Unrecognized data) \xff\xfe\x0d\x00\x0a\x00[\x00.\x00S\x00h\x00e\x00l\x00l\x00C\x00l\x00a\x00s\x00s\x00I\x00n\x00f\x00o\x00]\x00\x0d\x00\x0a\x00L\x00o\x00c\x00a\x00l\x00i\x00z\x00e\x00d\x00R\x00e\x00s\x00o\x00u\x00r\x00c\x00e\x00N\x00a\x00m\x00e\x00=\x00@\x00%\x00C\x00o\x00m\x00m\x00o\x00n\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00F\x00i\x00l\x00e\x00s\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x00\\x00w\x00a\x00b\x003\x002\x00r\x00e\x00s\x00.\x00d\x00l\x00l\x00,\x00-\x001\x000\x001\x000\x000\x00\x0d\x00\x0a\x00I\x00n\x00f\x00o\x00T (555 more characters) Encrypted data 3: (Unrecognized data) \x00\x00)\x01C\x00o\x00n\x00t\x00a\x00c\x00t\x00s\x00\x00\x00\x00\x00|\xe5\x1b\x00\xcah\xc0m\x00\x00\x00\x00\x00\x00)\x01`\xaah\x01\xe4\xe5\x1b\x00\xe3\xd0d\x01;\x00\x02\x00\x12\x0d\x00\x00\xe4\xe5\x1b\x00\x18\x00V\x01\x00\x00)\x01\xc0\xa9h\x01\x01\x00\x00\x00X\xaah\x01\xbc\xe5\x1b\x00\xe8,jw\x80\x00\x00\x00\x00\x00)\x01\x90\x0d)\x01X\xaah\x01\xd4\xe6\x1b\x00\x04\x01lw\x00\x00)\x01\x02\x00\x00\x00\x18\x01lw\x8e\xcdiw\x00\x00)\x01L\x02\x00\x00`\xaah\x01\x08\x00T\x00\x00\x00\x00\x00\x00\x00)\x01\x00\x00\x00\x (6306 more characters) Encrypted data 4: (Unrecognized data) <?xml\x20version="1.0"\x20encoding="UTF-8"?>\x0d\x0a<c:contact\x20c:Version="1"\x20xmlns:c="http://schemas.microsoft.com/Contact"\x20xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">\x0d\x0a\x09<c:CreationDate>2015-06-26T04:23:48Z</c:CreationDate><c:Extended\x20xsi:nil="true"/>\x0d\x0a\x09<c:ContactIDCollection><c:ContactID\x20c:ElementID="4104b4f9-c37a-4551-8960-0e1c16099c50"><c:Value>0454e423-8199-483d-9aae-d9519986e8d8</c:Value></c:ContactID></c:ContactIDCollection><c:NameCollection><c:Name\x20c:Ele (1698 more characters) Encrypted data 5: (Unrecognized data) \x00\x00)\x01d\x00e\x00s\x00k\x00t\x00o\x00p\x00.\x00i\x00n\x00i\x00\x00\x00\xcah\xc0m\x00\x00\x00\x00\x00\x00)\x01\xd8\xa9h\x01\xe4\xe5\x1b\x00\xe3\xd0d\x01;\x00\x13\x001\x0d\x00\x00\xe4\xe5\x1b\x00\x18\x00V\x01\x00\x00)\x01\xc0\xa9h\x01\x01\x00\x00\x00\xd0\xa9h\x01\xbc\xe5\x1b\x00\xe8,jw\x80\x00\x00\x00\x00\x00)\x01\x90\x0d)\x01\xd0\xa9h\x01\xd4\xe6\x1b\x00\x04\x01lw\x00\x00)\x01\x02\x00\x00\x00\x18\x01lw\x8e\xcdiw\x00\x00)\x01L\x02\x00\x00\xd8\xa9h\x01\x08\x00T\x00\x00\x00\x00\x00\x00\x00)\x01\x00\x00\x0 (392 more characters) Encrypted data 6: (Unrecognized data) \xff\xfe\x0d\x00\x0a\x00[\x00.\x00S\x00h\x00e\x00l\x00l\x00C\x00l\x00a\x00s\x00s\x00I\x00n\x00f\x00o\x00]\x00\x0d\x00\x0a\x00L\x00o\x00c\x00a\x00l\x00i\x00z\x00e\x00d\x00R\x00e\x00s\x00o\x00u\x00r\x00c\x00e\x00N\x00a\x00m\x00e\x00=\x00@\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00s\x00h\x00e\x00l\x00l\x003\x002\x00.\x00d\x00l\x00l\x00,\x00-\x002\x001\x007\x006\x009\x00\x0d\x00\x0a\x00I\x00c\x00o\x00n\x00R\x00e\x00s\x00o\x00u\x00r\x00c\x00e (224 more characters) Encrypted data 7: (Unrecognized data) \x00\x00)\x01f\x00o\x00o\x00b\x00a\x00r\x00.\x00b\x00m\x00p\x00\x00\x00\x1b\x00\xcah\xc0m\x00\x00\x00\x00\x00\x00)\x01\xd8\xa9h\x01\xe4\xe5\x1b\x00\xe3\xd0d\x01;\x00\x13\x00A\x0d\x00\x00\xe4\xe5\x1b\x00\x18\x00V\x01\x00\x00)\x01\xc0\xa9h\x01\x01\x00\x00\x00\xd0\xa9h\x01\xbc\xe5\x1b\x00\xe8,jw\x80\x00\x00\x00\x00\x00)\x01\x90\x0d)\x01\xd0\xa9h\x01\xd4\xe6\x1b\x00\x04\x01lw\x00\x00)\x01\x02\x00\x00\x00\x18\x01lw\x8e\xcdiw\x00\x00)\x01L\x02\x00\x00\xd8\xa9h\x01\x08\x00T\x00\x00\x00\x00\x00\x00\x00)\x01\x00\x00 (6342 more characters) Encrypted data 8: (Unrecognized data) BM6\xf9\x15\x00\x00\x00\x00\x006\x00\x00\x00(\x00\x00\x00\x20\x03\x00\x00X\x02\x00\x00\x01\x00\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\x13\x0b\x00\x00\x13\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0cK7\x09H4\x08G3\x09H4\x0eK7\x0dJ6\x0cG3\x08C/\x09D0\x0aE1\x0fG4\x10H5\x10G4\x0dD1\x0aA.\x09=+\x12?.\x0c8'\x0b8'\x0e>,\x0e>,\x08:(\x09=+\x0fF3\x05<)\x08C/\x0dH4\x09H4\x05D0\x03D/\x07H3\x0dL8\x0cI5\x0dH4\x0bF2\x0aE1\x09D0\x0aE1\x0bF2\x0bF2\x11L8\x0fJ6\x0dH4\x0eI5\x10K7\x10K7\x0dH4\x08E1\x0aG3\x0cK7\x10O;\x11P<\x (3687 more characters) Encrypted data 9: (Unrecognized data) \x00\x00)\x01f\x00o\x00o\x00b\x00a\x00r\x00.\x00e\x00x\x00e\x00\x00\x00\x1b\x00\xcah\xc0m\x00\x00\x00\x00\x00\x00)\x01\xd8\xa9h\x01\xe4\xe5\x1b\x00\xe3\xd0d\x01;\x00\x13\x00Q\x0d\x00\x00\xe4\xe5\x1b\x00\x18\x00V\x01\x00\x00)\x01\xc0\xa9h\x01\x01\x00\x00\x00\xd0\xa9h\x01\xbc\xe5\x1b\x00\xe8,jw\x80\x00\x00\x00\x00\x00)\x01\x90\x0d)\x01\xd0\xa9h\x01\xd4\xe6\x1b\x00\x04\x01lw\x00\x00)\x01\x02\x00\x00\x00\x18\x01lw\x8e\xcdiw\x00\x00)\x01L\x02\x00\x00\xd8\xa9h\x01\x08\x00T\x00\x00\x00\x00\x00\x00\x00)\x01\x00\x00 (6336 more characters) Encrypted data 10: (Likely PE file) MZ\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xff\xff\x00\x00\xb8\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd8\x00\x00\x00\x0e\x1f\xba\x0e\x00\xb4\x09\xcd!\xb8\x01L\xcd!This\x20program\x20cannot\x20be\x20run\x20in\x20DOS\x20mode.\x0d\x0d\x0a$\x00\x00\x00\x00\x00\x00\x00r\x81\xc2b6\xe0\xac16\xe0\xac16\xe0\xac1?\x98915\xe0\xac1?\x98?1+\xe0\xac16\xe0\xad1\xc1\xe0\xac1?\x98/1)\xe0\xac1?\x (5463 more characters) Encrypted data 11: (Unrecognized data) \x00\x00)\x01f\x00o\x00o\x00b\x00a\x00r\x00.\x00j\x00p\x00g\x00\x00\x00\x1b\x00\xcah\xc0m\x00\x00\x00\x00\x00\x00)\x01\xd8\xa9h\x01\xe4\xe5\x1b\x00\xe3\xd0d\x01;\x00\x13\x00a\x0d\x00\x00\xe4\xe5\x1b\x00\x18\x00W\x01\x00\x00)\x01\xc0\xa9h\x01\x01\x00\x00\x00\xd0\xa9h\x01\xbc\xe5\x1b\x00\xe8,jw\x80\x00\x00\x00\x00\x00)\x01\x90\x0d)\x01\xd0\xa9h\x01\xd4\xe6\x1b\x00\x04\x01lw\x00\x00)\x01\x02\x00\x00\x00\x18\x01lw\x8e\xcdiw\x00\x00)\x01L\x02\x00\x00\xd8\xa9h\x01\x08\x00U\x00\x00\x00\x00\x00\x00\x00)\x01\x00\x00 (6342 more characters) Encrypted data 12: (Likely JPEG file) \xff\xd8\xff\xe0\x00\x10JFIF\x00\x01\x02\x01\x00H\x00H\x00\x00\xff\xed\x0e\x0cPhotoshop\x203.0\x008BIM\x04\x04\x07Caption\x00\x00\x00\x10\x1c\x02\x00\x00\x02\x00\x02\x1c\x02x\x00\x04\x00\x00\x00\x008BIM\x03\xe9\x0aPrint\x20Info\x00\x00\x00\x00x\x00\x03\x00\x00\x00H\x00H\x00\x00\x00\x00\x02\xd8\x02(\xff\xe1\xff\xe2\x02\xf9\x02F\x03G\x05(\x03\xfc\x00\x02\x00\x00\x00H\x00H\x00\x00\x00\x00\x02\xd8\x02(\x00\x01\x00\x00\x00d\x00\x00\x00\x01\x00\x03\x03\x03\x00\x00\x00\x01'\x0f\x00\x01\x00\x01\x00\x00\x00\x00\x00\ (5724 more characters) Encrypted data 13: (Unrecognized data) \x00\x00)\x01f\x00o\x00o\x00b\x00a\x00r\x00.\x00m\x00p\x003\x00\x00\x00\x1b\x00\xcah\xc0m\x00\x00\x00\x00\x00\x00)\x01\xd8\xa9h\x01\xe4\xe5\x1b\x00\xe3\xd0d\x01;\x00\x13\x00q\x0d\x00\x00\xe4\xe5\x1b\x00\x18\x00W\x01\x00\x00)\x01\xc0\xa9h\x01\x01\x00\x00\x00\xd0\xa9h\x01\xbc\xe5\x1b\x00\xe8,jw\x80\x00\x00\x00\x00\x00)\x01\x90\x0d)\x01\xd0\xa9h\x01\xd4\xe6\x1b\x00\x04\x01lw\x00\x00)\x01\x02\x00\x00\x00\x18\x01lw\x8e\xcdiw\x00\x00)\x01L\x02\x00\x00\xd8\xa9h\x01\x08\x00U\x00\x00\x00\x00\x00\x00\x00)\x01\x00\x00 (6348 more characters) Encrypted data 14: (Likely PNG file) \x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x0dIHDR\x00\x00\x05\x9c\x00\x00\x02\xe0\x08\x02\x00\x00\x00\x9f\xf2%\xcb\x00\x00\x20\x00IDATx\x9c\xec\xbd]\x88\x1c\xc7\x9a\xe7\xfd\xef\xa1\x0cQ\xe0\x03\x990\x86J\x18A\xe7\xcb1\xb8\x84\x05\xaef\x0d\xaeb|\xa12\xbeP\x1b_Hf_\x18\x89Y\x98\xa3\xe1\\x8c}\x0e\xcc\xd8\x0cX\xea\xe3\x0b\xbb\xdb\x86w\xe5\x19\xf0\xb1f`v\xb4\x0b\xb3\xc8\x07vp\x1bV\xb8}!\\xba\xf0Re\xf0K\xb7\xa1\x8dJ\xa0a\xb2A\x03Y\xa0\x03\x19p\x0c\x19\xe0\x82\xde\x8b\xc8\x8c\x8a\xfc\xac\xac\xaa\xac\x8fn=?D\x12\x8a\x8a\x (5604 more characters) Encrypted data 15: (Unrecognized data) \x00\x00)\x01f\x00o\x00o\x00b\x00a\x00r\x00.\x00p\x00n\x00g\x00\x00\x00\x1b\x00\xcah\xc0m\x00\x00\x00\x00\x00\x00)\x01\xd8\xa9h\x01\xe4\xe5\x1b\x00\xe3\xd0d\x01;\x00\x13\x00\x81\x0d\x00\x00\xe4\xe5\x1b\x00\x18\x00W\x01\x00\x00)\x01\xc0\xa9h\x01\x01\x00\x00\x00\xd0\xa9h\x01\xbc\xe5\x1b\x00\xe8,jw\x80\x00\x00\x00\x00\x00)\x01\x90\x0d)\x01\xd0\xa9h\x01\xd4\xe6\x1b\x00\x04\x01lw\x00\x00)\x01\x02\x00\x00\x00\x18\x01lw\x8e\xcdiw\x00\x00)\x01L\x02\x00\x00\xd8\xa9h\x01\x08\x00U\x00\x00\x00\x00\x00\x00\x00)\x01\x00\ (6354 more characters) Encrypted data 16: (Likely PNG file) \x89PNG\x0d\x0a\x1a\x0a\x00\x00\x00\x0dIHDR\x00\x00\x02b\x00\x00\x02a\x08\x02\x00\x00\x00m\xa0K\x1f\x00\x00\x00\x01sRGB\x00\xae\xce\x1c\xe9\x00\x00\x00\x04gAMA\x00\x00\xb1\x8f\x0b\xfca\x05\x00\x00\x00\x09pHYs\x00\x00\x0e\xc3\x00\x00\x0e\xc3\x01\xc7o\xa8d\x00\x00\xa7$IDATx^\xed\x9d\x07|\x14E\x1b\xc6O\xfd\x14\x1b\x82\x02\x02\x09\x04\x90\x1e:\x84TzUA,(\x8a\x8a(EA\xa4\x08"\xd2{\xef\xbd\x83\x80\xa8\x14\x15\x04i\xd2\x12z\x87\x10z/\xd2\x04\xa4\x13\x08\xe5\x9b\xdd}wn\xb6]\xee\x92Kr\xe5\xf9\xff\x1eqw\xfa\xcc\xee\xce (5325 more characters) Encrypted data 17: (Unrecognized data) \x00\x00)\x01f\x00o\x00 Encrypted data 18: (Unrecognized data) foobar\x0a\x00 Encrypted data 19: (Unrecognized data) \x00\x00)\x01f\x00o\x00 Encrypted data 20: (Unrecognized data) foobar\x0a\x00 Encrypted data 21: (Unrecognized data) \x00\x00)\x01d\x00e\x00s\x00k\x00t\x00o\x00p\x00.\x00i\x00n\x00i\x00\x00\x00\xcah\xc0m\x00\x00\x00\x00\x00\x00)\x01`\xaah\x01\xe4\xe5\x1b\x00\xe3\xd0d\x01;\x00\x02\x00\xb9\x0d\x00\x00\xe4\xe5\x1b\x00\x18\x00W\x01\x00\x00)\x01\xc0\xa9h\x01\x01\x00\x00\x00X\xaah\x01\xbc\xe5\x1b\x00\xe8,jw\x80\x00\x00\x00\x00\x00)\x01\x90\x0d)\x01X\xaah\x01\xd4\xe6\x1b\x00\x04\x01lw\x00\x00)\x01\x02\x00\x00\x00\x18\x01lw\x8e\xcdiw\x00\x00)\x01L\x02\x00\x00`\xaah\x01\x08\x00U\x00\x00\x00\x00\x00\x00\x00)\x01\x00\x00\x00\x00\x08 (761 more characters) Encrypted data 22: (Unrecognized data) \xff\xfe\x0d\x00\x0a\x00[\x00.\x00S\x00h\x00e\x00l\x00l\x00C\x00l\x00a\x00s\x00s\x00I\x00n\x00f\x00o\x00]\x00\x0d\x00\x0a\x00L\x00o\x00c\x00a\x00l\x00i\x00z\x00e\x00d\x00R\x00e\x00s\x00o\x00u\x00r\x00c\x00e\x00N\x00a\x00m\x00e\x00=\x00@\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00s\x00h\x00e\x00l\x00l\x003\x002\x00.\x00d\x00l\x00l\x00,\x00-\x002\x001\x007\x007\x000\x00\x0d\x00\x0a\x00I\x00c\x00o\x00n\x00R\x00e\x00s\x00o\x00u\x00r\x00c\x00e (536 more characters) Encrypted data 23: (Unrecognized data) \x15\x01\x00\x00\x80\xfeg\x01\xc0\xa9h\x01\x01\x00\x00\x00\xd0\xa9h\x01\x08\xe1\x1b\x00\xe8,jw\x80\x00\x00\x00\x00\x00)\x01\x88\xfeg\x01\xd0\xa9h\x01\x20\xe2\x1b\x00\x04\x01lw\x00\x00)\x01\x02\x00\x00\x00\x18\x01lwz\xc9iw\x00\x00)\x01\x15\x01\x00\x00\xd8\xa9h\x01D\xe1\x1b\x00\xe8,jw\x15\x01\x00\x00\x00\x00)\x01\x00\xf9h\x01\x80\xfeg\x01\\xe2\x1b\x00\x04\x01lw\x00\x00)\x01\x02\x00\x00\x00\x18\x01lw\x06\xc9iw\x00\x00)\x01+\x03\x00\x00\x88\xfeg\x01\x08\x00U\x00\x00\x00\x00\x00\x00\x00)\x01\x00\x00\x00\x00\x08\ (6345 more characters) Encrypted data 24: (Unrecognized data) !BDN\x8a\x03\xfb\x88SM\x17\x00\x13\x00\x01\x01@\x00\x00\x00X\x9f\x18\x00\x04\x00\x00\x00\x01\x00\x00\x00\xd4\x0d\x00\x00\x00\x00\x00\x00\xbb\x00\x00\x00\x00\x04\x00\x00\x00\x04\x00\x00\x15\x04\x00\x00\x07@\x00\x00\x01\x00\x01\x00\x00\x04\x00\x00\x07@\x00\x00\x07@\x00\x00\x0f\x80\x00\x00\x00\x04\x00\x00\x00\x04\x00\x00\x00\x04\x00\x00\x00\x04\x00\x00\x15\x04\x00\x00\x15\x04\x00\x00\x15\x04\x00\x00\x07@\x00\x00\x00\x04\x00\x00\x00\x04\x00\x00\x00\x04\x00\x00\x00\x04\x00\x00\x00\x04\x00\x00\x00\x04\x00\x00\x00 (7635 more characters) Encrypted data 25: (Unrecognized data) \x00\x00)\x01d\x00e\x00s\x00k\x00t\x00o\x00p\x00.\x00i\x00n\x00i\x00\x00\x00\xcah\xc0m\x00\x00\x00\x00\x00\x00)\x01`\xaah\x01\xe4\xe5\x1b\x00\xe3\xd0d\x01;\x00\x02\x00\xfa\x0d\x00\x00\xe4\xe5\x1b\x00\x18\x00W\x01\x00\x00)\x01\xc0\xa9h\x01\x01\x00\x00\x00X\xaah\x01\xbc\xe5\x1b\x00\xe8,jw\x80\x00\x00\x00\x00\x00)\x01\x90\x0d)\x01X\xaah\x01\xd4\xe6\x1b\x00\x04\x01lw\x00\x00)\x01\x02\x00\x00\x00\x18\x01lw\x8e\xcdiw\x00\x00)\x01L\x02\x00\x00`\xaah\x01\x08\x00U\x00\x00\x00\x00\x00\x00\x00)\x01\x00\x00\x00\x00\x08 (386 more characters) Encrypted data 26: (Unrecognized data) \xff\xfe\x0d\x00\x0a\x00[\x00.\x00S\x00h\x00e\x00l\x00l\x00C\x00l\x00a\x00s\x00s\x00I\x00n\x00f\x00o\x00]\x00\x0d\x00\x0a\x00L\x00o\x00c\x00a\x00l\x00i\x00z\x00e\x00d\x00R\x00e\x00s\x00o\x00u\x00r\x00c\x00e\x00N\x00a\x00m\x00e\x00=\x00@\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00s\x00h\x00e\x00l\x00l\x003\x002\x00.\x00d\x00l\x00l\x00,\x00-\x002\x001\x007\x009\x008\x00\x0d\x00\x0a\x00I\x00c\x00o\x00n\x00R\x00e\x00s\x00o\x00u\x00r\x00c\x00e (224 more characters) Encrypted data 27: (Unrecognized data) \x00\x00)\x01\xc0\xa9h\x01\x01\x00\x00\x00X\xaah\x01x\xe5\x1b\x00\xe8,jw\x80\x00\x00\x00\x00\x00)\x01\x90]f\x01X\xaah\x01\x90\xe6\x1b\x00\x04\x01lw\x00\x00)\x01\x02\x00\x00\x00\x18\x01lw\xca\xcdiw\x00\x00)\x01\x0f\x01\x00\x00`\xaah\x01\x01\x00\x00\x00\x88]f\x01\xbc\xe5\x1b\x00\xe8,jw\x0f\x01\x00\x00\x00\x00)\x01\x00\xf9h\x01\x88]f\x01\xd4\xe6\x1b\x00\x04\x01lw\x00\x00)\x01\x02\x00\x00\x00\x18\x01lw\x8e\xcdiw\x00\x00)\x01"\x03\x00\x00\x90]f\x01\x08\x00U\x00\x00\x00\x00\x00\x00\x00)\x01\x00\x00\x00\x00\x08\x0 (6369 more characters) Encrypted data 28: (Likely PE file) MZ\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xff\xff\x00\x00\xb8\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\x00\x00\x00\x0e\x1f\xba\x0e\x00\xb4\x09\xcd!\xb8\x01L\xcd!This\x20program\x20cannot\x20be\x20run\x20in\x20DOS\x20mode.\x0d\x0d\x0a$\x00\x00\x00\x00\x00\x00\x00\x8a\xf9\x0e\x0a\xce\x98`Y\xce\x98`Y\xce\x98`YM\x84nY\xc9\x98`Y&\x87dY\xcc\x98`Y\x0d\x97?Y\xcf\x98`Y\x0d\x97=Y\xcd\x9 (6174 more characters) Encrypted data 29: (Unrecognized data) \x00\x00\x00\x00\xc0\xa9h\x01\x01\x00\x00\x00X\xaah\x01\x90\xdc\x1b\x00\xe8,jw\x80\x00\x00\x00\x00\x00)\x01\x08\xb4P\x01X\xaah\x01\xa8\xdd\x1b\x00\x04\x01lw\x00\x00)\x01\x02\x00\x00\x00\x18\x01lw\xf2\xf6iw\x00\x00)\x01N\x01\x00\x00`\xaah\x01pejw\xa6ejw\x00\x00\x00\x00\x08\xb4P\x01N\x01\x00\x00\x00\xf9h\x01\x81\x03\x00\x00\x00\xb4P\x01\xec\xdd\x1b\x00\x17\x00\x00\x00\x00\x00%\x00\x0d\x00\x00\x00HZf\x01\x00\x00)\x01\x08[f\x01\x9a\xf6iw\xa8\xde\x1b\x00<\x02%\x00\x00\x00\x00\x00\x0b\x00\x00\x00\xf0\xdd\x1b\x00\ (6156 more characters) Encrypted data 30: (Unrecognized data) BZh11AY&SY\x8a\x8f\x0a\x1d\x00\x00\x05\xe7\x00\xc0@\x00\x01\x02\x00\x10\x00\x00\x04\x00\x88\x20\x001\x0c\x08\x1a\x1ai\xea\x0f\x12v\xa7\x06\xd7\x8b\xb9"\x9c(HEG\x85\x0e\x80BZh11AY&SY:Az\x0a\x00\x01?\x7f\x98\xf0\x20\xc0\xa1@\x01D\x80\xe5BX\x00\xae\xa7\xdc\xa0\x0a\x08@\x00\x00\x08\x20\x00\x92\x84\xaa\x9a`\x00\x98\x00\x02`\xd1\xa6\x82H\xa9\xe9\xa9\xa0\x01\x88\x0d\x1a4\x01\xe5*\x0c\xc5\xe4\xf9\x9c\x07E,\x8fl\x03\xb0\x08N\xe5"\xc4\xee\x93\xbb\xa4\x90\x19X\xad2\x04\x80r\x00\xe9\x1a\x1a\xe2\xb2\xa2\xe2\xb2\x89\xde\ (5631 more characters) Other encryptions: 24 additional encrypted buffers

Attempts to connect to a dead IP:Port (4 unique times)
IP: 72.21.81.240:80 (United States)
IP: 216.58.214.243:443 (United States)
IP: 192.35.177.64:80 (United States)
IP: 216.58.214.243:80 (United States)
Performs Crypto API operations with keys or hashes

Performs some HTTP requests
url: http://www.myexternalip.com/raw
url: http://apps.identrust.com/roots/dstrootcax3.p7c
url: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Checks for the presence of known windows from debuggers and forensic tools
Window: ConsoleWindowClass
Harvests information related to installed mail clients
file: C:\Users\John\Documents\Outlook Files\Outlook.pst
Appends a known Alcatraz-Locker ransomware file extension to files that have been encrypted

#### Screenshots

#### Hosts

Direct | IP | Country Name
--- | --- | ---
Y | 8.8.8.8 [VT] | United States
N | 72.21.81.240 [VT] | United States
N | 51.140.127.197 [VT] | United Kingdom
N | 216.58.214.243 [VT] | United States
N | 192.35.177.64 [VT] | United States

#### DNS

Name | Response | Post-Analysis Lookup
--- | --- | ---
time.windows.com [VT] | A 51.140.127.197 [VT] CNAME time.microsoft.akadns.net [VT] |
www.myexternalip.com [VT] | CNAME ghs.googlehosted.com [VT] A 216.58.214.243 [VT] | 216.58.201.83 [VT]
apps.identrust.com [VT] | A 192.35.177.64 [VT] CNAME apps.digsigtrust.com [VT] | 192.35.177.64 [VT]
www.download.windowsupdate.com [VT] | CNAME cs11.wpc.v0cdn.net [VT] CNAME 2-01-3cf7-0009.cdx.cedexis.net [VT] CNAME wu.ec.azureedge.net [VT] CNAME hlb.apr-52dd2-0.edgecastdns.net [VT] A 72.21.81.240 [VT] CNAME wu.azureedge.net [VT] CNAME wu.wpc.apr-52dd2.edgecastdns.net [VT] | 2.21.74.104 [VT]

#### PE Information

Image Base | 0x00400000
Entry Point | 0x0040360d
Reported Checksum | 0x00000000
Actual Checksum | 0x0001f7f8
Minimum OS Version | 6.0
Compile Time | 2016-10-23 18:01:24
Import Hash | 9f7f4bcbcc59e1b63b584db899b5d397

#### Sections

Name | Virtual Address | Virtual Size | Size of Raw Data | Characteristics | Entropy
--- | --- | --- | --- | --- | ---
.text | 0x00001000 | 0x00013244 | 0x00013400 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 6.58
.rdata | 0x00015000 | 0x00006880 | 0x00006a00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 5.29
.data | 0x0001c000 | 0x00001ed4 | 0x00001600 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 4.48
.gfids | 0x0001e000 | 0x000000b4 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 1.50
.reloc | 0x0001f000 | 0x00001108 | 0x00001200 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ | 6.44

#### Imports

Library WINHTTP.dll:
• 0x4151a0 WinHttpReceiveResponse
• 0x4151a4 WinHttpSendRequest
• 0x4151a8 WinHttpAddRequestHeaders
• 0x4151ac WinHttpOpenRequest
• 0x4151b0 WinHttpQueryDataAvailable
• 0x4151b4 WinHttpReadData
• 0x4151b8 WinHttpConnect
• 0x4151bc WinHttpCloseHandle
• 0x4151c0 WinHttpOpen
Library KERNEL32.dll:
• 0x415048 GetFullPathNameA
• 0x41504c ReadFile
• 0x415050 WriteFile
• 0x415054 CloseHandle
• 0x415058 GetLastError
• 0x41505c CreateFileA
• 0x415060 GetFileSize
• 0x415064 AllocConsole
• 0x415068 HeapReAlloc
• 0x41506c HeapSize
• 0x415070 DeleteFileA
• 0x415074 FindNextFileA
• 0x415078 FindFirstFileA
• 0x41507c FindClose
• 0x415080 VerifyVersionInfoW
• 0x415084 SetCurrentDirectoryA
• 0x415088 VerSetConditionMask
• 0x41508c GetConsoleCP
• 0x415090 GetConsoleMode
• 0x415094 SetFilePointerEx
• 0x415098 FlushFileBuffers
• 0x41509c DecodePointer
• 0x4150a0 WriteConsoleW
• 0x4150a4 RaiseException
• 0x4150a8 CreateFileW
• 0x4150ac Sleep
• 0x4150b0 UnhandledExceptionFilter
• 0x4150b4 SetUnhandledExceptionFilter
• 0x4150b8 GetCurrentProcess
• 0x4150bc TerminateProcess
• 0x4150c0 IsProcessorFeaturePresent
• 0x4150c4 QueryPerformanceCounter
• 0x4150c8 GetCurrentProcessId
• 0x4150cc GetCurrentThreadId
• 0x4150d0 GetSystemTimeAsFileTime
• 0x4150d4 InitializeSListHead
• 0x4150d8 IsDebuggerPresent
• 0x4150dc GetStartupInfoW
• 0x4150e0 GetModuleHandleW
• 0x4150e4 GetModuleFileNameW
• 0x4150e8 InitializeCriticalSectionAndSpinCount
• 0x4150ec TlsAlloc
• 0x4150f0 TlsGetValue
• 0x4150f4 TlsSetValue
• 0x4150f8 TlsFree
• 0x4150fc FreeLibrary
• 0x415100 GetProcAddress
• 0x415104 LoadLibraryExW
• 0x415108 RtlUnwind
• 0x41510c SetLastError
• 0x415110 EnterCriticalSection
• 0x415114 LeaveCriticalSection
• 0x415118 DeleteCriticalSection
• 0x41511c MultiByteToWideChar
• 0x415120 GetStdHandle
• 0x415124 GetModuleFileNameA
• 0x415128 WideCharToMultiByte
• 0x41512c ExitProcess
• 0x415130 GetModuleHandleExW
• 0x415134 GetCommandLineA
• 0x415138 GetCommandLineW
• 0x41513c GetACP
• 0x415140 HeapFree
• 0x415144 HeapAlloc
• 0x415148 WaitForSingleObject
• 0x41514c GetExitCodeProcess
• 0x415150 CreateProcessA
• 0x415154 GetFileAttributesExW
• 0x415158 CompareStringW
• 0x41515c LCMapStringW
• 0x415160 MoveFileExW
• 0x415164 GetFileType
• 0x415168 FindFirstFileExA
• 0x41516c IsValidCodePage
• 0x415170 GetOEMCP
• 0x415174 GetCPInfo
• 0x415178 GetEnvironmentStringsW
• 0x41517c FreeEnvironmentStringsW
• 0x415180 SetEnvironmentVariableA
• 0x415184 SetStdHandle
• 0x415188 GetStringTypeW
• 0x41518c GetProcessHeap
Library USER32.dll:
• 0x415194 FindWindowA
• 0x415198 ShowWindow
Library CRYPT32.dll:
• 0x415034 CryptStringToBinaryA
• 0x415038 CryptBinaryToStringW
• 0x41503c CryptBinaryToStringA
• 0x415040 CryptStringToBinaryW
Library ADVAPI32.dll:
• 0x415000 SystemFunction036
• 0x415004 CryptDestroyHash
• 0x415008 CryptHashData
• 0x41500c CryptCreateHash
• 0x415010 CryptDecrypt
• 0x415014 CryptEncrypt
• 0x415018 CryptGetKeyParam
• 0x41501c CryptSetKeyParam
• 0x415020 CryptDestroyKey
• 0x415024 CryptDeriveKey
• 0x415028 CryptReleaseContext
• 0x41502c CryptAcquireContextW

.text
`.rdata
@.data
.gfids
@.reloc
Vh$SA
Vh8SA
VhTSA
VhhSA
SVWUj
Vh,hA
Main Invoked.
Main Returned.
EventRegister
EventSetInformation
EventUnregister
EventWriteTransfer
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`RTTI
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
COMSPEC
cmd.exe
`h````
(null)
CorExitProcess
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
March
April
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
AreFileApisANSI
CompareStringEx
GetCurrentPackageId
GetSystemTimePreciseAsFileTime
LCMapStringEx
LocaleNameToLCID
NAN(SNAN)
nan(snan)
NAN(IND)
nan(ind)
e+000
1#INF
1#QNAN
1#SNAN
1#IND
log10
log10
BC .=
"B <1=
#.X'=
atan2
floor
ldexp
_cabs
_hypot
frexp
_logb
_nextafter
InvokeMainViaCRT
"Main Invoked."
FileName
ExitMainViaCRT
"Main Returned."
FileName
Microsoft.CRTProvider
.text
.text$mn
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIC
.CRT$XIZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$sxdata
.rdata$zETW0
.rdata$zETW1
.rdata$zETW2
.rdata$zETW9
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata$x
.idata$2
.idata$3
.idata$4
.idata$6
.data
.gfids$x
.gfids$y
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WINHTTP.dll
VerSetConditionMask
SetCurrentDirectoryA
CreateFileA
DeleteFileA
FindClose
FindFirstFileA
FindNextFileA
GetFileSize
GetFullPathNameA
ReadFile
WriteFile
CloseHandle
GetLastError
Sleep
VerifyVersionInfoW
AllocConsole
KERNEL32.dll
ShowWindow
FindWindowA
USER32.dll
CryptStringToBinaryA
CryptStringToBinaryW
CryptBinaryToStringA
CryptBinaryToStringW
CRYPT32.dll
CryptAcquireContextW
CryptReleaseContext
CryptDeriveKey
CryptDestroyKey
CryptSetKeyParam
CryptGetKeyParam
CryptEncrypt
CryptDecrypt
CryptCreateHash
CryptHashData
CryptDestroyHash
ADVAPI32.dll
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
MultiByteToWideChar
GetStdHandle
GetModuleFileNameA
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
HeapFree
HeapAlloc
WaitForSingleObject
GetExitCodeProcess
CreateProcessA
GetFileAttributesExW
CompareStringW
LCMapStringW
MoveFileExW
GetFileType
FindFirstFileExA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
GetStringTypeW
GetProcessHeap
HeapSize
HeapReAlloc
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
DecodePointer
WriteConsoleW
RaiseException
CreateFileW
SystemFunction036
qvsxkDXwPHdJAIYleQMyocFmbEuaVgnORf
1CNpMj7DTH3gbJAPrQT2FZ4whqpYQvFrY8
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
USERNAME
C:\Users\
vssadmin.exe Delete Shadows /All /Quiet
.Alcatraz
ConsoleWindowClass
Windows_XP
Windows_XP
Windows_XP_SP1
Windows_XP_SP1
Windows_XP_SP2
Windows_XP_SP2
Windows_XP_SP3
Windows_XP_SP3
Windows_Vista
Windows_Vista
Windows_Vista_SP1
Windows_Vista_SP1
Windows_Vista_SP2
Windows_Vista_SP2
Windows_7
Windows_7
Windows_7_SP1
Windows_7_SP1
Windows_8
Windows_8
Windows_8.1
Windows_8.1
Windows_10
Windows_10
Windows_Server
Windows_Server
Windows_Client
Windows_Client
USERNAME
/index.php?ip=%s&id=%s&botid=%s&username=%s&key=%s%s&os=%s&count=%d
AppData
\Desktop\
ransomed.html
start
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
>4?A?N?[?r?
>1>>>C>Q>3?R?W?
>,>B>J>
> >$>(>4><>@>D>H>L>
7 7(707
;";&;
Aadvapi32
api-ms-win-core-fibers-l1-1-1
api-ms-win-core-synch-l1-2-0
kernel32
(null)
mscoree.dll
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
March
April
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
en-US
api-ms-win-appmodel-runtime-l1-1-1
api-ms-win-core-datetime-l1-1-1
api-ms-win-core-localization-l1-2-1
api-ms-win-core-localization-obsolete-l1-2-0
api-ms-win-core-processthreads-l1-1-2
api-ms-win-core-string-l1-1-0
api-ms-win-core-sysinfo-l1-2-1
api-ms-win-core-winrt-l1-1-0
api-ms-win-core-xstate-l2-1-0
api-ms-win-rtcore-ntuser-window-l1-1-0
api-ms-win-security-systemfunctions-l1-1-0
ext-ms-win-kernel32-package-current-l1-1-0
ext-ms-win-ntuser-dialogbox-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
user32
Aja-JP
zh-CN
ko-KR
zh-TW
zh-CHS
ar-SA
bg-BG
ca-ES
cs-CZ
da-DK
de-DE
el-GR
fi-FI
fr-FR
he-IL
hu-HU
is-IS
it-IT
nl-NL
nb-NO
pl-PL
pt-BR
ro-RO
ru-RU
hr-HR
sk-SK
sq-AL
sv-SE
th-TH
tr-TR
ur-PK
id-ID
uk-UA
be-BY
sl-SI
et-EE
lv-LV
lt-LT
fa-IR
vi-VN
hy-AM
az-AZ-Latn
eu-ES
mk-MK
tn-ZA
xh-ZA
zu-ZA
af-ZA
ka-GE
fo-FO
hi-IN
mt-MT
se-NO
ms-MY
kk-KZ
ky-KG
sw-KE
uz-UZ-Latn
tt-RU
bn-IN
pa-IN
gu-IN
ta-IN
te-IN
kn-IN
ml-IN
mr-IN
sa-IN
mn-MN
cy-GB
gl-ES
kok-IN
syr-SY
div-MV
quz-BO
ns-ZA
mi-NZ
ar-IQ
de-CH
en-GB
es-MX
fr-BE
it-CH
nl-BE
nn-NO
pt-PT
sr-SP-Latn
sv-FI
az-AZ-Cyrl
se-SE
ms-BN
uz-UZ-Cyrl
quz-EC
ar-EG
zh-HK
de-AT
en-AU
es-ES
fr-CA
sr-SP-Cyrl
se-FI
quz-PE
ar-LY
zh-SG
de-LU
en-CA
es-GT
fr-CH
hr-BA
smj-NO
ar-DZ
zh-MO
de-LI
en-NZ
es-CR
fr-LU
bs-BA-Latn
smj-SE
ar-MA
en-IE
es-PA
fr-MC
sr-BA-Latn
sma-NO
ar-TN
en-ZA
es-DO
sr-BA-Cyrl
sma-SE
ar-OM
en-JM
es-VE
sms-FI
ar-YE
en-CB
es-CO
smn-FI
ar-SY
en-BZ
es-PE
ar-JO
en-TT
es-AR
ar-LB
en-ZW
es-EC
ar-KW
en-PH
es-CL
ar-AE
es-UY
ar-BH
es-PY
ar-QA
es-BO
es-SV
es-HN
es-NI
es-PR
zh-CHT
af-za
ar-ae
ar-bh
ar-dz
ar-eg
ar-iq
ar-jo
ar-kw
ar-lb
ar-ly
ar-ma
ar-om
ar-qa
ar-sa
ar-sy
ar-tn
ar-ye
az-az-cyrl
az-az-latn
be-by
bg-bg
bn-in
bs-ba-latn
ca-es
cs-cz
cy-gb
da-dk
de-at
de-ch
de-de
de-li
de-lu
div-mv
el-gr
en-au
en-bz
en-ca
en-cb
en-gb
en-ie
en-jm
en-nz
en-ph
en-tt
en-us
en-za
en-zw
es-ar
es-bo
es-cl
es-co
es-cr
es-do
es-ec
es-es
es-gt
es-hn
es-mx
es-ni
es-pa
es-pe
es-pr
es-py
es-sv
es-uy
es-ve
et-ee
eu-es
fa-ir
fi-fi
fo-fo
fr-be
fr-ca
fr-ch
fr-fr
fr-lu
fr-mc
gl-es
gu-in
he-il
hi-in
hr-ba
hr-hr
hu-hu
hy-am
id-id
is-is
it-ch
it-it
ja-jp
ka-ge
kk-kz
kn-in
kok-in
ko-kr
ky-kg
lt-lt
lv-lv
mi-nz
mk-mk
ml-in
mn-mn
mr-in
ms-bn
ms-my
mt-mt
nb-no
nl-be
nl-nl
nn-no
ns-za
pa-in
pl-pl
pt-br
pt-pt
quz-bo
quz-ec
quz-pe
ro-ro
ru-ru
sa-in
se-fi
se-no
se-se
sk-sk
sl-si
sma-no
sma-se
smj-no
smj-se
smn-fi
sms-fi
sq-al
sr-ba-cyrl
sr-ba-latn
sr-sp-cyrl
sr-sp-latn
sv-fi
sv-se
sw-ke
syr-sy
ta-in
te-in
th-th
tn-za
tr-tr
tt-ru
uk-ua
ur-pk
uz-uz-cyrl
uz-uz-latn
vi-vn
xh-za
zh-chs
zh-cht
zh-cn
zh-hk
zh-mo
zh-sg
zh-tw
zu-za
CONOUT$
dAdobe Updater/33.4
onion.to
Host:eq4vimjrejnmvdf2.onion.to
AdobeAcrobat Update/21.0
www.myexternalip.com
User-Agent:Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0

#### Process Tree

- pQMupSSUjM.exe 880

Search term
pQMupSSUjM.exe, PID: 880, Parent PID: 2008
Full Path: C:\Users\John\AppData\Local\Temp\pQMupSSUjM.exe
Command Line: "C:\Users\John\AppData\Local\Temp\pQMupSSUjM.exe"
default registry filesystem network process threading services device synchronization crypto browser all
API Filter

- 1
- 2
- 3
- 4
- 5
- 6
- ...
- 32

Error loading data. Please reload the page and if the error persists contact us.

- 1
- 2
- 3
- 4
- 5
- 6
- ...
- 32

Download PCAP

#### Hosts

Direct | IP | Country Name
--- | --- | ---
Y | 8.8.8.8 [VT] | United States
N | 72.21.81.240 [VT] | United States
N | 51.140.127.197 [VT] | United Kingdom
N | 216.58.214.243 [VT] | United States
N | 192.35.177.64 [VT] | United States

#### TCP

Source | Source Port | Destination | Destination Port
--- | --- | --- | ---
192.168.1.101 | 49165 | 192.35.177.64 apps.identrust.com | 80
192.168.1.101 | 49163 | 216.58.214.243 www.myexternalip.com | 80
192.168.1.101 | 49164 | 216.58.214.243 www.myexternalip.com | 443
192.168.1.101 | 49170 | 72.21.81.240 www.download.windowsupdate.com | 80

- 192.168.1.101:49165 → 192.35.177.64:80

      00000000: 4745 5420 2f72 6f6f 7473 2f64 7374 726f  GET./roots/dstro
      00000010: 6f74 6361 7833 2e70 3763 2048 5454 502f  otcax3.p7c.HTTP/
      00000020: 312e 310d 0a43 6f6e 6e65 6374 696f 6e3a  1.1..Connection:
      00000030: 204b 6565 702d 416c 6976 650d 0a41 6363  .Keep-Alive..Acc
      00000040: 6570 743a 202a 2f2a 0d0a 5573 6572 2d41  ept:.*/*..User-A
      00000050: 6765 6e74 3a20 4d69 6372 6f73 6f66 742d  gent:.Microsoft-
      00000060: 4372 7970 746f 4150 492f 362e 310d 0a48  CryptoAPI/6.1..H
      00000070: 6f73 743a 2061 7070 732e 6964 656e 7472  ost:.apps.identr
      00000080: 7573 742e 636f 6d0d 0a0d 0a              ust.com....

- 192.35.177.64:80 → 192.168.1.101:49165

      00000000: 4854 5450 2f31 2e31 2032 3030 204f 4b0d  HTTP/1.1.200.OK.
      00000010: 0a44 6174 653a 2054 6875 2c20 3136 204d  .Date:.Thu,.16.M
      00000020: 6179 2032 3031 3920 3132 3a35 353a 3135  ay.2019.12:55:15
      00000030: 2047 4d54 0d0a 5365 7276 6572 3a20 4170  .GMT..Server:.Ap
      00000040: 6163 6865 0d0a 582d 4672 616d 652d 4f70  ache..X-Frame-Op
      00000050: 7469 6f6e 733a 2053 414d 454f 5249 4749  tions:.SAMEORIGI
      00000060: 4e0d 0a58 2d58 5353 2d50 726f 7465 6374  N..X-XSS-Protect
      00000070: 696f 6e3a 2031 3b20 6d6f 6465 3d62 6c6f  ion:.1;.mode=blo
      00000080: 636b 0d0a 4c61 7374 2d4d 6f64 6966 6965  ck..Last-Modifie
      00000090: 643a 2046 7269 2c20 3139 204f 6374 2032  d:.Fri,.19.Oct.2
      000000a0: 3031 3220 3230 3a30 383a 3131 2047 4d54  012.20:08:11.GMT
      000000b0: 0d0a 4163 6365 7074 2d52 616e 6765 733a  ..Accept-Ranges:
      000000c0: 2062 7974 6573 0d0a 436f 6e74 656e 742d  .bytes..Content-
      000000d0: 4c65 6e67 7468 3a20 3839 330d 0a43 6163  Length:.893..Cac
      000000e0: 6865 2d63 6f6e 7472 6f6c 3a20 6d61 782d  he-control:.max-
      000000f0: 6167 653d 3836 3430 300d 0a4b 6565 702d  age=86400..Keep-
      00000100: 416c 6976 653a 2074 696d 656f 7574 3d35  Alive:.timeout=5
      00000110: 2c20 6d61 783d 3130 300d 0a43 6f6e 7465  ,.max=100..Conte
      00000120: 6e74 2d54 7970 653a 2061 7070 6c69 6361  nt-Type:.applica
      00000130: 7469 6f6e 2f78 2d70 6b63 7337 2d6d 696d  tion/x-pkcs7-mim
      00000140: 650d 0a0d 0a30 8203 7906 092a 8648 86f7  e....0..y..*.H..
      00000150: 0d01 0702 a082 036a 3082 0366 0201 0131  .......j0..f...1
      00000160: 0030 0b06 092a 8648 86f7 0d01 0701 a082  .0...*.H........
      00000170: 034e 3082 034a 3082 0232 a003 0201 0202  .N0..J0..2......
      00000180: 1044 afb0 80d6 a327 ba89 3039 862e f840  .D.....'..09...@
      00000190: 6b30 0d06 092a 8648 86f7 0d01 0105 0500  k0...*.H........
      000001a0: 303f 3124 3022 0603 5504 0a13 1b44 6967  0?1$0"..U....Dig
      000001b0: 6974 616c 2053 6967 6e61 7475 7265 2054  ital.Signature.T
      000001c0: 7275 7374 2043 6f2e 3117 3015 0603 5504  rust.Co.1.0...U.
      000001d0: 0313 0e44 5354 2052 6f6f 7420 4341 2058  ...DST.Root.CA.X
      000001e0: 3330 1e17 0d30 3030 3933 3032 3131 3231  30...00093021121
      000001f0: 395a 170d 3231 3039 3330 3134 3031 3135  9Z..210930140115
      00000200: 5a30 3f31 2430 2206 0355 040a 131b 4469  Z0?1$0"..U....Di
      00000210: 6769 7461 6c20 5369 676e 6174 7572 6520  gital.Signature.
      00000220: 5472 7573 7420 436f 2e31 1730 1506 0355  Trust.Co.1.0...U
      00000230: 0403 130e 4453 5420 526f 6f74 2043 4120  ....DST.Root.CA.
      00000240: 5833 3082 0122 300d 0609 2a86 4886 f70d  X30.."0...*.H...
      00000250: 0101 0105 0003 8201 0f00 3082 010a 0282  ..........0.....
      00000260: 0101 00df afe9 9750 0883 57b4 cc62 65f6  .......P..W..be.
      00000270: 9082 ecc7 d32c 6b30 ca5b ecd9 c37d c740  .....,k0.[...}.@
      00000280: c118 148b e0e8 3376 492a e33f 2149 93ac  ......3vI*.?!I..
      00000290: 4e0e af3e 48cb 65ee fcd3 210f 65d2 2ad9  N..>H.e...!.e.*.
      000002a0: 328f 8ce5 f777 b012 7bb5 95c0 89a3 a9ba  2....w..{.......
      000002b0: ed73 2e7a 0c06 3283 a27e 8a14 30cd 11a0  .s.z..2..~..0...
      000002c0: e12a 38b9 790a 31fd 50bd 8065 dfb7 5163  .*8.y.1.P..e..Qc
      000002d0: 83c8 e288 61ea 4b61 81ec 526b b9a2 e24b  ....a.Ka..Rk...K
      000002e0: 1a28 9f48 a39e 0cda 098e 3e17 2e1e dd20  .(.H......>.....
      000002f0: df5b c62a 8aab 2ebd 70ad c50b 1a25 9074  .[.*....p....%.t
      00000300: 72c5 7b6a ab34 d630 89ff e568 137b 540b  r.{j.4.0...h.{T.
      00000310: c8d6 aeec 5a9c 921e 3d64 b38c c6df bfc9  ....Z...=d......
      00000320: 4170 ec16 72d5 26ec 3855 3943 d0fc fd18  Ap..r.&.8U9C....
      00000330: 5c40 f197 ebd5 9a9b 8d1d bada 25b9 c6d8  \@..........%...
      00000340: dfc1 1502 3aab da6e f13e 2ef5 5c08 9c3c  ....:..n.>..\..<
      00000350: d683 69e4 109b 192a b629 57e3 e53d 9b9f  ..i....*.)W..=..
      00000360: f002 5d02 0301 0001 a342 3040 300f 0603  ..]......B0@0...
      00000370: 551d 1301 01ff 0405 3003 0101 ff30 0e06  U.......0....0..
      00000380: 0355 1d0f 0101 ff04 0403 0201 0630 1d06  .U...........0..
      00000390: 0355 1d0e 0416 0414 c4a7 b1a4 7b2c 71fa  .U..........{,q.
      000003a0: dbe1 4b90 75ff c415 6085 8910 300d 0609  ..K.u...`...0...
      000003b0: 2a86 4886 f70d 0101 0505 0003 8201 0100  *.H.............
      000003c0: a31a 2c9b 1700 5ca9 1eee 2866 373a bf83  ..,...\...(f7:..
      000003d0: c73f 4bc3 09a0 9520 5de3 d959 44d2 3e0d  .?K.....]..YD.>.
      000003e0: 3ebd 8a4b a074 1fce 1082 9c74 1a1d 7e98  >..K.t.....t..~.
      000003f0: 1add cb13 4bb3 2044 e491 e9cc fc7d a5db  ....K..D.....}..
      00000400: 6ae5 fee6 fde0 4edd b700 3ab5 7049 aff2  j.....N...:.pI..
      00000410: e5eb 02f1 d102 8b19 cb94 3a5e 48c4 181e  ..........:^H...
      00000420: 5819 5f1e 025a f00c f1b1 ada9 dc59 868b  X._..Z.......Y..
      00000430: 6ee9 91f5 86ca fab9 6633 aa59 5bce e2a7  n.......f3.Y[...
      00000440: 1673 47cb 2bcc 99b0 3748 cfe3 564b f5cf  .sG.+...7H..VK..
      00000450: 0f0c 7232 87c6 f044 bb53 726d 43f5 2648  ..r2...D.SrmC.&H
      00000460: 9a52 67b7 58ab fe67 7671 78db 0da2 5614  .Rg.X..gvqx...V.
      00000470: 1339 2431 85a2 a802 5a30 47e1 dd50 07bc  .9$1....Z0G..P..
      00000480: 0209 9000 eb64 6360 9b16 bc88 c912 e6d2  .....dc`........
      00000490: 7d91 8bf9 3d32 8d65 b4e9 7cb1 5776 eac5  }...=2.e..|.Wv..
      000004a0: b628 39bf 1565 1cc8 f677 966a 0a8d 770b  .(9..e...w.j..w.
      000004b0: d891 0b04 8e07 db29 b60a ee9d 8235 3510  .......).....55.
      000004c0: 3100                                     1.

- 192.35.177.64:80 → 192.168.1.101:49165

      00000000: 4854 5450 2f31 2e31 2032 3030 204f 4b0d  HTTP/1.1.200.OK.
      00000010: 0a44 6174 653a 2054 6875 2c20 3136 204d  .Date:.Thu,.16.M
      00000020: 6179 2032 3031 3920 3132 3a35 353a 3135  ay.2019.12:55:15
      00000030: 2047 4d54 0d0a 5365 7276 6572 3a20 4170  .GMT..Server:.Ap
      00000040: 6163 6865 0d0a 582d 4672 616d 652d 4f70  ache..X-Frame-Op
      00000050: 7469 6f6e 733a 2053 414d 454f 5249 4749  tions:.SAMEORIGI
      00000060: 4e0d 0a58 2d58 5353 2d50 726f 7465 6374  N..X-XSS-Protect
      00000070: 696f 6e3a 2031 3b20 6d6f 6465 3d62 6c6f  ion:.1;.mode=blo
      00000080: 636b 0d0a 4c61 7374 2d4d 6f64 6966 6965  ck..Last-Modifie
      00000090: 643a 2046 7269 2c20 3139 204f 6374 2032  d:.Fri,.19.Oct.2
      000000a0: 3031 3220 3230 3a30 383a 3131 2047 4d54  012.20:08:11.GMT
      000000b0: 0d0a 4163 6365 7074 2d52 616e 6765 733a  ..Accept-Ranges:
      000000c0: 2062 7974 6573 0d0a 436f 6e74 656e 742d  .bytes..Content-
      000000d0: 4c65 6e67 7468 3a20 3839 330d 0a43 6163  Length:.893..Cac
      000000e0: 6865 2d63 6f6e 7472 6f6c 3a20 6d61 782d  he-control:.max-
      000000f0: 6167 653d 3836 3430 300d 0a4b 6565 702d  age=86400..Keep-
      00000100: 416c 6976 653a 2074 696d 656f 7574 3d35  Alive:.timeout=5
      00000110: 2c20 6d61 783d 3130 300d 0a43 6f6e 7465  ,.max=100..Conte
      00000120: 6e74 2d54 7970 653a 2061 7070 6c69 6361  nt-Type:.applica
      00000130: 7469 6f6e 2f78 2d70 6b63 7337 2d6d 696d  tion/x-pkcs7-mim
      00000140: 650d 0a0d 0a30 8203 7906 092a 8648 86f7  e....0..y..*.H..
      00000150: 0d01 0702 a082 036a 3082 0366 0201 0131  .......j0..f...1
      00000160: 0030 0b06 092a 8648 86f7 0d01 0701 a082  .0...*.H........
      00000170: 034e 3082 034a 3082 0232 a003 0201 0202  .N0..J0..2......
      00000180: 1044 afb0 80d6 a327 ba89 3039 862e f840  .D.....'..09...@
      00000190: 6b30 0d06 092a 8648 86f7 0d01 0105 0500  k0...*.H........
      000001a0: 303f 3124 3022 0603 5504 0a13 1b44 6967  0?1$0"..U....Dig
      000001b0: 6974 616c 2053 6967 6e61 7475 7265 2054  ital.Signature.T
      000001c0: 7275 7374 2043 6f2e 3117 3015 0603 5504  rust.Co.1.0...U.
      000001d0: 0313 0e44 5354 2052 6f6f 7420 4341 2058  ...DST.Root.CA.X
      000001e0: 3330 1e17 0d30 3030 3933 3032 3131 3231  30...00093021121
      000001f0: 395a 170d 3231 3039 3330 3134 3031 3135  9Z..210930140115
      00000200: 5a30 3f31 2430 2206 0355 040a 131b 4469  Z0?1$0"..U....Di
      00000210: 6769 7461 6c20 5369 676e 6174 7572 6520  gital.Signature.
      00000220: 5472 7573 7420 436f 2e31 1730 1506 0355  Trust.Co.1.0...U
      00000230: 0403 130e 4453 5420 526f 6f74 2043 4120  ....DST.Root.CA.
      00000240: 5833 3082 0122 300d 0609 2a86 4886 f70d  X30.."0...*.H...
      00000250: 0101 0105 0003 8201 0f00 3082 010a 0282  ..........0.....
      00000260: 0101 00df afe9 9750 0883 57b4 cc62 65f6  .......P..W..be.
      00000270: 9082 ecc7 d32c 6b30 ca5b ecd9 c37d c740  .....,k0.[...}.@
      00000280: c118 148b e0e8 3376 492a e33f 2149 93ac  ......3vI*.?!I..
      00000290: 4e0e af3e 48cb 65ee fcd3 210f 65d2 2ad9  N..>H.e...!.e.*.
      000002a0: 328f 8ce5 f777 b012 7bb5 95c0 89a3 a9ba  2....w..{.......
      000002b0: ed73 2e7a 0c06 3283 a27e 8a14 30cd 11a0  .s.z..2..~..0...
      000002c0: e12a 38b9 790a 31fd 50bd 8065 dfb7 5163  .*8.y.1.P..e..Qc
      000002d0: 83c8 e288 61ea 4b61 81ec 526b b9a2 e24b  ....a.Ka..Rk...K
      000002e0: 1a28 9f48 a39e 0cda 098e 3e17 2e1e dd20  .(.H......>.....
      000002f0: df5b c62a 8aab 2ebd 70ad c50b 1a25 9074  .[.*....p....%.t
      00000300: 72c5 7b6a ab34 d630 89ff e568 137b 540b  r.{j.4.0...h.{T.
      00000310: c8d6 aeec 5a9c 921e 3d64 b38c c6df bfc9  ....Z...=d......
      00000320: 4170 ec16 72d5 26ec 3855 3943 d0fc fd18  Ap..r.&.8U9C....
      00000330: 5c40 f197 ebd5 9a9b 8d1d bada 25b9 c6d8  \@..........%...
      00000340: dfc1 1502 3aab da6e f13e 2ef5 5c08 9c3c  ....:..n.>..\..<
      00000350: d683 69e4 109b 192a b629 57e3 e53d 9b9f  ..i....*.)W..=..
      00000360: f002 5d02 0301 0001 a342 3040 300f 0603  ..]......B0@0...
      00000370: 551d 1301 01ff 0405 3003 0101 ff30 0e06  U.......0....0..
      00000380: 0355 1d0f 0101 ff04 0403 0201 0630 1d06  .U...........0..
      00000390: 0355 1d0e 0416 0414 c4a7 b1a4 7b2c 71fa  .U..........{,q.
      000003a0: dbe1 4b90 75ff c415 6085 8910 300d 0609  ..K.u...`...0...
      000003b0: 2a86 4886 f70d 0101 0505 0003 8201 0100  *.H.............
      000003c0: a31a 2c9b 1700 5ca9 1eee 2866 373a bf83  ..,...\...(f7:..
      000003d0: c73f 4bc3 09a0 9520 5de3 d959 44d2 3e0d  .?K.....]..YD.>.
      000003e0: 3ebd 8a4b a074 1fce 1082 9c74 1a1d 7e98  >..K.t.....t..~.
      000003f0: 1add cb13 4bb3 2044 e491 e9cc fc7d a5db  ....K..D.....}..
      00000400: 6ae5 fee6 fde0 4edd b700 3ab5 7049 aff2  j.....N...:.pI..
      00000410: e5eb 02f1 d102 8b19 cb94 3a5e 48c4 181e  ..........:^H...
      00000420: 5819 5f1e 025a f00c f1b1 ada9 dc59 868b  X._..Z.......Y..
      00000430: 6ee9 91f5 86ca fab9 6633 aa59 5bce e2a7  n.......f3.Y[...
      00000440: 1673 47cb 2bcc 99b0 3748 cfe3 564b f5cf  .sG.+...7H..VK..
      00000450: 0f0c 7232 87c6 f044 bb53 726d 43f5 2648  ..r2...D.SrmC.&H
      00000460: 9a52 67b7 58ab fe67 7671 78db 0da2 5614  .Rg.X..gvqx...V.
      00000470: 1339 2431 85a2 a802 5a30 47e1 dd50 07bc  .9$1....Z0G..P..
      00000480: 0209 9000 eb64 6360 9b16 bc88 c912 e6d2  .....dc`........
      00000490: 7d91 8bf9 3d32 8d65 b4e9 7cb1 5776 eac5  }...=2.e..|.Wv..
      000004a0: b628 39bf 1565 1cc8 f677 966a 0a8d 770b  .(9..e...w.j..w.
      000004b0: d891 0b04 8e07 db29 b60a ee9d 8235 3510  .......).....55.
      000004c0: 3100                                     1.

- 192.168.1.101:49165 → 192.35.177.64:80

#### UDP

Source | Source Port | Destination | Destination Port
--- | --- | --- | ---
192.168.1.101 | 137 | 192.168.1.255 | 137
192.168.1.101 | 52558 | 224.0.0.252 | 5355
192.168.1.101 | 55864 | 224.0.0.252 | 5355
192.168.1.101 | 58359 | 224.0.0.252 | 5355
192.168.1.101 | 60621 | 224.0.0.252 | 5355
192.168.1.101 | 68 | 255.255.255.255 | 67
192.168.1.101 | 123 | 51.140.127.197 time.windows.com | 123
192.168.1.101 | 50966 | 8.8.8.8 | 53
192.168.1.101 | 52350 | 8.8.8.8 | 53
192.168.1.101 | 56072 | 8.8.8.8 | 53
192.168.1.101 | 61816 | 8.8.8.8 | 53

- 192.168.1.101:137 → 192.168.1.255:137

      00000000: cb28 0110 0001 0000 0000 0000 2046 4846  .(...........FHF
      00000010: 4145 4245 4543 4143 4143 4143 4143 4143  AEBEECACACACACAC
      00000020: 4143 4143 4143 4143 4143 4141 4100 0020  ACACACACACAAA...
      00000030: 0001                                     ..

- 192.168.1.101:137 → 192.168.1.255:137

      00000000: cb28 0110 0001 0000 0000 0000 2046 4846  .(...........FHF
      00000010: 4145 4245 4543 4143 4143 4143 4143 4143  AEBEECACACACACAC
      00000020: 4143 4143 4143 4143 4143 4141 4100 0020  ACACACACACAAA...
      00000030: 0001                                     ..

- 192.168.1.101:137 → 192.168.1.255:137

      00000000: cb28 0110 0001 0000 0000 0000 2046 4846  .(...........FHF
      00000010: 4145 4245 4543 4143 4143 4143 4143 4143  AEBEECACACACACAC
      00000020: 4143 4143 4143 4143 4143 4141 4100 0020  ACACACACACAAA...
      00000030: 0001                                     ..

- 192.168.1.101:137 → 192.168.1.255:137

      00000000: cb29 0110 0001 0000 0000 0000 2046 4846  .)...........FHF
      00000010: 4145 4245 4543 4143 4143 4143 4143 4143  AEBEECACACACACAC
      00000020: 4143 4143 4143 4143 4143 4141 4100 0020  ACACACACACAAA...
      00000030: 0001                                     ..

- 192.168.1.101:137 → 192.168.1.255:137

      00000000: cb29 0110 0001 0000 0000 0000 2046 4846  .)...........FHF
      00000010: 4145 4245 4543 4143 4143 4143 4143 4143  AEBEECACACACACAC
      00000020: 4143 4143 4143 4143 4143 4141 4100 0020  ACACACACACAAA...
      00000030: 0001                                     ..

- 192.168.1.101:137 → 192.168.1.255:137

      00000000: cb29 0110 0001 0000 0000 0000 2046 4846  .)...........FHF
      00000010: 4145 4245 4543 4143 4143 4143 4143 4143  AEBEECACACACACAC
      00000020: 4143 4143 4143 4143 4143 4141 4100 0020  ACACACACACAAA...
      00000030: 0001                                     ..

- 192.168.1.101:137 → 192.168.1.255:137

      00000000: cb2a 0110 0001 0000 0000 0000 2046 4846  .*...........FHF
      00000010: 4145 4245 4543 4143 4143 4143 4143 4143  AEBEECACACACACAC
      00000020: 4143 4143 4143 4143 4143 4141 4100 0020  ACACACACACAAA...
      00000030: 0001                                     ..

- 192.168.1.101:137 → 192.168.1.255:137

      00000000: cb2a 0110 0001 0000 0000 0000 2046 4846  .*...........FHF
      00000010: 4145 4245 4543 4143 4143 4143 4143 4143  AEBEECACACACACAC
      00000020: 4143 4143 4143 4143 4143 4141 4100 0020  ACACACACACAAA...
      00000030: 0001                                     ..

- 192.168.1.101:137 → 192.168.1.255:137

      00000000: cb2a 0110 0001 0000 0000 0000 2046 4846  .*...........FHF
      00000010: 4145 4245 4543 4143 4143 4143 4143 4143  AEBEECACACACACAC
      00000020: 4143 4143 4143 4143 4143 4141 4100 0020  ACACACACACAAA...
      00000030: 0001                                     ..

- 192.168.1.101:137 → 192.168.1.255:137

      00000000: cb2b 0110 0001 0000 0000 0000 2046 4846  .+...........FHF
      00000010: 4145 4245 4543 4143 4143 4143 4143 4143  AEBEECACACACACAC
      00000020: 4143 4143 4143 4143 4143 4141 4100 0020  ACACACACACAAA...
      00000030: 0001                                     ..

- 192.168.1.101:137 → 192.168.1.255:137

      00000000: cb2b 0110 0001 0000 0000 0000 2046 4846  .+...........FHF
      00000010: 4145 4245 4543 4143 4143 4143 4143 4143  AEBEECACACACACAC
      00000020: 4143 4143 4143 4143 4143 4141 4100 0020  ACACACACACAAA...
      00000030: 0001                                     ..

- 192.168.1.101:137 → 192.168.1.255:137

      00000000: cb2b 0110 0001 0000 0000 0000 2046 4846  .+...........FHF
      00000010: 4145 4245 4543 4143 4143 4143 4143 4143  AEBEECACACACACAC
      00000020: 4143 4143 4143 4143 4143 4141 4100 0020  ACACACACACAAA...
      00000030: 0001                                     ..

#### DNS

Name | Response | Post-Analysis Lookup
--- | --- | ---
time.windows.com [VT] | A 51.140.127.197 [VT] CNAME time.microsoft.akadns.net [VT] |
www.myexternalip.com [VT] | CNAME ghs.googlehosted.com [VT] A 216.58.214.243 [VT] | 216.58.201.83 [VT]
apps.identrust.com [VT] | A 192.35.177.64 [VT] CNAME apps.digsigtrust.com [VT] | 192.35.177.64 [VT]
www.download.windowsupdate.com [VT] | CNAME cs11.wpc.v0cdn.net [VT] CNAME 2-01-3cf7-0009.cdx.cedexis.net [VT] CNAME wu.ec.azureedge.net [VT] CNAME hlb.apr-52dd2-0.edgecastdns.net [VT] A 72.21.81.240 [VT] CNAME wu.azureedge.net [VT] CNAME wu.wpc.apr-52dd2.edgecastdns.net [VT] | 2.21.74.104 [VT]

#### HTTP Requests

URI | Data
--- | ---
http://www.myexternalip.com/raw |
    GET /raw HTTP/1.1
    Cache-Control: no-cache
    Connection: Keep-Alive
    Pragma: no-cache
    User-Agent: AdobeAcrobat Update/21.0
    Host: www.myexternalip.com
http://apps.identrust.com/roots/dstrootcax3.p7c |
    GET /roots/dstrootcax3.p7c HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: apps.identrust.com
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab |
    GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1
    Cache-Control: max-age = 86410
    Connection: Keep-Alive
    Accept: */*
    If-Modified-Since: Thu, 25 Apr 2019 15:54:20 GMT
    If-None-Match: "05ef4247ffbd41:0"
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: www.download.windowsupdate.com

#### SMTP traffic

No SMTP traffic performed.

#### IRC traffic

No IRC requests performed.

#### ICMP traffic

No ICMP traffic performed.

#### CIF Results

No CIF Results

#### Suricata Alerts

No Suricata Alerts

#### Suricata TLS

No Suricata TLS

#### Suricata HTTP

No Suricata HTTP

Sorry! No dropped Suricata Extracted files.

File name | flashplayer15_0r0_152_win_debug.exe.Alcatraz
Associated Filenames | C:\Users\John\Downloads\fp_15.0.0.152_archive\15_0_r0_152_debug\flashplayer15_0r0_152_win_debug.exe.Alcatraz
File Size | 23544748 bytes
File Type | ASCII text, with very long lines, with no line terminators
MD5 | e40a32fcc79f550c57f02c652f1f1146
SHA1 | 64f66a778770218b23a4dabe5a02a5dc08626472
SHA256 | d55db890e8dcc9879a49713e18d376a16272f39e84165e7e56c659293eb9f1cd
CRC32 | 62CCC586
Ssdeep | None
ClamAV | None
Yara | embedded_pe - Contains an embedded PE32 file vmdetect - Possibly employs anti-virtualization techniques
VirusTotal | Search for Analysis
| Download Display Text
    [encoded data, 8192 characters] <truncated>

File name | uninstall_flashplayer15_0r0_152_mac.dmg.Alcatraz
Associated Filenames | C:\Users\John\Downloads\fp_15.0.0.152_archive\15_0_r0_152\uninstall_flashplayer15_0r0_152_mac.dmg.Alcatraz
File Size | 322648 bytes
File Type | ASCII text, with very long lines, with no line terminators
MD5 | 252b544537a80211449afefd1aee7941
SHA1 | 52746d475bdc50109e3e83d8bb8388ca8f5fc00b
SHA256 | a43a2a73bd52e88b6af9ddb3c6389f9acc067982641726bcf742ddcdfd4e5b06
CRC32 | 901ABF9A
Ssdeep | None
ClamAV | None
Yara | None matched
VirusTotal | Search for Analysis
| Download Display Text
    [encoded data, 8192 characters] <truncated>

File name | Outlook.pst.Alcatraz
Associated Filenames | C:\Users\John\Documents\Outlook Files\Outlook.pst.Alcatraz
File Size | 361836 bytes
File Type | ASCII text, with very long lines, with no line terminators
MD5 | 82f65dc620bd789189e0cc8c71816b1f
SHA1 | a877c71ce017c6d2879674154cb825f0858ab170
SHA256 | facb7d1ca23b73b3b2a37c7e99cc142ccab0d4e6cf5823c74597bef7b8dad55c
CRC32 | 217025FE
Ssdeep | None
ClamAV | None
Yara | vmdetect - Possibly employs anti-virtualization techniques
VirusTotal | Search for Analysis
| Download Display Text
    [encoded data, 8192 characters] <truncated>

File name | flashplayer15_0r0_152_win.msi.Alcatraz
Associated Filenames | C:\Users\John\Downloads\fp_15.0.0.152_archive\15_0_r0_152\flashplayer15_0r0_152_win.msi.Alcatraz
File Size | 25333784 bytes
File Type | ASCII text, with very long lines, with no line terminators
MD5 | 9a824bfd6f3ed569446dce8ca1c866a6
SHA1 | 7855c76e852b86e046932371d67f92e7f595bd38
SHA256 | caa370c11dcc818684fb45722e14811214dd26fd16a0bedfac97307e8aaf1789
CRC32 | A00F7A21
Ssdeep | None
ClamAV | None
Yara | embedded_pe - Contains an embedded PE32 file
VirusTotal | Search for Analysis
| Download Display Text
    [encoded data, 8192 characters] <truncated>

File name | E0F5C59F9FA661F6F4C50B87FEF3A15A
Associated Filenames | C:\Users\John\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
File Size | 212 bytes
File Type | data
MD5 | ef68e2c67d69686db0731a1f7b755c2c
SHA1 | de3156b22a4e4241c173947e2bfac8ec42d03cf0
SHA256 | 8359e120d0e9d5840d7c511cb1a9f2f285be0be94ad65ca8bdc1c73de7473ff9
CRC32 | 7BB96F4E
Ssdeep | None
ClamAV | None
Yara | None matched
VirusTotal | Search for Analysis
| Download

File name | flashplayer15_0r0_152_winax_debug.exe.Alcatraz
Associated Filenames | C:\Users\John\Downloads\fp_15.0.0.152_archive\15_0_r0_152_debug\flashplayer15_0r0_152_winax_debug.exe.Alcatraz
File Size | 23619160 bytes
File Type | ASCII text, with very long lines, with no line terminators
MD5 | a0d2d9775315bf6326150e642f1faa74
SHA1 | f150a9091b57745c318b822903311472401d42fa
SHA256 | 801495638e14a98f312235c11048bdf8d7c2750056ae45f55a84a89ceecd46ff
CRC32 | 11121FF1
Ssdeep | None
ClamAV | None
Yara | embedded_pe - Contains an embedded PE32 file vmdetect - Possibly employs anti-virtualization techniques
VirusTotal | Search for Analysis
| Download Display Text
    [encoded data, 8192 characters] <truncated>

File name | foobar.png.Alcatraz
Associated Filenames | C:\Users\John\Desktop\foobar.png.Alcatraz
File Size | 57216 bytes
File Type | ASCII text, with very long lines, with no line terminators
MD5 | ebfc9d91cc2a3809be20d370e38f8dd8
SHA1 | 27166903df2b5cba53ec4db8f0565d31a956d5de
SHA256 | 0dfcb48f1386d0f5c6eb3242319694a1e9a10e1d9093add9143dc5f289090b38
CRC32 | 635ACF56
Ssdeep | None
ClamAV | None
Yara | None matched
VirusTotal | Search for Analysis
| Download Display Text
    [encoded data, 8192 characters] <truncated>

File name | flashplayer15_0r0_152_mac_sa_debug.dmg.Alcatraz
Associated Filenames | C:\Users\John\Downloads\fp_15.0.0.152_archive\15_0_r0_152_debug\flashplayer15_0r0_152_mac_sa_debug.dmg.Alcatraz
File Size | 18667776 bytes
File Type | ASCII text, with very long lines, with no line terminators
MD5 | 8c0e7c1e42348f5a95f138126ef367bf
SHA1 | e48355cd2f6891fc98c3d378bdf1a2744850ab13
SHA256 | ea078f732245104073cb07f4174616ddcfa2a96632e5132b5deb71bbbe52f159
CRC32 | E6DE48FB
Ssdeep | None
ClamAV | None
Yara | embedded_pe - Contains an embedded PE32 file vmdetect - Possibly employs anti-virtualization techniques
VirusTotal | Search for Analysis
| Download Display Text
    [encoded data, 8192 characters] <truncated>

File name | flashplayer15_0r0_152_mac_debug.dmg.Alcatraz
Associated Filenames | C:\Users\John\Downloads\fp_15.0.0.152_archive\15_0_r0_152_debug\flashplayer15_0r0_152_mac_debug.dmg.Alcatraz
File Size | 21259180 bytes
File Type | ASCII text, with very long lines, with no line terminators
MD5 | 16ce4f2eb4dc64a6b1974efcb3ab1c89
SHA1 | aca9dd98d178f051a8e842c42a490a1f7c848fb4
SHA256 | da0f4e81cc416a95d232481037d62d436f32cebaa2ce592411497ead727450e7
CRC32 | 3FC299E7
Ssdeep | None
ClamAV | None
Yara | embedded_pe - Contains an embedded PE32 file vmdetect - Possibly employs anti-virtualization techniques
VirusTotal | Search for Analysis
| Download Display Text
    [encoded data, 8192 characters] <truncated>

File name | John.contact.Alcatraz
Associated Filenames | C:\Users\John\Contacts\John.contact.Alcatraz
File Size | 91180 bytes
File Type | ASCII text, with very long lines, with no line terminators
MD5 | 697554fa24419d09ffc9c88c8651c3ec
SHA1 | 177a55a553b026029eb377e040f3c7330458a49f
SHA256 | 0476d90a80bbec2ec55ccc068c819b318c3edf51b1827e8b65636873325b3734
CRC32 | E9AFD985
Ssdeep | None
ClamAV | None
Yara | None matched
VirusTotal | Search for Analysis
| Download Display Text
    [encoded data, 8192 characters] <truncated>

File name | desktop.ini.Alcatraz
Associated Filenames | C:\Users\John\Desktop\desktop.ini.Alcatraz
File Size | 384 bytes
File Type | ASCII text, with very long lines, with no line terminators
MD5 | ebd84b62aef95f292306b0b6336995af
SHA1 | b1bd22f8fa486fa3c97b8c0d22bab6144d7086aa
SHA256 | 567246ff98d24780a97a9ca2dc601801a9f1de18494350020cc44b344439afb8
CRC32 | 50994C2F
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download Display Text
    F1dmhmM1YuzmcWNAVcweURHRXgbTsdC4VT1BSDXO9PQ1nUFTxdoepCEqIKEyBa+IHmukflhEDr2SdcFcHrXUq+oCBV2L+DnoFtZcN/J5/xLwL9Q1llRBH/+/eHkk+C8qApmudoT8VlO9e6mJ/uWzwoASW7haX4E0EvvMusJKspOhYdPvf2v1V0wdBZpRVpIrLibJFcuZsP3kz0DofhjIeMv2W+fdMHP7/MZAoqTNyNdiyatE9bJsj5zzzvH8kVAf7isD7a6atYgVPCnHdIL1HQk3UzJ+cF46/Ebo7j3e6OpbfKrk9GhoELrW/1/WQYJ6Tu0ubSbnhvWsBYVVV86Z1JMqbyzn3stptlU4Bfdyou4+1IUNtg2zNPJ0Hwmy2HXE

File name | foobar.mp3.Alcatraz
Associated Filenames | C:\Users\John\Desktop\foobar.mp3.Alcatraz
File Size | 118060 bytes
File Type | ASCII text, with very long lines, with no line terminators
MD5 | ce307d38ef6f9ed0678f547c2fea8d54
SHA1 | 5d84ea4a264a496f900a4828bb1e6f9550e65f00
SHA256 | 9c0ca9a311d4c200ac1ac19bcd9459fab4ed43f34b5a7c7cd0b5c90511899382
CRC32 | 8957A8B3
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download Display Text
    [encoded data, 8192 characters] <truncated>

File name | foobar.exe.Alcatraz
Associated Filenames | C:\Users\John\Desktop\foobar.exe.Alcatraz
File Size | 239640 bytes
File Type | ASCII text, with very long lines, with no line terminators
MD5 | 495f15728bdef25a6bb3c386d54ff045
SHA1 | 8bb6d7d63641a0532f72eacad3f011685b1db102
SHA256 | 19becfdc71da7193f33bfa28d1dc86cf33019a6aa9de239a41c82b0fffadf2bd
CRC32 | 4B00C10E
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download Display Text
    [encoded data, 8192 characters] <truncated>

File name | desktop.ini.Alcatraz
Associated Filenames | C:\Users\John\Documents\desktop.ini.Alcatraz
File Size | 556 bytes
File Type | ASCII text, with very long lines, with no line terminators
MD5 | e893235c9e1d70b846f694c25910407d
SHA1 | 60d20260d92c0d8fd0d1c9be8f86dae949bdb149
SHA256 | 6357ce05ba3845534fa6bcd22d93fd2831e45b500722bb867c77d9838fa09f05
CRC32 | 3A4BE2FB
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download Display Text
    F1dmhmM1YuzmcWNAVcweURHRXgbTsdC4VT1BSDXO9PQ1nUFTxdoepCEqIKEyBa+IHmukflhEDr2SdcFcHrXUq+oCBV2L+DnoFtZcN/J5/xLwL9Q1llRBH/+/eHkk+C8qApmudoT8VlO9e6mJ/uWzwoASW7haX4E0EvvMusJKspOhYdPvf2v1V0wdBZpRVpIrLibJFcuZsP3kz0DofhjIeOJFEho+m8Ebe34NiaN1sxjSjzWrVggiKicYMYJBtw2KJs3KA3owJjjlLA+IoCTP+b44IoVIUASQ0Eml1a9Yhg52LpczW1I3gjE2/bzbgwK3h4Pn4DD9B6BiLMeHsl+SccLbPZQKn1ho1FOkCoKLqhrDLHksF1eB6pdJ66Y/LIC5d5PdJGuoqDEC8d+F/6xNBgmKPX11a3bQI0IxWVf5zz+LVmyaMxAYMLlC2h0f2d3DmrAjNdr979gd2rKZycYGsLG1T1cYRhdf20XbuXGRz9xUJw4dMIrUOMt755+vfQqnim4JR+e+zItyF5fQOoviZm0oOQOCc6Toxm3mrRpcmMg=

File name | desktop.ini.Alcatraz
Associated Filenames | C:\Users\John\Contacts\desktop.ini.Alcatraz
File Size | 556 bytes
File Type | ASCII text, with very long lines, with no line terminators
MD5 | 52c56aa49bc0f6b96822c7db3d64fa13
SHA1 | 8e860cb7c7d81cbb5b7df66003ac4d93a8f7aa42
SHA256 | 72eb7a32a4f6fd4496e1ee6501963d6d450e9238d8a0f529914f3c9c0d8bfa14
CRC32 | 29433D9E
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download Display Text
    F1dmhmM1YuzmcWNAVcweURHRXgbTsdC4VT1BSDXO9PQ1nUFTxdoepCEqIKEyBa+IHmukflhEDr2SdcFcHrXUq+oCBV2L+DnoFtZcN/J5/xJeD05afCG5Jkaaa15oWyov2fvXrJ7FyeMO4C/vW2kdXFq55pqnY8lCzYMuzEBBubOQwe4ZpYsCOnvCk4EWJUoryp5znR36NqyKO6HJY19iNDLZm9jlFDgCnpXuFQ1eIuqSxQ2wEoxMZQKZ3zPHxzOEkllup8OPqKf4dRA73Kc8tfA1hGHmF5iM8lKHbnPYHIpuukUCTm9ODyjcYsdpiFyZ+1wEggpAceHlZWGXx7xQ2MA2XVyoWdMl0ULUKCw0A+OVnYhOzff82U4fXB5X+Jwkc3kJedUV9ihN4dFlMyr2EloGxolmgvvXXQNbpRno/GGV/3KLl8/xjP25PJidOf5wAM8iQsdakQpEAsEE3YJ8lP3FLOs1AwY3IlFu2a6XDxUr4t1Zc/rfInxycnlJ9m7PGTknvIYl56ToNpuEY6p2M512IQQxTJARQUBnknnDjXU=

File name | Cab7280.tmp
Associated Filenames | C:\Users\John\AppData\Local\Temp\Cab7280.tmp C:\Users\John\AppData\Local\Temp\Cab72C1.tmp C:\Users\John\AppData\Local\Temp\Cab8810.tmp
File Size | 57523 bytes
File Type | Microsoft Cabinet archive data, 57523 bytes, 1 file
MD5 | 7eb117d4f238090940dbe43efbcdf1f4
SHA1 | 73a69b3ce43bf74d60af94c251d7cca64b206a44
SHA256 | a45a77d256628943190f8aa0f4673496d11dba6bc3569796b6f733465fd005e4
CRC32 | 7EB6943B
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | Firefox Installer.exe.Alcatraz
Associated Filenames | C:\Users\John\Downloads\Firefox Installer.exe.Alcatraz
File Size | 429804 bytes
File Type | ASCII text, with very long lines, with no line terminators
MD5 | 8740a3bf4b4f4982838cbac8f5f31b76
SHA1 | 0f316b26ea9fbd08f13693656eba6d409dc5558e
SHA256 | ad645139c914a695b6aa30f54d886e995274095661ae49064de7cf4d6c7e8ba0
CRC32 | CA8023A4
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download Display Text
    [encoded data, 8192 characters] <truncated>

File name | flashplayer15_0r0_152_win_sa_debug.exe.Alcatraz
Associated Filenames | C:\Users\John\Downloads\fp_15.0.0.152_archive\15_0_r0_152_debug\flashplayer15_0r0_152_win_sa_debug.exe.Alcatraz
File Size | 16070912 bytes
File Type | ASCII text, with very long lines, with no line terminators
MD5 | b4da2a769b98949b82228d7d8127bedc
SHA1 | 5020082c75a0c2242fec1f31b3d6461ed5157ed6
SHA256 | 7904fff15b6e261c1e6564124c59de6906ba0e25d89175eaa6f309dce65536f9
CRC32 | D8846EAD
Ssdeep | None
ClamAV | None
Yara | vmdetect - Possibly employs anti-virtualization techniques
| None matched
VirusTotal | Search for Analysis
| Download Display Text
    [encoded data, 8192 characters] <truncated>

File name | uninstall_flashplayer15_0r0_152_win.exe.Alcatraz
Associated Filenames | C:\Users\John\Downloads\fp_15.0.0.152_archive\15_0_r0_152\uninstall_flashplayer15_0r0_152_win.exe.Alcatraz
File Size | 1139628 bytes
File Type | ASCII text, with very long lines, with no line terminators
MD5 | 5fc2f6efabbdd68a55e4e12271c09bfb
SHA1 | 3e4976e09f32d81e891b283c705f6886ba9ef506
SHA256 | 36ede81b044e7b87db25a5cb5faa8486936d922968a8bf70ae92745b544942b5
CRC32 | 5551348D
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download Display Text
    [encoded data, 8192 characters] <truncated>

File name | foobar.txt.Alcatraz
Associated Filenames | C:\Users\John\Desktop\foobar.txt.Alcatraz C:\Users\John\Desktop\foobar.wri.Alcatraz
File Size | 24 bytes
File Type | ASCII text, with no line terminators
MD5 | f39e24cc11ac6bdfaf3d02b2bc4a2634
SHA1 | 8f7ee0e85b911988ab051e076a11f27cc08209fc
SHA256 | 660159041db47900310ab0958332040a7aa99063fa961acf198bcfc3c50e6ef2
CRC32 | D06AC11F
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download Display Text
    6dEPwrg8tuONfW2LMRm7Vw==

File name | flashplayer15_0r0_152_winax.exe.Alcatraz
Associated Filenames | C:\Users\John\Downloads\fp_15.0.0.152_archive\15_0_r0_152\flashplayer15_0r0_152_winax.exe.Alcatraz
File Size | 23105112 bytes
File Type | ASCII text, with very long lines, with no line terminators
MD5 | 13cdf16ba24c2a8e6c4907d07f3d0af8
SHA1 | 1b5ee1ced99718acb73a765219aad8abc37b171d
SHA256 | 8f5f8b4645b63a9eb7a5a22f77bf7f161a8fa8bce6351da83082bc116add8d27
CRC32 | 891E12D4
Ssdeep | None
ClamAV | None
Yara | embedded_pe - Contains an embedded PE32 file vmdetect - Possibly employs anti-virtualization techniques
| None matched
VirusTotal | Search for Analysis
| Download Display Text
    [encoded data, 8192 characters] <truncated>

File name | foobar.bmp.Alcatraz
Associated Filenames | C:\Users\John\Desktop\foobar.bmp.Alcatraz
File Size | 1920088 bytes
File Type | ASCII text, with very long lines, with no line terminators
MD5 | a49ade15408e37d158f7a84fc50d9a5c
SHA1 | 2dadf53bff5d574091eae896b39892fcfb809310
SHA256 | b7fdf334e69e01537126d0ffb7d3b15de040adbc1b6c7fef9f61d4afa389c9b6
CRC32 | CCDA0A28
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download Display Text
    [encoded data, 8192 characters] <truncated>

File name | flashplayer15_0r0_152_winax.msi.Alcatraz
Associated Filenames | C:\Users\John\Downloads\fp_15.0.0.152_archive\15_0_r0_152\flashplayer15_0r0_152_winax.msi.Alcatraz
File Size | 24648384 bytes
File Type | ASCII text, with very long lines, with no line terminators
MD5 | 1e3cbb1dc67c902b27f6d03f81170137
SHA1 | 54cb6aabb2cbbab13aec5450f54d95c7659e8c4e
SHA256 | 1924515c049e31f6e9aade26c2f39294b1434ce45c8741f6e0b7892d35cca3ff
CRC32 | 04BFE9EA
Ssdeep | None
ClamAV | None
Yara | embedded_pe - Contains an embedded PE32 file
| None matched
VirusTotal | Search for Analysis
| Download Display Text
    [encoded data, 8192 characters] <truncated>

File name | Tar7281.tmp
Associated Filenames | C:\Users\John\AppData\Local\Temp\Tar7281.tmp C:\Users\John\AppData\Local\Temp\Tar72C2.tmp C:\Users\John\AppData\Local\Temp\Tar8811.tmp
File Size | 140227 bytes
File Type | data
MD5 | 80604770c16fc09ef4d8ca10d375c04c
SHA1 | 822b5b8cb9169c358c6bc2c92466d439c983cd87
SHA256 | f520a87fbe85e4021c9d5e9fe24be9ccaa9549fd0ea3acc91089cbd5a3f2fdf4
CRC32 | 669B283E
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | desktop.ini.Alcatraz
Associated Filenames | C:\Users\John\Downloads\desktop.ini.Alcatraz
File Size | 384 bytes
File Type | ASCII text, with very long lines, with no line terminators
MD5 | 91cad0364bb17d588cdcd4eaa4f4a519
SHA1 | 2496c4194599f0d0caea5615a63f098119cd7f2f
SHA256 | c7b8aabd59b51c08405fe7be5ea682b75f46713534f6665c0dc5b00d3b83f75d
CRC32 | 855F1E76
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download Display Text
    F1dmhmM1YuzmcWNAVcweURHRXgbTsdC4VT1BSDXO9PQ1nUFTxdoepCEqIKEyBa+IHmukflhEDr2SdcFcHrXUq+oCBV2L+DnoFtZcN/J5/xLwL9Q1llRBH/+/eHkk+C8qApmudoT8VlO9e6mJ/uWzwoASW7haX4E0EvvMusJKspOhYdPvf2v1V0wdBZpRVpIrLibJFcuZsP3kz0DofhjIeKGEwjJ3vK7gjuRw+p4WoFGYn6bMk4BfF42X4Bdbu7t/FTYwt4bCL3uZuRxKV3GGpa8e7DowfBfwVAnI/+73KuGwDKG18Jx2x/Ud7WUPyvmXAHPq5wHf3uyW9g9DRTI1LWeSxjVwAZPl8KScnx3aFaA2wmEpYa32QBDnngUzhgQM

File name | flashplayer15_0r0_152_win.exe.Alcatraz
Associated Filenames | C:\Users\John\Downloads\fp_15.0.0.152_archive\15_0_r0_152\flashplayer15_0r0_152_win.exe.Alcatraz
File Size | 23871744 bytes
File Type | ASCII text, with very long lines, with no line terminators
MD5 | 05f2602e7da4977873040743c963dc24
SHA1 | ef0a6728ca6dde1b22ffa869bd9ea560cbbabddf
SHA256 | e9d815e058069354fcbc216945abf70c99bbb2044fd3f7be1998d13a85dff71a
CRC32 | B8F224FD
Ssdeep | None
ClamAV | None
Yara | embedded_pe - Contains an embedded PE32 file vmdetect - Possibly employs anti-virtualization techniques
| None matched
VirusTotal | Search for Analysis
| Download Display Text
    [encoded data, 8192 characters] <truncated>

File name | foobar.jpg.Alcatraz
Associated Filenames | C:\Users\John\Desktop\foobar.jpg.Alcatraz
File Size | 56984 bytes
File Type | ASCII text, with very long lines, with no line terminators
MD5 | 572036ef0166861db92a9940a83e9cea
SHA1 | 1b7f882f80fb53185dd7971d49aeee1a08fd238c
SHA256 | f50057b9b02b1d76f308ffc671e06cd67203a4c54dbc9d6381a5010cff99035c
CRC32 | 318226D4
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download Display Text
    [encoded data, 8192 characters] <truncated>

File name | flashplayer15_0r0_152_mac_pkg.dmg.Alcatraz
Associated Filenames | C:\Users\John\Downloads\fp_15.0.0.152_archive\15_0_r0_152\flashplayer15_0r0_152_mac_pkg.dmg.Alcatraz
File Size | 20474240 bytes
File Type | ASCII text, with very long lines, with no line terminators
MD5 | 936529be9f121ae4575a3858b3de8e3e
SHA1 | 25d66ff4be9d1c868a385febab3d412d29fa7123
SHA256 | 087693a5f964c011b0056cb184f246bc6b645498bb5382eb36b6e70deac2fd06
CRC32 | 04042F84
Ssdeep | None
ClamAV | None
Yara | embedded_pe - Contains an embedded PE32 file vmdetect - Possibly employs anti-virtualization techniques
| None matched
VirusTotal | Search for Analysis
| Download Display Text
    [encoded data, 8192 characters] <truncated>

File name | E0F5C59F9FA661F6F4C50B87FEF3A15A
Associated Filenames | C:\Users\John\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
File Size | 893 bytes
File Type | data
MD5 | d4ae187b4574036c2d76b6df8a8c1a30
SHA1 | b06f409fa14bab33cbaf4a37811b8740b624d9e5
SHA256 | a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7
CRC32 | 1C31685D
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | 94308059B57B3142E455B38A6EB92015
Associated Filenames | C:\Users\John\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
File Size | 342 bytes
File Type | data
MD5 | 67fff9e8953015d051df51b44697bb18
SHA1 | 365321dc80768eac0f8b7ab70cb4ee53a42e5982
SHA256 | 55b91274be1891f32691448f128cad04ee09d05c5c339cdf3a5805e46cafe2db
CRC32 | A49BAFBB
Ssdeep | None
ClamAV | None
Yara | None matched
| None matched
VirusTotal | Search for Analysis
| Download

File name | flashplayer15_0r0_152_mac.dmg.Alcatraz
Associated Filenames | C:\Users\John\Downloads\fp_15.0.0.152_archive\15_0_r0_152\flashplayer15_0r0_152_mac.dmg.Alcatraz
File Size | 20805784 bytes
File Type | ASCII text, with very long lines, with no line terminators
MD5 | 37e7aee7087ad87673108309ff7dc180
SHA1 | 7f81f6a0551f72db076a04721dd7bf118e9ac2bc
SHA256 | 29dc9d69da52a2a0773a7da098444400e15f506d63952b99d58bf0bd517e6b48
CRC32 | CA8C45D7
Ssdeep | None
ClamAV | None
Yara | vmdetect - Possibly employs anti-virtualization techniques
| None matched
VirusTotal | Search for Analysis
| Download Display Text
    [encoded data, 8192 characters] <truncated>

JSON Report | Download
HTML Report | Download
Summary HTML Report | Download

#### Comments

No comments posted

#### Processing ( 8.723 seconds )

- 6.877 Dropped
- 0.594 BehaviorAnalysis
- 0.586 Static
- 0.321 peid
- 0.186 NetworkAnalysis
- 0.146 AnalysisInfo
- 0.004 TargetInfo
- 0.003 Strings
- 0.002 Debug
- 0.002 Memory
- 0.002 config_decoder

#### Signatures ( 0.569 seconds )

- 0.106 fakesys_similarity
- 0.104 antiav_detectreg
- 0.038 infostealer_ftp
- 0.036 crypto_analysis_signature
- 0.025 antianalysis_detectreg
- 0.023 stealth_timeout
- 0.023 infostealer_im
- 0.02 api_spamming
- 0.016 decoy_document
- 0.014 virut
- 0.012 antivm_vbox_keys
- 0.011 ransomware_files
- 0.009 antiav_detectfile
- 0.008 antivm_vmware_keys
- 0.008 infostealer_mail
- 0.007 antivm_generic_scsi
- 0.007 antivm_generic_disk
- 0.006 antivm_parallels_keys
- 0.005 bootkit
- 0.005 mimics_filetime
- 0.005 virus
- 0.005 antivm_xen_keys
- 0.005 infostealer_bitcoin
- 0.005 ransomware_extensions
- 0.004 reads_self
- 0.004 antivm_generic_services
- 0.004 stealth_file
- 0.004 antivm_generic_diskreg
- 0.004 antivm_vpc_keys
- 0.004 geodo_banking_trojan
- 0.003 persistence_autorun
- 0.003 antianalysis_detectfile
- 0.003 antivm_vbox_files
- 0.002 antiemu_wine_func
- 0.002 hancitor_behavior
- 0.002 infostealer_browser
- 0.002 recon_programs
- 0.002 ransomware_message
- 0.002 infostealer_browser_password
- 0.002 antivm_hyperv_keys
- 0.002 bypass_firewall
- 0.001 network_tor
- 0.001 tinba_behavior
- 0.001 betabot_behavior
- 0.001 antivm_vbox_libs
- 0.001 ipc_namedpipe
- 0.001 kibex_behavior
- 0.001 shifu_behavior
- 0.001 kovter_behavior
- 0.001 antidbg_devices
- 0.001 antivm_xen_keys
- 0.001 antivm_generic_system
- 0.001 antivm_vbox_acpi
- 0.001 antivm_vmware_files
- 0.001 browser_security
- 0.001 darkcomet_regkeys
- 0.001 disables_browser_warn
- 0.001 network_torgateway

#### Reporting ( 11.623 seconds )

- 0.934 ReportHTML
- 0.767 ReportHTMLSummary
- 0.718 JsonDump
- 0.286 MemoryDump

Task ID | 519
Mongo ID | 5cdd7602df01a34f3a420bd5
Cuckoo release | 1.3-NG
| Delete