2.5
中危
DACN
0.12
FACILE
1.00
IMCLNet
0.66
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:StartPage-APD [Trj] | 20200214 | 18.4.3895.0 |
| Baidu | Win32.Trojan.Agent.ej | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200214 | 2013.8.14.323 |
| McAfee | W32/Duptwux.worm | 20200214 | 6.0.6.653 |
| Tencent | Trojan.Win32.Agent.tol | 20200214 | 1.0.0.1 |
静态指标
动态指标
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Program Files (x86)\e8fdc9c8\jusched.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Program Files (x86)\e8fdc9c8\jusched.exe |
搜索运行中的进程，可能用于识别沙箱规避、代码注入或内存转储的进程
(1 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545318.62425 Process32NextW |
snapshot_handle:
0x0000003c
process_name: jusched.exe process_identifier: 920 |
success | 1 | 0 |
重复搜索未找到的进程，您可能希望在分析期间运行一个网络浏览器
(50 out of 100 个事件)
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
操作本地防火墙的策略和设置
(1 个事件)
| registry | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List |
连接到不再响应请求的 IP 地址（合法服务通常会保持运行）
(1 个事件)
| dead_host | 209.202.252.54:21 |
文件已被 VirusTotal 上 65 个反病毒引擎识别为恶意
(50 out of 65 个事件)
| ALYac | Gen:Variant.Ulise.29364 |
| APEX | Malicious |
| AVG | Win32:StartPage-APD [Trj] |
| Acronis | suspicious |
| Ad-Aware | Gen:Variant.Ulise.29364 |
| AhnLab-V3 | Backdoor/Win32.LolBot.R19970 |
| Arcabit | Trojan.Ulise.D72B4 |
| Avast | Win32:StartPage-APD [Trj] |
| Avira | TR/Agent.hfta |
| Baidu | Win32.Trojan.Agent.ej |
| BitDefender | Gen:Variant.Ulise.29364 |
| BitDefenderTheta | Gen:NN.ZexaF.34090.cqX@ayfYffbi |
| Bkav | W32.StartPageSunLnr.Trojan |
| CAT-QuickHeal | Worm.Duptwux.A4 |
| CMC | Backdoor.Win32.LolBot!O |
| ClamAV | Win.Worm.Lolbot-6787741-0 |
| Comodo | Backdoor.Win32.LolBot.GA@48x6oc |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.15bd0b |
| Cylance | Unsafe |
| Cyren | W32/StartPage.AU.gen!Eldorado |
| DrWeb | Trojan.Siggen2.56716 |
| ESET-NOD32 | a variant of Win32/Agent.TNE |
| Emsisoft | Gen:Variant.Ulise.29364 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/StartPage.AU.gen!Eldorado |
| F-Secure | Trojan.TR/Agent.hfta |
| FireEye | Generic.mg.38a825015bd0bf3d |
| Fortinet | W32/Agent.RTK!tr |
| GData | Gen:Variant.Ulise.29364 |
| Ikarus | Backdoor.Win32.LolBot |
| Invincea | heuristic |
| Jiangmin | Backdoor/LolBot.jq |
| K7AntiVirus | Trojan ( 004d243b1 ) |
| K7GW | Trojan ( 004d243b1 ) |
| Kaspersky | HEUR:Worm.Win32.Generic |
| MAX | malware (ai score=83) |
| Malwarebytes | Worm.Duptwux |
| MaxSecure | Backdoor.LolBot.gen |
| McAfee | W32/Duptwux.worm |
| McAfee-GW-Edition | BehavesLike.Win32.Duptwux.pm |
| MicroWorld-eScan | Gen:Variant.Ulise.29364 |
| Microsoft | Worm:Win32/Ganelp.E |
| NANO-Antivirus | Trojan.Win32.LolBot.dfheig |
| Panda | Trj/Lolbot.Y |
| Qihoo-360 | HEUR/QVM19.1.3C87.Malware.Gen |
| Rising | Malware.FakeFolder@CV!1.6ABC (RDMK:cmRtazqWXPybb9Dbj55fLisxCR02) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Duptwux |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2011-03-03 03:56:19
PE Imphash
fe9b94dd0e4ea2a905fbd4f42f4b2f8f
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x000049c6 | 0x00004a00 | 6.344033344297286 |
| .rdata | 0x00006000 | 0x000007a8 | 0x00000800 | 5.571708494368706 |
| .data | 0x00007000 | 0x0000e000 | 0x00000a00 | 2.3341854176937415 |
| .rsrc | 0x00015000 | 0x00017000 | 0x00002800 | 3.2228099649009923 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x000150a0 | 0x000025a8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x00017648 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library KERNEL32.dll:
• 0x407790 Sleep
• 0x407794 GetModuleHandleA
• 0x407798 GetLastError
• 0x40779c GetLocaleInfoA
• 0x4077a0 GetStartupInfoA
• 0x4077a4 ExitProcess
• 0x4077a8 RtlUnwind
• 0x4077ac HeapCreate
• 0x4077b0 HeapDestroy
• 0x4077b4 HeapAlloc
• 0x4077b8 HeapReAlloc
• 0x4077bc HeapFree
• 0x4077c0 HeapSize
• 0x4077c4 HeapValidate
• 0x4077c8 GetSystemTimeAsFileTime
• 0x4077cc GetFileType
• 0x4077d0 GetStdHandle
• 0x4077d4 GetCurrentProcess
• 0x4077d8 DuplicateHandle
• 0x4077dc SetHandleCount
• 0x4077e0 GetCommandLineA
• 0x4077e4 GetModuleFileNameA
• 0x4077e8 GetEnvironmentStrings
• 0x4077ec FreeEnvironmentStringsA
• 0x4077f0 UnhandledExceptionFilter
• 0x4077f4 SetConsoleCtrlHandler
• 0x4077f8 VirtualAlloc
• 0x4077fc VirtualQuery
L!This program cannot be run in DOS mode.
.rdata
@.data
9|F9|E
u;54NA
U,SVWE
EE;E~8NA
UEf:MZt
EP;EP@NA
PlP@NA
EPEP@NA
EPEP@NA
EPEP@NA
EPwEP@NA
EPREP@NA
EP-EP@NA
EPEP@NA
EPEP@NA
EPEP@NA
EPeEP@NA
EP@EP@NA
EPEP@NA
EPEP@NA
EPEP@NA
EPEP@NA
EPbEP@NA
EP=EP@NA
EPEP@NA
EPEP@NA
EPEP@NA
EPEP@NA
EP_EP@NA
EP:EP@NA
BuXhDc@
BuXhBc@
U8SVW]
EPeEPW
EPEEPW
U<SVW]
EP(EPV
EP7EPV
U<SVW]
EPhEPV
U4SVW]
EP(EPV
4Pv4PW
4PP4PW
4P*4PW
lP4PV4P
BuX4PlP
lP4Pr1
fPdfPV
fP>fPV
E0F0EE
BuXEPP
P\Ppj#
P5PIj#
BuXPj#
SV1W8NA
BuXhNA
PEPEPEPh
BuX_^]
t<;t"SP
.P$h`@
BuXh@`@
BuXhNA
BuXh6`@
BuXh,`@
2f4qBft
f9tf9u
BCNu1^[
Pr=lr@
Ujh@e@
PSVWeh
YM_^[Md
PX1tPQ1
VC20XC00U
W Y-.}B Djg
_E>%Y.
USVWUj
t9|$$t
;t$$v,4v
UXSVWh
9rG95OA
URPVEP
?"u.G+t
GE?\tE
YEPEPE
u@E>=t
u@E>=t
|9]s#SY
OQJ9<\s@
u%}M<\s@
JMWzUzUW
WBP9<\s@
|^J9u8]
| ZKYM9
/Downs/HelpVer.hlp
/Downs/Help.hlp
Help.hlp
/Private/
Pfile.hlp
\VirtualDevice.vxd
ProgramFiles
?>D85<9>EH
6D@]DB9@?4]3?=
gdaheb
eedeia
7B9@D?<?:9]8?CD\54]>5D
gdaheb123
5<571>0ghfddd
5<571>0ghfddd]5<]6E>@93]?B7
B57549D]5H5
!B?7B1=v9<5C
$?6DG1B5]aaaaaaaaaaaaaaaaa]sEBB5>D'5BC9?>]#E>
e.gteeixrde
JUthnaac,uvdSdSapee
JUthnaac.uvdSdSapee
JUthnaac_uvdSdSapee
JUthnaac-uvdSdSapee
JUthnaacuvdSdSapee
\Java\jre-
gFsomeralPri
\RLN06530
\RLN06527
\RLT6990
\RLT6989
\RLT6988
\RLT6987
DtlgeaAelVeReeu
CtygaeAeeKxRreE
oePari.recFtutMSrtiipSnsaldzLereiati.eeecllYt.rlPeinvsrnhoCtdryeiSrSaPrdstisedonu.As..cTohmooAtCc.warsrSc.SAaElaelfp
bd:ael*nE::
leeexthEuSlcA
l.e2lh3lsld
PipFAtteFul
etsnteoaennlHlIrCed
GipFAtteFel
etnAtentnnocIrCe
etnteennpIrOA
i.ntlielwnd
CegsyeoeRlK
SaEgVeetuARelx
OKxgnEeeyRpeA
a2lv3ldidap.
broFlleGae
bloAclloGal
FSteeelzGii
dealeiRF
tliirFWee
aieFAreeCtl
snoaelHlCed
c3xosersNPe2t
c3rosirsFtPe2s
CerstrPedertcIGunos
aoe2pteTh3aorelpnhCtolSs
LcrSntiDeiAeglvrsGoaitg
DeetvpeiyGrTA
eilFAeeeDtl
oitAmDcyeeerRvro
dsnoilFCe
dtenxlieiFNFA
dslnriiiFAFFte
VmfantunmoelIriGoeotA
WoitAtdDcyenserGiwro
yeploiCFA
EreabtimVaAevntieGnonrl
MllmtuiaedFNAGoeee
aitAeDcyreerCtro
FAieterteltuASitbs
erebyrirFLa
drAabyoirLLa
MlnAtuaeedHlGoed
PAetcreodsGrds
n2lr3leldke.
0123456789abcdefghijklmnopqrstuvwxyz
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_abcdefghijklmnopqrstuvwxyz{|}~aa1vd2apeJUt
JUth1naac2uvdSdSapee
GetModuleHandleA
GetLastError
GetLocaleInfoA
KERNEL32.dll
GetStartupInfoA
ExitProcess
RtlUnwind
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
HeapValidate
GetSystemTimeAsFileTime
GetFileType
GetStdHandle
GetCurrentProcess
DuplicateHandle
SetHandleCount
GetCommandLineA
GetModuleFileNameA
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
SetConsoleCtrlHandler
VirtualAlloc
VirtualQuery
-kkeJ/
.nnnnnnnS8
/qqqqqqqqqqq\@$
ICONMD5.6c78a9c3
tttttttttttttttfI3
wwwwwwwwwwwwwwwwwwwpS<
zzzzzzzzzzzzzzzzzzzzzzzz\E&
}}}}}}}}}}}}}}}}}}}}}}}}}}M
H((w6f,
I33lFfZ
KUUmfh
]WWn6f
912hj8h@A9:pr@pHIABxzHxPQIJPXYQRX`aYZ`hiabhpq862i7jkj@>:q?rsrHFByGz{zPNJOXVRW`^Z_hfbg5dg97g<k=loA?oDsEtwIGwL{M|
TUYW\]a_deigddd<77j;lllD??rCtttLGGzK|||TOOS\WW[d__clggktoos|ww{
61c5=:g=>9k=EBoEFAsEMJwMNI{MUR
UVQU]Z]^Y]ebefaemj5587gki?==@?osqGEEHGw{yOMMPO
WUUXW_]]`_geehge5d3;99;m=l;CAACuEtCKIIK}M|KSQQSUS[YY[][caaceckiikmksqqsus{yy{}{
3d6h4567;l>p<=>?CtFxDEFGK|NLMNOSVTUVW[^\]^_cf1bdg;=?h9jloCEGpArtwKMOxIz|
SUWQ[]_Ycega152<9g9h9=:DAoApAEBLIwIxIMJTQ
QQUR\YYY]Zdaaafe95<;>lnmA=DCFtvuIELKN|~}QMTSVYU\[^a]dcfielknqmtsvyu|{~}
7chhei6??kppmq>GGsxxuyFOO{}NWWV__^ggfef26;h>9mn:>CpFAuvBFKxNI}~JNSVQRV[^YZ^cfabfknijnsvqrv{~yz~
66g;=g<j>>oCEoDrFFwKMwLzNN
TVV[]\^^cedffkm6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikn463d4jhj<>;l<rprDFCtDzxzLNK|LTVST\^[\dfccb;<5;<lkjCD=CDtsrKLEKL|{zSTMST[\U[\cd]cdkleklstmst{|u{|}
9cdg9h?lAkloApGtIstwIxO|Q{|
QWYY_aagiioqe3:4i<6hm;B<qD>puCJDyLFx}KRLTNSZT\V[b\d^cjdlfkrltnszt|v{|~
6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfiknb27f<khjj:?nDsprrBGvL{xzzJO~TRW\Z_dbgljotrw|z
36e;4;=l;>mC<CEtCFuKDKM|KN}SLSUSV[T[][^c\cecf97d3:gklA?l;BostIGtCJw{|QO|KR
YWSZa_[bigcjq1ddg4;g@9llo<CoHAttwDKwPI||
XQT[`Y\cha6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikn6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikn6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikn6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfiknab796hi=ij?A>pqEqrGIFxyMyzOQNUWYV]_a^egifmoqnuwyv}
~f:435h9=nB<;=pAEvJDCExIM~RLKMQUZTSUY]b\[]aejdceimrlkmquztsuy}|{}
6g2:6j>?>o:B>rFGFwBJFzNON
JRNVWVRZV^_^Zb^fgfbjf6gd7::;=>ol?BBCEFwtGJJKMN
|ORRSUVWZZ[]^_bbcefgjj6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikna1c:e5l?i9kBm=tGqAsJuE|OyI{R}MWQZU_Yb]gajeoirmwqzu
dc;64fjllkC><nrttsKFDvz||{SNL~[VTc^\kfdsnl{vt~|
be87557?jm@?==?GruHGEEGOz}POMMOWXWUUW_`_]]_ghgeegopommowxwuuw
397:4<i;;A?B<DqCCIGJDLyKKQORLTSSYWZT\[[a_b\dccig6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfiknfghe8<=?nopm@DEGvwxuHLMO~
}PTUWX\]_`deghlmoptuwx|}
384efj:h;@<mnrBpCHDuvzJxKPL}~RSXTZ[`\bchd958g96>jA=@oA>FrIEHwIFNzQMP
QNVYUXYV^a]`a^fiehifnqf994g6k9nAA<o>sAvIIDwF{I~QQL
NQYYTVYaa\^aiidfiqqlnqyytvy|~
68864879>@@><@?AFHHFDHGINPPNLPOQVXXVTXWY^``^\`_afhhfdh6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikn8b;f::=l@jCnBBEtHrKvJJM|PzS~RRUX[ZZ]`cbbehkjjm5gf;=fhh=onCEnppEwvKMvxxM
~SU~U[]]ceekmd:;;=69=lBCCE>AEtJKKMFIM|RSSUNQUZ[[]VY]bcce^aejkkmfimrssunquz{{}vy}~
2cd36fk?:kl;>nsGBstCFv{OJ{|KN~WRSV_Z[^gb6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikn17;3=f?@9?C;EnGHAGKCMvOPIOSKU~WXQW[S]_`Y_c[egha6:64igl;>B><qotCFJFDyw|KNRNL
SVZVT[^b^\cfjfd4b99ig6;<jAAqo>CDrIIywFKLzQQ
NSTYYV[\aa^cdii9dg8659lAlo@>=AtItwHFEI|Q|
PNMQYXVUYa`^]aihfeiq72f5g=:>?:n=oEBFGBvEwMJNOJ~M
URVWRU]Z^_Z]ebfgbemj6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikn6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfiknd:6g58l?lB>o=@tGtJFwEH|O|RN
MPWZVUX_b^]`gjfehornmpwzvux
b7668:k=j?>>@BsErGFFHJ{MzONNPRUWVVXZ]_^^`begffhjmonnpruwvvxz}
b6h7hk<jj>p?psDrrFxGx{LzzNOTVW\^_dfglnotvw|~
6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikned:f5g>hmlBn=oFputJvEwNx}|R~M
VZU^b]fjenrmvzu~}
4c63<69h<k>;D>ApDsFCLFIxL{NKTNQTVS\VY\^[d^adfc6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikn6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikn72f5g=:>?:n=oEBFGBvEwMJNOJ~M
URVWRU]Z^_Z]ebfgbemj6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikn72f5g=:>?:n=oEBFGBvEwMJNOJ~M
URVWRU]Z^_Z]ebfgbemj1f;gg;j79nCooCr?AvKwwKzGI~S
SOQ[[WYcc_a8e;3ifh7@mC;qnp?HuKCyvxGP}SK~OX[SW`c[_hkcgd697i98hl>A?qA@ptFIGyIHx|NQOQPVYWYX^a_a`figihnqoqpvywyx~
9eeh;5ghAmmpC=opIuuxKEwxQ}}SM
Y[Uac]ikeq9c36:5:7Ak;>B=B?IsCFJEJGQ{KNRMROYSVZUZWa[^b]b_icfjejgq6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikn31f46<7;;9n<>D?CCAvDFLGKKI~LNTOSSQTV\W[[Y\^d_cca6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikn6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfiknd7h;e:?jl?pCmBGrtGxKuJOz|OS}RWW[Z__cbggkjoosrww{z
72f5g=:>?:n=oEBFGBvEwMJNOJ~M
URVWRU]Z^_Z]ebfgbemj5b9ig>87=jAqoF@?ErIywNHGMzQ
VPOUY^XW]af`_ei2:55668l:B==>>@tBJEEFFH|JRMMNNPRZUUVVXZb]]^^`bjf78;7>6=n?@C?F>EvGHKGNFM~OPSOVNUWX[W^V]_`c_f^eghkgnfmopsovnuwx{w~v}
3878=f=l;@?@EnEtCHGHMvM|KPOPU~USXWX]][`_`eechg36e6=5>=;>m>E=FECFuFMENMKN}NUMVUSVV]U^][^^e]fecf72f5g=:>?:n=oEBFGBvEwMJNOJ~M
URVWRU]Z^_Z]ebfgbemj6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikn72f5g=:>?:n=oEBFGBvEwMJNOJ~M
URVWRU]Z^_Z]ebfgbemj6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikne5d9<5jjm=lAD=rruEtILEzz}M|QTMUY\U]ad]eilemqtmuy|u}}
72f5g=:>?:n=oEBFGBvEwMJNOJ~M
URVWRU]Z^_Z]ebfgbemj6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikn6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikn6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikn6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikn3d6h4567;l>p<=>?CtFxDEFGK|NLMNOSVTUVW[^\]^_cf72f5g=:>?:n=oEBFGBvEwMJNOJ~M
URVWRU]Z^_Z]ebfgbemj6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikn6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikn6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikn72f5g=:>?:n=oEBFGBvEwMJNOJ~M
URVWRU]Z^_Z]ebfgbemjd53e<<7jl=;mDD?rtECuLLGz|MK}TTOUS\\W][dd_ecllgmkttous||w}{
6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikne244:jgjm:<<BroruBDDJzwz}JLLR
RTTZZ\\bbddjjllrrttzz||
72f5g=:>?:n=oEBFGBvEwMJNOJ~M
URVWRU]Z^_Z]ebfgbemj6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikn6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikn72f5g=:>?:n=oEBFGBvEwMJNOJ~M
URVWRU]Z^_Z]ebfgbemj6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikn6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikna58;9j77i=@CAr??qEHKIzGGyMPSQOOUX[YWW]`ca__ehkiggmpsqooux{yww}
6d9;e>i:>lACmFqBFtIKuNyJN|QS}VRVY[^Z^acfbfikn
! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ a b c d e f g h i j k l m n o p q r s t u v w x y z [ \ ] ^ _ ` a b c d e f g h i j k l m n o p q r s t u v w x y z { | } ~
Process Tree
-
08847b322735faa9b17de14f67d557616f6f1202fb29ef14de1acc061d99e172.exe (1064)
"C:\Users\Administrator\AppData\Local\Temp\08847b322735faa9b17de14f67d557616f6f1202fb29ef14de1acc061d99e172.exe"
- jusched.exe (920) "C:\Program Files (x86)\e8fdc9c8\jusched.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
| 209.202.252.54 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | 131.107.255.255 | |
| elegan_786444.el.funpic.org | ||
| griptoloji.host-ed.net | ||
| ftp.tripod.com | A 209.202.252.54 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
| 192.168.56.101 | 57665 | 8.8.8.8 | 53 |
| 192.168.56.101 | 51758 | 114.114.114.114 | 53 |
| 192.168.56.101 | 51758 | 8.8.8.8 | 53 |
| 192.168.56.101 | 52215 | 8.8.8.8 | 53 |
| 192.168.56.101 | 52215 | 114.114.114.114 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | f163c62c72748681_e8fdc9c8 |
|---|---|
| Filepath | C:\Program Files (x86)\e8fdc9c8\e8fdc9c8 |
| Size | 26.0B |
| Processes | 1064 (08847b322735faa9b17de14f67d557616f6f1202fb29ef14de1acc061d99e172.exe) 920 (jusched.exe) |
| Type | ASCII text, with no line terminators |
| MD5 | ac42fcbe17137c9e75a3d649ff55c054 |
| SHA1 | f0d6b569f7d65935604783d10040d6ddbd2fb4da |
| SHA256 | f163c62c72748681126cbb1b801c7dea485a77a01747de0ce78179cc13984551 |
| CRC32 | 79ADA70D |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 02c473e63756fc29_jusched.exe |
|---|---|
| Filepath | C:\Program Files (x86)\e8fdc9c8\jusched.exe |
| Size | 41.0KB |
| Processes | 1064 (08847b322735faa9b17de14f67d557616f6f1202fb29ef14de1acc061d99e172.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | fd6a8fa0622a0cc9cda1b7132a09c105 |
| SHA1 | 06e92211626d558b6993efb9f16baec93443d720 |
| SHA256 | 02c473e63756fc2988e522389b919a281eab79668dc7fb9113f3019b1afd2463 |
| CRC32 | 3EF85907 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.