1.0
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.68
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Agent-AUID [Trj] | 20191124 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Waski.a | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20191124 | 2013.8.14.323 |
| McAfee | GenericRXHT-NB!3CFD24CA2D9F | 20191124 | 6.0.6.653 |
| Tencent | Trojan.Win32.Inject.hjqba | 20191124 | 1.0.0.1 |
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(3 个事件)
| section | .MPRESS1 |
| section | .MPRESS2 |
| section | .imports |
动态指标
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 59 个反病毒引擎识别为恶意
(50 out of 59 个事件)
| ALYac | Trojan.Agent.BBNR |
| APEX | Malicious |
| AVG | Win32:Agent-AUID [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Agent.BBNR |
| AhnLab-V3 | Trojan/Win32.Upatre.C3110476 |
| Arcabit | Trojan.Agent.BBNR |
| Avast | Win32:Agent-AUID [Trj] |
| Avira | TR/Crypt.XPACK.Gen |
| Baidu | Win32.Trojan-Downloader.Waski.a |
| BitDefender | Trojan.Agent.BBNR |
| BitDefenderTheta | Gen:NN.ZexaF.32253.cqY@ayUKHboi |
| Bkav | W32.FamVT.GeND.Trojan |
| CAT-QuickHeal | TrojanSpy.Zbot |
| ClamAV | Win.Downloader.Upatre-5744087-0 |
| Comodo | TrojWare.Win32.Inject.HJR@59lmvg |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.a2d9f2 |
| Cylance | Unsafe |
| Cyren | W32/Zbot.ZW.gen!Eldorado |
| DrWeb | Trojan.DownLoad.64857 |
| ESET-NOD32 | Win32/TrojanDownloader.Waski.A |
| Emsisoft | Trojan.Agent.BBNR (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Zbot.ZW.gen!Eldorado |
| F-Secure | Trojan.TR/Crypt.XPACK.Gen |
| FireEye | Generic.mg.3cfd24ca2d9f2849 |
| Fortinet | W32/Waski.A!tr |
| GData | Trojan.Agent.BBNR |
| Ikarus | Trojan-Downloader.Win32.Upatre |
| Invincea | heuristic |
| Jiangmin | Trojan/Inject.arcs |
| K7AntiVirus | Trojan ( 0052964f1 ) |
| K7GW | Trojan ( 0052964f1 ) |
| Kaspersky | Trojan-Spy.Win32.Zbot.znbz |
| MAX | malware (ai score=89) |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | GenericRXHT-NB!3CFD24CA2D9F |
| McAfee-GW-Edition | BehavesLike.Win32.PWSZbot.nm |
| MicroWorld-eScan | Trojan.Agent.BBNR |
| Microsoft | TrojanDownloader:Win32/Upatre.AA |
| NANO-Antivirus | Trojan.Win32.Inject.cswlpr |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM19.1.6F3B.Malware.Gen |
| Rising | Spyware.Zbot!8.16B (TFE:2:A8b9Y8vlCC) |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/DwnLdr-LIQ |
| Symantec | ML.Attribute.HighConfidence |
| Tencent | Trojan.Win32.Inject.hjqba |
| Trapmine | malicious.high.ml.score |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2013-10-28 00:00:06
PE Imphash
5c7bd8e9f46408bfe57efe5104eaa1c9
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .MPRESS1 | 0x00001000 | 0x00007000 | 0x00002c00 | 5.299378371407275 |
| .MPRESS2 | 0x00008000 | 0x00001000 | 0x00000400 | 5.917321111820713 |
| .rsrc | 0x00009000 | 0x00003000 | 0x00002800 | 4.647963164847453 |
| .imports | 0x0000c000 | 0x00001000 | 0x00000200 | 3.916230399925804 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x00009068 | 0x00002428 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x0000b4d0 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x0000b524 | 0x00000148 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library USER32.dll:
• 0x402028 PostQuitMessage
• 0x40202c GetMessageA
• 0x402030 DispatchMessageA
• 0x402034 CreateWindowExA
• 0x402038 RegisterClassExA
• 0x40203c SendMessageA
• 0x402040 ShowWindow
• 0x402044 DefWindowProcA
• 0x402048 GetFocus
• 0x40204c EnableWindow
• 0x402050 UpdateWindow
• 0x402054 IsZoomed
Library KERNEL32.dll:
• 0x402010 CreateFileA
• 0x402014 HeapAlloc
• 0x402018 HeapCreate
• 0x40201c HeapDestroy
• 0x402020 ExitProcess
Library GDI32.dll:
• 0x402008 GetStockObject
Library COMCTL32.dll:
• 0x402000 InitCommonControlsEx
L!Win32 .EXE.
.MPRESS1
.MPRESS2
.imports
*, dXK
3P50<@
3PPPUR
t =0 @
MQ3PPPUR
MZuScAWVAf9
GEGEGMG;r
@@@@UV3W}
FG3@_^]
*,D$Qa
tKU^d=?@
`;`}-t
>tI\Hd=?]
.{>gG{ #, u
ERcKIY
~7tCIY
f=Q*_k
Z3jOkz
w3tOXzd=?]
s<ckdz
eO_ e1%y
~RrOBz
`<EEBz
sOXHd,?`
c'r}dk
ERrOBz
q'Q*yd
wIf\tfr>j
@rO'H=^
*,Ga%\K
su'C,1
tW4&*F 2XEI<D8
Z2CGf4$
a#H=BrQ
+^z)36
$wOgv]t,wXKz
t>-8#K
F |E}n6k]=
wOgu>b d
a|P|,wdXKzyH=:
thuwdXKzyH=:
B. dPeaY\>-:
$Rrs(!{H
a]GA>D8P@Z6
e|I( Q
4PeaY\2
I<-j*, =dM3x
q=tO_]
g.ki4l
wdXKzyH=:zn*,
"uQSzgXK
K[ydXKM
{|c*_:
|RbKIlD7<~
G8RrOBz
sRkMMo
w*|X<E
|1sM_k
&Tv.~a?2fY
ocjav*SJ
/IuX[_[+S
USER32.dll
PostQuitMessage
GetMessageA
DispatchMessageA
CreateWindowExA
RegisterClassExA
SendMessageA
ShowWindow
DefWindowProcA
GetFocus
EnableWindow
UpdateWindow
IsZoomed
KERNEL32.dll
CreateFileA
HeapAlloc
HeapCreate
HeapDestroy
ExitProcess
GDI32.dll
GetStockObject
COMCTL32.dll
InitCommonControlsEx
8Muex<
KERNEL32
VirtualProtect
G(XPTPjxWXt=
button
static
4S9?V+
>B7* F)
&YUM@:_(
invocatory
cognomen
! ''!$
GetModuleHandleA
GetProcAddress
KERNEL32.DLL
USER32.dll
GetFocus
GDI32.dll
GetStockObject
COMCTL32.dll
InitCommonControlsEx
t7Kt'Kt
KKMM""
uuDD--
117722
}}^^mm
I'6*(******************++""
!!##**********************::v
DZ5Lar
'@WmAYG_
_p\\\n
`s]]]m
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo></assembly>
USER32.dll
PostQuitMessage
GetMessageA
DispatchMessageA
CreateWindowExA
RegisterClassExA
SendMessageA
ShowWindow
DefWindowProcA
GetFocus
EnableWindow
UpdateWindow
IsZoomed
KERNEL32.dll
CreateFileA
HeapAlloc
HeapCreate
HeapDestroy
ExitProcess
GDI32.dll
GetStockObject
COMCTL32.dll
InitCommonControlsEx
s z i G 6 . e x e
C : \ E z N 6 z t U 1 . e x e
C : \ e 8 2 d a 6 0 2 9 6 0 3 1 e 0 8 e c 0 1 6 3 4 d c d 5 1 f 2 9 7 3 2 b 2 c e 1 e 7 f 5 3 2 0 d 1 9 7 8 3 e 9 6 c 0 4 d 4 c f 4 d
C : \ 9 4 2 f e 5 1 1 a 4 b 3 1 d 8 c 8 8 9 0 c 1 1 1 4 0 4 3 6 0 b 6 1 9 f b e 2 a 7 a 6 b 5 6 6 5 c a 3 d 8 8 4 e b c 7 9 d 5 9 d 4
C : \ U s e r s \ L i s a \ D e s k t o p \ 0 9 f p 6 X l d . e x e
C : \ 6 l o 3 0 p a g . e x e
C : \ R a i d e n \ G o a t \ F T P \ S a m p l e \ F C 5 F 8 2 D E 5 A 2 5 1 9 B 1 1 7 E 9 A D B 8 0 7 4 D 9 2 9 2 . b i n . e x e
C : \ o B M K u G j t . e x e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 5 4 1 b 8 a 1 d 9 d b 1 5 9 d 4 8 7 d 4 c f e f c 2 4 f 3 c 6 c 1 9 3 1 6 7 1 7 9 f c 8 6 4 3 1 4 1 6 9 5 f 8 2 d 5 f c 6 f 3 4 . e x e
C : \ R a i d e n \ G o a t \ F T P \ S a m p l e \ B 6 B 7 C E 6 E D 9 7 E B C 9 1 0 1 8 F 7 1 2 C 5 6 A 6 9 7 5 9 . b i n . e x e
C : \ 4 6 9 8 a 0 7 6 8 e e a 0 4 2 8 e a c 7 e c b 9 0 c 8 c d a 9 9 0 8 1 6 3 e 3 b 5 6 c 1 f 5 8 7 d 4 e 5 8 b e 5 a 3 2 7 a f 5 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ F b M 0 k 4 h C . e x e
C : \ R a i d e n \ G o a t \ F T P \ S a m p l e \ 7 A 3 D 3 B E 3 1 E 5 3 3 2 3 C D 8 6 7 2 0 E 3 D 8 9 D D 2 1 F . b i n . e x e
C : \ c 3 e 0 b 8 a d 2 b d f b 8 4 f 9 5 a 3 b f 3 c 6 e e 3 9 5 3 d f b 9 e 4 f 8 0 7 b 8 e c 9 8 a 0 6 f 5 f 0 5 b c 2 6 3 d 4 f 3
C : \ 2 e b 5 e 6 0 2 3 a 1 3 9 e 8 1 1 a 2 b 1 d 5 e 5 b 9 1 f a a 1 7 d 6 d 1 d 1 6 3 8 6 a b 9 b d 9 0 2 0 a d f 7 4 1 f 9 4 c 4 1
C : \ f 6 d 4 0 7 6 3 5 9 2 8 0 9 3 f a 2 e c 7 3 f c 9 1 e 2 4 3 c 5 4 2 c f 6 8 c c 5 2 8 8 6 d 6 4 c 4 b f 0 4 d d f a 8 a f 4 2 a
C : \ 4 5 8 9 5 1 1 8 b c 4 2 9 2 8 9 1 b b b 3 e 7 1 5 c 8 1 d 7 1 4 5 3 0 3 c 6 1 d 9 c 6 a 2 d 2 9 9 6 7 3 2 0 b e f 5 8 2 7 8 a c
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 8 8 2 b 0 6 d b 9 9 b f 4 f e 6 5 d 5 2 b 2 7 9 d d b c 9 0 6 a e f 7 1 d b b f e a 6 6 e f 4 e 6 0 e 3 0 4 3 2 b 1 e 1 7 f e 8 . e x e
C : \ r J D k M e Z H . e x e
C : \ 0 e 6 9 1 c 7 4 a 0 6 1 e 0 7 b 1 6 5 e e a 3 e f b b 6 3 a 8 e 6 6 1 e 7 d a c 9 2 3 7 2 9 e 1 c e 5 e b 6 3 0 a 6 4 9 3 5 d 4
C : \ U s e r s \ L i s a \ D e s k t o p \ 2 v D W J Q D C . e x e
C : \ e 4 6 8 2 a f c 4 f 0 6 7 b 5 5 4 6 d 4 1 e c 9 d 7 2 e 9 4 c 4 2 1 6 3 4 3 0 1 9 d 4 6 f 9 9 b 6 7 d a a 3 d f 0 e 3 3 c 8 b 3
C : \ q 6 r E d U K p . e x e
C : \ a a 8 7 4 a 3 1 1 a a 7 7 4 e e 3 6 a 7 1 7 9 0 4 c a e c d c 4 f 3 8 4 4 c 8 7 a 5 d d a 8 1 4 9 f a 5 3 5 8 3 b 6 0 7 d b e 4
C : \ 2 f d c 2 b 4 4 2 1 5 8 8 3 9 9 6 6 0 a a d 2 e e 9 f 4 4 8 5 2 d 4 4 b c 2 2 c a f e 8 8 9 6 d 0 d b 9 b 9 6 0 d 9 0 1 e f 4 c
C : \ 1 b a 1 4 c 9 a b 4 f 0 3 a 1 e d 8 7 b 3 8 3 4 8 7 9 e d 0 b d e 6 1 3 9 7 d 9 e c e e 1 5 f 3 2 9 b 6 1 6 d 5 0 4 f 6 a e 6 4
C : \ f 4 c 5 1 b b 6 6 b 2 d a 6 3 d f 0 d 0 7 f 3 7 1 8 0 2 1 9 a 2 4 3 4 b b a a c b a d 5 0 a b e 8 b 0 5 e 6 0 8 4 c b f f 4 0 6
C : \ U s e r s \ L i s a \ D e s k t o p \ M n f A o x m O . e x e
c : \ t a s k \ 1 F 5 E 2 C B D 6 E 1 5 9 6 0 9 7 7 D E 2 A 4 9 2 B 4 3 D 5 C A . e x e
c : \ t a s k \ 6 8 F 5 3 E A B E D 7 5 1 7 B 3 7 A 6 8 7 D 5 0 3 5 F 2 0 3 A E . e x e
c : \ t a s k \ 1 3 3 D C A F 1 E F 9 6 1 5 0 D C D D 9 6 D 8 1 3 0 B 7 B 9 A D . e x e
c : \ t a s k \ 7 3 6 B E 7 2 6 2 6 1 4 7 E 7 8 B A C F B 7 E 0 5 7 E 3 8 9 9 9 . e x e
c : \ t a s k \ C 5 9 F B F 2 2 8 7 9 4 A D 4 2 F 4 3 9 1 2 0 A 2 F 6 5 C 9 A 3 . e x e
c : \ t a s k \ 3 3 0 C 8 4 3 9 8 1 C 8 1 3 B D 0 2 F A 2 C F 6 F 9 8 9 A 9 6 F . e x e
c : \ t a s k \ F C D A D 4 2 6 9 3 A E B 2 9 3 5 1 F 7 8 1 F 7 0 1 A 9 3 6 4 7 . e x e
c : \ t a s k \ F B 2 5 9 2 0 F 6 C 6 2 A B 7 6 3 C 1 A D 5 B 5 D 8 1 2 A 0 0 A . e x e
c : \ t a s k \ B E C F D 2 7 B B 4 E B A C B 1 E 4 D D 0 6 1 D 3 F 5 B C 9 F B . e x e
c : \ t a s k \ F F D 0 8 7 F 7 7 A 0 0 7 3 2 2 7 D F 1 F 3 3 8 0 1 A 6 9 A A 3 . e x e
c : \ t a s k \ 0 C 8 4 4 E 4 1 A 4 2 2 6 2 7 2 6 D 7 A 6 6 4 6 E F 1 5 9 3 C 0 . e x e
c : \ t a s k \ D 0 1 8 E 2 6 9 5 D C 1 6 2 5 A 9 F 4 8 2 7 0 A 7 9 5 4 8 9 5 0 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ 3 e 6 0 b 7 e c 2 5 4 c a 8 6 4 7 4 d 4 e 5 7 6 7 9 1 1 5 7 1 7 a e 7 c 2 4 e 8 c b 0 c a 7 a 4 3 9 4 a 9 3 e 7 0 6 7 a b 3 5 c
C : \ 4 f 9 8 a 5 e 9 b a 8 3 3 c 7 f 3 1 7 e 4 4 7 4 6 9 c 9 9 c 4 6 6 d f a 9 9 e d d b 6 4 1 0 0 6 8 5 a 5 2 5 9 6 8 0 5 4 6 4 9 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ b 7 9 f 1 a 6 f d f 7 2 b 5 4 9 e a 9 e 6 2 e 5 0 c 1 b 1 8 5 4 f 8 f c 1 b 3 5 7 0 3 a 2 b e 7 4 e 4 6 7 8 8 8 5 0 d 4 4 b 3 f
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ W 8 P n E C P S . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ Z x U 3 e 3 x c . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ 4 4 e c f 4 5 f c f c c c a 1 f 7 d 2 e 5 6 2 e c b 7 2 f 2 c 2 0 5 b 3 e b f 7 a 7 b 8 1 f a d 5 c 8 b b 6 a c f 1 f c a 1 5 4
C : \ f 5 b 9 2 1 a b 6 3 1 7 e a 2 a 9 8 a 6 2 2 8 2 5 e 6 b b 0 5 f 8 3 f 2 0 9 4 f d 0 c f 5 2 c d a 8 e 6 c a a 7 0 6 d b f 0 7 3
C : \ e 0 a f 6 5 f 0 0 e e e e 9 2 5 9 a 8 8 a 2 3 8 5 0 7 f 1 c f 8 2 4 0 1 9 7 e 3 8 0 c 8 7 6 4 b f b 2 c 9 f 4 3 2 4 d a 3 e 6 7
C : \ a c c c 1 9 7 d e 6 e c 6 5 2 3 3 8 5 1 0 6 1 9 4 9 b 2 9 4 4 1 2 6 3 7 e f 8 e d b e 1 d f 0 1 c 2 3 d 9 4 b d 3 5 4 f 7 a d 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ f a 5 e 9 9 0 b 7 3 b 3 d e e 5 5 3 e f 2 d 8 0 6 e c 6 7 3 b 1 5 d 4 c b a 4 e 7 4 0 1 2 8 d 1 f b 2 2 b 3 7 5 0 d 5 0 e b 2 3
C : \ 0 1 5 0 0 6 a e 9 b 0 6 3 e 0 8 0 9 d a e 0 5 9 6 1 4 9 8 4 d a c 0 d f b 0 c 5 b f 8 7 9 6 8 c 4 e a 5 9 8 e 7 e d 6 e 2 c 5 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ b 5 9 1 1 c e b 5 c b 3 2 c 0 e 5 2 d 9 a 4 5 3 f 7 b 5 f 7 c e b 3 9 8 4 6 d 5 d 4 f 9 a f 8 e e 7 0 9 1 8 9 8 b 7 f 3 e 1 5 a
C : \ d 2 2 9 1 4 7 a 6 6 a 4 d 4 e 8 0 f e 4 1 3 6 9 a 5 c 2 6 7 a c e 1 0 a 4 7 c 0 d 0 f 4 b 9 f a 3 8 6 4 b b d 7 a c a 5 c 8 c 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ f 1 d e e 3 c f 6 2 a c 8 c e 4 f a c 8 1 0 1 9 5 4 d e 1 0 c d d 0 b 6 3 3 b 4 e 5 f 9 6 a c c 6 3 8 0 2 6 d 8 6 1 d 0 3 8 2 c
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ c K 6 8 i X V L . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ J N S 8 3 8 0 s . e x e
C : \ b v M O 7 G L 5 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a 5 1 3 7 c 9 8 c 8 e 2 a 6 b 9 1 3 4 0 2 4 d 8 7 6 c 7 5 1 3 6 . v i r u s . e x e
C : \ f e e b c 2 7 e e 3 b 9 d 0 f 7 6 c 7 8 7 b b 1 e 8 7 a f 9 b 3 6 f c a 7 0 a 8 c d c 2 3 a 5 2 9 6 e f b 5 0 d 9 7 3 2 2 e 3 d
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ s D p K C I p J . e x e
C : \ 2 7 b b 8 8 5 a 5 9 1 7 9 8 9 9 3 5 a 9 f f d f b d 5 b d f b d f 7 6 c d 7 b 3 e c 3 e 4 4 4 8 f 4 d 8 2 0 1 5 8 1 8 b 6 a 6 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ p d f u p d a t e . e x e
C : \ 3 1 8 e 9 5 5 b f a 3 5 0 9 2 9 7 5 1 8 7 5 1 2 e 1 c f 0 8 9 0 a d b 2 0 e c 8 8 3 d 4 b f 8 e 1 0 d a 5 8 3 1 e 5 d 2 5 0 7 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ p d f u p d a t e . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ p d f u p d a t e . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 4 8 3 8 f 4 5 c c 9 3 f c a 6 e _ p d f u p d a t e . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ p d f u p d a t e . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e 1 7 8 7 1 d 1 f 0 0 9 d 1 b b _ p d f u p d a t e . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ u m T U 6 N Q i . e x e
C : \ 7 1 3 0 5 1 c 0 1 4 5 a 1 7 a 1 5 6 a 4 9 7 9 4 2 2 6 2 5 d d b a 1 f 9 c a 2 b 5 d 0 2 8 9 d 5 5 d 1 0 5 0 6 e 3 8 7 f 2 b 9 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ p d f u p d a t e . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ p d f u p d a t e . p e 3 2
C : \ U s e r s \ R A 4 9 1 ~ 1 . V U L \ A p p D a t a \ L o c a l \ T e m p \ c 9 0 2 e 9 6 9 0 c 4 2 9 f 3 9 f 7 3 2 7 1 d 5 a d 9 6 0 0 c 1 . e x e
C : \ 9 7 d a c b 5 0 1 8 f 2 e 5 3 e 9 8 c d 1 f 5 2 6 8 6 2 0 5 c 4 6 1 a 7 2 1 6 4 2 8 2 2 d 7 0 5 f c 3 6 8 9 2 2 f 9 e c 8 8 f 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ p d f u p d a t e . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ p d f u p d a t e . p e 3 2
C : \ 3 0 3 2 f f e c 2 d c 1 b 0 9 8 b 5 f d 4 a b 9 0 b 3 a f 6 8 0 d 3 6 e 9 8 b 7 2 d e 4 9 b 8 c 7 6 f 5 0 3 9 0 7 b a b 8 f 4 f
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ p d f u p d a t e . p e 3 2
C : \ 5 2 2 8 a 8 0 5 4 7 f e 3 d 5 5 2 b c 9 e 4 4 6 4 0 d 2 1 5 4 2 c 1 f 0 b 5 f 3 1 1 6 7 6 e c 4 b 4 6 8 5 b 6 a 6 1 9 b 8 5 8 b
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ p d f u p d a t e . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d 8 2 7 f 9 f a 7 1 8 8 9 8 2 e _ p d f u p d a t e . e x e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 3 e 7 d 8 b 5 0 8 e c e 7 a 6 9 2 1 b e 0 4 c d 1 5 1 6 1 d 5 f 5 6 2 c 4 6 b 4 1 8 2 e 8 d 9 4 6 4 7 6 3 e 8 5 9 8 8 0 f 2 b 0 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ p d f u p d a t e . p e 3 2
C : \ e 0 8 c a 5 b 3 4 f 4 f 3 5 7 6 6 0 d 2 8 c e c 3 9 f b 3 8 d f 6 5 3 7 1 2 1 a 4 0 1 9 5 b f 9 b 6 f c 7 9 4 2 3 3 e 6 1 1 6 2
C : \ 2 c e d 6 d a 3 6 3 2 5 d 2 b f 1 3 9 f f 6 0 b 9 a 6 d 2 6 0 9 3 0 f 5 8 2 e 4 e 9 4 3 1 3 7 5 2 7 f f 8 b d 3 7 1 b a 4 2 e c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ p d f u p d a t e . e x e
C : \ b 5 c 5 9 d e c 1 5 c 0 0 a b 4 1 0 0 f d f 4 3 a 0 0 2 1 e 9 5 8 9 4 8 c c b 2 2 1 a b 5 1 e 2 f a 1 0 9 c 1 c 3 f f c 0 3 8 a
C : \ 7 1 1 e 5 7 2 a b 9 3 8 8 e b c 3 1 b 8 7 7 0 2 9 5 b 6 1 4 e 9 0 7 e 7 b 1 7 9 0 1 3 8 0 4 b d c b f 8 2 f c 9 4 c 5 c c a 6 f
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ p d f u p d a t e . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 8 f d 9 2 6 5 b 9 2 6 5 6 2 1 _ p d f u p d a t e . e x e
C : \ 1 b 2 b 3 f a d 3 6 4 a 8 a 0 4 7 9 3 d 1 0 8 6 f d 5 4 3 7 b 3 3 f 2 d 6 2 3 d a c e 2 0 c 4 8 0 b 3 e a 3 b b 8 c 0 2 6 2 1 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ p d f u p d a t e . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Q C p 3 S X d Q . e x e
C : \ d 7 a 4 e d a 3 6 5 2 e 4 a f c 1 d b 4 a 4 1 4 b 4 6 6 e c 6 3 5 9 f c 9 1 4 c b 2 7 1 e 7 c c 4 1 c 6 a e 2 5 8 c 2 9 e 5 f 2
C : \ 4 0 7 3 f 6 f 3 9 6 9 5 8 3 4 8 3 4 b e 7 4 b 3 a 9 1 6 9 b b 4 3 2 2 3 3 c d b 1 a e f 0 9 9 4 d b 4 d 7 0 8 1 f 0 c 2 7 4 8 4
C : \ c 7 4 a e 1 b 0 8 c e 0 2 1 3 3 f 7 7 a 3 5 5 2 7 3 2 8 3 0 b 9 b 5 f d 0 4 e 6 a 8 0 c a c 8 e 4 4 2 5 5 5 a 4 7 4 5 5 c c 6 d
C : \ 2 3 e e 7 f 4 6 e 7 4 4 4 3 6 b 4 e a 5 b 7 e 8 7 9 e 0 d 6 8 6 1 1 c c 3 8 b 3 c f 9 b 3 6 5 0 1 b e 5 4 7 3 4 0 b 7 6 c 4 2 5
C : \ U s e r s \ J a s o n \ A p p D a t a \ L o c a l \ T e m p \ a 8 e 0 e 9 8 2 f 1 e 3 b 2 1 4 e 7 4 5 4 5 1 2 0 7 b a 5 8 b a 1 c e a f f a 0 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d t t c o d e x g i g a s . 6 a c 6 b 8 b c 7 9 e 1 8 1 0 c 4 d 7 b d 3 a e 9 a 0 4 8 1 d d e c 1 2 5 7 f e . e x e
C : \ 9 9 d c a 2 6 b 4 e 7 b 5 7 3 9 c b 1 a d e 8 e a 4 5 7 3 0 d 3 2 9 d 4 6 0 7 c 0 7 4 d 5 5 f b 6 2 4 0 5 1 c a b d 6 f 6 9 1 f
C : \ d 7 1 5 0 5 d 6 8 6 7 8 7 3 5 b a b 5 5 c b 7 0 b 0 7 d 5 0 d 8 9 2 f 2 0 6 b c a 9 c 1 4 0 2 6 d 6 a 2 2 1 c 0 c b 9 1 7 2 9 f
C : \ 5 7 e 8 7 0 c c d 4 e 5 f 2 b d d c 6 8 3 9 7 8 2 6 c b 1 9 e 8 a 2 7 6 5 3 4 f 9 3 1 1 0 2 3 3 a d e 9 c e 5 d 3 9 1 a 9 0 6 5
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ p d f u p d a t e . p e 3 2
C : \ 0 5 0 d d 6 f 1 2 a e 2 f 9 6 7 5 f a 6 e 1 7 5 6 a 0 0 b 3 6 1 b a 7 d 5 6 3 6 f e a 7 e d 1 9 8 f 0 e d 1 7 a 3 8 a f 0 7 0 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ p d f u p d a t e . e x e
C : \ 8 1 c d 9 4 6 f 3 f 6 e 6 b c 7 a 0 5 6 5 2 a 5 c a 9 5 f a 6 b 0 0 a 6 f 5 3 a 1 e a d 9 4 2 5 4 5 8 4 c 3 7 d a 3 9 0 c a 7 2
C : \ 3 3 5 0 4 e 4 d 7 e 1 b 0 b 4 0 5 e d 8 c 3 7 3 7 8 7 e 4 3 4 f c b b 6 f 3 0 1 7 f 9 8 1 7 7 5 3 6 7 e 9 d b e b 1 d 5 f c 7 6
C : \ b b 3 9 1 3 e 0 0 d e 3 5 0 f d f 7 2 5 f 7 0 2 5 1 f 2 f d c 4 b 7 8 8 8 c c e 5 4 d b 9 6 a d 0 3 8 6 6 f 7 a 0 7 3 d d 9 f 8
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ p d f u p d a t e . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ p d f u p d a t e . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 3 c e 2 e d 8 8 a c 9 c 6 a 4 d _ p d f u p d a t e . e x e
C : \ 3 d 8 b 6 e c 8 e 4 8 5 5 4 3 0 c b 7 f d 0 0 9 e 3 b 3 c 4 c c b d 9 1 9 3 5 2 f c 8 7 5 c b 8 1 4 1 8 7 f b 9 1 5 c 2 f 9 a 6
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ p d f u p d a t e . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 5 c a 0 1 2 9 1 1 9 4 d f 2 4 d _ p d f u p d a t e . e x e
C : \ b 5 f 1 c 3 f 1 d 3 1 c e a 4 b 5 d 4 7 d 0 9 3 1 8 3 7 b 6 9 2 a 2 e 8 4 1 b 1 c c 6 c d 9 9 b 2 4 9 6 0 7 1 a 5 4 9 e 9 1 c 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ p d f u p d a t e . e x e
C : \ 0 8 2 1 d b c d c b 4 1 4 7 b c 9 5 5 3 b 1 a 7 8 f 3 f 3 3 9 2 f e 6 f 6 8 f 8 4 a 3 d b 0 4 a 5 5 d 9 1 a e 7 3 7 4 1 b e a 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ p d f u p d a t e . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ p d f u p d a t e . p e 3 2
C : \ d 2 e d 2 4 4 9 3 d 4 e f 2 5 9 9 8 8 c 9 2 5 a 1 0 4 c 4 a a c 1 f d e 5 6 3 6 5 a 9 5 7 5 7 1 0 f c 1 1 c 7 d d 9 0 0 1 1 4 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ p d f u p d a t e . e x e
C : \ f 1 9 f c a 7 a d 9 2 7 a 1 4 4 b 8 4 a 6 2 5 1 2 d b d 5 e 3 3 9 1 b f b 7 a 2 5 0 6 3 3 0 6 4 c b 9 0 a f 0 3 4 c b a 1 5 e c
C : \ 5 a 2 3 8 f d 0 e 2 8 0 7 a d 7 4 4 0 8 5 2 8 9 6 1 1 0 9 a e 2 5 f 7 4 9 9 2 3 4 5 f 4 f 6 6 2 2 b 2 c 3 d 3 a 8 e d 4 f 2 5 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ p d f u p d a t e . e x e
C : \ e 8 9 9 4 b d e a c 8 1 0 8 4 2 f 7 6 2 c 6 8 0 8 4 b e a 9 1 6 1 0 a c 8 6 5 3 4 5 3 c 6 b b f b e 0 3 9 8 4 1 e 2 8 5 4 b e 8
C : \ a 2 9 2 6 4 c 7 9 e 9 7 4 3 a a 5 3 0 1 7 1 9 1 6 6 0 5 c c 8 a 6 e f 2 c d f 6 d 0 c 0 a 8 1 9 b 3 c b 4 d 0 2 a 6 c c 6 f b 0
C : \ a 1 8 0 d 8 2 6 6 f c 4 0 6 9 9 5 7 9 d d 3 8 a c f d c 3 9 9 1 0 e 6 e 4 0 c 1 9 3 2 3 7 5 a e f a 3 6 f 4 a d c 2 6 0 6 5 5 e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ p d f u p d a t e . e x e
C : \ d 4 9 5 f 9 0 f 0 6 8 9 1 0 d 6 0 3 c 3 0 c 5 0 5 0 f 8 4 b 2 8 7 f a 2 9 8 1 8 f a c a 6 e 2 9 8 1 1 d b 3 3 6 7 0 1 6 9 a 0 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ p d f u p d a t e . e x e
C : \ 9 d 3 9 2 6 0 5 3 4 e f d 7 a 0 8 a b d 3 b 8 2 0 4 b f 0 b 0 8 2 0 1 6 4 2 f 9 d 9 1 9 3 6 b 1 8 2 2 4 a 3 e 6 0 3 b 0 3 4 b a
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.