1.4
低危

278f07e47ceb9e84b2f10c64512b0b10e1d21540ae91645e4eff0a4f6745ee52

278f07e47ceb9e84b2f10c64512b0b10e1d21540ae91645e4eff0a4f6745ee52.exe

分析耗时

196s

最近分析

361天前

文件大小

56.6KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN DOWNLOADER ZBOT
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.55
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Agent-ASIQ [Trj] 20191227 18.4.3895.0
Baidu Win32.Trojan-Downloader.Small.az 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20191227 2013.8.14.323
McAfee BackDoor-FBKE!42BC01D2AD62 20191227 6.0.6.653
Tencent Malware.Win32.Gencirc.10b8026d 20191227 1.0.0.1
行为判定
动态指标
该二进制文件可能包含加密或压缩数据,表明使用了打包工具 (2 个事件)
section {'name': 'UPX1', 'virtual_address': '0x00007000', 'virtual_size': '0x00003000', 'size_of_data': '0x00002200', 'entropy': 7.244730641768269} entropy 7.244730641768269 description 发现高熵的节
entropy 0.21794871794871795 description 此PE文件的整体熵值较高
可执行文件使用UPX压缩 (2 个事件)
section UPX0 description 节名称指示UPX
section UPX1 description 节名称指示UPX
网络通信
与未执行 DNS 查询的主机进行通信 (2 个事件)
host 114.114.114.114
host 8.8.8.8
文件已被 VirusTotal 上 59 个反病毒引擎识别为恶意 (50 out of 59 个事件)
ALYac Trojan.Downloader.JQDS
APEX Malicious
AVG Win32:Agent-ASIQ [Trj]
Acronis suspicious
Ad-Aware Trojan.Downloader.JQDS
AhnLab-V3 Spyware/Win32.Zbot.C3292276
Antiy-AVL Trojan[Spy]/Win32.Zbot
Arcabit Trojan.Downloader.JQDS
Avast Win32:Agent-ASIQ [Trj]
Avira TR/Spy.Zbot.amoam
Baidu Win32.Trojan-Downloader.Small.az
BitDefender Trojan.Downloader.JQDS
BitDefenderTheta Gen:NN.ZexaF.33558.dq2@a4EQq!p
Bkav W32.AIDetectVM.malware1
CMC Trojan-Spy.Win32.Zbot!O
ClamAV Win.Downloader.Upatre-5744087-0
Comodo Packed.Win32.MUPX.Gen@24tbus
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.2ad629
Cyren W32/S-107e7686!Eldorado
DrWeb Trojan.Packed.24872
ESET-NOD32 Win32/TrojanDownloader.Small.AAB
Emsisoft Trojan.Downloader.JQDS (B)
Endgame malicious (high confidence)
F-Prot W32/S-107e7686!Eldorado
F-Secure Trojan.TR/Spy.Zbot.amoam
FireEye Generic.mg.42bc01d2ad6293be
Fortinet W32/Zbot.AAB!tr
GData Trojan.Downloader.JQDS
Ikarus Trojan-Downloader.Win32.Small
Invincea heuristic
Jiangmin TrojanSpy.Zbot.dxoc
K7AntiVirus Trojan-Downloader ( 00457c511 )
K7GW Trojan-Downloader ( 00457c511 )
Kaspersky Trojan-Spy.Win32.Zbot.qntr
MAX malware (ai score=81)
Malwarebytes Backdoor.Bot
McAfee BackDoor-FBKE!42BC01D2AD62
McAfee-GW-Edition BehavesLike.Win32.Cutwail.qt
MicroWorld-eScan Trojan.Downloader.JQDS
Microsoft TrojanDownloader:Win32/Upatre.A
NANO-Antivirus Trojan.Win32.Zbot.cmktgr
Panda Trj/Downloader.WLX
Qihoo-360 HEUR/QVM19.1.28E7.Malware.Gen
Rising Trojan.Waski!1.A489 (CLASSIC)
Sangfor Malware
SentinelOne DFI - Malicious PE
Sophos Troj/Agent-BCMS
Symantec ML.Attribute.HighConfidence
Tencent Malware.Win32.Gencirc.10b8026d
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2004-10-13 11:27:30

PE Imphash

c2343dd84ed5ff77d987b94d6bc90ce0

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
UPX0 0x00001000 0x00006000 0x00005c00 3.4925752955674856
UPX1 0x00007000 0x00003000 0x00002200 7.244730641768269
.rsrc 0x0000a000 0x00002000 0x00001800 4.701766952012845
.imports 0x0000c000 0x00001000 0x00000600 3.800056145706608

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x0000a17c 0x00000ea8 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_DIALOG 0x00006020 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_GROUP_ICON 0x0000b028 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_VERSION 0x0000b040 0x00000318 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_MANIFEST 0x0000b35c 0x00000193 LANG_NEUTRAL SUBLANG_NEUTRAL None

Imports

Library KERNEL32.DLL:
0x404110 GetModuleHandleA
0x404114 CreateSemaphoreW
0x404118 GetProcAddress
0x40411c HeapCreate
0x404120 HeapAlloc
0x404124 ExitProcess
0x404128 FreeLibrary
Library GDI32.dll:
0x4043b4 CreateBitmap
0x4043b8 IntersectClipRect
0x4043bc ExcludeClipRect
0x4043c0 UpdateColors
0x4043c4 DeleteDC
0x4043cc CreateCompatibleDC
0x4043d0 DeleteObject
0x4043d4 TextOutA
0x4043d8 SetBkColor
0x4043dc SetTextColor
0x4043e0 Rectangle
0x4043e4 CreateSolidBrush
0x4043e8 GetStockObject
0x4043ec SelectObject
0x4043f0 CreateFontIndirectA
0x4043f8 SetMapMode
0x4043fc GetDeviceCaps
0x404400 GetTextMetricsA
0x404404 CreateFontA
0x404408 RealizePalette
Library IMM32.dll:
0x4045a8 ImmGetContext
Library Msacm32.dll:
0x404674 acmStreamOpen
Library OLE32.dll:
0x404624 CoUninitialize
0x404628 CoInitialize
0x40462c CoCreateInstance
Library user32.dll:
0x4041e8 CreateWindowExA
0x4041ec GetMessageA
0x4041f0 DispatchMessageA
0x4041f4 DefWindowProcA
0x4041f8 PostQuitMessage
0x4041fc GetForegroundWindow
0x404200 SetForegroundWindow
0x404204 CreateMenu
0x404208 GetSystemMenu
0x40420c GetDoubleClickTime
0x404210 UpdateWindow
0x404214 GetQueueStatus
0x404218 GetClipboardOwner
0x40421c FindWindowA
0x404220 LoadIconA
0x404224 LoadCursorA
0x404228 RegisterClassA
Library Winmm.dll:
0x404694 mciSendStringA

L!This program cannot be run in DOS mode.
.imports
E%)E%-
2Q?@HGGQ
g@N[vf
X=g;QFvZVCy
LoadLibraryExA
save recsound aaa
TranslateMessage
user32.dll
GetModuleHandleA
CreateSemaphoreW
GetProcAddress
HeapCreate
HeapAlloc
ExitProcess
FreeLibrary
CreateBitmap
IntersectClipRect
ExcludeClipRect
UpdateColors
DeleteDC
GetTextExtentPoint32A
CreateCompatibleDC
DeleteObject
TextOutA
SetBkColor
SetTextColor
Rectangle
CreateSolidBrush
GetStockObject
SelectObject
CreateFontIndirectA
GetTextExtentExPointA
SetMapMode
GetDeviceCaps
GetTextMetricsA
CreateFontA
RealizePalette
ImmGetCompositionStringW
ImmSetCompositionFontA
ImmGetContext
ImmSetCompositionWindow
acmStreamOpen
CoUninitialize
CoInitialize
CoCreateInstance
CreateWindowExA
GetMessageA
DispatchMessageA
DefWindowProcA
PostQuitMessage
GetForegroundWindow
SetForegroundWindow
CreateMenu
GetSystemMenu
GetDoubleClickTime
UpdateWindow
GetQueueStatus
GetClipboardOwner
FindWindowA
LoadIconA
LoadCursorA
RegisterClassA
mciSendStringA
.idata
sz42(u
ka*cn@X_`a
Aa0iV=
LoadLibraryExA
save recsound a
nslateMesge
use{r32.dllNLSSTPRU3t
*'$LUWsj1
l#&!O2
P`Sg$L2
EK$L6Y
dd@~dd@Fn@F
o,Yi05
N?7{}#5_;
R?'H7i
N"Y)/^
]7!od-
Gl-K57
iWG!*EaH
!?c}[cw
Yym9}/W#2V
Kb/_+@
0ADiXjxA<l
0B4MBPdvM4MY6
,8FC E`G
D 4FV4M4bz4M
E":HXUajxE[
EQa+lE
le4FFVF
I/DlE\
1GetModul
meHand
Semapho
W#ProcAdd
Exi'#FeY
rsectClipR/
Cclude
Upd1Co[marUDe
DCText/
32b[%.mp
4ObjP5Out+`/
ol-GidBrushStkPSgCv^ct/FoB
~e"Mvic
sAWAa6
_5mnImm9osdi-
W>dowb
ac!tmOp
o$3Unin
1;ef,k
cRQui3?Fgfr*
z8nuh5yI
D*a|ATime
mci<AnhyPEL#l
XPTPSWXaD$j
#######
###;KK>
26;2+##########
#########
#####+bEXL
+######+
#####3
######3#
PD[>J22Ib|tLx63
#######3#>>
vDDP>2
########3+ug
DW[[FvV####
########3#J~~3#5gJIk#
3333333333+g +zT
##++++######
3333333333#J%Tz+33#3333######
33333333333+
#33############
33333333333@II#333###########
33333333333@+333333#########
33333333@?a
+233333#3#######
33@j+23333333#######
j@33333333#######
+jj23333333333####
+I@3333333333##
2+@2333333333#
al233333333
$$$2333
C&SCCCSCS&&&&
&&&&$$
7:::::::****************ss****@$$$$$
788888881;111n;;;11p;11111111;
))))))
o,,,,,,,L6,6Lr66rq6,,,,,,,E
)f/HHHH/
8(((((,Lx|>>Eq6,(,((,EM&/-999N/
K((((((XmV#R?DlV((((((EMC/N9<<<<<
,444444X|JJVT
DRmXF4444F4VMC-9<UUU
(444444X3?
DPIDP#F04440tM
4000000y2WIWRIuRI
0000050
5y{kkJ0? D~`f9f
0%%%%%%_
3^%%%%%y`f\f#
%%%%%%%%^_a%G_a%%G=%%%%%%^`f\f#
%%%%%%%%%BB%%%BB%GG%BB%GGGGG%G`f
G.......'''''''''''''''''''''.
-----------------d-)/
&&&&$$$&
$$$$$$$
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
GDI32.dll
IMM32.dll
KERNEL32.DLL
Msacm32.dll
OLE32.dll
user32.dll
Winmm.dll
DeleteDC
ImmGetContext
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
acmStreamOpen
CoInitialize
LoadIconA
mciSendStringA
KERNEL32.DLL
GetModuleHandleA
CreateSemaphoreW
GetProcAddress
HeapCreate
HeapAlloc
ExitProcess
FreeLibrary
GDI32.dll
CreateBitmap
IntersectClipRect
ExcludeClipRect
UpdateColors
DeleteDC
GetTextExtentPoint32A
CreateCompatibleDC
DeleteObject
TextOutA
SetBkColor
SetTextColor
Rectangle
CreateSolidBrush
GetStockObject
SelectObject
CreateFontIndirectA
GetTextExtentExPointA
SetMapMode
GetDeviceCaps
GetTextMetricsA
CreateFontA
RealizePalette
IMM32.dll
ImmGetCompositionStringW
ImmSetCompositionFontA
ImmGetContext
ImmSetCompositionWindow
Msacm32.dll
acmStreamOpen
OLE32.dll
CoUninitialize
CoInitialize
CoCreateInstance
user32.dll
CreateWindowExA
GetMessageA
DispatchMessageA
DefWindowProcA
PostQuitMessage
GetForegroundWindow
SetForegroundWindow
CreateMenu
GetSystemMenu
GetDoubleClickTime
UpdateWindow
GetQueueStatus
GetClipboardOwner
FindWindowA
LoadIconA
LoadCursorA
RegisterClassA
Winmm.dll
mciSendStringA
About
MS Sans Serif
VS_VERSION_INFO
StringFileInfo
08000025
Comments
CompanyName
MSFT Corp
FileDescrsiption
calc.exe
FileVersion
2.1.1.2
InternalName
calc.exe
LegalCopyright
Copyright (C) 2011
LegalTrademarks
OriginalFilename
calc.exe
PrivateBuild
ProductName
ProductVersion
3.1.1.3
SpecialBuild
VarFileInfo
Translation
C:\unzipped\Vodafone_Statement_301013\Vodafone_Statement_301013.exe
C:\gXv2hPql.exe
C:\YfCD_0Ke.exe
C:\hAQy8VUv.exe
C:\M2s0DYQY.exe
C:\Rfn6ZiRI.exe
C:\ig8mcBw9.exe
C:\KuFgCxrs.exe
C:\8V3OSvjc.exe
C:\pMtT8Xax.exe
C:\Q2Oc2jet.exe
C:\Fa76eTeX.exe
C:\xKwlgvcz.exe
C:\P0oPJQyP.exe
C:\yyuhqIDT.exe
C:\Sx2OTjNs.exe
C:\07o6wEu8.exe
C:\BgorlgnY.exe
C:\4YdtssQ0.exe
C:\WWYCVlSg.exe
C:\CF0QlxPE.exe
C:\tu7EYUMm.exe
C:\M7yFOghH.exe
C:\LTtwKCAl.exe
C:\110e410477cd8741132a927dc72d1c2e00aef83ef2a27851011e8e1d7d7bcc74
C:\3e8m0OZW.exe
C:\Users\Virtual\AppData\Local\Temp\b676f4d97df64b1371bb33a0a069712c30aaa450a7cda54958fe4bd35d8d03fe.exe
C:\104bfc43442a5e9780fec4b6574377fae04a980c67a3959b8ef2eb1df267d876
C:\8dedf5e73df59d95fded41d5079e63d93cb682db631f6b7e914b04d08c517a0f
C:\252d30ab526931f867e86676a92aee78140184bba30bc5aededb76241b958d72
C:\Users\Lisa\Desktop\waqnyU3F.exe
C:\QjoqIPQf.exe
C:\Users\Lisa\Desktop\f5WuWRAd.exe
C:\Users\Johnny Cage\Desktop\75DuOKCJGT.exe
C:\262c8644778d1763bbdcfe36c6928edcd70897046690220137bb8d394533a6fc
c:\analyse\1554570684.8925583_d696fe11-baf5-4650-b697-793c38eaebb2
C:\TXT8mbt7.exe
C:\622b8ec5f939650c68bc4f2fea5e0e1b44ced2060ddc8fa0f0fd2ec49e2c7b9e
C:\4a7fff194cb3d4567a9c4893f51dacc66c08a096ab9dffd23440bfb7fd56e489
C:\ee747d41254f7d834380a5226d39c961b009906467b5f4cd029974214dac32f6
C:\4c2850c5ee919baa2c9cf7351ff8a18150ade33d567a531795f9c3082e25804a
C:\Users\Virtual\AppData\Local\Temp\182ae01e39a619cb202a3b57f5e5b50645aa6f259177e67306b4b4a7a5df21c8.exe
C:\9d342367f942c10128cb4a15fb77dc7e7470000419ca958bdc855c956e0fc0e1
C:\Users\Petra\AppData\Local\Temp\hhcbrnaff.pe32
C:\a25b445fb8fbb6116cd25c0718e5152d7c7d71d250218be16a4c5c49537571c2
C:\54e97c548ea23b86fe25239905d6411272100554da5846cf7f2b725971a67903
C:\dbc151337d66846d89bcf8d29bb121fc17b62e1cb7c55e1338190afdf9ee139b
C:\E5XJ9GPT.exe
C:\a0c7a12bfaad483af10c42f32f3b6f1600d39657c8270442142422468493bdb2
C:\kl9WUYYW.exe
C:\117a4216ca7e0b588406b3edc35a7024108694a128de639181d87e90d986f1af
C:\d39f1d6f70819470683aee661108dfb0104edf71a589e3e2f9c28fdbb6db9d8c
C:\6a33d2b0db262dff317f238b850517847f146f8b84308f282488ac9b633816f2
C:\UuGz2m6M.exe
C:\Users\Lisa\Desktop\ONQASouD.exe
C:\15uVrFlb.exe
C:\Users\Lisa\Desktop\j2WUz7xn.exe
C:\844b0102a64672e29b1af3761b07de02cd19b7e96602a00db65e99c0f9c54519
C:\3f5b6c4df2b286fcbf4bf7d8a975603566ae42ddaa5cef5dc571c935434c2085
C:\Documents and Settings\Administrator\Desktop\bA7dudUF.exe
C:\cc2918c2428813b29abef18849ba0b07aa5b47c858d16954ab100a214d00e1af
C:\Documents and Settings\Administrator\Desktop\TcmNeCj1.exe
C:\d55b83c9338cf31eb22d5a841df761b4a79dfb95fb4a4e12b6f3a58b52f5584e
C:\45f81afc475bbec92f03a8641fe7aa2a0746a77ed780b62db56c8eae4fd7d10d
C:\0FAykCRV.exe
C:\8c143ab5f813e98b33dc4d703141eb01c732c94846eb45df54df79595ec5273f
C:\Users\admin\Downloads\invoice.exe
C:\Users\admin\Downloads\sample.exe
C:\e44b1158bc6f1d6b7334d5447dd905331c4a6d9712b126db1c2bb850c493007d
C:\0qlrNbP7.exe
C:\Users\admin\Downloads\factura.exe
C:\08eae702d464221bfd0d87c92256eccbb945859eb849fc8945a7484beb7a2c29
C:\Users\admin\Downloads\sample.exe
C:\Users\admin\Downloads\important_document.exe
C:\Users\admin\Downloads\factura.exe
C:\Users\admin\Downloads\invoice.exe
C:\Users\admin\Downloads\sample.exe
C:\Users\admin\Downloads\sample.exe
C:\Users\admin\Downloads\important_document.exe
C:\Documents and Settings\Administrator\Desktop\jYz7uu5f.exe
C:\17uioWO1.exe
C:\Users\admin\Downloads\sample.exe
C:\Users\Lisa\Desktop\AWjHnquw.exe
C:\6866cwGw.exe
C:\0c9d82a43d52460c1a9287f99d90f1b4e36575319328097cfb5ec5249167d1d2
C:\Users\admin\Downloads\invoice.exe
C:\97df30752ba0722b25fb4c3f74a3b5cf45c10e45ef0736fa66a5ea627ddaa7c0
C:\Users\Joe Cage\Desktop\FfGazgtsVi.exe
C:\09177f33898366c4ed118c156729327fac9834301ab984c0c6017ed10eee17ed
C:\Users\Petra\AppData\Local\Temp\hhcbrnaff.pe32
C:\Users\admin\Downloads\7b6d58d188dfa9e6_hhcbrnaff.exe
C:\94a3af280d8f763ca81260d0c73d7385f402091d545b1703a2de2024bbff9d24
C:\Users\admin\Downloads\hhcbrnaff.exe
C:\8a0f293e672879962b1975b10aed29253720b7a5c85e057cc871fdcc477f0e95
C:\Users\Lisa\Desktop\mQG8Pm0c.exe
C:\43467a536fd2d751ff272a25b06929611a3d33926c87426647c7e1ab5f0f3d52
C:\Documents and Settings\Administrator\Desktop\33p2b1ef.exe
C:\Users\admin\Downloads\5dfdbb7014edf66ebb10b60152067db5b937e9fd64799c518f95da74e150c6cf.exe
C:\0de830321042da18336359c7832587bf569801ae61ef88424b7aec9413273e44
C:\Documents and Settings\Administrator\Desktop\tlUWeINm.exe
C:\Users\admin\Downloads\f8a6c2b4a237852d17071c60d188d3c3d33bb7a1dc69c8246cb46d8d08736f42.exe
C:\Documents and Settings\luser\Desktop\MAcEKVPk.exe
C:\Users\admin\Downloads\0b7f01d865ed517af0bbab9d80b2dbbc6860f058730cf25cc39e00f23cd3d9ad.exe
C:\Documents and Settings\Administrator\Desktop\IV1Ol1ke.exe
C:\Users\admin\Downloads\c94d2fac06aab0fb6c719c9a37f6b7337883a66241f4fa1217adb9923f0d04b3.exe
C:\2b86156ca9a0e60b138fe0ddf61629dbd8e663d9a3d13c2a9c0d5c71f7edfac5
C:\bda6eb11b1531cfa72afd135dc9162bf14723633407f6a8c4d9613e59aff5688
C:\Users\admin\Downloads\hhcbrnaff.exe
C:\aabe333d4d6a603ecce91db56fb818f793746516428067d7d2e9d683a63deea2
C:\Users\admin\Downloads\hhcbrnaff.exe
C:\Users\Virtual\AppData\Local\Temp\be4615b35f4bd8ca8af4cde77d58775274eccb7a693e7627da7d6d91ab041756.exe
C:\ee195b2941c17517303df9e029ebdc9288abdb7831275bda7f85fd14c0a488fb
C:\Users\Petra\AppData\Local\Temp\hhcbrnaff.pe32
C:\99d36a0de734584e17aeef9b6a5cd42b178a8e2b76e36df52b7b27710d7cdf57
C:\Users\Petra\AppData\Local\Temp\hhcbrnaff.pe32
C:\Users\admin\Downloads\0bdb794f4651733b_hhcbrnaff.exe
C:\Users\Petra\AppData\Local\Temp\hhcbrnaff.pe32
C:\537d72601be29a59e01b573d68eef4ff221de1c468f1003eef1315b032be835a
C:\Users\Petra\AppData\Local\Temp\hhcbrnaff.pe32
C:\6aec79806a6f8694c6612fb7e735b759d03983854857bdbb63747463da93d869
C:\858d4b582ce1b2d18167d404e4aa935bf52a937f6737af45ec518b68312668b4
C:\Users\Petra\AppData\Local\Temp\hhcbrnaff.pe32
C:\c912470cb40166ed23d616b4f3d40bce11a26f7c2b548a6a222ef804c4541bb4
C:\Users\Lisa\Desktop\rdahc57w.exe
C:\Users\Petra\AppData\Local\Temp\.pe32.exe
C:\Users\admin\Downloads\05c5539a69a2e85d_hhcbrnaff.exe
C:\Users\Lisa\Desktop\FoeZRH6q.exe
C:\Users\admin\Downloads\5128d4bbe6c497dc1afdd302cf5edae75bc4c7de1855c6151d965515cd7a45de.exe
C:\Users\Petra\AppData\Local\Temp\hhcbrnaff.pe32
C:\83d7019c9cc7688d10f4aeed5e53d37a23764f2b5f89e6d0d5115bb818c26a94
C:\Users\admin\Downloads\hhcbrnaff.exe
C:\3904e8fc74fb231d0997d08889533d17750065a5eef02084591926800561f319
C:\2a19a1d5385d55b2d929300749888e2e5a846921331ca23040b99da12bf37c47
C:\Documents and Settings\Administrator\Desktop\QI04nMVW.exe
C:\Users\Administrator\AppData\Local\Temp\fbxfcHYy.exe
C:\53722c9a0f13798bc4a8761b75c5636974a2a6681c52f67f179581c370e4c43f
C:\Users\admin\Downloads\hhcbrnaff.exe
C:\d7bc9be7107178fd545edcb37992d0499fe1127b9d17e8afc01876e4f3e87081
C:\0db412971b87459de63063f2a5e62ff851ff3243d0ba72583d3545ca87ca50d6
C:\Users\admin\Downloads\hhcbrnaff.exe
C:\e1bde2184ed7a856797de985531c7b9108e5337ed03d7e9ccd14433a3a58bc0e
C:\Documents and Settings\luser\Desktop\V4dfOxpt.exe
C:\Users\Petra\AppData\Local\Temp\.pe32.exe
C:\Users\admin\Downloads\c85a01c327e4142d_hhcbrnaff.exe
C:\88176a10a54661e75f60769dd1c9787ad93bb6b938ebea3cb105af272b317718
C:\08e2cb36559dc61776f17072a85d3530827020bcb107214172bcfd14201fc4c2
C:\Documents and Settings\Administrator\Desktop\nU8SaZMW.exe
C:\2bc4747dc075975abedd0c5c8630fb5f1cb2af468efd1d9e114c567e0bb79782
C:\494a389e39081992c4ffc89b3e3e5bbd57e0a9c3282105a2bf120d88745fdba5
C:\83f0c65030e2e880da03d02e09de4e4cd92e086760c85aff325499c68d1cd83f
C:\Users\Petra\AppData\Local\Temp\hhcbrnaff.pe32
C:\Users\Lisa\Desktop\Hqtqtn8G.exe
C:\Users\admin\Downloads\fe3a58e9d1cd3d0fdfc562828774927942c89784c33490f229481dba2ce1e14e.exe
C:\1c9fd2f5a60ec3e97cc530d812231302eaf13f93334514ec0dd2ccd48e79c50a
C:\Users\admin\Downloads\hhcbrnaff.exe
C:\f3293d949d6ea77a9203c495591c99ab4149aac505e27410c2d74b8450a249fb
C:\Documents and Settings\Administrator\Desktop\lWJfoizB.exe
C:\Users\admin\Downloads\fa4068d7d21ebf6b5d8c06c0207aa48efca58c434ddae626c02a5863719bff86.exe
C:\Users\Petra\AppData\Local\Temp\hhcbrnaff.pe32
C:\6fc304c37bde4aa737c75a15dd036cf1cec1b9c107ddec4aefff35f000a8e928
C:\e938ba4af2fd8c4722b468db272ecb2105512f04ec2532eb4c30979344363a55
C:\Users\admin\Downloads\hhcbrnaff.exe
C:\c9b0c97362e2db673090dd8baae75f1354e810e54e72a21622acbdeba5399802
C:\Users\admin\Downloads\hhcbrnaff.exe

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 61714 8.8.8.8 53
192.168.56.101 56933 8.8.8.8 53
192.168.56.101 138 192.168.56.255 138
192.168.56.101 58485 114.114.114.114 53
192.168.56.101 58485 8.8.8.8 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.