0.9
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.52
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | None | 20200811 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Small.ck | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200811 | 2013.8.14.323 |
| McAfee | GenericATG-FKM!433BB210CCC4 | 20200810 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b09a9d | 20200811 | 1.0.0.1 |
静态指标
动态指标
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
文件已被 VirusTotal 上 58 个反病毒引擎识别为恶意
(50 out of 58 个事件)
| ALYac | Trojan.Downloader.JQDW |
| APEX | Malicious |
| AVG | Win32:Waski-A [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Downloader.JQDW |
| AhnLab-V3 | Trojan/Win32.Dloader.R87521 |
| Antiy-AVL | Trojan/Win32.AGeneric |
| Arcabit | Trojan.Downloader.JQDW |
| Avira | HEUR/AGEN.1102634 |
| Baidu | Win32.Trojan-Downloader.Small.ck |
| BitDefender | Trojan.Downloader.JQDW |
| BitDefenderTheta | Gen:NN.ZexaF.34152.cuY@amDnDEni |
| Bkav | W32.AIDetectVM.malware1 |
| CAT-QuickHeal | Trojan.Mauvaise.SL1 |
| ClamAV | Win.Downloader.Upatre-5744089-0 |
| Comodo | TrojWare.Win32.TrojanDownloader.Upatre.A@52i1eo |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.0ccc47 |
| Cylance | Unsafe |
| Cynet | Malicious (score: 100) |
| DrWeb | Trojan.DownLoad3.28161 |
| ESET-NOD32 | Win32/TrojanDownloader.Small.AAB |
| Elastic | malicious (high confidence) |
| Emsisoft | Trojan.Downloader.JQDW (B) |
| F-Prot | W32/S-b8568f35!Eldorado |
| F-Secure | Heuristic.HEUR/AGEN.1102634 |
| FireEye | Generic.mg.433bb210ccc474a2 |
| Fortinet | W32/Waski.A!tr |
| GData | Win32.Trojan-Downloader.Upatre.BJ |
| Ikarus | Trojan-Downloader.Win32.Upatre |
| Invincea | heuristic |
| Jiangmin | Trojan/Generic.azrvz |
| K7AntiVirus | Trojan-Downloader ( 00457c511 ) |
| K7GW | Trojan-Downloader ( 00457c511 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=86) |
| Malwarebytes | Trojan.Downloader |
| McAfee | GenericATG-FKM!433BB210CCC4 |
| MicroWorld-eScan | Trojan.Downloader.JQDW |
| Microsoft | TrojanDownloader:Win32/Upatre.A |
| NANO-Antivirus | Trojan.Win32.DownLoad3.dgmrrz |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | Trojan.Downloader.Win32.Waski.G |
| Rising | Dropper.Generic!8.35E (TFE:dGZlOgPqI1TWNgPuNQ) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Mal/EncPk-ACO |
| Symantec | ML.Attribute.HighConfidence |
| Tencent | Malware.Win32.Gencirc.10b09a9d |
| TrendMicro | TROJ_UPATRE.SMAZ |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2013-10-30 18:58:20
PE Imphash
e836076a09dba03e4d6faa46dda0fefc
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x000003d8 | 0x00001000 | 2.018853001442933 |
| .rdata | 0x00002000 | 0x00000474 | 0x00001000 | 1.731690264021055 |
| .data | 0x00003000 | 0x00000014 | 0x00001000 | 0.036262711990452945 |
| .rsrc | 0x00004000 | 0x000001c0 | 0x00001000 | 1.0593330749615644 |
| .reloc | 0x00005000 | 0x000000b2 | 0x00001000 | 0.0 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_MANIFEST | 0x00004058 | 0x00000165 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library WININET.dll:
• 0x402050 HttpSendRequestW
• 0x402054 InternetSetOptionW
• 0x402058 InternetQueryOptionW
• 0x40205c HttpOpenRequestW
• 0x402060 HttpQueryInfoW
• 0x402064 InternetReadFile
• 0x402068 InternetConnectW
• 0x40206c InternetOpenW
Library KERNEL32.dll:
• 0x402000 GetTempPathW
• 0x402004 GetFileSize
• 0x402008 GetCurrentDirectoryW
• 0x40200c DeleteFileW
• 0x402010 CloseHandle
• 0x402014 WriteFile
• 0x402018 lstrcmpW
• 0x40201c ReadFile
• 0x402020 GetModuleHandleW
• 0x402024 ExitProcess
• 0x402028 HeapCreate
• 0x40202c HeapAlloc
• 0x402030 GetModuleFileNameW
• 0x402034 CreateFileW
• 0x402038 lstrlenW
Library USER32.dll:
• 0x402048 wsprintfW
Library SHELL32.dll:
• 0x402040 ShellExecuteW
L!This program cannot be run in DOS mode.
898k8k8Rich8
`.rdata
@.data
@.reloc
_3^@[VP
CVMQuPu
VSVuhL!@
tVVVVhX!@
0EPEVV4
_EPEPj S}
WEPj S
3VVVVS
u3VEPEPh
u+};}t
v)Yv>v4v
zv-Jv&&wPIv\?v
tAwt~tBJtu\t
InternetOpenW
InternetConnectW
HttpOpenRequestW
InternetQueryOptionW
InternetSetOptionW
HttpSendRequestW
HttpQueryInfoW
InternetReadFile
WININET.dll
GetModuleHandleW
ExitProcess
HeapCreate
HeapAlloc
GetModuleFileNameW
GetTempPathW
CreateFileW
GetFileSize
lstrlenW
ReadFile
lstrcmpW
WriteFile
CloseHandle
DeleteFileW
GetCurrentDirectoryW
KERNEL32.dll
wsprintfW
USER32.dll
ShellExecuteW
SHELL32.dll
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
/ c o m m e r c i a l / m r x 3 0 d . e x e
/ i d e v a f f i l i a t e / d o c s / x 3 0 d o t . e x e
g r o u p e s o r e p c o . c o m
b u l k b a c k l i n k s . c o m
h u m m y . e x e
U p d a t e s d o w n l o a d e r
t e x t / *
a p p l i c a t i o n / *
w i n y g . e x e
C : \ F u Z C e h A Z . e x e
C : \ G T K a D k E e . e x e
C : \ v z E C m D o Z . e x e
C : \ f s 9 i w z N 6 . e x e
C : \ 1 f c 2 6 c 5 2 5 4 3 1 f 1 b 9 f 3 d 3 0 f 6 a f a 9 e 4 5 e 3 3 9 9 c 8 f 3 0 6 e 7 5 f e e 7 b 9 e f 8 d 4 7 a a 6 1 4 9 e 7
C : \ n i _ D o M M I . e x e
C : \ 5 x 3 b s D E j . e x e
C : \ F G t M r N E S . e x e
c : \ a n a l y s e \ 1 5 5 6 3 2 6 0 2 8 . 4 0 9 1 1 2 _ 8 a a c e 5 8 9 - 8 4 3 1 - 4 4 c 1 - 8 e 8 3 - e b e e 0 5 6 b 3 e 9 1
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ D o z P y T M T . e x e
C : \ T t 3 Q 3 U 4 q . e x e
C : \ _ l J a O 3 J O . e x e
c : \ t a s k \ 5 F 2 5 B 5 D 8 2 F E E 8 6 C E 8 F 1 E A 4 9 F D 1 8 4 8 3 0 A . e x e
C : \ M I N 0 f L E 4 . e x e
C : \ 9 z 5 n l n y l . e x e
C : \ m H s u 4 q q 1 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ y V x X Y g D S . e x e
C : \ h Y c k P m B p . e x e
c : \ a n a l y s e \ 1 5 5 8 5 3 7 1 7 4 . 1 7 1 7 6 4 1 _ 0 2 1 3 c 4 f 1 - d 8 1 0 - 4 8 8 2 - a 2 b c - 8 b 0 8 a a e 5 f 3 3 5
C : \ B K j F U 1 R G . e x e
C : \ k R Y I d Y l r . e x e
C : \ t 3 k K h Z g 8 . e x e
C : \ 5 n C u K b N e . e x e
C : \ v B P x X 8 Y a . e x e
C : \ 0 0 d a 4 3 f 8 e 8 f 8 d 6 c 9 6 b f 1 6 b 6 7 e a a 3 c 1 8 6 c 5 7 e d c 4 4 e 4 1 b 3 1 0 4 4 b f e c 7 a a b e 3 2 b 9 7 1
C : \ U s e r s \ L i s a \ D e s k t o p \ d m U B t m l B . e x e
C : \ 8 9 3 c 2 e d f d 1 d 2 9 b 9 b 5 7 5 f 9 b 1 4 b 7 a 2 7 7 d 3 6 f 4 6 3 1 6 8 1 c e 4 3 5 9 1 b c a 6 c e b b b 6 a 3 f c 2 3
C : \ J 3 4 r v u u 7 . e x e
C : \ U s e r s \ J o e C a g e \ D e s k t o p \ q E b j E 1 u 0 p 5 . e x e
C : \ 7 3 2 8 e 7 2 9 5 d 7 8 d d 1 0 d 2 2 8 4 a 3 2 1 8 f d a f 0 e 0 7 d 7 b 2 1 9 8 3 f 4 d 3 1 a 9 6 6 e 4 4 2 9 3 b e b f e 0 9
C : \ 7 1 8 a 7 d 4 f 2 2 e 1 a 3 a a b 9 9 7 3 b c 4 7 2 c 4 b f f 9 4 6 a 8 5 8 a f f 3 b 5 3 0 7 4 c 8 d 7 f 5 1 b c 2 4 5 a d 7 b
C : \ f 8 2 e d 2 e b d b 4 f 1 9 7 b 7 2 3 5 f b e b 9 0 6 a f a 2 7 2 b 7 b a 7 0 b 1 3 1 6 f 6 1 d 1 c 1 3 d a 4 4 e 8 3 d f 4 6 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ x S R r A 9 C g . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 3 3 f 2 c 6 a c b 6 2 c 4 e a 0 a c 5 b f f 3 5 1 5 7 b 4 7 7 d 3 c a 0 e a 3 a 4 e 9 a e 3 b 4 c 0 d 8 a b a 9 4 1 5 6 7 c 0 9 . e x e
C : \ 0 2 7 6 c 7 9 a 3 4 0 1 f 9 3 9 c a 4 1 8 7 3 b 1 2 e 2 a 2 6 0 1 3 5 9 7 d f b 3 c 3 b 0 f 9 6 a b 5 2 3 a 1 a d e 0 0 7 5 7 3
C : \ b 5 8 3 2 8 f d 8 6 9 9 4 6 d c 9 a c c 7 4 8 3 f 2 5 1 b 4 5 f a 4 4 7 b 5 4 2 3 4 0 1 6 f a a 4 e c 9 6 9 7 5 f b e a 6 c 8 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ d 6 d d 1 2 6 c d 6 a a b 6 3 1 5 4 b 4 5 a b 8 9 d 2 7 7 3 c 0 0 0 9 8 3 4 e 9 9 f 7 0 f c f 6 2 5 8 9 9 7 c f 3 a 9 0 d 0 1 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ 1 7 f 7 4 f 3 6 5 2 1 3 5 0 0 1 9 0 5 b 1 1 6 f 5 4 e 6 3 1 c 3 5 b 7 6 5 e a 1 b b 8 3 9 1 6 1 3 6 f 8 1 1 e 0 e 2 2 7 b 6 0 1
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ L i m k d e I W . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 2 5 f b 0 1 c c 4 7 7 e c b 8 4 d c d 7 b 2 9 c 1 4 7 5 b b d e a 6 1 7 9 f 4 1 7 1 d 7 0 6 b b 8 d e d 8 7 e 0 b 4 7 7 a 9 a 6 . e x e
C : \ f 9 5 b e e e f 0 1 b c f a e 5 0 e 8 6 b c e 0 9 a 3 e b b 2 d 1 c 2 6 d a 8 0 1 b 2 e 0 3 9 7 a 6 b 6 b 5 b 6 9 0 0 0 2 7 b 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ e 4 e 3 8 0 b d b 6 b 7 d 3 9 6 d 0 4 1 f 6 b 4 5 d 6 7 1 e 0 d 4 6 b 8 f a 6 0 4 d 5 d 9 0 f 2 e 5 3 c 3 5 5 c 4 a e b 9 c 7 d . e x e
C : \ 5 5 8 2 c 9 3 3 6 7 a 3 2 8 e b 8 d 9 7 1 b 7 d 9 5 9 4 7 d 9 5 9 3 e 5 0 b 9 3 0 4 0 6 2 7 c e f d e b 8 7 b 9 7 6 3 e f f 2 5
C : \ U s e r s \ a r y a \ A p p D a t a \ L o c a l \ T e m p \ 2 e d 1 e 7 7 c 8 e 0 1 3 f a 0 5 4 6 a e 1 7 7 c 5 9 5 3 1 4 3 3 1 5 7 c 6 5 8 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ t t 9 A k V l 7 . e x e
C : \ 1 1 8 3 6 3 9 b a 8 f f a 1 d 4 f f a 6 d 9 d 6 d 5 d f 0 a 7 3 e 7 9 5 c d f 5 b b d 8 e 0 8 c 4 0 8 9 5 2 e a f 8 6 2 9 4 c 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ d B f n 1 n 9 9 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d 5 3 a b d 7 3 a 0 d d e 3 b 5 a e 5 4 9 7 e 7 a 4 3 9 5 8 5 2 3 6 8 c 1 f b b f d 4 6 7 9 6 0 d 8 4 f 5 3 8 b 6 b b 6 b 7 8 5 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 4 d c b c 3 8 b a 3 6 2 8 5 3 4 _ h u m m y . e x e
C : \ 5 a 1 d 0 f 3 2 9 9 b 3 6 f 4 c 1 7 c d f 3 c 6 9 6 3 5 1 4 4 4 7 e c f 6 b b f c d 6 5 4 4 a 9 d 8 f 2 c c c 5 0 f e 0 d 4 8 b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 9 c 8 3 0 2 f e e 3 3 f c 8 a 6 _ h u m m y . e x e
C : \ 7 6 a b e c d 0 3 0 3 d a 7 c c 5 e 9 0 3 5 9 4 8 8 1 d 5 3 d 6 a 3 9 6 2 c 9 3 7 c 1 8 8 3 f 3 5 3 4 6 4 e b a 3 4 2 2 f c 0 6
C : \ 5 8 2 4 d 8 0 8 f 2 0 1 2 5 9 f 9 d 3 a 8 5 4 4 6 c f 9 6 4 8 1 3 6 b 5 7 b 1 4 f 1 5 1 7 3 8 a c a 1 b e 5 4 d 6 4 6 e 2 a c 6
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ c G K J k I R n . e x e
C : \ 1 0 4 3 6 c 5 4 0 c 4 b 1 2 3 d 1 f a e 9 f 8 8 0 e 0 7 e 5 5 7 4 7 6 8 d f 3 1 a 0 6 0 1 7 3 3 6 e 0 c e 8 1 9 7 1 7 c b 8 0 f
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ h t O h r 1 o 6 . e x e
C : \ 5 7 9 2 a c 4 8 9 b b 2 d 2 4 1 6 f f 6 d a 8 6 2 f 3 d d 7 3 2 e 8 b 8 3 6 5 4 d 7 7 1 f 1 b 5 4 9 3 9 5 3 2 c 4 a 5 d 1 d b 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ 9 8 4 d 0 b f 2 0 8 1 9 8 0 6 c b a f c 0 2 9 c 5 b 9 4 0 0 f d 1 f 1 7 6 7 f 8 2 3 d e 7 5 6 d 2 d 7 5 e e c a 2 0 a 1 8 0 2 f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ e 9 0 0 7 8 a 0 9 6 9 9 8 8 d 4 f 6 e c e c e 5 0 b d 8 d a 4 7 6 d 0 e b 1 5 6 e d b 3 2 c 3 c f d 8 d a 3 8 3 c 3 4 d 0 c 0 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ 0 1 f a 4 6 4 8 9 b 4 f 6 0 a 3 2 e 4 d 4 2 2 c 2 c 9 3 3 9 8 9 0 5 8 2 c 1 d c 8 f 2 b c 4 a 8 9 5 1 5 1 f 8 b 7 6 d 7 5 9 0 1
C : \ 7 0 d 4 5 f d 7 0 e 7 c 6 6 e 7 7 9 d f 0 1 9 2 b c 1 5 1 b 5 d c 2 8 f e 8 d 9 5 a 2 0 0 4 8 5 c 5 0 3 0 3 8 b c a 3 2 5 2 7 e
C : \ e 9 0 8 a b 7 b 4 8 6 d f e b e 1 5 4 9 0 f d 8 a e 4 f 0 a 0 4 f a 1 d 6 2 7 1 5 2 0 a 4 5 6 a 9 2 7 8 f 3 0 d d d 8 5 c 5 0 d
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ 9 6 8 7 7 a 2 7 9 7 d 4 7 f 2 d e e 6 f 4 e 0 e 7 b c b f e 7 f d 7 2 b 2 c 8 9 e 9 6 9 e 2 9 3 8 9 9 c e 4 4 2 e 7 7 6 5 3 3 0
C : \ 4 b 5 1 c 0 e 3 e 1 5 c d b 1 9 a 6 c 3 0 5 b 1 7 5 4 8 6 a e 6 2 d d 6 f 5 3 7 0 8 5 e 6 c f 9 a e b 0 f a 2 8 6 9 b c 2 3 d 9
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ i D 1 N D M 4 y . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 8 3 2 b 9 b a b 4 b 4 5 9 8 a f f f f f 5 1 9 f 1 a 3 4 a 9 0 5 9 d 3 5 6 1 5 9 f e c b b 8 4 d 2 b d c 4 6 b b f c e d e e 4 3 . e x e
C : \ 1 f c 2 1 d 9 1 d 1 3 6 4 6 0 f 4 6 1 c 2 b b 0 1 8 1 1 5 b a a 6 5 d 4 7 f b 7 9 0 e 5 d 2 d c 2 5 e 9 a 2 0 b 8 5 c 6 d 0 0 c
C : \ 1 7 3 8 0 f d 8 b f c 1 2 a 5 e 7 d 6 e e 5 4 4 1 f 4 0 2 8 e 3 5 4 6 b 0 c e 6 c 3 4 e d 7 6 0 b 8 e 8 2 d f 8 2 c d 3 b b 1 8
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ s 4 M V p s c 4 . e x e
C : \ 6 a 1 6 4 9 e 6 0 4 f 3 2 b a 5 4 2 0 2 f c 0 d e 4 f b f 4 9 0 8 7 9 8 3 0 1 2 f e e 7 3 3 9 c 4 6 2 a e 4 a 5 6 9 e e 4 7 1 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ 6 a c c 7 d 7 7 1 9 b d b 1 d 9 3 f 7 9 5 1 5 9 f 8 d 5 1 2 7 e 5 4 d d 2 4 6 5 6 0 5 7 4 2 3 d 7 9 8 1 0 a 7 c 8 0 6 a e d 9 3
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ b e 2 6 1 3 8 b 9 9 4 a 7 a 7 b 4 7 6 f d 3 a 1 1 6 e a 0 b 5 5 1 2 f 3 0 1 b f f 7 2 0 e 9 4 5 2 4 4 a 3 a d 9 0 d 4 4 a 4 5 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ 0 3 6 6 f 3 e a 9 3 9 5 a 8 9 d 7 c c 7 1 5 5 c c a 0 e c b 6 4 8 5 3 8 c c 1 d 9 c 3 d 1 b 0 d b 0 2 2 2 6 e 2 0 2 0 9 0 e c 6
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a 2 2 9 5 1 8 4 1 1 b f 8 8 f 9 _ h u m m y . e x e
C : \ 4 5 b d 9 8 7 a 4 4 1 8 7 4 3 a 6 d 2 8 1 3 4 6 f d d 5 5 b 1 7 8 7 5 8 6 c b 0 c 6 9 f 6 b 4 7 9 4 c 5 5 d a d e 8 d e c 2 5 c
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ _ o P 3 5 M G i . e x e
C : \ 5 3 b 0 3 0 d a 0 7 1 d b 6 8 1 0 b 5 0 e 4 c 5 5 a 1 a f 2 4 4 0 9 f 5 f f 1 e 6 f 5 b 0 9 4 3 9 0 a 6 e e e 8 9 5 2 c 2 4 8 b
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ 8 1 4 0 e f 3 6 8 2 6 f 5 a 3 f c 4 0 0 6 a 6 1 c e 5 f 9 9 0 2 9 8 1 6 2 1 d 4 f 4 6 6 2 d 4 5 9 2 c 9 d c 2 b 5 1 4 7 6 6 d c
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 1 W P E M w d e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 0 9 4 d 1 3 0 b b 8 4 b 0 b b 6 b 1 f 3 e 4 c 5 5 8 0 5 5 d a 9 9 b c 0 7 8 b a f c 6 8 1 b 3 c 7 4 6 b 7 a 3 1 b a d 6 0 5 8 1 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ 4 9 8 7 1 7 0 2 8 b 0 5 2 c 8 6 0 b 9 5 1 5 8 f 5 1 a 9 8 d 7 a c 7 8 9 a e e 7 3 9 e f 8 c b 3 4 2 8 3 f d 3 e 2 5 9 6 6 e 7 2
C : \ U s e r s \ R A 4 9 1 ~ 1 . V U L \ A p p D a t a \ L o c a l \ T e m p \ f 0 8 3 8 8 4 a 5 d a b b 6 8 a d 7 1 b 2 7 8 e 9 d 4 9 f c 3 b . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ w H G F U x A 1 . e x e
C : \ 7 7 0 f 3 8 a 7 4 c 2 8 1 3 9 3 7 b e c 3 f d 8 e 6 c c d a 6 3 c 0 b 7 a 8 1 c e 9 1 2 f 6 7 a 7 0 9 5 2 e b a 1 3 0 f 3 6 9 3
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Q R O J C O B R . e x e
C : \ b 7 d c 0 a c 8 9 6 5 7 c a 6 9 c 8 1 d b 1 f c 6 d 8 1 f f f 2 3 1 e 4 6 e 5 a a 2 f b 7 2 b e b 9 e 2 6 f b 5 9 6 8 0 1 4 3 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Z w R 2 G a g 5 . e x e
C : \ 7 7 b 9 6 d 9 0 2 6 f 9 6 c a 6 e 8 0 c b 2 4 4 2 c 4 f f 3 2 8 b 1 1 4 5 6 8 2 b c b 9 e 6 d 9 5 6 1 e b c 3 3 f 0 a d 6 7 e 5
C : \ 7 5 2 b 5 4 f 0 b a 5 4 e 8 2 9 3 a c 7 9 8 e 4 7 a a 4 2 f 0 9 c 0 5 e e a b 9 0 2 4 4 a d f 3 7 b f 6 b f 3 d 6 b f f 5 0 b e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ y W 3 O R V 4 X . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ a 4 f b b e 7 4 8 2 2 8 c 3 a 1 3 0 a b 2 c 3 e 1 4 1 b b a e 2 e a b b 7 8 d d 2 e f b 6 4 b a e c c 6 f a 8 d b c 3 a f c a 0
C : \ 3 e c 6 d 8 8 6 1 b 5 9 e 6 1 e a 6 6 4 9 2 4 e 6 d 4 a 9 f 1 9 2 1 8 f d a d 9 f 5 1 5 6 e d 6 d 2 b 6 d 0 d 4 6 7 8 c d 8 d 8
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ d 3 6 e 7 4 d 2 5 8 8 a 3 3 a a 2 1 3 f 1 d 7 0 1 5 c 4 2 f 2 a 8 3 5 4 6 6 9 8 2 6 9 c 3 1 7 d 0 c a 2 8 4 4 1 1 d 9 3 e d 8 5
C : \ f a 1 b 5 3 f 0 2 8 6 a 7 5 2 1 e 2 8 3 a 2 3 b 1 1 1 6 5 1 a 8 a d e f e e 9 d b 4 1 f 7 b b b 7 4 7 3 0 0 7 e 2 8 f 7 3 e 6 c
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ C i B 0 4 5 B Y . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d f 7 0 5 a e d 1 f 3 8 1 f 8 4 0 b 2 1 1 4 a 7 5 a a a 4 0 d a f 2 d 0 0 1 3 e 8 3 6 6 3 f 4 9 2 0 7 0 4 9 3 8 e 1 8 e 7 2 4 a . e x e
C : \ u u M o 7 b n V . e x e
C : \ N X o k k 3 x b . e x e
C : \ a b c 0 b 3 4 a 6 9 2 3 9 4 c 4 4 8 9 f f a d 4 3 2 e 8 0 e f 2 6 e 2 a 6 9 1 6 8 0 6 0 b f 7 5 7 9 5 4 3 1 6 c 9 1 4 4 f b 1 d
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ i 4 a 0 U G 0 h . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ . p e 3 2 . e x e
C : \ 6 e 3 0 5 d 0 5 f 9 9 9 4 2 8 9 c 5 0 b 0 6 8 c e d c 8 d 8 6 f 1 5 9 d 8 b f 7 d 6 e f 1 d 8 2 7 e 7 b 0 7 d 4 e 1 6 e 7 a e 3
C : \ 9 d f 3 8 4 7 8 1 5 e 3 6 0 d a 4 f 7 5 0 c 4 9 f f d 4 0 7 c b 5 1 d 9 f c b 4 2 c f 8 0 a 7 5 0 6 0 9 5 4 f b 6 0 7 8 7 b 5 7
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ 3 1 f c 8 7 a 6 e 4 0 f d 7 6 3 c 8 3 5 c 9 7 a 0 a 5 c 2 2 e 1 6 8 8 6 2 d 9 4 8 7 8 3 7 3 d b d 5 4 7 0 3 9 d a 2 a f 7 1 c 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ D I X O 5 X f M . e x e
C : \ 3 a e 0 a 7 e f a 9 b 3 4 5 4 f 0 b 1 9 6 2 e 9 e e b d 5 8 7 a e 8 c 3 b f 6 8 c b 1 c 3 1 b e 0 2 6 e 2 d 7 8 4 c d 8 7 c c c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ C P A i 6 G E i . e x e
C : \ 9 d b 2 4 8 b f 2 8 d c 4 d a a 6 8 1 b 2 8 3 4 0 f f b 3 9 6 b 8 4 8 c 6 3 5 3 d 1 5 a 3 1 b 8 b e a 8 b 9 3 a c 2 6 f e c 4 d
C : \ c 6 9 a 9 0 f a e 5 d f 8 1 1 d 6 8 c 6 9 0 c c c 6 5 a 8 b 4 1 0 0 6 2 8 c e c 8 e 4 e 4 4 b 0 f c 2 8 8 a 1 3 2 1 3 1 d 3 d b
C : \ 2 a 0 c 9 5 2 d 5 b b b f 1 3 4 b 0 7 f f 6 5 9 b c f e 2 1 4 8 e 0 4 b 9 e b 3 4 0 e a 8 d a 6 4 0 3 c 2 b c 5 6 6 f 0 1 8 8 3
C : \ 6 2 1 4 5 0 6 8 4 d e f 9 8 c e a 4 5 b 8 5 3 d 0 e d 3 2 c c 2 3 2 f f 2 f e 7 1 a e d 6 6 4 e d c 0 2 8 1 4 f 5 9 b 4 9 2 6 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ a 5 f 3 8 c 5 f 4 f d 1 e e f c 6 3 4 8 e f c 6 0 e 1 5 a a 3 4 7 7 0 1 a f c 0 9 f b d 2 d a 6 9 4 4 7 6 b 3 4 8 3 d c 1 c c 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ 6 2 6 9 1 2 9 d 8 f 5 e 1 3 8 e 0 e 0 7 f 8 a a 2 b 0 f f 1 6 0 5 9 3 a f 7 1 0 f a 5 8 9 5 0 a d 1 0 b 2 8 0 6 3 6 f 1 c d c 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ U s e r s \ R A 4 9 1 ~ 1 . V U L \ A p p D a t a \ L o c a l \ T e m p \ f 0 8 3 8 8 4 a 5 d a b b 6 8 a d 7 1 b 2 7 8 e 9 d 4 9 f c 3 b . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ b 3 7 7 4 1 c e 5 d 4 3 e 5 2 1 f 9 0 7 d 3 1 a 7 8 5 6 f c f 3 6 f d a b 4 1 a c 8 d 0 5 2 4 f f 9 8 f e 1 8 1 f 0 f 0 7 3 f 9
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ f e 9 7 9 0 5 6 0 f 8 a d a c 1 8 e 8 0 9 d d 1 9 1 1 0 1 b a a 2 6 5 c 6 1 0 5 d 9 0 4 5 5 2 5 5 a d 0 b 5 2 c e 4 4 2 3 6 9 a
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 4 z T W 7 s Q M . e x e
C : \ U s e r s \ J o e C a g e \ D e s k t o p \ 3 n L E b N G K f r . e x e
C : \ b 1 4 6 c 2 b d 0 5 0 b 5 d 9 1 e 8 c 0 3 c d a 5 6 2 a 4 9 1 e 0 b 3 0 f 7 3 8 f 8 8 5 1 c 1 0 0 4 7 d 0 f 1 1 7 7 f 0 c 5 e 3
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ y M q Q 0 K u h . e x e
C : \ c 8 d c 3 a f 5 2 8 b 7 c 9 6 4 4 6 a 5 7 a 4 1 5 9 8 0 4 a c 8 e 2 2 1 d 8 3 c 5 a 3 d 4 f 1 8 a b b 1 e 8 4 4 e 3 5 6 4 d 4 1
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ C E m z j D w Q . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f i l e . p e 3 2
C : \ 8 2 7 1 0 b 0 9 0 d e 9 8 c 6 2 b 8 0 4 4 d d e e e 2 0 9 d 8 3 f f 8 9 3 7 b a 1 1 0 d 3 0 f 4 8 5 6 c 3 8 9 8 0 8 e 6 8 b 9 3
C : \ 7 a 6 2 2 e e b c e d 9 b 8 f b 1 1 0 4 f 3 5 b 7 6 c 6 a 3 8 a c 3 e 9 1 7 4 e a 0 9 8 9 f 6 c 8 2 2 4 9 2 2 c 1 9 2 9 2 3 4 a
C : \ 9 b f 8 9 c 9 a f b 2 b 5 0 8 0 b c 8 2 b c 3 8 6 5 0 3 f 8 c 4 5 7 7 6 8 b e 8 8 7 8 1 f e e 3 2 3 9 e 0 4 1 e e e 9 9 8 b c 9
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ z X j 8 d 5 P D . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f i l e . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ A O J V I S l s . e x e
C : \ 6 6 a 7 3 d b e c 5 6 3 0 d 2 7 f 9 6 b c b 6 e f e d 6 c d 3 4 d d b 2 a b 8 d 0 a e c 7 f 9 9 f 4 3 f c 7 e 2 1 d 7 d c d e c
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ t l 4 E z y 6 1 . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f i l e . p e 3 2
C : \ 8 d c a f 1 a 0 6 4 2 d 4 d c f c 0 9 4 f 9 d 4 b 8 4 d d e 4 4 4 e 3 c b 7 0 5 9 5 b a e 3 c c b e 7 e 5 8 0 b d f c 6 b f 1 3
C : \ 4 f 9 0 0 f 5 d c 6 f e f 1 d f b 9 d 7 7 6 6 4 6 d 6 8 8 b e a 6 c a d 0 0 0 7 0 0 4 5 9 0 8 0 9 7 9 5 b 9 9 4 6 1 b 3 b 5 a 6
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ U 5 Z o e D I d . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f i l e . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ M y E 9 A p Q T . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ f i l e . p e 3 2
C : \ 3 2 e 4 1 b c 8 9 4 d b 0 e 7 8 2 a 9 e 2 0 6 1 c 4 e d 3 6 1 7 5 1 c a 2 5 3 5 1 8 6 2 9 8 8 f 1 2 2 f f 8 c 1 d f c 4 2 e e 2
C : \ 5 8 e b 9 9 2 f 4 b 1 5 1 9 4 2 4 a 2 2 a b 5 7 c 5 e 6 e 0 f 8 0 e a 1 f 0 b 1 5 2 5 6 f 5 6 b 8 8 a a b 5 6 7 7 c b 3 e 3 b 8
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ l o i N n W Q O . e x e
C : \ 1 5 c c c d 0 e 5 9 7 e f c d f 7 b 4 6 1 d 7 3 2 2 b a 1 1 3 f 0 9 9 5 e 2 0 f d d 1 9 9 e d 5 3 9 a 3 8 c 2 4 0 d 4 5 8 7 6 5
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ O G D g c 3 3 m . e x e
C : \ p D c D Q N U O . e x e
C : \ b 2 h U x v 7 z . e x e
C : \ 9 a b s Z I i e . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ 9 0 2 7 b f 8 9 f d 8 0 a 2 e f 4 1 6 c . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ 7 4 7 e 2 4 4 2 c 8 4 e 2 8 9 4 0 c d c a 3 7 0 4 f a 7 b c 5 b 9 e 3 2 7 a 3 3 1 b d 0 4 d 7 a 0 6 0 b a 1 3 d e 8 6 4 e a 1 5
C : \ d 6 5 a c e 0 5 4 2 6 c 7 b a 9 f 7 9 d 6 0 2 b 8 8 3 0 1 a 4 f b 4 3 5 f 7 3 c c 2 1 4 9 d 4 4 8 6 5 3 3 7 c a 0 c 3 6 b 5 d 8
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ 2 d b d e 4 d 2 2 7 d 7 8 4 6 c 0 3 4 6 9 6 7 f 2 0 8 7 d 3 6 9 5 f f 8 a 9 a 5 2 f 0 8 d 8 d a 1 2 a e 5 3 c 6 1 1 7 3 d d 4 1
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ f b 0 2 e 5 7 7 f e b 4 5 5 e 2 6 6 1 d 1 4 5 0 d 5 b d 2 4 1 c f a 9 1 b 3 c f 8 2 0 8 9 a f 1 e 3 3 0 1 e 7 c a f 5 b a a 2 a
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ f 0 6 e 5 2 c 2 e 8 9 b 8 e 7 2 a 7 e c d a b a c 0 1 6 a b 3 1 d 4 e a 4 3 4 c 2 e 0 2 c 9 c 7 d 0 e 9 4 7 d 8 3 5 e 3 7 e 9 7
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com |
A 131.107.255.255
A 131.107.255.255 |
131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.