1.4
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.68
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Upatre-D [Cryp] | 20191222 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Waski.a | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20191222 | 2013.8.14.323 |
| McAfee | IStartSurf | 20191222 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b07883 | 20191222 | 1.0.0.1 |
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(1 个事件)
| section | .imports |
动态指标
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(1 个事件)
| section | {'name': 'UPX1', 'virtual_address': '0x00007000', 'virtual_size': '0x00002000', 'size_of_data': '0x00001a00', 'entropy': 7.2090034506255956} | entropy | 7.2090034506255956 | description | 发现高熵的节 | |||||||||
可执行文件使用UPX压缩
(2 个事件)
| section | UPX0 | description | 节名称指示UPX | ||||||
| section | UPX1 | description | 节名称指示UPX | ||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 60 个反病毒引擎识别为恶意
(50 out of 60 个事件)
| APEX | Malicious |
| AVG | Win32:Upatre-D [Cryp] |
| Acronis | suspicious |
| Ad-Aware | Gen:Trojan.Ipatre.1 |
| AhnLab-V3 | Trojan/Win32.Upatre.R261778 |
| Antiy-AVL | Trojan[Spy]/Win32.Zbot |
| Arcabit | Trojan.Ipatre.1 |
| Avast | Win32:Upatre-D [Cryp] |
| Avira | TR/Crypt.ULPM.Gen |
| Baidu | Win32.Trojan-Downloader.Waski.a |
| BitDefender | Gen:Trojan.Ipatre.1 |
| BitDefenderTheta | Gen:NN.ZexaF.33556.dqY@aqqdcWhi |
| Bkav | W32.AIDetectVM.malware1 |
| CAT-QuickHeal | Trojanspy.Zbot.8657 |
| ClamAV | Win.Downloader.Upatre-5744092-0 |
| Comodo | Packed.Win32.MUPX.Gen@24tbus |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.40d64a |
| Cylance | Unsafe |
| Cyren | W32/S-44ff66f0!Eldorado |
| DrWeb | Trojan.DownLoad3.28161 |
| ESET-NOD32 | Win32/TrojanDownloader.Waski.A |
| Emsisoft | Gen:Trojan.Ipatre.1 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/S-44ff66f0!Eldorado |
| F-Secure | Trojan.TR/Crypt.ULPM.Gen |
| FireEye | Generic.mg.45d542240d64a874 |
| Fortinet | W32/Kryptik.GQIX!tr |
| GData | Gen:Trojan.Ipatre.1 |
| Ikarus | Trojan-Spy.Zbot |
| Invincea | heuristic |
| Jiangmin | TrojanSpy.Zbot.eeim |
| K7AntiVirus | Trojan-Downloader ( 004b972f1 ) |
| K7GW | Trojan-Downloader ( 004b972f1 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=86) |
| McAfee | IStartSurf |
| McAfee-GW-Edition | BehavesLike.Win32.PWSZbot.qt |
| MicroWorld-eScan | Gen:Trojan.Ipatre.1 |
| Microsoft | TrojanDownloader:Win32/Upatre |
| NANO-Antivirus | Trojan.Win32.Zbot.czktya |
| Panda | Generic Malware |
| Qihoo-360 | HEUR/QVM19.1.0CBF.Malware.Gen |
| Rising | Trojan.Waski!1.A489 (CLASSIC) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Dropper |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Mal/Zbot-QL |
| Symantec | ML.Attribute.HighConfidence |
| Tencent | Malware.Win32.Gencirc.10b07883 |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
1992-01-17 12:30:14
PE Imphash
120333c7f5efe2cf1ca4b387c2c6ca58
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| UPX0 | 0x00001000 | 0x00006000 | 0x00006000 | 2.57189557917262 |
| UPX1 | 0x00007000 | 0x00002000 | 0x00001a00 | 7.2090034506255956 |
| .rsrc | 0x00009000 | 0x00002000 | 0x00002000 | 3.7808033053841013 |
| .imports | 0x0000b000 | 0x00001000 | 0x00000200 | 4.310025885684905 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x000090ec | 0x00001ca8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_STRING | 0x00006db0 | 0x00000060 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x0000ad98 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library KERNEL32.DLL:
• 0x403018 HeapAlloc
• 0x40301c GetProcessHeap
• 0x403020 LoadLibraryW
• 0x403024 GetModuleHandleA
• 0x403028 CloseHandle
• 0x40302c GetCurrentThreadId
Library COMCTL32.dll:
• 0x403000 ImageList_Add
• 0x403004 None
• 0x403008 ImageList_Create
• 0x40300c ImageList_Destroy
• 0x403010 ImageList_AddMasked
Library USER32.dll:
• 0x403034 PostQuitMessage
• 0x403038 GetMessageA
• 0x40303c DispatchMessageA
• 0x403040 TranslateMessage
• 0x403044 CreateWindowExA
• 0x403048 RegisterClassExA
• 0x40304c DefWindowProcA
• 0x403050 SendMessageA
• 0x403054 SetWindowTextA
• 0x403058 GetActiveWindow
• 0x40305c TrackPopupMenu
L!This program cannot be run in DOS mode.
qHy'q&
qHy%q!
qHy#q&
qHy$q&
qRich'
.imports
^YQVVD$
tRVW|$
)+_^][
PjuhZ\
fold.html
userDefine.currenP @
@@@@@@
3PQPVj h
SWAVAf9
;wME;r
@@@@@@
@@@@@@@@@
P+5$0@
BBBBUE
tF]%L0@
AK}h'E$pJb
_Te=Bk}w.E9fKkn
rhb}n;13vKk
T"zKhXv-
i.f}{*E9fKij
Yn{~2E$vaiFn;r8vZO
D%DfwaH;
EV}Kbci;]V}Kbj~
r;T#v.M/
:GrQSZ
<DM{1BQeMmBC.
DM{A%J%C]
p\YVSM[
dM{GrU
^+zO.2
O@,1Vy
DGrYSZ
rAM[;GR1o[0
R{[mSz
;kS(|oBTDVB
$+BPg:@.
|cyV"X
1VJ1S-c
FC9kW'zA
lJ:.pl4;T/=V"
VcBf`5tK#|I7f{9
?Rx|.t
fqs&J_
:,F$l{|r
X+PQyY
nectarine
name please
plucklife
somnolent
static
RichEdit
button
trigeder
reelese
welation
tinits
hidelism
@@@@@@@
HeapAlloc
GetProcessHeap
LoadLibraryW
GetModuleHandleA
CloseHandle
GetCurrentThreadId
ImageList_Add
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
PostQuitMessage
GetMessageA
DispatchMessageA
TranslateMessage
CreateWindowExA
RegisterClassExA
DefWindowProcA
SendMessageA
SetWindowTextA
GetActiveWindow
TrackPopupMenu
`.rdata
@.data
tDi69;8sm%
N<u?F8b
QUR/Q=X
s4>)s\KFGW<
{M+<RJ#Z
8%+3}_k.8U
o@s{>sjY
|@L_0/
AURu .P0
|w{I_5B
fold.html*userDefine.curr P
QM;H:j h-
hn hF0h15j
7m7@j1Ag#
EWAVAf9
,,B?pN$
QHc 6N
<k2]kW
Nbc;u*
FGF*3<6@_G,}Ad
`@w`:Q
A8u{4Bx
tF]V%L&
(*,`i.0
4:<?@SBm
JB? guHDs
'ZWAK}h'E$pJb
_Te=Bk}w.;9fKkn
T"zKhXv-_V
i.f}{*_ij
Yn{~2E$aiFr8
D;DfwaH;
E}Kbci;
r;T#v.M/
+Lt+0>
:GrQSZ
<DM{1BQeMm
d&Jon-\S;
pk.no!
HO_~{Yd
C'?^+zUO.2
YUYtM/I\
yw@S?.
;#(S\eO'
QorAe;o[0
&JcY/i;2X
R{[mSz
x[u';kSo
S|oBTD?B
PSR+BPgv
'J1S-c
FC9kW'zA
OwCr&6s3[
s51QhzBY=c
OglJ:p
Jl4;Gg/=V"
VcBf`5tKj
|I7f{9
?Rx|.tk*k
fqs&J_
,F$l{|r
!vZ$K}$
Mtfs3% /5e L
o-Uy!ue3
e;elPKbM
!s5c4#spsMdL6 w]b
:3&dd2LL&
/Qnectari
name pleas
ucklif
somnolo5
casshi6hBo{sm
&8_elI2M[
u3oTei
HeapAllocGetPr
LoadLibrm?aryW
ModuleHand
CO$tTh
8IditvdImageJst_Ad
ty6MaskeT
4P}tQui'mf3
D6pW2vch
Tnslk0wYzWiowEx"Regm
TextAAc{;
tivSsckpup4_pnuPEL
[xC`.rda
Kq"'Osrm%
GPGWHU
XPTPSWXaD$j
YT&!XT
30302/
/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"*
, 1#1#1#1#1#1#1#1#/"1#1#1#1#/"/"/"1#1#1#/"1#1#1#1#1#1#1#1#1#1#,
.!2$2$2$2$2$2$2$2$2$2$2$2$ia2$2$2$2$2$2$2$2$2$2$2$2$.!
0"4%4%4%4%4%4%4%4%2$2$3$4%pg4%4%4%4%4%4%4%4%4%4%4%4%0"
1#5&5&5&5&5&5&5&5&5&5&ri5&5&3$3$4&5&5&5&5&5&5&5&1#
3%7'7'7'7'7'7'7'7'L=
7'7'7'7'7'z7'7'7'7'7'7'7'3%
5&8(8(8(8(8(8(8(8(8(bW8(8(ul8(8(8(8(8(8(8(8(8(8(8(8(5&
7'<,<,<,<,<,<,<,<,bX<,bX<,<,7'7':+<,<,<,<,<,<,<,7'
;+B2B2B2B2B2B2B2B2B2{rB2B2
B2B2B2B2B2B2B2;+
B2G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7B2
I9L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;I9
O?nbnbnbnbnbnbnbnbnbnbmcmcmcmcmcmcmcmcmcmcmcmcmcmcmcmcmcmcmcmcO?
COMCTL32.dll
KERNEL32.DLL
USER32.dll
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
GetMessageA
KERNEL32.DLL
HeapAlloc
GetProcessHeap
LoadLibraryW
GetModuleHandleA
CloseHandle
GetCurrentThreadId
COMCTL32.dll
ImageList_Add
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
USER32.dll
PostQuitMessage
GetMessageA
DispatchMessageA
TranslateMessage
CreateWindowExA
RegisterClassExA
DefWindowProcA
SendMessageA
SetWindowTextA
GetActiveWindow
TrackPopupMenu
r o g r a m i s f r e e s o f t w a r e ; y o u c a n r e d i s t r i b u t e i t a n d / o r m o d i f y i t u n d e r t h e
e r m s o f t h e G N U G e n e r a l P u b l i c L i c e n s e a s p u b l i s h e d b y t h e F r e e S o f
K e r n e l 3 2 . d l l
R i c h e d 3 2 . d l l
P a n e 1
P a n e 2
S t a n d a r d
C u s t o m i z e . . .
C : \ s a m p l e . e x e
C : \ 6 6 9 a 7 d 0 5 b 3 4 a 2 b e 8 b 8 0 8 f 2 d c 4 4 6 b f 9 5 7 e 1 e e 8 8 9 4 0 d a c e c b d c 1 9 a 7 b e 6 b d f 4 7 1 e 2
C : \ A a q G J R L X . e x e
C : \ 5 J j d h b X w . e x e
C : \ s 8 Z N n W V E . e x e
C : \ G Y z H U h t X . e x e
C : \ W H R q x g 6 5 . e x e
C : \ l E b t F 0 R 1 . e x e
C : \ J I V i x O e X . e x e
C : \ e 6 d 5 5 c a 7 4 6 6 a a 3 2 2 9 1 0 2 7 8 0 b b e 7 f 2 1 9 5 a 8 6 c a 6 1 d e 1 3 e 9 4 e f d 4 2 c a b c c 0 4 0 0 9 1 e 9
C : \ 7 8 9 e d c 6 5 c 3 5 0 f e 2 8 d e f a 5 8 2 3 5 9 8 f c f d b 8 4 c 9 6 d 2 a 1 7 c f 4 8 2 0 3 9 7 a 3 c 7 f 1 a a 5 f a a 1
C : \ B E 0 y x W Y c . e x e
C : \ 9 v _ d 0 8 O C . e x e
C : \ K 2 2 1 S k 8 E . e x e
C : \ f x S 0 6 R M h . e x e
C : \ 8 T G W x g O F . e x e
C : \ O X D Q W c Y a . e x e
C : \ p L 7 l R X Y z . e x e
C : \ D g l 4 C r t j . e x e
C : \ M 9 b Z 5 M Z H . e x e
C : \ I J K B U g G S . e x e
C : \ 5 R o D J U y Z . e x e
C : \ K B N 5 o t O X . e x e
C : \ j W H S 1 G v E . e x e
C : \ q X b B n x I 7 . e x e
C : \ 3 t h v 2 1 \ q v n 3 2 p . e x e
C : \ G G m O d y c Y . e x e
C : \ d 0 7 c 0 2 6 1 f 1 1 e f 0 0 8 1 6 a 1 1 b c f d b e e 5 7 b e a 4 6 e 0 1 0 1 d 0 e c a f 0 1 3 b a d 1 d 3 5 3 9 a 9 0 5 c 0
C : \ 3 6 3 b 0 3 7 7 6 7 7 2 c c 8 a d d 7 d d b 3 d 1 b f 6 c 9 b d 6 e 1 a 6 8 b 0 a 0 7 c 5 0 b f 1 f c 4 5 d a f 3 a 0 5 2 0 7 e
C : \ 8 0 5 6 e e c a 1 a e d d f 1 2 5 e 0 e 0 a 8 5 0 f e 9 5 2 9 2 8 e 7 7 8 8 6 4 7 5 2 9 9 2 f a a a b 2 e 7 2 a 6 f b c 9 c b 8
C : \ 4 4 b e b a 0 c d 2 3 b 7 7 2 5 5 7 b 1 f d 4 9 a 6 7 a 8 9 1 5 0 4 d 1 c 4 f 7 2 f 5 f 1 1 e 8 6 4 d 8 d f 2 0 1 d 6 d e 6 6 4
C : \ U s e r s \ L i s a \ D e s k t o p \ P s a K k 3 J 9 . e x e
C : \ 9 9 7 f 7 2 6 7 d 7 d 6 5 8 1 1 7 7 0 f b a 7 a e 3 f 9 0 f f 4 f 6 a 2 1 6 0 a f 2 4 5 2 a 3 c b 8 8 1 a c 4 e 7 7 c 9 b 5 a 2
C : \ 1 9 b 1 b a 5 5 2 9 6 4 c e 2 d 1 0 f 1 c 5 0 2 5 3 3 b c 8 6 5 e c e e 0 8 5 e b 6 3 b 3 3 4 2 4 b 2 3 f 1 b 5 2 4 2 d 4 4 1 3
C : \ U s e r s \ L i s a \ D e s k t o p \ g i b 6 7 n M Q . e x e
C : \ 2 c 0 d b 0 e 5 7 9 1 6 3 b 9 a 3 6 6 f e 8 6 9 c 8 4 f 7 4 2 3 0 7 a 8 1 6 2 3 4 8 f f 4 1 2 f e 3 f 3 0 b 5 5 d 4 7 f 3 8 a 7
C : \ U s e r s \ L i s a \ D e s k t o p \ N S h n I j v f . e x e
C : \ a C n Q D T e z . e x e
C : \ c 3 b 3 0 0 e b 8 6 9 8 a 0 e 0 b 1 9 d 8 5 1 0 2 e 2 3 f b 9 7 a b b 2 7 5 1 3 0 7 3 7 3 a 4 c 4 d d 3 6 a c 5 4 b d 6 b 4 3 6
C : \ O W q 2 p 3 i z . e x e
C : \ 5 4 d 0 7 8 8 d 8 6 e c b 9 a e 7 d 1 9 3 2 7 8 b b 8 2 3 d e e 0 e 8 0 7 7 0 2 b 4 4 e f c 1 0 c 3 e 5 b d b 7 8 c d 9 4 5 d 8
C : \ f 5 2 4 7 f 7 8 d f 2 a 4 8 2 d e 3 8 b 3 0 c 2 c 1 8 b a 4 7 4 0 5 f d e 5 c 8 a e 8 e b c 3 a d 7 e c 9 4 1 d 1 3 e 3 1 a d 3
C : \ 9 b c e a e 9 7 4 7 7 c c c 3 4 2 e 4 6 1 9 3 d 0 2 2 9 3 5 a d 5 f b d c 9 9 c d a 5 d 9 e 4 d 4 3 a 2 0 c e e 3 1 3 c b 5 d 5
C : \ U s e r s \ L i s a \ D e s k t o p \ g 8 h F u y 0 r . e x e
C : \ U s e r s \ J o h n n y C a g e \ D e s k t o p \ w 8 D P 2 4 M z F Q . e x e
C : \ U s e r s \ L i s a \ D e s k t o p \ D B s 9 H u l Y . e x e
C : \ v 6 1 R e j q A . e x e
c : \ t a s k \ 6 9 3 0 0 0 2 8 2 B F C 8 3 D A 4 4 F E 7 A E 5 7 A 5 0 C E 6 F . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ D Q m 7 Y x O h . e x e
C : \ 2 7 4 3 2 3 1 6 3 5 0 d 6 c 5 4 6 b 7 5 3 c 8 8 c 3 1 b 9 5 b 4 7 8 d 4 6 9 4 7 b 1 8 8 7 3 9 9 b a 0 7 7 2 a c 4 5 5 e 8 2 8 a
C : \ 7 7 b 4 c b 4 5 f 1 b 3 d a 3 2 0 f 2 0 e a 6 9 d 2 8 7 9 4 0 9 6 f 4 f 7 2 7 c f 3 5 0 b 9 6 c 8 4 6 b 0 1 0 d a 3 6 1 e f 2 d
c : \ t a s k \ 3 5 2 7 9 C 3 5 9 E 9 7 E 2 A 1 4 A 6 C C 1 5 8 F 4 8 5 B A 8 3 . e x e
c : \ t a s k \ 8 8 2 8 F 1 6 9 2 D B 9 9 D 9 B 3 A 1 8 A 5 F 2 D 7 0 C E 2 8 9 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ a f e 4 4 7 b c 8 0 e b f 1 f 2 d 5 f 5 f 3 4 7 1 3 c 4 2 4 9 5 1 a f 2 1 2 e 7 b b 3 e 6 4 1 7 6 2 c 8 8 5 3 7 d d 8 7 c 8 9 6
C : \ 6 1 5 8 7 0 2 f 5 c 2 d 3 4 0 8 1 1 d 5 1 3 6 e 7 0 2 c d 6 f a 8 4 a a b a e 9 d 8 8 8 1 f 5 d c 4 4 b 8 5 a f f 6 9 1 1 8 b e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i n v o i c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w s a c e . p e 3 2
C : \ 5 e 7 a c d 9 4 2 6 f b d 6 b 8 1 a c 8 2 2 1 6 3 2 6 0 0 7 1 a 7 3 7 3 d c 8 8 f b f c c 9 b e 2 f 3 6 3 b 2 e 3 9 3 3 0 a 2 7
C : \ E r 6 t s d 1 j . e x e
C : \ 6 d 7 1 a 0 9 3 c 0 d e 0 0 7 3 a 5 c 3 9 b 9 d 4 e f 7 9 9 2 e d d f 6 7 8 2 f e 9 e 9 2 a d 4 3 0 8 e b d 3 3 3 1 2 2 a b 9 7
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ q c S X n E m B . e x e
C : \ U s e r s \ J o e C a g e \ D e s k t o p \ h D m w X i N 9 S T . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 5 5 e 4 e b 4 8 3 9 f 6 b c c e 0 3 e 5 5 6 2 7 2 8 a e 4 c 2 . v i r u s . e x e
C : \ 3 7 5 7 5 9 c 9 1 b 9 7 a 1 a f d 2 5 d f 5 b 0 4 0 4 0 4 a a 3 1 c a 4 c 1 5 7 7 1 d e c e 7 8 6 a 1 4 6 9 0 6 d 9 4 d f 9 8 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w s a c e . e x e
C : \ e 4 4 0 e 3 6 b 0 f b 7 3 7 e f d 0 c 8 c 4 4 d 9 a 7 d 4 5 6 c 6 c a a e 4 9 9 8 7 b 4 7 8 f 2 5 2 f e c 2 0 a 2 a c 9 e 9 3 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w s a c e . e x e
C : \ 8 6 5 2 3 d 1 5 b 3 f a a d b 5 9 5 9 7 f 3 a 6 2 9 7 5 5 1 a f 3 5 e a a a b 3 f f f f 7 5 2 2 6 2 2 c 4 8 1 e 6 6 0 4 e f c 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w s a c e . e x e
C : \ b f 9 0 1 7 5 1 f e a 8 2 e 4 0 b 4 d e f c 5 e 8 f 8 b 5 a 3 e e 8 9 0 1 e 6 5 6 d 1 c a a 1 1 4 7 0 1 9 e d 7 3 d 3 f d 9 a 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w s a c e . e x e
C : \ 0 5 2 a f d a c 3 e b 7 8 e d b f 5 5 e 5 4 6 b 1 c 1 3 e 1 c 0 0 0 7 6 2 c e 4 1 2 7 6 8 1 b 1 6 5 c 5 f e c f e 7 6 7 1 f 8 9
C : \ 3 4 b b 3 e a a 1 e e 5 f 8 8 3 d 4 3 3 7 6 d 5 8 8 4 a 2 f 9 a 2 d 8 6 5 f e b c 6 f 6 b d 6 7 5 f e 2 a 3 8 4 5 c a f b b b d
C : \ b 6 f 0 9 e e 2 e f 9 8 b 7 8 4 a c c 0 5 c f d 8 b a b e 0 5 0 c b e 1 3 b e 0 6 2 f e 1 8 4 4 a d a 6 7 c 1 e d d a 0 0 6 e a
C : \ 0 7 8 d 7 7 d 9 5 1 a e 1 2 d 8 7 d 9 e e d f 9 3 0 c 5 a 6 8 3 5 b 6 8 0 7 a 8 6 d b b 9 b c 6 a 9 d d 3 d a b 4 c 4 c 3 9 f 9
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w s a c e . p e 3 2
C : \ 1 0 3 e 2 6 b 0 3 0 f f e 7 9 9 5 b 7 d 1 3 8 3 1 f b 3 a d 2 8 7 8 8 b 8 2 a e 6 d 6 f f 3 a e 7 d e 7 4 5 e 9 1 2 5 d f 1 d 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w s a c e . e x e
C : \ d f b e a c 4 a 3 0 8 6 8 d 1 3 d 0 8 b 6 9 e 3 b 9 5 6 5 f 1 c e d 0 a 2 a 9 a e 5 9 e d 3 6 a c b 9 4 c 6 8 5 b c 8 1 6 8 c 2
C : \ f c 6 b 8 c e f 3 3 4 6 3 8 0 7 e 3 c 8 c 6 9 e 8 8 4 4 4 2 0 8 7 b d 7 d 7 b e c 1 0 8 b 1 b 5 6 c 9 f 4 0 e 7 a 7 b 1 e c 0 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w s a c e . e x e
C : \ 5 e f c 0 0 e 8 9 2 e a d 5 f f f 9 6 9 c d e d 7 e a e a 3 f d e 3 4 2 f f a 1 8 f 8 1 5 9 5 a 0 e 2 7 e 3 6 3 8 1 7 1 5 a 5 3
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w s a c e . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d c c e 8 f f d 1 0 9 8 b 7 7 5 _ w s a c e . e x e
C : \ 9 5 e b 2 8 5 1 4 b e 2 e 0 2 8 f 0 a f 0 f 1 3 4 5 b 9 a 6 c d c 6 0 1 f f 3 6 3 2 0 5 c f 5 3 1 2 1 7 f a 8 5 7 3 9 4 1 6 6 6
C : \ 8 3 e 3 5 1 c d b 6 7 7 c 3 a e 0 6 c 1 5 2 8 2 8 7 f a 7 3 c f 0 7 0 8 2 f f 7 6 5 8 f 6 1 c 3 b b f e 8 a 8 d 9 b e a 7 a 7 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w s a c e . e x e
C : \ b 6 a a 3 5 4 0 6 0 6 f 5 d a 5 a a 1 2 7 7 4 8 f 6 4 6 1 c 8 3 8 9 b 6 a 1 3 7 4 1 a 7 0 b 7 b a 0 6 f 9 5 6 e e f b e 4 e 6 3
C : \ 1 5 4 0 3 c f 5 c 6 d 4 5 b a c e 8 d 2 1 9 a 1 a d d 8 1 2 a a 6 5 0 f a 9 0 3 e 7 b f a 5 d 5 9 8 1 2 b 4 0 6 d 8 e 9 f 4 7 f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w s a c e . e x e
C : \ 5 a 6 0 5 5 f 5 9 7 5 4 1 d b 0 3 7 d 5 a d 8 4 b 1 7 0 c 0 8 0 3 0 4 f 8 5 f 2 2 5 3 5 d f 8 1 e d c 1 3 1 9 e a 2 2 5 0 c 1 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w s a c e . e x e
C : \ e 8 e 2 5 5 6 9 d 8 7 0 0 5 8 5 a 3 a 8 7 f 9 a 9 c a c 3 4 d c d e 3 b 6 b a e b 3 f 0 7 d 0 9 a 2 0 9 e 7 f 9 1 d c e d f b a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w s a c e . e x e
C : \ 7 0 c a 5 8 0 4 c e 0 6 0 b 7 3 5 4 3 b a 0 e d c 2 1 2 d f 6 3 d 2 2 0 2 a 7 0 0 1 0 4 5 8 1 a d e 2 c 1 0 8 0 3 d c 4 3 f 6 2
C : \ e f 4 9 6 f 9 0 e 4 1 8 7 6 e 3 8 a 3 a 7 e 9 8 0 f c 2 a 8 c 9 f 2 0 2 f 3 c 7 0 a b 9 e a f 0 3 7 8 c d 3 0 5 0 8 0 5 f 0 7 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w s a c e . e x e
C : \ 4 d b c 2 9 2 2 a c 6 b b b 0 8 a 1 3 6 2 d 2 d c c 2 4 8 f 9 f 1 9 d a c d b 4 5 9 b e 3 c 2 c 6 5 6 e 4 5 e 2 0 f a 6 1 d d d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 4 9 1 4 2 1 4 f a 6 6 0 9 9 f 9 2 6 0 e 3 c b 4 1 a f f 2 d e d . v i r u s . e x e
C : \ f 1 f 7 b 5 7 8 9 3 a d 8 8 b 5 c b 8 f 3 6 a 2 6 0 4 e 6 6 9 2 e 2 1 9 0 3 0 c d a e 7 2 7 1 a d 8 d a 7 9 9 5 f d a a 4 8 d e
C : \ 2 f 8 6 3 0 9 b 8 6 9 9 2 f 8 a b 4 0 d c 9 d a a a e b 8 9 6 b 5 3 e f 7 4 7 8 0 1 d c e f c 9 c f 2 6 5 b 5 2 b 7 0 b b 8 7 6
C : \ 2 4 d f 3 c 7 5 0 c 1 6 c 6 0 3 5 8 1 f 4 f 5 1 1 7 8 9 c 6 f 7 8 c 9 7 9 e 4 5 8 9 5 5 9 0 d f 6 7 7 6 7 0 f d 0 3 c 1 7 4 a d
C : \ a 1 5 f a 0 5 e b b 1 0 0 d 7 0 4 d 5 a 4 6 e 7 0 d d e f b 6 e e 6 4 3 b 3 e b 5 7 7 4 f 7 0 b 3 d 9 2 6 e c a 0 7 5 9 4 5 d 8
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w s a c e . p e 3 2
C : \ 1 8 e 8 8 b 3 c f 3 f 0 9 d a b 0 1 3 2 a 5 d 3 1 e 3 0 6 0 4 7 d 8 9 d 7 6 d f 5 e b e a c 2 9 1 9 e 2 c 4 1 7 8 2 e a d 6 3 9
C : \ 2 e e 8 6 5 2 d 1 4 8 7 3 5 c 6 e 5 e 0 f 8 e 7 2 3 e 9 6 3 f 0 8 9 d a a f 0 d 6 0 6 8 c 7 1 9 d 7 0 e 1 1 d 6 c d 8 9 5 5 9 6
C : \ 1 4 7 9 d e d f 9 e a 2 1 1 e 5 f b 6 e 5 f 9 c 3 7 0 b 8 2 d d 8 c 8 1 6 2 1 9 9 0 2 f 4 7 4 a 1 5 d 4 8 4 1 7 3 b d 2 7 2 f 7
C : \ 5 2 c 5 f b e f e b 0 b f b 4 6 5 2 d 9 b 8 c 6 9 e b b 0 d 0 8 c 3 2 5 d 0 8 d 8 1 4 8 7 0 0 1 6 d d 1 d e e 2 f 3 4 b d 3 b f
C : \ 1 e 0 d 6 4 9 8 8 b 8 b f 6 8 1 c 8 8 c 8 8 f a 8 7 d 2 4 4 0 e c d 6 6 3 e c e 4 e 6 2 1 b 0 8 b 6 8 1 6 f f e 1 2 f 0 3 0 c e
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.