2.8
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.58
MFGraph
0.00
反病毒引擎
未检测
暂无反病毒引擎检测结果
静态指标
动态指标
提取了一个或多个潜在有趣的缓冲区，这些缓冲区通常包含注入的代码、配置数据等。
分配可读-可写-可执行内存（通常用于自解压）
(6 个事件)
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\budha.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\budha.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\budha.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
网络通信
一个或多个缓冲区包含嵌入的PE文件
(1 个事件)
| buffer | Buffer with sha1: 4cfc623a6f5439c5ec1c9403c98bbf50971a705b |
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
生成一些 ICMP 流量
连接到不再响应请求的 IP 地址（合法服务通常会保持运行）
(1 个事件)
| dead_host | 162.241.24.59:443 |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2005-05-24 21:02:47
PE Imphash
d5f816a33d9d1b53674d94bcd201ba83
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00000a38 | 0x00000c00 | 6.057660666849108 |
| .data | 0x00002000 | 0x0000202e | 0x00002200 | 5.348765660252148 |
| .idata | 0x00005000 | 0x00000394 | 0x00000400 | 4.056905800728207 |
| .rsrc | 0x00006000 | 0x00001768 | 0x00001800 | 4.394398125356529 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x00006130 | 0x00000ea8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x00006fd8 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_VERSION | 0x00006fec | 0x000001e8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x000071d4 | 0x00000193 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library user32.dll:
• 0x4052d4 GetMessageA
• 0x4052d8 DefWindowProcA
• 0x4052dc PostQuitMessage
• 0x4052e0 LoadIconA
• 0x4052e4 RegisterClassA
Library kernel32.dll:
• 0x4050d0 GetModuleHandleA
• 0x4050d4 GetProcAddress
• 0x4050d8 CreateEventW
• 0x4050dc HeapCreate
• 0x4050e0 HeapAlloc
• 0x4050e4 ExitProcess
• 0x4050e8 FreeLibrary
• 0x4050ec GetLastError
• 0x4050f0 GetTickCount
• 0x4050f4 CloseHandle
• 0x4050f8 DeleteCriticalSection
• 0x4050fc WaitForMultipleObjects
• 0x405100 Sleep
• 0x405104 InitializeCriticalSection
• 0x405108 SetEvent
• 0x40510c TryEnterCriticalSection
• 0x405110 GetPrivateProfileIntW
• 0x405114 GetPrivateProfileStringW
• 0x405118 GetDiskFreeSpaceExW
• 0x40511c GetUserDefaultUILanguage
• 0x405120 GlobalMemoryStatusEx
L!This program cannot be run in DOS mode.
.idata
gigigigi
z0/2/O
++r+r++2++Q
gaggif
Ob/ghg}~D$
f?MZue
W<f:PEuYUBx
?ko@Bb"
W3rN+,
KJn83%
hUPf<'
}~Nw!k
IX fR
a>9e}W
FIu1%S@
LoadCursorA
Winmm.dll
mciSendStringA
TranslateMessage
StAtUs type mpeGvideo alIas myFttt
CreateWindowExA
LoadLibraryExA
user32.dll
&ZdKg"
3nj1VM
LnAOYi
p(mVa'
Y^bfh#
~\{MLY
#X`^hH
($L%rk-
Yz^!Y2
cZ1O#q
j<{Q(|
LZ@\ZC
J_O Y
N^@T$3
4ZKbz%
user32.dll
Msacm32.dll
kernel32.dll
GetModuleHandleA
GetProcAddress
CreateEventW
HeapCreate
HeapAlloc
ExitProcess
FreeLibrary
GetLastError
GetTickCount
CloseHandle
DeleteCriticalSection
WaitForMultipleObjects
InitializeCriticalSection
SetEvent
TryEnterCriticalSection
GetPrivateProfileIntW
GetPrivateProfileStringW
GetDiskFreeSpaceExW
GetUserDefaultUILanguage
GlobalMemoryStatusEx
GetMessageA
DefWindowProcA
PostQuitMessage
LoadIconA
RegisterClassA
acmStreamOpen
acmFilterChooseA
EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE
EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE
EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE
26)EEEEEEEEEEEEEEEEEEEEEEEEE
EEEEEEEEEEEEEEEEEEEEEEEE
SEEEEEEEEEEEEEEEEEEEEEEE
EEE8/5[g
8EEEEEEEEEEEEEEEEEEEEEE
6EEEEEEEEEEEEEEEEEEEEEE
EEEEEEi5@?oEEEEEEEEEEEEEEEEEEEEE
EEEEEEE86e,<RkEEEEEEEE8S!
2kEEEE
EEEEEEEEE
EEEEEEEEE
j,?*W$$f
EEEEEEEEEEi.HEEE<(
.s,*@ff?<EEEE
EkEEEEEEEEcss8EE<
EEEEEE
EEEkEEEEEEEi
+*<EEEEEEEEEEEEE
kkEEEkEEEkE)
QanEEEEEEEEEEEEEE
kkkkkEEkEEEEHaa
=EEEEEEEEEEEEEEE
kkkkkkkkkkEER(T(REEEEEEEEEEEEEEE
kkkkkkkkkEkkk^TBEEEEEEEEEEEEEEEE
kkk8k8k8kk9E
-E8EEEEEEEEEEEEEE
kkkkkkk
kkEEEEEEEEEEEEEE
kkkE-`KBkkkk
EEEEEEEEEEE
k "\Bkk
kkkkEEEEEEEEE
k8kkEEEEEEEE
kt"--nE
EEEEEEE
Rkkkkk
kkkkkkkkkEk
0000000
00000000000000
FFhFFhFhhhhFh
5?55555
?5?5?5
65F62F5?5??5?5h>
%%____
55@WEh
fZ5555?5
@WE8<Z
i<1@*5*5
*WE$8!$8.
+Mk.j)
YYYYYY
+YYYYYYs+7I_IEEEEJ
QdLEEk$
+ Ek<QYsYQY
+2I_DEEEJ
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 8 0 0 0 0 2 7
C o m p a n y N a m e
H a m a r C o r p
F i l e V e r s i o n
6 . 2 . 3 . 2
O r i g i n a l F i l e n a m e
h a m a r . e x e
P r o d u c t N a m e
h a m a r . e x e
P r o d u c t V e r s i o n
6 . 2 . 3 . 2
V a r F i l e I n f o
T r a n s l a t i o n
C : \ F M S - . e x e
C : \ b r S o B d L K . e x e
C : \ C o 1 u H T P B . e x e
C : \ R m X K d f t b . e x e
C : \ L U h g K U j C . e x e
C : \ Q M k z g L 4 Y . e x e
C : \ d l x b u n 2 t . e x e
C : \ f y G F T C 0 d . e x e
C : \ c p H A e Y 9 S . e x e
C : \ q Z c V L L w f . e x e
C : \ j h G i n I t k . e x e
C : \ N 0 Y N a D r X . e x e
C : \ G j V 7 o b f 3 . e x e
C : \ p x F X P L h i . e x e
C : \ Y e A H h C p j . e x e
C : \ M O S C f n T s . e x e
C : \ F a j A m Q W H . e x e
C : \ j d M T O S s k . e x e
C : \ w h C O I L U Y . e x e
C : \ G d 6 A l E N O . e x e
C : \ q w k m I 8 o w . e x e
C : \ 4 a 4 1 d 9 7 5 2 3 4 a c d 1 5 6 a 0 2 e 6 7 4 6 3 0 1 d 2 8 7 f 1 d 7 3 0 1 1 7 9 7 1 5 a 9 7 3 7 1 5 e c d d 8 e 5 4 6 9 c 3
C : \ 5 0 b 8 a a b a a 4 2 5 e 7 0 4 0 9 a 4 3 7 2 0 8 1 0 6 f 8 8 4 8 8 1 2 b c 1 7 4 6 b a 7 d 3 5 0 0 6 f c 6 4 2 0 5 0 e f d a 6
C : \ 8 5 7 0 b 4 e d e 9 4 2 7 7 c 7 b c 3 1 9 d 5 f 4 3 3 4 f a 9 e 0 0 8 9 9 9 8 d d 1 e f b 3 2 d 3 4 4 7 0 f 7 b e 2 5 5 8 9 6 1
C : \ 4 f 1 e e 8 f f 5 2 5 7 a 6 1 e 0 0 e 2 f c a 3 c 0 8 a 1 7 2 7 b c 5 9 3 6 6 2 4 c 4 7 0 6 2 c a b 9 b 1 b 3 6 c c 9 6 e 3 a 0
C : \ b C 5 x c V v k . e x e
C : \ 5 5 c c e 4 e 9 0 8 d 5 5 e c 4 1 3 2 a a c 8 f a 7 2 f 3 8 c d 4 e 1 2 8 b c b 9 9 0 e 0 6 0 d 9 b 9 c f 2 0 6 e 3 b 1 d c c a
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 8 7 2 b a c 1 b 4 f 3 c 5 f e b 1 3 4 c e 4 5 6 8 7 c 9 7 e 2 3 f 9 3 2 9 b 7 1 9 f b 4 c 1 f 3 3 6 7 b b 9 8 3 8 c 4 1 4 8 1 8 . e x e
C : \ Y v T 4 u a l 4 . e x e
C : \ 0 2 6 6 d 9 d c d 0 3 b c 8 a d 9 e 5 0 b 1 e a f 9 6 b 1 7 f 1 f f 8 f 9 6 5 b 7 b c 2 7 8 0 1 8 b c 6 d d 8 0 7 1 b a 9 5 1 f
C : \ 7 7 7 e d a d f 7 1 4 7 f d 9 2 3 b 6 9 3 a 4 7 7 8 c d 5 3 9 d 1 9 1 a d a f 9 5 4 0 b 6 1 6 2 c 2 e 0 7 0 1 f f c e 7 1 1 c 6
C : \ m X k b _ F Q q . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ 4 c 2 9 b 8 6 4 0 0 1 0 b f 7 9 4 1 3 6 5 9 7 c b 6 b 0 3 2 6 f 0 c b f 9 f c b 8 2 b f 7 6 7 a 7 0 7 9 b 0 a 4 2 e 8 8 0 d 3 f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ a e 7 7 d e b 5 3 f 1 5 3 c 5 d d d d 6 0 3 0 a c 8 d 5 e c 3 3 0 8 c 6 4 c 3 8 0 9 1 5 2 e 1 6 a e c 7 4 2 d 8 e 8 b d 5 d 8 3
C : \ 2 9 5 a c 7 6 8 4 8 0 f 4 3 3 4 3 8 0 0 6 5 3 b 0 0 d 1 4 7 8 3 b 2 5 8 a 0 c d 7 b 5 4 3 f c 9 6 4 9 e 4 4 c f f e 5 b 7 e 0 a
C : \ S o s 5 4 5 b W . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ s a m p l e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ f 9 9 e 3 2 2 0 6 9 f c f 7 d 1 d 9 d 5 d 7 f b 9 c 3 4 f 1 b c 7 1 5 a a f 0 c 5 8 6 3 7 3 6 5 f b 2 9 6 a d c 8 2 e b b 1 9 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ i m p o r t a n t _ d o c u m e n t . e x e
C : \ b a 4 c f f 6 9 e a 2 1 9 a 3 e 8 d 1 2 7 c a e e 8 a 8 4 c 2 8 6 f 9 9 a 3 d 6 5 d 0 9 5 6 a 2 b 9 9 f 9 6 f 7 e 7 0 f 2 0 f 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a c t u r a . e x e
C : \ U s e r s \ J o e C a g e \ D e s k t o p \ L z i A Q d Q q 0 C . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 4 0 4 0 5 2 2 7 1 9 a 5 9 f 0 d e d 0 e d 9 9 6 0 1 f a 0 5 b 6 . v i r u s . e x e
C : \ 6 e 0 d c 7 6 1 c 2 1 1 4 0 3 8 2 9 8 0 8 0 6 d 1 f c 1 a f e d 3 8 c c 1 f 6 9 0 4 e a 5 8 b e d 8 3 a 8 f 0 7 f e 8 4 1 2 3 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 6 4 d 7 4 4 2 b 9 c e 6 3 2 4 2 4 6 f 8 b 9 8 3 3 a 7 2 a 5 7 4 3 2 8 5 7 0 c 7 6 6 f c d 0 a a 2 2 5 3 2 5 c 7 6 f 8 0 7 1 d 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 5 c 0 5 b 7 3 2 5 c b 9 5 a 0 b 4 5 2 2 7 f 5 2 8 2 5 f 8 3 3 c 0 d 8 b 1 3 5 8 8 7 9 8 e 4 f 5 9 8 9 0 6 d 7 7 3 0 4 8 c c 4 4
C : \ 7 0 8 9 7 7 7 5 3 5 7 4 5 8 c 8 3 0 8 6 b 8 8 6 9 f 4 5 0 4 d 0 a 3 f 2 0 0 8 d e e a 7 b 7 8 c 7 5 c 9 0 f b 8 5 a 9 1 6 7 f 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 3 1 3 5 b 2 8 6 6 8 2 2 d 2 2 3 1 5 d 7 7 7 4 3 0 c 4 e 8 0 1 1 c a 2 1 0 d 7 4 e f b c 7 5 0 f c 7 f 2 e 2 e a f c e 7 a a f 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d f d a a e 8 e 4 6 f f 8 a 3 d _ b u d h a . e x e
C : \ d 7 b 3 6 b 7 b 2 b 5 b 1 8 6 c f 0 5 e 5 a 8 1 8 e 4 9 1 0 4 3 8 4 3 0 3 5 c 5 e b f d 9 2 b f 7 9 4 4 f e c 8 8 e 8 6 2 f 5 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 2 1 4 9 d f e 9 5 1 4 f c f 2 4 8 7 1 2 e 7 6 0 4 2 b 7 c 4 0 f 2 5 e 4 0 b e 8 0 2 6 a d f 4 f 0 6 0 0 0 8 4 a 4 a 8 9 f 5 c 8
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 4 2 5 4 8 a 1 a 0 f d 1 a c b 8 5 d 2 b 2 7 c a 2 f 5 5 f 9 f 1 7 4 8 e d e 4 7 1 2 5 9 b f f 1 5 f 1 d b 2 d 5 3 6 c 9 a 1 c 7
C : \ 3 6 6 c 5 0 d b a 2 0 2 1 9 5 4 b 9 7 7 9 0 f 0 7 4 c 3 3 5 c 2 a e f 7 9 9 0 e 0 2 0 7 4 4 b a 8 3 1 1 1 9 8 d 7 a 6 1 5 8 4 b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 7 9 3 8 0 5 5 9 8 2 b 0 c 4 e c c 3 7 a d 1 d 2 a 5 2 7 9 2 9 f 5 0 d b 6 f 7 a 5 4 7 e 5 2 a 7 c f 5 f 8 3 3 1 a c b 5 9 1 5 c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 5 0 4 f 2 a 9 5 6 d a 6 2 a e e c b f c c 6 f 4 e 6 3 8 2 7 7 5 5 8 f 0 8 6 b 8 4 0 f 2 8 d f b 7 a 5 c 4 9 d 4 b 5 c 9 7 0 c 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ 4 3 d e d c 2 0 4 1 d 1 8 9 2 d 9 d e 8 3 d b d e 0 9 9 b e 7 1 9 2 a 4 e 3 7 9 a e f f 7 4 4 f 2 0 d 4 9 9 6 3 e 0 a d 9 b 8 1
C : \ 5 a 8 e f 1 8 3 3 4 5 d a 5 c 0 f 7 7 a a b 4 0 2 5 1 7 e 4 7 d 0 4 9 a 3 d 8 6 0 3 f 3 8 a e f 3 5 6 1 3 0 2 2 7 6 0 2 d a c 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c b a a 6 2 a a 1 1 a 2 6 c 7 6 _ b u d h a . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ e e 3 8 8 2 6 c 7 6 2 1 7 c e a a 9 e 2 d 7 b 4 4 b 4 a 7 c e 2 1 a b 6 4 7 f 4 1 2 5 d 0 e 6 8 7 d 9 7 0 3 7 2 e d 2 a 6 a f e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ f 5 a 1 9 d 4 c 6 b 6 7 2 8 f 4 c a 1 a b 3 1 3 5 5 5 a 6 e e 0 f f 3 f 4 8 4 5 f 6 0 5 4 4 b 0 3 4 d a 2 2 a 8 d d 9 4 5 c 1 9
C : \ 0 W n j 3 Y O d . e x e
C : \ 8 2 0 4 d f 3 f b 8 b e 6 9 5 c 0 1 8 c 8 b 2 3 c 6 6 0 9 4 a e 9 f c 8 4 8 1 5 7 6 f 0 2 b 8 0 d 0 f 0 0 d 0 8 6 4 e 6 2 8 5 a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ a d e 9 4 4 e d 4 5 1 4 f d 1 1 c 7 c c 0 4 8 8 5 8 0 9 2 4 2 0 9 2 9 4 9 0 f 2 c 1 8 5 d 2 1 8 9 6 0 7 5 2 7 2 9 e f a d 1 0 1
C : \ 8 2 8 a 0 4 7 d 3 e 6 0 8 3 9 b 1 c 0 1 8 e c d b 5 f 5 f a 3 1 3 4 5 0 1 a b f b 5 1 a b 3 2 c 6 4 e c 4 e e 4 4 9 4 c a 4 6 4
C : \ 8 b f 4 9 4 a c 6 9 1 a 9 1 d 1 3 0 9 6 0 0 8 e 5 f a 1 b 9 7 d 2 d f f 3 9 b 7 2 c 6 e 7 f f 3 1 3 0 b 0 1 8 c 5 c 3 7 2 b d 9
C : \ a 8 1 5 2 2 1 f 9 0 1 b 7 4 9 8 1 8 1 c 9 e 9 7 f f 1 3 3 b d d 2 3 d 2 9 4 c 9 5 f 6 5 f d a 3 1 1 f 1 3 b 5 f f 6 1 0 6 0 2 8
C : \ 7 6 4 0 0 6 2 a 8 5 0 1 e 1 e f 3 6 a 7 e 8 f 4 6 e d f 7 d 7 0 7 f c 9 d d 4 d 8 7 0 d b d c 8 8 2 2 3 c c b f 8 4 b 4 1 7 4 2
C : \ 5 c 3 1 5 5 2 f e a 9 4 2 a 3 3 6 b 0 3 f 6 7 0 6 5 a c a 3 b 1 7 1 c 6 e 9 8 d 4 3 8 6 7 f 4 8 5 4 4 b 4 0 e 0 3 e 7 c f 2 7 6
C : \ 3 b 9 f 4 0 7 a 1 0 9 b e f f e 2 8 6 7 5 0 8 2 2 4 c 2 a 6 9 c 6 c 5 9 f c c b 9 8 a 2 d 1 1 b b 5 6 d 1 8 b 5 6 5 1 6 c 2 5 a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 4 7 2 b 8 a 7 e 1 b d a 5 d d 3 3 8 a 8 c 9 c e 6 0 f 2 0 e 4 a c f 7 d b e 4 5 8 8 e 8 0 0 6 2 0 a 4 f 1 3 5 3 7 a 1 3 3 b 9 1
C : \ 6 d c 0 c e 6 e f c c 7 a 1 c c 8 1 2 4 a b b f 7 9 4 3 0 4 b 9 f 7 8 8 2 d 4 5 d e 9 f 6 0 7 0 3 b 3 9 3 0 a e c f 7 4 f 2 c b
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ 4 9 9 b 7 5 7 0 3 f 2 8 9 a f d 3 3 6 f 2 5 b 2 6 f e 2 0 0 7 7 7 8 8 a c 4 a 6 4 3 8 6 9 4 e 4 c 7 1 c 5 f 8 0 f 7 9 a 3 1 8 b . e x e
C : \ 9 5 2 e 9 1 2 4 c 3 b f 1 c 4 4 6 5 6 c 4 e c 4 7 a 3 e d a a 3 6 c e 2 b 3 3 e b 5 e a 2 4 7 f e d 9 5 f d 5 0 1 c 3 a 3 c e 8
C : \ f e 1 9 6 b b 9 f 7 b 1 6 0 1 7 c 9 f 2 a 5 d a c 5 5 2 8 d 8 3 e 5 8 8 b c c a a 0 f 7 4 4 b 7 6 6 7 0 0 c 4 2 3 0 5 d 2 6 c f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 8 1 5 2 8 6 8 9 a 5 a d 1 b 7 5 a 8 6 f 1 6 2 8 5 3 8 6 8 9 2 c 8 d 7 7 5 4 2 2 1 8 3 5 5 2 6 6 7 b 5 8 6 c b e d 4 9 6 2 4 b 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 9 4 0 9 5 a a d 8 6 6 5 e 7 0 9 1 b 6 7 c 4 f 4 f 7 3 2 8 f 2 9 a c c 1 8 9 9 0 0 2 2 f a a 9 7 e e b e 8 3 5 2 6 e a 2 c 3 f 9
C : \ 3 c 9 5 c f 7 7 6 5 7 5 2 5 f 8 f a 5 3 c 6 0 b e 6 3 b b 8 e 3 3 f 7 6 0 b 4 c f e b b 6 d 1 2 f a 1 d 6 b e d e 7 2 7 8 2 b f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ f a d 3 5 1 0 2 e 3 f 0 1 1 1 7 c b d 9 9 b 2 b 6 8 c e f a 1 f 3 4 6 8 3 d d 0 6 b b b e e 8 1 3 5 4 a 9 5 0 e 7 6 8 b f 7 7 5
C : \ f 9 2 f 3 9 8 3 e 5 3 3 6 c 4 b e 5 a 1 a d 4 f 8 5 e 8 0 6 7 b 7 1 2 0 9 0 d 8 5 8 1 1 4 0 3 5 4 1 3 1 a 3 4 d 9 0 5 f 4 e b d
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ 2 a b c 7 2 9 f b 1 1 d a 2 6 2 0 c f 9 3 6 2 0 5 3 3 8 6 f f 3 f f 5 a 2 a 7 9 e d 3 7 3 9 5 1 5 8 3 7 3 9 e e 5 7 5 0 6 7 9 0
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 5 2 9 8 f 5 d 0 0 5 d c d 2 5 f _ b u d h a . e x e
C : \ d 5 d 0 5 f 9 7 4 0 c 8 5 a 6 6 4 5 1 9 c 7 8 d 7 f b f b 4 d d 3 c 7 a a d 1 5 f b 5 0 f f e 9 1 6 f c f f d 7 d c 0 7 c b d 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ f 1 f 6 d 5 c 9 d e 0 f 7 f c d 6 2 0 b 4 9 6 0 9 3 d 6 1 3 1 3 4 5 d c b f e 8 0 6 2 5 1 9 8 6 9 e d 5 2 9 7 9 e 9 a 6 e 6 c 3
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ b u d h a . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 9 f 6 0 5 c 3 a 0 8 0 5 b f 4 d _ b u d h a . e x e
C : \ d b 6 a b a 7 0 9 1 6 9 3 2 2 b b 9 3 c e f c d 1 6 e e 8 e 6 2 a 7 4 a 5 b 9 e f 2 e 0 e 3 d 6 9 e 3 b 8 d 3 7 0 7 8 3 8 7 4 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ e a 8 3 1 a c 0 5 d b 0 a f 7 6 4 5 5 8 9 b 8 6 5 f 6 2 8 5 9 6 2 c 7 6 4 b 1 3 a c f e 8 d 3 2 4 e 6 d c 1 6 a f 2 1 8 e 3 1 c
C : \ f e 4 a e d 1 5 c 7 4 3 3 c 5 9 4 8 8 6 9 2 9 d 2 2 2 e e 0 7 1 5 4 e e 3 1 6 8 6 f e 0 6 d 8 d b a a b 3 9 f e b 2 c 0 e 7 c 9
C : \ c 4 3 0 3 b 4 7 f d 0 1 1 7 d 9 3 e 2 4 5 9 1 0 1 e 1 f 0 e c 6 6 8 2 e e d 6 9 d 2 d 3 c 3 0 f d 3 7 8 e e 4 e d 2 4 0 3 f 4 4
C : \ 8 8 2 d 6 a b f d b 1 c c d f 0 d a 1 f 0 d d 1 8 7 c a 4 5 6 2 3 3 b 7 6 9 a e d 0 0 7 2 a c e e 1 d d 2 c 9 9 d b f c c f 7 a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 2 4 9 b e 2 1 3 9 3 c 7 4 0 a 8 9 6 1 0 b 2 1 e 8 4 9 5 6 1 c 9 5 6 2 1 8 0 f 6 e 4 3 c 7 b a 1 7 3 b 9 b 3 8 f 6 a e c c 7 2 3
C : \ 3 e b e a e f 5 9 9 8 a b 4 1 1 2 e 8 b a d e 6 1 d a d 7 2 1 f 8 2 9 6 a f 5 8 b 2 9 9 4 d 9 0 f b d 4 3 f 3 c 7 8 b b 5 d 7 b
C : \ c e c 1 9 a 2 3 2 f 5 9 3 1 2 5 a 6 2 7 d 1 9 9 d 3 e 9 d 1 5 6 e d c a 4 6 8 8 0 c 2 4 5 5 6 a 4 d e a e b 1 a b 0 c c b 3 6 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 1 c 3 b 4 8 1 d 9 b f 1 d 5 3 2 1 7 c d 9 b e a 7 8 1 5 d c 2 4 6 b 2 b 1 5 d 0 4 8 4 1 1 0 a 1 2 9 5 7 4 b f 2 4 1 8 6 4 9 7 9
C : \ 5 b 1 1 f d b 2 f 7 c 7 d 4 d 8 c 6 0 c e 0 1 2 3 9 e 6 3 e a f b d 8 3 c 7 d c 5 7 6 0 6 d 6 c e 9 d 2 4 0 9 1 a 7 4 1 6 6 b 4
C : \ 4 f 5 4 1 1 5 2 8 6 2 e f 2 5 1 6 4 e a 2 3 f 2 1 2 e e 7 f 1 c 1 8 c 7 b 3 1 a 8 3 6 1 0 2 6 d 7 d c 2 f b d 0 7 4 1 a 5 9 8 8
C : \ e 8 d c b 0 3 e 0 9 9 6 7 3 2 a 4 6 1 9 8 0 b 8 7 a a 0 6 2 8 d 8 3 f d 9 2 b e 0 d 4 3 5 2 4 8 9 2 c 6 c a c f f 8 e a 1 6 c c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 8 b 6 f 5 9 7 c b 9 5 6 5 c d 7 e f 1 7 e 5 5 d 9 e 3 d 5 e 8 1 d f d 1 3 9 d 4 6 d a 9 3 f a 4 d 8 9 f b 7 7 8 7 a 7 9 f a f a
C : \ c 7 7 e 2 c 6 c 5 c 6 3 e 2 0 4 e f e 7 a c f b 7 4 3 0 5 6 1 0 c a b a b f 4 0 6 e d 2 0 d 0 c e 1 2 c 7 7 9 9 3 1 a 5 4 1 5 6
C : \ b 5 a 3 1 3 2 3 d 6 1 7 4 6 9 3 e 6 a f 3 f 5 c 7 2 f 0 8 f c e 5 c c 2 9 4 4 4 3 7 d c d 5 3 e c 7 4 0 7 c 8 0 0 5 4 1 f e 7 4
C : \ 9 7 c f a 7 c d 9 f e e c 9 8 6 4 d b d 7 e 5 1 a a a 9 9 e 0 d 0 a 6 4 c f 3 a 2 0 5 e 0 8 8 8 8 d 4 9 7 c 2 d 4 5 7 2 e 0 7 d
C : \ d e 5 7 8 1 5 6 e 1 3 a 9 8 8 9 f 3 c b 1 f 4 5 6 8 6 a 5 c 7 9 3 e a 2 b 8 5 c d 0 9 2 a a 2 4 c 8 d 3 a b e 0 2 f 2 f 4 6 e 6
C : \ c 5 2 7 c f 3 3 1 a 8 a 2 1 7 f c 2 3 f 1 1 6 7 0 b 6 d d 5 9 e 0 a 2 8 2 6 5 9 1 8 6 d 8 4 8 4 5 0 a b a e 8 1 8 a a 3 1 3 8 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ f 3 0 3 e 0 1 9 b 2 2 2 0 b 3 e 6 0 2 6 9 c 5 f 1 4 e f 4 f 9 8 a 1 a 5 f e 1 b c b b 4 c 5 2 e a 8 c 5 3 6 b 3 3 e 0 e 1 3 4 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ c c 6 3 b 8 f 1 b 8 b 8 2 4 a c 1 c 8 2 5 2 1 e 7 d 0 2 4 f 7 f e f 4 9 e a e 0 7 a 3 0 5 f 2 0 5 a 7 9 7 f 1 d 4 a b b c 1 c e
C : \ 3 b f d d 5 7 a 6 3 6 b a 5 3 3 2 a 9 3 d 3 1 1 5 3 c 3 7 f f d d 4 a 6 4 b 6 2 4 1 f 9 4 7 9 8 5 1 2 d c 3 c 4 6 a 2 f d e 3 1
C : \ U s e r s \ R A 4 9 1 ~ 1 . V U L \ A p p D a t a \ L o c a l \ T e m p \ c 6 3 d 3 7 5 0 2 5 b f c f 8 c 4 3 e e 6 8 5 e d f c 5 7 6 5 e . e x e
C : \ b 6 8 d 4 f c a 3 4 f 4 a 7 e b 6 3 5 a 0 2 2 0 3 e 0 c f 5 8 3 5 6 5 d 8 3 7 1 9 e 1 6 d 4 4 b 0 a 3 7 2 3 1 3 d 9 b e 4 3 5 9
C : \ 1 1 4 0 4 4 8 7 5 6 9 c b 6 1 2 3 d a a 8 8 e 0 c 1 b 8 7 9 6 0 1 b 5 f c b 6 9 e 5 8 1 0 7 3 c 6 4 e a 2 d 9 1 d b 8 2 4 0 1 1
C : \ c d 1 1 3 0 1 8 8 4 9 a f a 8 a 5 e 6 9 8 7 e 8 8 c 3 e c 7 8 4 1 5 7 f 3 e e 5 a d 0 8 3 d 5 c 4 7 3 6 a 6 6 5 0 4 5 c 0 7 4 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ b 4 7 3 e c f 9 c 3 e 6 a 7 e 9 3 4 1 e e c 1 d 3 3 a 9 6 2 4 c 9 1 6 4 4 3 c f 4 0 0 3 e c f c 1 7 6 8 5 d 3 1 e f 0 0 5 5 6 6
C : \ a d 9 7 4 e 0 b 5 6 0 4 9 c a 1 1 e c 0 6 d 3 d 8 b f d 0 4 5 3 a b 6 4 6 1 8 f 1 6 2 6 0 0 3 e 6 1 5 a e e 9 e c 3 1 e 5 f 0 b
C : \ c 2 2 3 4 f a 4 2 f 0 d 2 a 6 f c 5 9 e 1 6 c 3 3 8 c 9 5 7 4 9 8 e 0 6 2 2 e 2 d c 5 5 b 6 8 c 2 5 4 e 6 8 3 a d 2 d 0 7 2 9 1
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 6 c c 6 1 4 a 0 4 0 e a e 1 d 4 8 b 5 b a 1 9 b 1 6 3 c 3 9 e 0 b 5 7 6 0 7 0 9 c a 0 5 b 6 5 5 6 f 0 1 5 5 f 4 2 0 9 c e 8 4 6
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b u d h a . e x e
C : \ 6 9 3 8 4 3 3 9 8 6 d 2 a 9 2 e 1 e 0 c e 5 4 b 6 c b 9 b 4 a 1 a 9 d f f 2 c 2 2 6 0 6 a 0 5 5 2 c 4 f b 5 a 7 d b d b 0 8 6 e
Process Tree
-
0c610f4db34bb8244b56ff3baeed922b10e016bb25a2b3d01c932f5e7f03c68f.exe (1064)
"C:\Users\Administrator\AppData\Local\Temp\0c610f4db34bb8244b56ff3baeed922b10e016bb25a2b3d01c932f5e7f03c68f.exe"
- budha.exe (628) "C:\Users\ADMINI~1\AppData\Local\Temp\budha.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
| 162.241.24.59 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com |
A 131.107.255.255
A 131.107.255.255 |
131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
| myshootingheritage.org | ||
| dallasroofingconstruction.net |
A 162.241.24.59
A 162.241.24.59 |
TCP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 49164 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49165 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49166 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49169 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49170 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49171 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49174 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49175 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49176 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49178 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49179 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49180 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49182 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49183 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49184 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49186 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49187 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49188 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49190 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49191 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49192 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49194 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49195 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49196 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49198 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49199 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49200 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49202 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49203 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49204 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49206 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49207 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49208 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49210 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49211 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49212 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49214 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49215 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49216 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49218 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49219 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49220 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49222 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49223 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49224 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49226 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49227 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49228 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49230 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49231 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49232 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49234 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49235 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49236 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49238 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49239 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49240 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49242 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49243 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49244 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49246 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49247 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49248 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49250 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49251 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49252 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49255 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49256 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49257 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49262 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49263 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49264 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49266 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49267 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49268 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49270 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49271 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49272 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49274 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49275 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49276 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49278 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49279 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49280 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49282 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49283 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49284 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49286 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49287 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49288 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49290 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49291 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49292 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49294 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49295 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49296 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49298 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49299 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49300 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49302 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49303 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49304 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49306 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49307 | 162.241.24.59 dallasroofingconstruction.net | 443 |
| 192.168.56.101 | 49308 | 162.241.24.59 dallasroofingconstruction.net | 443 |
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
| 192.168.56.101 | 51758 | 114.114.114.114 | 53 |
| 192.168.56.101 | 51758 | 8.8.8.8 | 53 |
| 192.168.56.101 | 52215 | 114.114.114.114 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
| Source | Destination | ICMP Type | Data |
|---|---|---|---|
| 192.168.56.101 | 114.114.114.114 | 3 |
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 9b49d745a541c75b_budha.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\budha.exe |
| Size | 35.4KB |
| Processes | 1064 (0c610f4db34bb8244b56ff3baeed922b10e016bb25a2b3d01c932f5e7f03c68f.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 4ccc1ce904d86ba185b6cebca90c7d0a |
| SHA1 | f758f425718ca6bc11b4a75615c6dc5f73eccc95 |
| SHA256 | 9b49d745a541c75b68c950dd6fcdc76efb506a74820d5b5d065b4f1b3ef2bd4f |
| CRC32 | BB2D1ACD |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 4cfc623a6f5439c5ec1c9403c98bbf50971a705b |
|---|---|
| Size | 5.0KB |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | be7b6362de2f831b98cb24bbef01cf1a |
| SHA1 | 4cfc623a6f5439c5ec1c9403c98bbf50971a705b |
| SHA256 | 0af02332f60afa990a1126ca3f6d25364b31fb88264c3633be38c735e77b9d81 |
| CRC32 | C6638989 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |