1.2
低危
66 个模型检测该样本为恶意！
重新分析
更多

1194aec0f4d04e2270f3777a5c974f69338f154d9f765e33ae613d3606e4b41f

1194aec0f4d04e2270f3777a5c974f69338f154d9f765e33ae613d3606e4b41f.exe

分析耗时

192s

最近分析

377天前

文件大小

44.8KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN DOWNLOADER GENERICKD
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.67
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Malware-gen 20191222 18.4.3895.0
Baidu Win32.Trojan-Downloader.Agent.kj 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20191222 2013.8.14.323
McAfee GenericRXAT-KR!5B6CDE39C410 20191222 6.0.6.653
Tencent Malware.Win32.Gencirc.10b076db 20191222 1.0.0.1
静态指标
此可执行文件具有 PDB 路径 (1 个事件)
pdb_path uiopferta.pdb
行为判定
动态指标
该二进制文件可能包含加密或压缩数据，表明使用了打包工具 (2 个事件)
section {'name': '.text', 'virtual_address': '0x00001000', 'virtual_size': '0x0000210a', 'size_of_data': '0x00002200', 'entropy': 6.976678225471402} entropy 6.976678225471402 description 发现高熵的节
entropy 0.3333333333333333 description 此PE文件的整体熵值较高
网络通信
与未执行 DNS 查询的主机进行通信 (1 个事件)
host 114.114.114.114
文件已被 VirusTotal 上 66 个反病毒引擎识别为恶意 (50 out of 66 个事件)
ALYac Trojan.GenericKD.1801883
APEX Malicious
AVG Win32:Malware-gen
Acronis suspicious
Ad-Aware Trojan.GenericKD.1801883
AhnLab-V3 Trojan/Win32.Necurs.R115578
Antiy-AVL Trojan[Backdoor]/Win32.Androm
Arcabit Trojan.Generic.D1B7E9B
Avast Win32:Malware-gen
Avira TR/Katusha.uaws
Baidu Win32.Trojan-Downloader.Agent.kj
BitDefender Trojan.GenericKD.1801883
BitDefenderTheta Gen:NN.ZexaF.33556.cqY@aG0fYvhi
Bkav W32.FamVT.GeND.Trojan
CAT-QuickHeal TrojanDwnldr.Upatre.AB4
ClamAV Win.Malware.Upatre-6726322-0
Comodo TrojWare.Win32.TrojanDownloader.Waski.FDA@5s4u0d
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.9c4108
Cylance Unsafe
Cyren W32/Trojan.PBPB-2165
DrWeb Trojan.DownLoad3.33795
ESET-NOD32 Win32/TrojanDownloader.Waski.F
Emsisoft Trojan.GenericKD.1801883 (B)
Endgame malicious (high confidence)
F-Prot W32/Trojan3.JYB
F-Secure Trojan.TR/Katusha.uaws
FireEye Generic.mg.5b6cde39c41087d1
Fortinet W32/Kryptik.CKUG!tr
GData Trojan.GenericKD.1801883
Ikarus Backdoor.Win32.Androm
Invincea heuristic
Jiangmin Backdoor/Androm.gxn
K7AntiVirus Trojan-Downloader ( 004b8d561 )
K7GW Trojan-Downloader ( 004b8d561 )
Kaspersky HEUR:Trojan.Win32.Generic
MAX malware (ai score=87)
Malwarebytes Trojan.Upatre
MaxSecure Trojan.Upatre.Gen
McAfee GenericRXAT-KR!5B6CDE39C410
McAfee-GW-Edition BehavesLike.Win32.Generic.pm
MicroWorld-eScan Trojan.GenericKD.1801883
Microsoft TrojanDownloader:Win32/Upatre.AA
NANO-Antivirus Trojan.Win32.Dwn.ddtmhv
Panda Trj/Genetic.gen
Qihoo-360 HEUR/QVM20.1.0CBF.Malware.Gen
Rising Trojan.Waski!1.A489 (CLASSIC)
SUPERAntiSpyware Trojan.Agent/Gen-Upatre
Sangfor Malware
SentinelOne DFI - Malicious PE
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2014-02-20 03:20:30

PDB Path

uiopferta.pdb

PE Imphash

222e7b320f36011feb1642000d8fa826

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0000210a 0x00002200 6.976678225471402
.rdata 0x00004000 0x00000708 0x00000800 4.108494791503498
.data 0x00005000 0x00000d43 0x00000e00 5.175104830655795
.rsrc 0x00006000 0x00002cae 0x00002e00 3.123562248238736

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00006706 0x000025a8 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_MENU 0x000060f0 0x00000600 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_GROUP_ICON 0x000066f0 0x00000016 LANG_NEUTRAL SUBLANG_NEUTRAL None

Imports

Library cryptdll.dll:
• 0x404100 CDBuildVect
• 0x404104 MD5Update
• 0x404108 CDLocateRng
• 0x40410c MD5Init
Library shell32.dll:
• 0x404114 DragAcceptFiles
• 0x404118 SHCreateShellItem
• 0x40411c ShellAboutA
• 0x404120 SHGetFileInfoA
• 0x404124 StrChrA
• 0x404128 SHFileOperationA
• 0x40412c DragQueryFileA
• 0x404130 FreeIconList
• 0x404138 SHGetDiskFreeSpaceA
• 0x40413c FindExecutableA
• 0x404140 SHGetDesktopFolder
• 0x404144 ShellMessageBoxW
• 0x404148 SHGetFolderPathA
• 0x40414c SHGetMalloc
• 0x404150 DragFinish
Library dbnmpntw.dll:
• 0x404158 ConnectionClose
• 0x40415c ConnectionWrite
• 0x404160 ConnectionError
Library kernel32.dll:
• 0x40416c SearchPathA
• 0x404170 OpenMutexA
• 0x404178 GetModuleHandleW
• 0x40417c GetLocalTime
• 0x404180 ReadConsoleW
• 0x404184 FindFirstFileA
• 0x40418c DeviceIoControl
• 0x404194 CompareStringW
• 0x404198 GetStringTypeW
• 0x40419c IsValidCodePage
• 0x4041a0 lstrcmpiA
• 0x4041a4 lstrcmpA
• 0x4041a8 TlsGetValue
• 0x4041ac GetProcAddress
• 0x4041b0 GetTickCount
• 0x4041b4 WriteConsoleA
• 0x4041b8 lstrcpynW
• 0x4041bc GetLastError
• 0x4041c0 CreateDirectoryA
• 0x4041c8 SetErrorMode
• 0x4041cc SleepEx
• 0x4041d4 GetFullPathNameW
• 0x4041dc IsBadStringPtrA
L!That program cannot be run in DOS mode.
`.rdata
@.data
.4$g)=4P@
^!5@Q@
t;8{1j[<U@
P^=8U@
3!5RQ@
4$U15P@
$u*%P@
H)=}Q@
aXPh\@
Y1=9Q@
W(-|Q@
{a99azza==aGGaaGGaaGGaaGGaaGGaaGGaaG~
wIH'Oib
NWsCllC##B B##B B#"BB))HH))HHBBXXBBXXBBZZFFZZBBZZBBXXBBXHBBXHBBXXBBXXBBXXBBXXBBXXBBXXBBXXBBXXBBXXBBXXBBXXBBXXBBXXBBXX
===--////
~<EbT0k;".z)~ZMC
KW31-G2J0A=
TkxG T
RfSa88at
EUnoHGl
g``!5!
xZhiT?>h
O\D~M!
+M&8O@K&KL
$!OB2dxFd
?Brs#GE
cjuCCEj%Y^^1`
A`EQ0T
I#@('G@
f~a$xj{
PXOrrOXU
F??Fob
r /<<EG
^Czc&\.9.6=gtHprra$
rCCCA)
`p&|-}
K#4nn<#31[3Y0.n[YYY'
rTW0\ttA
#ta$b/}
o~7-Xy~(FJ
s~Z|m|K
ABoBAQ
gO~IMmO
KY:N=Jauua74)
5s#paE
vaD33D
Ch!So?
oOz*S\
B=+x#!
2"UUWC_v1?
f[=fUZ+
!l5,1'1tk
Lm'GPE
66\\Q\#oT:
Nf1"1uVqx
hQR*K
]&v vs
ZnAnZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ--ZZ-->>-->>
77hhmmmmuu[[
ccPP00
ePKKPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
wPEEPw
MD5Init
MD5Update
CDLocateRng
CDBuildVect
cryptdll.dll
SHCreateShellItem
ShellAboutA
SHGetDiskFreeSpaceA
DragQueryFileA
SHGetFolderPathA
SHGetFileInfoA
FreeIconList
SHGetMalloc
DragFinish
ShellMessageBoxW
SHGetDesktopFolder
StrChrA
FindExecutableA
SHFileOperationA
DragAcceptFiles
SHGetDataFromIDListA
shell32.dll
ConnectionError
ConnectionClose
ConnectionWrite
dbnmpntw.dll
WriteConsoleA
IsValidCodePage
IsBadStringPtrA
CreateDirectoryA
OpenMutexA
GetProcAddress
InterlockedDecrement
CompareStringW
SleepEx
ReadConsoleW
GetModuleHandleW
GetFullPathNameW
SearchPathA
GetLastError
lstrcpynW
FindFirstFileA
GetLocalTime
DeviceIoControl
GetStringTypeW
GetTickCount
GetCurrentDirectoryW
lstrcmpA
GetEnvironmentVariableA
GetPrivateProfileIntW
FileTimeToSystemTime
GetPrivateProfileIntW
lstrcmpiA
TlsGetValue
SetEnvironmentVariableW
SetErrorMode
kernel32.dll
jscript.DLL
LoadLibraryA
TrO(t#C
6V!#}mm+}
8h<J)@Q
V:ppX$
Otr42}
qV$ VVY%2#n,V
?MHR,R
`|]%Q|#/
OxqM:$M
yYuiyZ
}u$rVMK
t[tv}yz
sy3SB8
4P<:@wvI*
t>Ebp<
GLP[_>3d6G
%xV\\9
6>Pc>tltw.lll&h~
ImVr|J*
VCh~8T~]
&ZTVCdfe#1C
Jx|b1qX
T;%o4\uu"-
Kh?0ub`8
.HeapCreate
WriteProcessMemory
fmtmtzlnik
fmtmtzlnik
ldlaivqxuju
vonrjrzk
nbarkmefzda
vjiyymiqvgoxh
hwiwjgtqkyrjleqld
kltjziry
ishueinxvfhblayn
ulbitvgjhqsnlryi
iymyivqsw
iymyivqsw
hqedcpekvgn
mvmpnewbmhkc
uiopferta.pdb
=Ch$$$
Xur$$$
f0xf$$$
!vv$$$
BhB$$$
H!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T
N!S!S!S!S!S!S!S!S S!S!S!S!S S S S!U!S!S S!S!S!S!S!S!S!S!S!S!S
Q"X"X"X"X"X"X"X"X"X"X"X"Xn"X"X"X"X"X"X"X"X"X"X"X"XQ$$$
Q#Z#Z#Z#Z#Z#Z#Z#Z"W"X#V#Zs#Z#Z#Z#Z#Z#Z#Z#Z#Z#Z#Z#ZQ$$$
Q*_*_*_*_*_*_*_*_*_*_t*_*_#V#V']*_*_*_*_*_*_*_!S$$$
#Y/`/`/`/`/`/`/`/`Lp/`/`.b/`/`/`/`/`/`/`/`/`#Y$$$
*_5h5h5h5h5h5h5h5h5hf5h5hx5h5h5h5h5h5h5h5h5h5h5h5h*_$$$
1e:k:k:k:k:k:k:k:kg:kg:k:k1e1e:k:k:k:k:k:k:k:k1e$$$
:k?m?m?m?m?m?m?m?m?m~?m?m?m?m?m?m?m?m?m:k$$$
?mFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFq?m$$$
HvJuFqFqFqJuJuJuJuJuJuJuJuJuJuJuJuJuJuJuJuJuFqFqFqFqFqFqJuJuJuHv$$$
HvHvooooooooooooooooooooooooooooHvOz$$$
kernel32.DLL
WFFFEEEED
C:\Users\User\Desktop\Ref_11082014.scr
C:\98b2c2c0dbb646efddcf6e0b642b1f3a8697fe3c77fad9c133049b65da6af0dc
C:\QkAixjKC.exe
C:\ZRNRvXV1.exe
C:\1a1af2cb7736a4101634229f639b565252c269dfec6a1b711d27c3f9a3492b41
C:\lnUzE1Q7.exe
C:\SD5Pd907.exe
C:\TY5B3Qq8.exe
C:\c5TMzii3.exe
C:\b27ba4f5b90a057cfb585d02ab7ea9364fcef847d1efa552eb9b0f39c2c35817
C:\b6cae1e3545309f4e16291ac898c1d58e513e4408e04649a63c426b507613664
C:\ae7800238bbd91545e9d35e484bb2f85e23aac9e1777d3bfc978bf46756e90c0
C:\d6cc69191b3db0ebaf94cb498e80c3da4355d154e46fdc84a7453e865abffab4
C:\B8vjeb4O.exe
C:\EsYDurHP.exe
C:\YLweoRq1.exe
C:\XkS7BoX5.exe
C:\4hr_4l6I.exe
C:\oWf0ABh1.exe
C:\OrhU2eZb.exe
C:\6mdoGGkv.exe
C:\N5gS8h0J.exe
C:\ekM6gg5z.exe
C:\3Y3NGaR1.exe
C:\EI5tGCoO.exe
C:\_ouzcRJn.exe
C:\IpFUnKHW.exe
C:\1nzHfB9C.exe
C:\HaoPDTXv.exe
C:\C4jr4Nol.exe
C:\Whyyr7tV.exe
C:\YmefALlM.exe
C:\BHnlpuSO.exe
C:\QCedyPjY.exe
C:\QTs2_RTL.exe
C:\eWh7DJ8v.exe
C:\VsKK1bK3.exe
C:\EkQERVoT.exe
C:\xbqcGvNB.exe
C:\Uwd6bKKp.exe
C:\SlPTV4AS.exe
C:\tkNwT0vL.exe
C:\hvnGhvkI.exe
C:\mnJsTnRX.exe
C:\whDaCo0Z.exe
C:\pJlu_de_.exe
C:\OQUcixn1.exe
C:\yKVXVzGt.exe
C:\eIChPZL4.exe
C:\iJ2FhlR8.exe
C:\9xV5Am4g.exe
C:\oeD_P2o0.exe
C:\WFuTJp25.exe
C:\qG1uXFdl.exe
C:\IUZq8exQ.exe
C:\JLYCqMTy.exe
C:\EZIr5Dw8.exe
C:\jCRSZAq6.exe
C:\xgjJ7gJh.exe
C:\MVul7Rhk.exe
C:\gz97WQbP.exe
C:\7Vr6afZm.exe
C:\KD6MZhOV.exe
C:\NkPXr6Z6.exe
C:\mwpW7FY4.exe
C:\7OCpwXRU.exe
C:\FJ0Gas5D.exe
C:\zRsS03It.exe
C:\L0kgfaev.exe
C:\jOfiTsqV.exe
C:\Lmqek2Bt.exe
C:\yZBb2B1m.exe
C:\h1c0b63F.exe
C:\czO47h5K.exe
C:\OH8Cuj49.exe
C:\4WPRGV25.exe
C:\VhRzYHFg.exe
C:\RZTEQnHD.exe
C:\1uLg3kMK.exe
C:\N1Yfeyzw.exe
C:\3vRkhFbR.exe
C:\XcxgcttG.exe
C:\44VxuS8V.exe
C:\ipAlt5ho.exe
C:\xprMFuQI.exe
C:\2butDzFq.exe
C:\SKVe3MDH.exe
C:\SBUGkBES.exe
C:\1Rg6zV6d.exe
C:\Z4yEmdQu.exe
C:\4JmedDSZ.exe
C:\2M59fXrb.exe
C:\2kLypeFw.exe
C:\TbPvCkgn.exe
C:\5ouBHWvd.exe
C:\JZ1vjQKj.exe
C:\HhnqJJcI.exe
C:\btBeKQJm.exe
C:\d_PiwtSp.exe
C:\_5A5uoHA.exe
C:\Zi82fc86.exe
C:\1da3b1c7c482892260ab3e457977eb2c4e9e9a91240ac5927c54afe4251f39b2
C:\nRLUtcwt.exe
C:\9ZhipDY8.exe
C:\vBYn_g_X.exe
C:\UkxtrNPw.exe
C:\OKCyqjIK.exe
C:\j9SbJgGo.exe
C:\yXZAo0Eo.exe
C:\OfXYZR95.exe
C:\wbH3gHyM.exe
C:\hNUsgqlg.exe
C:\QyQdHcKo.exe
C:\hhbTpZXJ.exe
C:\ivcrqoVA.exe
C:\lsVrwYWR.exe
C:\djHL6rfe.exe
C:\gwm0fo4K.exe
C:\SPmVefFm.exe
C:\m6Iql17P.exe
C:\EMrEJnzw.exe
C:\ab5QQPal.exe
C:\utIg7pg7.exe
C:\ywmFfOOU.exe
C:\JQttVsQ2.exe
C:\IWqO0Uhv.exe
C:\ZcCOu4oi.exe
C:\Z5UNCjgn.exe
C:\CBWElKWV.exe
C:\XX5Jz4Kb.exe
C:\YM4I24u0.exe
C:\_fAxvjC7.exe
C:\t_iBS7Tf.exe
C:\ZjzSDJCP.exe
C:\b8vrMOb8.exe
C:\EkJfDYS7.exe
C:\AV5JjV_U.exe
C:\nPe1yJdU.exe
C:\oBibG75Q.exe
C:\xWhYNbhp.exe
C:\oCKaU0jb.exe
C:\GSZMHmlj.exe
C:\SZyB6CYY.exe
C:\yfWlX92k.exe
C:\lTQDs3AJ.exe
C:\lhiAU4W_.exe
C:\eKQUfRN1.exe
C:\owXcuLzn.exe
C:\G5VyKQWB.exe
C:\Fq7jsxN9.exe
C:\rjXMERu6.exe
C:\YJ5IsEWM.exe
C:\krtaWjZ_.exe
C:\6n4w1M_c.exe
C:\Vx7HVNN8.exe
C:\PDML9LuX.exe
C:\xa0NmGUa.exe
C:\62B1FWk1.exe
C:\9BJMTcdm.exe
C:\rT9kYsNd.exe
C:\GFfOGrmQ.exe
C:\uFtBpYjG.exe
C:\y02s6cGA.exe
C:\aLbk98NK.exe
C:\DcjTwR82.exe
C:\v7sL_EUB.exe
C:\SXqXJ0KE.exe
C:\OYHA4NBV.exe
C:\PbNuEogH.exe
C:\AdzMqFpj.exe
C:\8vHPmHtO.exe
C:\4Jt_lhHF.exe
C:\LCvtGFk2.exe
C:\aMD9I00D.exe
C:\jfJIlppt.exe
C:\MAc9ghnK.exe
C:\ydBkarJs.exe
C:\nu6Q_W76.exe
C:\Trj5JDAn.exe
C:\20qxYaD3.exe
C:\0RzZAcrd.exe
C:\uhgEUdvH.exe
C:\MbTERxGs.exe
C:\dLhdOpk1.exe
C:\32ZCPXq9.exe
C:\hsRVZQjt.exe
C:\OSGFkIm7.exe
C:\Ul4JHYLK.exe
C:\DJr7V4FY.exe
C:\2TGVDpjQ.exe
C:\FdvtXhKj.exe
C:\F2zRsBZw.exe
C:\Z9xbGiNn.exe
C:\WWXdYaAl.exe
C:\Y1eRpOzm.exe
C:\DOQI3Fsq.exe
C:\dul87EgL.exe
C:\1dRHwoTc.exe
C:\nLebwqZM.exe
C:\GYEw3qrb.exe
C:\o1pofhY3.exe
C:\uvEw0eH1.exe
C:\wv_kz0LD.exe
C:\h1rAKmtc.exe
C:\nr2y5150.exe
C:\qAq8riT2.exe
C:\EAZ2IujK.exe
C:\2vNpSp82.exe
C:\m36k22S5.exe
C:\91vlfRBS.exe
C:\qmYxjf_C.exe
C:\W8BUyO1f.exe
C:\E_MUp7Fy.exe
C:\TVurQyEf.exe
C:\DTcW6A_E.exe
C:\NBcUTgvu.exe
C:\uA7_5_5H.exe
C:\Tvijedty.exe
C:\36YQsi63.exe
C:\baDwQssS.exe
C:\UcUWBzD5.exe
C:\4iINid0Q.exe
C:\oOsNQN0e.exe
C:\G21Izj1W.exe
C:\1RSLAhVk.exe
C:\s5FJym7E.exe
C:\KChNuXI0.exe
C:\MeyCxomu.exe
C:\zSNlLpsh.exe
C:\pEzt6hdb.exe
C:\E6BlYz6h.exe
C:\i3Bb6lO3.exe
C:\5Q7r95Sp.exe
C:\8wEnaeJq.exe
C:\Wq__tpK5.exe
C:\PZSe0GqX.exe
C:\Y4loWGOz.exe
C:\OxGgXzh_.exe
C:\KZZsQVhU.exe
C:\LlABJemf.exe
C:\33GrXdfC.exe
C:\u4QUVBZi.exe
C:\gTvsfmd6.exe
C:\lxUsbh3l.exe
C:\iiyr5AqB.exe
C:\WnSE82wf.exe
C:\ObZ2TBhu.exe
C:\7_eRzhfR.exe
C:\XIFXd3WI.exe
C:\raFHPOnt.exe
C:\k4KYYbBk.exe
C:\NsaA49PI.exe
C:\VNDksYGR.exe
C:\UB0H2sdb.exe
C:\FmBa7HdN.exe
C:\wd7_NIoS.exe
C:\_fwL6EV6.exe
C:\TXHwHU4I.exe
C:\QNzJCCUW.exe
C:\LN7zmDv3.exe
C:\dfJ5IJlF.exe
C:\h94S_lZo.exe
C:\C4bLeZaL.exe
C:\3i2PvrXI.exe
C:\0Lhnt25Z.exe
C:\e4JWshlw.exe
C:\uRhdBdIW.exe
C:\9pK59M6l.exe
C:\NyiXTxFX.exe
C:\fCeDeeO4.exe
C:\JJLGvg5O.exe
C:\j1IdjNQ0.exe
C:\dfcb6de2ac936b04f9ce1f620bd2b684c36200c28457af93685b4effe2ece7e5
C:\Ee5HlqaQ.exe
C:\jNHeLXpX.exe
C:\3ZAEloWL.exe
C:\rMc1Wdqu.exe
C:\7_ag3u8K.exe
C:\8n2rmuk1.exe
C:\TNExd6Zn.exe
C:\JOUWJJ1i.exe
C:\1qepD1ax.exe
C:\HX1SOxye.exe
C:\BafetDY1.exe
C:\RpZVYfAt.exe
C:\YXX_P_cs.exe
C:\BUejs96h.exe
C:\cOuST2GN.exe
C:\JssDXVGv.exe
C:\cwOCizKq.exe
C:\7uMlNZLo.exe
C:\9oI20dO7.exe
C:\PptORORq.exe
C:\EUxl0111.exe
C:\beJNCS3l.exe
C:\c_AI0BlI.exe
C:\hQQSFlCG.exe
C:\__VylQlz.exe
C:\ZjavA8Yf.exe
C:\A4rPQNIm.exe
C:\hmwH5mc7.exe
C:\_Xl0JcUM.exe
C:\_4F1JDbZ.exe
C:\7OO2PJBP.exe
C:\zgOknwRj.exe
C:\xSwAiAlL.exe
C:\CaJqRW27.exe
C:\A3Gmay5R.exe
C:\lOHe4Xb8.exe
C:\_jm5Mgqu.exe
C:\GUGiAyZ6.exe
C:\oE4v75Xg.exe
C:\YUM7LzYt.exe
C:\mk5CanZk.exe
C:\Hb2AStcF.exe
C:\jLkRUztC.exe
C:\ymnkhLxq.exe
C:\DOJ5XRQM.exe
C:\kx60yIbi.exe
C:\f9oshaZ3.exe
C:\5tjMruMx.exe
C:\hv5UwaLV.exe
C:\E2EmRaoL.exe
C:\bfyZi69G.exe
C:\zBaJFm2o.exe
C:\byT6Twq2.exe
C:\MLxvEEpl.exe
C:\ApXIs6YX.exe
C:\vOlIpsD3.exe
C:\fEX1rkXb.exe
C:\pB4Repn5.exe
C:\0l6fK0lT.exe
C:\uncpODD6.exe
C:\c8zeIA1V.exe
C:\GnDmLRtL.exe
C:\48W6rjmK.exe
C:\3e47UYGf.exe
C:\y64FrLmB.exe
C:\2eKLK_DY.exe
C:\hkN3vBhX.exe
C:\HNuZGHAm.exe
C:\sM0Ur1A5.exe
C:\7_90bZwH.exe
C:\kaUP9umq.exe
C:\9LhD3a4Q.exe
C:\2gywGLWE.exe
C:\A1xcsqhe.exe
C:\ICHzg4l8.exe
C:\7SYJ4TNR.exe
C:\JLAQNdWY.exe
C:\KCfQFZHE.exe
C:\oRw62Wo2.exe
C:\qCk9sNqC.exe
C:\ABrhLrhF.exe
C:\UcHVyXUU.exe
C:\nTYV36PM.exe
C:\eeYdDAzY.exe
C:\PhrD4ezR.exe
C:\OJ9RuJ3T.exe
C:\ZQYwM49G.exe
C:\q1XHy7k0.exe
C:\7XM3hibU.exe
C:\NSVqkr_Z.exe
C:\1SEzEH9h.exe
C:\Egts1H17.exe
C:\QxeyVkn4.exe
C:\EbWxdntr.exe
C:\hbRqRcwO.exe
C:\FN72FcgS.exe
C:\67LZvNeJ.exe
C:\3oWhPFKL.exe
C:\vmji1_Hp.exe
C:\I7aJUGJK.exe
C:\PG1Ry2pT.exe
C:\AgVe27MS.exe
C:\uUS5wJpO.exe
C:\uaDpYqyO.exe
C:\H3gYogfL.exe
C:\dvXYkkaN.exe
C:\tcQqQBBI.exe
C:\n77SJvfX.exe
C:\JrbhG3Yi.exe
C:\9nOm9Yvl.exe
C:\AQVhEi2h.exe
C:\Yihyn0IT.exe
C:\ht7Rchew.exe
C:\_P3ExOFD.exe
C:\CB4QfMSG.exe
C:\740kQVdg.exe
C:\InLwPuLl.exe
C:\0EAWMiW8.exe
C:\FjQNTjox.exe
C:\LdUax6_g.exe
C:\pi7Qpuhd.exe
C:\0JP4DUJk.exe
C:\489w5wSn.exe
C:\pxnK4HyH.exe
C:\OkyrF4AT.exe
C:\bKqrKGGC.exe
C:\2tG3XtjK.exe
C:\yAEEn6lM.exe
C:\nin5V46v.exe
C:\0XYlK1mo.exe
C:\Users\Johnny Cage\AppData\Local\Temp\43570dd189c9c6eb119fd2fd7577ae6489f27aec67db6a4f9ef0cf624c792c94.exe
C:\9e36b435af23283f9081c4651e09cb9b00ff055d24de893360e186da6ed90f3a
C:\Users\admin\Downloads\szgfw.exe
C:\Users\Petra\AppData\Local\Temp\szgfw.pe32
C:\Users\Petra\AppData\Local\Temp\szgfw.pe32
C:\370a2d5ebb0dd2b2bf42bed5615269ea55878bdf10b817a29188a9b4b7e16893
C:\fe7ef34192135a250f02a7115f48d3abfc9cbb917483da27818f08041acd4585
C:\Users\Petra\AppData\Local\Temp\szgfw.pe32
C:\Users\admin\Downloads\31ea3a0bf6f5bdba_szgfw.exe
C:\f109d70d940e9cd1341a0c41850979afd17ba045b79955a0140d3a7e7549fa42
C:\ee0021a1a81629fb4b3cfbe610473e9062da81b682425eb9e372bbd8044ed2d7
C:\Users\admin\Downloads\szgfw.exe
C:\Users\Petra\AppData\Local\Temp\szgfw.pe32
C:\Users\admin\Downloads\a99e3f9c4f8b1993_szgfw.exe
C:\08038f3a26d4b303d4ca03a5bca29f62d885550db356e07da0f362ab3dfa5d86
C:\Users\admin\Downloads\szgfw.exe
C:\Users\Administrator\AppData\Local\Temp\TgDbWQPsUK.exe
C:\2e65964f0bb54ab92b275edc108038abe9f3e03145f75c0505881c56f83ba99b
C:\178c92ad5cfe5e9e6e29a5bc4ae800c7989e3fbd6c75d9f03e0df0945f6579c9
C:\Users\Petra\AppData\Local\Temp\szgfw.pe32
C:\84b7314407588f07746273a3d49164d5461c59e86e486d8bb64a4d7d6beff837
C:\Users\admin\Downloads\szgfw.exe
C:\b48d7f1629e83187e25834e036aa6963687ef10872c23a25329f7c2da760ac74
C:\Users\admin\Downloads\szgfw.exe
C:\943947a9123e3aba2350f93da8fdc84b90927269412f0d6af410b850bd28b03f
C:\f4ed4ae31338c4cea551161b90b1b039a9919a3a2b1878dab72aa79d9061ae31
C:\9f574297350b50d415b3eb0e996963c3b41e55ed44a15e6a68a52c7c37cb5902
C:\3ba4a7d553ddd98aeee67adf03771ae04e77188780870a9857b723aa9a7e0a26
C:\Users\admin\Downloads\szgfw.exe
C:\Users\Petra\AppData\Local\Temp\szgfw.pe32
C:\Users\Petra\AppData\Local\Temp\szgfw.pe32
C:\5c82d4b0fd10023ada44b0bbf598fb6eb4423f421b147f03259dbcddc35f7cd0
C:\1aa5e57470be24bc73a0c96d8d4929192d3f52581ad3b9498049ec612dd89726
C:\235bd7cf8d7b4c1f635dd759ccddc40e6286697298a2df8511ccb6c159fa4483
C:\Users\admin\Downloads\szgfw.exe
C:\8c213d3c7ea608e38056040749ce7e5987666c3f770fde97f5ffb52e78d5d331
C:\0153230cc25c53474b85b052541074f96c87c73a2a669fbcdf3419fb1fce43ab
C:\Users\admin\Downloads\szgfw.exe
C:\02651aa40fa531226e4c5ca7fc8bf02f5cc0935210d1e607c3c942f9c34176c6
C:\Users\Petra\AppData\Local\Temp\szgfw.pe32
C:\Users\Petra\AppData\Local\Temp\szgfw.pe32
C:\e307f46e3bf76511f3a322b73aa4dc28468cabf4d359e68b01bf6d59736065b0
C:\2622159f2fafaf7fd4c23d3dbcd195b06d07495361e16e1e7f91a2cc757c358e
C:\Users\admin\Downloads\szgfw.exe

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.